Kavos trj sévit
Résolu
Bonjour,
je viens de lire votre discussion sur le trojan kavos.
je suis infectée de puis 3 jours, je pense que jai chopé ca avec mon disque dur externe
kavos apparait sur tous les disques durs,( chaque partition) et sur l'ordi, dans le système.
avast a identifié kavos, mais il ne peut pas le supprimer, il reapparait chaque fois, meme après le scan au démarrage.
jai telechargé spyware terminator pour faire une analyse complète.
il a trouvé le Trojan.crypt.XPACK.Gen et rien d'autre.
je nai pas réussi à analyser mon disque dur externe avec spyware terminator...
une autre chose, jai recu un message d'avast qui me dit avoir trouvé un objet suspect ( un rootkit, mais je ne trouve pas le nom) par la méthode heuristique, et de le supprimer, ce que j'ai fait.
est ce que quelqu'un peut m'aider?
je viens de lire votre discussion sur le trojan kavos.
je suis infectée de puis 3 jours, je pense que jai chopé ca avec mon disque dur externe
kavos apparait sur tous les disques durs,( chaque partition) et sur l'ordi, dans le système.
avast a identifié kavos, mais il ne peut pas le supprimer, il reapparait chaque fois, meme après le scan au démarrage.
jai telechargé spyware terminator pour faire une analyse complète.
il a trouvé le Trojan.crypt.XPACK.Gen et rien d'autre.
je nai pas réussi à analyser mon disque dur externe avec spyware terminator...
une autre chose, jai recu un message d'avast qui me dit avoir trouvé un objet suspect ( un rootkit, mais je ne trouve pas le nom) par la méthode heuristique, et de le supprimer, ce que j'ai fait.
est ce que quelqu'un peut m'aider?
Configuration: Windows XP Internet Explorer 6.0
34 réponses
Résumé de la discussion
Le fil expose une infection par le trojan kavos détecté par Avast, qui réapparaît malgré les scans au démarrage, et la présence présumée d’un rootkit nécessitant une désinfection approfondie. Plusieurs conseils suivent: Malwarebytes est recommandé, Spyware Terminator est délaissé, CCleaner nettoie les répertoires temporaires, et OTMoveIt avec OTListIt aident à analyser et nettoyer les traces. Des échanges insistent sur la sécurisation des supports amovibles par mesures comme éviter l’ouverture automatique des clés USB et appliquer un vaccin USB, tandis que mises à jour d’Adobe et navigateurs renforcent la prévention. Pour la suite, certains évoquent l’emploi de la console de récupération et de ComboFix, et les rapports OTListIt fournissent les éléments pour guider le nettoyage sans conclure sur l’état du fil.
-
Contributeur sécuritéRe,
Il te faudra toujours IE pour certaines mises à jour de sécurité.
Note: http://www.secuser.com/vulnerabilite/2009/090305-firefox-thunderbird.htm
Tu as encore des reliquats de SpywareTerminator:
C:\Program Files\Crawler\Toolbar\CToolbar.exe
IE - URLSearchHook: {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\Program Files\Crawler\Toolbar\ctbr.dll (Crawler.com)
O2 - BHO: () - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\Program Files\Crawler\Toolbar\ctbr.dll (Crawler.com)
O3 - HKLM\..\Toolbar: (Barre d'outils &Crawler) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\Program Files\Crawler\Toolbar\ctbr.dll (Crawler.com
O3 - HKU\S-1-5-21-602162358-796845957-725345543-1003\..\Toolbar\WebBrowser: (no name) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\Program Files\Crawler\Toolbar\ctbr.dll (Crawler.com)
O18 - Protocol\Handler\tbr {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\Program Files\Crawler\Toolbar\ctbr.dll (Crawler.com)
Pour ces lignes-ci:
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-602162358-796845957-725345543-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-602162358-796845957-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-21-602162358-796845957-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O7 - HKU\S-1-5-21-602162358-796845957-725345543-1003_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
Section O7 < https://www.bleepingcomputer.com/tutorials/comment-utiliser-hijackthis/#O7Diag >
Cette section correspond au blocage de l'exécution de Regedit via une modification d'une clé dans le Registre.
O7= Accès à la base de registre (regedit) retreinte par l'administrateur (ou par un malware); exemple:
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
Veuillez noter que de nombreux administrateurs système en milieu professionnel utilisent ce blocage délibérément, et que demander à HijackThis de corriger cela peut constituer une violation du règlement intérieur.
Si vous êtes l'administrateur système et si ceci a été activé sans votre permission, vous pouvez demander à HijackThis de le corriger.
Bonne chance
Al. -
OTListIt logfile created on: 05/03/2009 20:21:51 - Run 1
OTListIt2 by OldTimer - Version 2.0.3.4 Folder = C:\Documents and Settings\po\Bureau
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 0000040C | Country: France | Language: FRA | Date Format: dd/MM/yyyy
511,36 Mb Total Physical Memory | 233,16 Mb Available Physical Memory | 45,60% Memory free
1,22 Gb Paging File | 0,93 Gb Available in Paging File | 76,25% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536;
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 11,93 Gb Total Space | 4,43 Gb Free Space | 37,13% Space Free | Partition Type: NTFS
Drive D: | 26,34 Gb Total Space | 3,33 Gb Free Space | 12,65% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive K: | 495,22 Mb Total Space | 10,68 Mb Free Space | 2,16% Space Free | Partition Type: FAT
Computer Name: DUDULE
Current User Name: po
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: All users
Output = Standard
File Age = 30 Days
Company Name Whitelist: On
[color=orange]========== Processes (SafeList) ==========[/color]
PRC - [2008/10/15 13:31:25 | 00,068,865 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
PRC - [2008/09/05 23:30:04 | 00,952,360 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\WgaTray.exe
PRC - [2004/08/19 15:09:54 | 01,036,288 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Explorer.EXE
PRC - [2004/06/11 04:15:18 | 00,083,968 | R--- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvraidservice.exe
PRC - [2003/12/13 01:50:34 | 00,033,792 | ---- | M] () -- C:\Program Files\Winamp\winampa.exe
PRC - [2007/01/20 17:21:50 | 00,098,304 | ---- | M] (Apple Computer, Inc.) -- C:\program files\quicktime\qttask.exe
PRC - [2005/10/26 16:17:24 | 00,159,744 | R--- | M] (Sony Ericsson Mobile Communications AB) -- C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
PRC - [2008/06/12 13:28:40 | 00,266,497 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
PRC - [2004/08/19 15:10:00 | 01,667,584 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe
PRC - [2006/03/09 01:00:28 | 00,212,992 | ---- | M] (Popwire AB) -- C:\Program Files\Fichiers communs\Teleca Shared\CapabilityManager.exe
PRC - [2008/10/15 13:29:28 | 00,151,297 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
PRC - [2006/02/28 12:42:38 | 00,229,376 | ---- | M] (Apple Computer, Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe
PRC - [2004/08/11 01:45:04 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wdfmgr.exe
PRC - [2004/08/19 15:10:06 | 00,218,112 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\wbem\wmiprvse.exe
PRC - [2001/08/28 13:00:00 | 00,016,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\wbem\unsecapp.exe
PRC - [2005/08/10 07:54:34 | 00,385,024 | R--- | M] (Teleca Software Solutions) -- C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
PRC - [2006/08/15 07:45:46 | 00,856,064 | R--- | M] (Sony Ericsson Mobile Communications AB) -- C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
PRC - [2009/02/27 10:29:44 | 02,351,568 | ---- | M] (Crawler.com) -- C:\Program Files\Crawler\Toolbar\CToolbar.exe
PRC - [2004/08/19 15:10:06 | 00,013,824 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wscntfy.exe
PRC - [2009/03/05 20:20:06 | 00,498,176 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\po\Bureau\OTListIt2.exe
[color=orange]========== Win32 Services (SafeList) ==========[/color]
SRV - [2008/10/15 13:31:25 | 00,068,865 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe -- (AntiVirScheduler [Auto | Running])
SRV - [2008/10/15 13:29:28 | 00,151,297 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe -- (AntiVirService [Auto | Running])
SRV - [2006/02/28 12:42:38 | 00,229,376 | ---- | M] (Apple Computer, Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe -- (Bonjour Service [Auto | Running])
SRV - [2008/03/09 17:12:35 | 00,654,848 | ---- | M] (Macrovision Europe Ltd.) -- C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service [On_Demand | Stopped])
SRV - [2004/08/19 15:09:38 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll -- (helpsvc [Auto | Running])
SRV - [2003/07/28 19:28:22 | 00,089,136 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE -- (ose [On_Demand | Stopped])
SRV - [2004/08/11 01:45:04 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wdfmgr.exe -- (UMWdf [Auto | Running])
[color=orange]========== Driver Services (SafeList) ==========[/color]
DRV - [2007/02/27 14:24:55 | 00,011,840 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgio.sys -- (avgio [System | Running])
DRV - [2008/05/20 15:29:43 | 00,052,032 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgntflt.sys -- (avgntflt [On_Demand | Running])
DRV - [2008/10/30 10:21:03 | 00,075,072 | ---- | M] (Avira GmbH) -- C:\WINDOWS\system32\DRIVERS\avipbb.sys -- (avipbb [System | Running])
DRV - [2005/04/18 14:30:20 | 00,805,440 | R--- | M] (C-Media Inc) -- C:\WINDOWS\system32\drivers\cmuda.sys -- (cmuda [On_Demand | Running])
DRV - [2004/08/03 21:29:56 | 01,897,408 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\System32\DRIVERS\nv4_mini.sys -- (nv [On_Demand | Running])
DRV - [2004/06/03 03:40:46 | 00,079,360 | R--- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\DRIVERS\nvatabus.sys -- (nvatabus [Boot | Running])
DRV - [2004/05/17 07:00:52 | 00,033,280 | R--- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\DRIVERS\NVENETFD.sys -- (NVENETFD [On_Demand | Running])
DRV - [2004/05/17 07:00:54 | 00,012,928 | R--- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\DRIVERS\nvnetbus.sys -- (nvnetbus [On_Demand | Running])
DRV - [2004/06/03 03:40:50 | 00,068,224 | R--- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\DRIVERS\nvraid.sys -- (nvraid [Boot | Running])
DRV - [2004/04/02 08:40:00 | 00,021,760 | R--- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\DRIVERS\nv_agp.sys -- (nv_agp [Boot | Running])
DRV - [2003/09/08 10:49:44 | 00,014,604 | ---- | M] (Padus, Inc.) -- C:\WINDOWS\system32\drivers\pfc.sys -- (pfc [On_Demand | Running])
DRV - [2001/08/28 13:00:00 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINDOWS\System32\DRIVERS\ptilink.sys -- (Ptilink [On_Demand | Running])
DRV - [2006/04/06 19:15:29 | 00,020,640 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys -- (PxHelp20 [Boot | Running])
DRV - [2001/08/28 13:00:00 | 00,027,440 | ---- | M] () -- C:\WINDOWS\System32\DRIVERS\secdrv.sys -- (Secdrv [On_Demand | Stopped])
DRV - [2004/09/10 07:00:00 | 00,084,064 | ---- | M] (Rainbow Technologies, Inc.) -- C:\WINDOWS\System32\Drivers\SENTINEL.SYS -- (Sentinel [Auto | Running])
DRV - [2007/11/08 18:03:26 | 00,021,248 | ---- | M] (AVIRA GmbH) -- C:\WINDOWS\system32\DRIVERS\ssmdrv.sys -- (ssmdrv [System | Running])
DRV - [2006/11/07 09:42:16 | 00,061,504 | R--- | M] (MCCI) -- C:\WINDOWS\system32\DRIVERS\w200bus.sys -- (w200bus [On_Demand | Stopped])
DRV - [2006/11/07 09:42:22 | 00,009,328 | R--- | M] (MCCI) -- C:\WINDOWS\system32\DRIVERS\w200mdfl.sys -- (w200mdfl [On_Demand | Stopped])
DRV - [2006/11/07 09:42:24 | 00,097,056 | R--- | M] (MCCI) -- C:\WINDOWS\system32\DRIVERS\w200mdm.sys -- (w200mdm [On_Demand | Stopped])
DRV - [2006/11/07 09:42:28 | 00,088,560 | R--- | M] (MCCI) -- C:\WINDOWS\system32\DRIVERS\w200mgmt.sys -- (w200mgmt [On_Demand | Stopped])
DRV - [2006/11/07 09:42:30 | 00,086,368 | R--- | M] (MCCI) -- C:\WINDOWS\system32\DRIVERS\w200obex.sys -- (w200obex [On_Demand | Stopped])
[color=orange]========== Standard Registry (SafeList) ==========[/color]
[color=orange]========== Internet Explorer ==========[/color]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchasst.htm
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-19\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-20\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-602162358-796845957-725345543-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKU\S-1-5-21-602162358-796845957-725345543-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKU\S-1-5-21-602162358-796845957-725345543-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
IE - URLSearchHook: {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\Program Files\Crawler\Toolbar\ctbr.dll (Crawler.com)
IE - HKU\S-1-5-21-602162358-796845957-725345543-1003\S-1-5-21-602162358-796845957-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-602162358-796845957-725345543-1003\S-1-5-21-602162358-796845957-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
FF - prefs.js..browser.search.defaultenginename: "Crawler Search"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "https://www.google.fr/?gws_rd=ssl"
FF - prefs.js..extensions.enabledItems: {4B3803EA-5230-4DC3-A7FC-33638F3D3542}:1.3
FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.6
FF - HKLM\software\mozilla\Firefox\Extensions\\{4B3803EA-5230-4DC3-A7FC-33638F3D3542} -> %ProgramFiles%\Crawler\Toolbar\firefox [C:\PROGRA~1\CRAWLER\TOOLBAR\FIREFOX\] -> [2009/03/03 20:19:54 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.6\extensions\\Components -> %ProgramFiles%\MOZILLA FIREFOX\COMPONENTS [C:\PROGRAM FILES\MOZILLA FIREFOX\COMPONENTS] -> [2009/03/03 09:17:12 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.6\extensions\\Plugins -> %ProgramFiles%\MOZILLA FIREFOX\PLUGINS [C:\PROGRAM FILES\MOZILLA FIREFOX\PLUGINS] -> [2009/03/03 11:28:27 00,000,000 | ---D | M]
FF - C:\Documents and Settings\po\Application Data\mozilla\Extensions [2009/03/03 09:17:13 00,000,000 | ---D | M]
FF - C:\Documents and Settings\po\Application Data\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384} [2009/03/03 09:17:13 00,000,000 | ---D | M]
FF - C:\Documents and Settings\po\Application Data\mozilla\Firefox\Profiles\t6jmuf4n.default\extensions [2009/03/03 20:18:18 00,000,000 | ---D | M]
FF - C:\Program Files\mozilla firefox\extensions [2009/03/03 09:16:59 00,000,000 | ---D | M]
FF - C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [2009/03/03 09:16:59 00,000,000 | ---D | M]
O1 HOSTS File: (790 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Yahoo! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: () - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\Program Files\Crawler\Toolbar\ctbr.dll (Crawler.com)
O3 - HKLM\..\Toolbar: (Barre d'outils &Crawler) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\Program Files\Crawler\Toolbar\ctbr.dll (Crawler.com)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar avec bloqueur de fenêtres pop-up) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKU\S-1-5-21-602162358-796845957-725345543-1003\..\Toolbar\ShellBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - Reg Error: Key error. File not found
O3 - HKU\S-1-5-21-602162358-796845957-725345543-1003\..\Toolbar\WebBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - Reg Error: Key error. File not found
O3 - HKU\S-1-5-21-602162358-796845957-725345543-1003\..\Toolbar\WebBrowser: (no name) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\Program Files\Crawler\Toolbar\ctbr.dll (Crawler.com)
O3 - HKU\S-1-5-21-602162358-796845957-725345543-1003\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min (Avira GmbH)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" (NVIDIA Corporation)
O4 - HKLM..\Run: [NVRaidService] C:\WINDOWS\system32\nvraidservice.exe (NVIDIA Corporation)
O4 - HKLM..\Run: [QuickTime Task] "C:\program files\quicktime\qttask.exe" -atboottime (Apple Computer, Inc.)
O4 - HKLM..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions (Sony Ericsson Mobile Communications AB)
O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe ()
O4 - HKU\S-1-5-21-602162358-796845957-725345543-1003..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-602162358-796845957-725345543-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-602162358-796845957-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O7 - HKU\S-1-5-21-602162358-796845957-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-602162358-796845957-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-21-602162358-796845957-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O7 - HKU\S-1-5-21-602162358-796845957-725345543-1003_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra Button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [mdnsNSP] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKU\S-1-5-21-602162358-796845957-725345543-1003\..Trusted Domains: akamai.net ([a248.e] https in Sites de confiance)
O15 - HKU\S-1-5-21-602162358-796845957-725345543-1003\..Trusted Sites: bitdefender.com ([]https in Sites de confiance)
O15 - HKU\S-1-5-21-602162358-796845957-725345543-1003\..Trusted Domains: netflame.cc ([ssl-hints] https in Sites de confiance)
O15 - HKU\S-1-5-21-602162358-796845957-725345543-1003\..Trusted Domains: 2 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr (CKAVWebScan Object)
O18 - Protocol\Handler\ipp Reg Error: Value error. - Reg Error: Key error. File not found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp Reg Error: Value error. - Reg Error: Key error. File not found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Fichiers communs\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Fichiers communs\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\tbr {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\Program Files\Crawler\Toolbar\ctbr.dll (Crawler.com)
O18 - Protocol\Filter: - text/xml - C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Ma page d'accueil) - About:Home
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/07/14 23:58:46 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2009/03/02 15:09:14 00,000,000 | ---D | M] - K:\autorun.inf -- [ FAT ]
O33 - MountPoints2\{acec32dd-f4c8-11d9-8ded-806d6172696f}\Shell - "" = AutoRun
O33 - MountPoints2\{acec32dd-f4c8-11d9-8ded-806d6172696f}\Shell\AutoRun\command - "" = K:\ASUSACPI.exe -- File not found
O33 - MountPoints2\{e5aa89c4-8bda-11dc-85e6-0013d4cad5f0}\Shell\AutoRun\command - "" = C:\WINDOWS\explorer.exe -- [2004/08/19 15:09:54 | 01,036,288 | ---- | M] (Microsoft Corporation)
[color=orange]========== Files/Folders - Created Within 30 Days ==========[/color]
[1 C:\WINDOWS\System32\*.tmp files]
[3 C:\WINDOWS\*.tmp files]
[2009/03/05 20:20:00 | 00,498,176 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\po\Bureau\OTListIt2.exe
[2009/03/05 20:18:40 | 00,085,366 | ---- | C] () -- C:\Documents and Settings\po\Bureau\Bureau.rar
[2009/03/04 00:14:33 | 00,000,000 | ---D | C] -- C:\Documents and Settings\po\Application Data\Malwarebytes
[2009/03/04 00:14:31 | 00,015,504 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2009/03/04 00:14:28 | 00,038,496 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/03/04 00:14:27 | 00,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2009/03/04 00:14:27 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2009/03/03 11:08:17 | 00,000,000 | ---D | C] -- C:\Program Files\NOS
[2009/03/03 11:08:17 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\NOS
[2009/03/03 10:27:30 | 00,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2009/03/03 10:13:18 | 00,001,501 | ---- | C] () -- C:\Documents and Settings\po\Bureau\Editeur KaraFun.lnk
[2009/03/03 10:13:18 | 00,000,623 | ---- | C] () -- C:\Documents and Settings\po\Bureau\KaraFun.lnk
[2009/03/03 09:17:14 | 00,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2009/03/03 09:17:10 | 00,000,000 | ---D | C] -- C:\Documents and Settings\po\Local Settings\Application Data\Mozilla
[2009/03/03 09:17:10 | 00,000,000 | ---D | C] -- C:\Documents and Settings\po\Application Data\Mozilla
[2009/03/03 09:17:02 | 00,001,609 | ---- | C] () -- C:\Documents and Settings\All Users\Bureau\Mozilla Firefox.lnk
[2009/03/03 09:16:56 | 00,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2009/03/02 22:16:21 | 00,045,376 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntdd.sys
[2009/03/02 22:16:21 | 00,022,336 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntmgr.sys
[2009/03/02 22:16:21 | 00,021,248 | ---- | C] (AVIRA GmbH) -- C:\WINDOWS\System32\drivers\ssmdrv.sys
[2009/03/02 22:16:18 | 00,075,072 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys
[2009/03/02 22:16:18 | 00,000,000 | ---D | C] -- C:\Program Files\Avira
[2009/03/02 22:16:18 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Avira
[2009/03/02 20:30:45 | 00,000,000 | ---D | C] -- C:\_OTMoveIt
[2009/03/02 16:10:29 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\Kaspersky Lab
[2009/03/02 15:51:37 | 00,000,212 | ---- | C] () -- C:\Boot.bak
[2009/03/02 15:51:35 | 00,263,488 | ---- | C] () -- C:\cmldr
[2009/03/02 15:51:33 | 00,000,000 | RHSD | C] -- C:\cmdcons
[2009/03/02 15:49:54 | 00,000,000 | ---D | C] -- C:\ComboFix
[2009/03/02 15:47:42 | 00,000,000 | -HSD | C] -- C:\RECYCLER
[2009/03/02 15:09:47 | 00,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2009/03/02 15:09:47 | 00,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2009/03/02 15:09:47 | 00,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2009/03/02 15:09:47 | 00,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2009/03/02 15:09:47 | 00,089,504 | ---- | C] (Smallfrogs Studio) -- C:\WINDOWS\fdsv.exe
[2009/03/02 15:09:47 | 00,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2009/03/02 15:09:47 | 00,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2009/03/02 15:09:47 | 00,049,152 | ---- | C] () -- C:\WINDOWS\VFIND.exe
[2009/03/02 15:09:44 | 00,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2009/03/02 15:09:41 | 00,000,000 | ---D | C] -- C:\Qoobox
[2009/03/01 23:17:07 | 00,000,000 | ---D | C] -- C:\Program Files\Crawler
[2009/02/24 09:59:55 | 00,145,463 | ---- | C] () -- C:\Documents and Settings\po\Bureau\christmas carols.pdf
[2009/02/24 09:59:54 | 00,052,430 | ---- | C] () -- C:\Documents and Settings\po\Bureau\choupikan.pdf
[2009/02/22 12:25:03 | 00,000,000 | R--D | C] -- C:\Documents and Settings\po\Bureau\APPLICATION CALL!
[2009/02/18 20:47:23 | 00,000,425 | ---- | C] () -- C:\Documents and Settings\po\Bureau\book.lnk
[2009/02/18 13:27:10 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
[2009/02/15 19:43:15 | 00,000,444 | ---- | C] () -- C:\Documents and Settings\po\Bureau\karaoké.lnk
[2009/02/15 01:24:39 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\CatRoot_bak
[2009/02/14 20:59:16 | 00,000,000 | ---D | C] -- C:\Documents and Settings\po\Mes documents\chachamail
[2009/02/13 23:48:25 | 00,000,430 | ---- | C] () -- C:\Documents and Settings\po\Bureau\NICO!.lnk
[2009/02/13 23:48:12 | 00,000,376 | ---- | C] () -- C:\Documents and Settings\po\Bureau\DOCAPOPO.lnk
[2009/02/13 13:36:01 | 21,244,872 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\MRT.exe
[2009/02/12 19:28:37 | 00,008,192 | -HS- | C] () -- C:\WINDOWS\Thumbs.db
[2009/02/12 19:28:31 | 00,005,120 | -HS- | C] () -- C:\Thumbs.db
[2009/02/11 23:44:39 | 00,000,000 | ---D | C] -- C:\Documents and Settings\po\Local Settings\Application Data\Identities
[2009/02/11 12:05:00 | 00,000,000 | ---D | C] -- C:\Program Files\KaraFun
[2009/02/11 12:05:00 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Recisio
[2009/02/11 03:39:21 | 00,000,000 | ---D | C] -- C:\Program Files\MSXML 4.0
[2009/02/11 03:09:57 | 00,272,768 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\bthport.sys
[2009/02/11 03:09:07 | 00,663,552 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wininet.dll
[2009/02/11 03:09:06 | 00,449,024 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mshtmled.dll
[2009/02/11 03:09:03 | 00,357,888 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dxtmsft.dll
[2009/02/11 03:09:02 | 01,024,000 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\browseui.dll
[2009/02/11 03:09:02 | 00,146,432 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msrating.dll
[2009/02/11 03:09:01 | 00,474,624 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\shlwapi.dll
[2009/02/11 03:09:01 | 00,205,312 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dxtrans.dll
[2009/02/11 03:09:00 | 00,152,064 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cdfview.dll
[2009/02/11 03:08:59 | 00,532,480 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mstime.dll
[2009/02/11 03:08:58 | 01,056,768 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\danim.dll
[2009/02/11 03:08:57 | 00,251,392 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iepeers.dll
[2009/02/11 03:08:57 | 00,055,808 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\extmgr.dll
[2009/02/11 03:08:57 | 00,039,424 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\pngfilt.dll
[2009/02/11 03:08:57 | 00,018,432 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iedw.exe
[2009/02/11 03:08:57 | 00,016,384 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\jsproxy.dll
[2009/02/11 03:08:56 | 01,495,040 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\shdocvw.dll
[2009/02/11 03:08:55 | 00,617,984 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\urlmon.dll
[2009/02/11 03:08:55 | 00,096,768 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\inseng.dll
[2009/02/11 03:08:09 | 01,846,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\win32k.sys
[2009/02/11 03:08:01 | 02,138,112 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ntkrnlmp.exe
[2009/02/11 03:07:57 | 02,182,400 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ntoskrnl.exe
[2009/02/11 03:07:56 | 02,059,776 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ntkrnlpa.exe
[2009/02/11 03:07:50 | 02,017,792 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ntkrpamp.exe
[2009/02/11 03:07:37 | 03,081,216 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mshtml.dll
[2009/02/11 03:06:51 | 00,453,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mrxsmb.sys
[2009/02/11 03:06:33 | 00,333,184 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\srv.sys
[2009/02/11 03:06:27 | 00,331,776 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msadce.dll
[2009/02/11 03:06:18 | 00,683,520 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\inetcomm.dll
[2009/02/11 03:05:29 | 00,247,326 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\strmdll.dll
[2009/02/11 03:05:25 | 00,332,800 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\netapi32.dll
[2009/02/11 03:05:19 | 01,106,944 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msxml3.dll
[2009/02/11 03:02:10 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\PreInstall
[2009/02/11 03:02:03 | 00,000,000 | -H-D | C] -- C:\WINDOWS\$hf_mig$
[2009/02/11 01:45:11 | 00,008,704 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdjpn.dll
[2009/02/11 01:45:11 | 00,008,192 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdkor.dll
[2009/02/11 01:45:11 | 00,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbd106.dll
[2009/02/11 01:45:11 | 00,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbd101c.dll
[2009/02/11 01:45:11 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbd103.dll
[2009/02/11 01:45:10 | 00,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbd101b.dll
[2009/02/10 18:19:21 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\SoftwareDistribution
[color=orange]========== Files - Modified Within 30 Days ==========[/color]
[1 C:\WINDOWS\System32\*.tmp files]
[3 C:\WINDOWS\*.tmp files]
[2009/03/05 20:20:06 | 00,498,176 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\po\Bureau\OTListIt2.exe
[2009/03/05 20:18:40 | 00,085,366 | ---- | M] () -- C:\Documents and Settings\po\Bureau\Bureau.rar
[2009/03/05 20:09:31 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009/03/05 20:09:06 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2009/03/05 20:09:03 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009/03/04 01:37:41 | 00,000,155 | ---- | M] () -- C:\WINDOWS\winamp.ini
[2009/03/04 01:23:35 | 00,081,920 | ---- | M] () -- C:\Documents and Settings\po\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/03/04 01:14:04 | 00,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2009/03/03 11:25:25 | 01,496,944 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2009/03/03 10:13:18 | 00,001,501 | ---- | M] () -- C:\Documents and Settings\po\Bureau\Editeur KaraFun.lnk
[2009/03/03 10:13:18 | 00,000,623 | ---- | M] () -- C:\Documents and Settings\po\Bureau\KaraFun.lnk
[2009/03/03 09:17:14 | 00,000,000 | ---- | M] () -- C:\WINDOWS\nsreg.dat
[2009/03/03 09:17:02 | 00,001,609 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\Mozilla Firefox.lnk
[2009/03/02 23:32:10 | 00,002,573 | ---- | M] () -- C:\Documents and Settings\po\Bureau\Microsoft Office Word 2003.lnk
[2009/03/02 22:16:44 | 00,046,512 | ---- | M] () -- C:\Documents and Settings\po\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2009/03/02 22:05:50 | 00,003,072 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2009/03/02 15:51:37 | 00,000,282 | RHS- | M] () -- C:\boot.ini
[2009/03/02 15:33:16 | 00,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2009/02/18 20:47:23 | 00,000,425 | ---- | M] () -- C:\Documents and Settings\po\Bureau\book.lnk
[2009/02/15 19:43:13 | 00,000,444 | ---- | M] () -- C:\Documents and Settings\po\Bureau\karaoké.lnk
[2009/02/14 21:50:27 | 00,000,151 | ---- | M] () -- C:\WINDOWS\PhotoSnapViewer.INI
[2009/02/13 23:48:22 | 00,000,430 | ---- | M] () -- C:\Documents and Settings\po\Bureau\NICO!.lnk
[2009/02/13 23:48:10 | 00,000,376 | ---- | M] () -- C:\Documents and Settings\po\Bureau\DOCAPOPO.lnk
[2009/02/12 19:28:37 | 00,008,192 | -HS- | M] () -- C:\WINDOWS\Thumbs.db
[2009/02/12 19:28:33 | 00,005,120 | -HS- | M] () -- C:\Thumbs.db
[2009/02/11 20:56:18 | 21,244,872 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\MRT.exe
[2009/02/11 10:19:42 | 00,038,496 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/02/11 10:19:34 | 00,015,504 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[color=orange]========== Alternate Data Streams ==========[/color]
@Alternate Data Stream - 0 bytes -> C:\WINDOWS\Thumbs.db:encryptable
@Alternate Data Stream - 0 bytes -> C:\Thumbs.db:encryptable
@Alternate Data Stream - 0 bytes -> C:\Documents and Settings\po\Mes documents\Thumbs.db:encryptable
@Alternate Data Stream - 0 bytes -> C:\Documents and Settings\po\Bureau\Thumbs.db:encryptable
< End of report > -
OTListIt Extras logfile created on: 05/03/2009 20:21:51 - Run 1
OTListIt2 by OldTimer - Version 2.0.3.4 Folder = C:\Documents and Settings\po\Bureau
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 0000040C | Country: France | Language: FRA | Date Format: dd/MM/yyyy
511,36 Mb Total Physical Memory | 233,16 Mb Available Physical Memory | 45,60% Memory free
1,22 Gb Paging File | 0,93 Gb Available in Paging File | 76,25% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536;
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 11,93 Gb Total Space | 4,43 Gb Free Space | 37,13% Space Free | Partition Type: NTFS
Drive D: | 26,34 Gb Total Space | 3,33 Gb Free Space | 12,65% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive K: | 495,22 Mb Total Space | 10,68 Mb Free Space | 2,16% Space Free | Partition Type: FAT
Computer Name: DUDULE
Current User Name: po
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: All users
Output = Standard
File Age = 30 Days
Company Name Whitelist: On
[color=orange]========== File Associations ==========/color
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
[HKEY_USERS\S-1-5-21-602162358-796845957-725345543-1003\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
[color=orange]========== Security Center Settings ==========/color
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts]
[color=orange]========== Authorized Applications List ==========/color
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
[2006/02/28 12:42:38 | 00,229,376 | ---- | M] (Apple Computer, Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour
[color=orange]========== HKEY_LOCAL_MACHINE Uninstall List ==========/color
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{04AF207D-9A77-465A-8B76-991F6AB66245}" = Adobe Help Viewer CS3
"{08B32819-6EEF-4057-AEDA-5AB681A36A23}" = Adobe Bridge Start Meeting
"{09E2111C-16B1-4DDF-BF0D-F994C9A12350}" = Adobe Setup
"{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}" = Adobe WinSoft Linguistics Plugin
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{29E5EA97-5F74-4A57-B8B2-D4F169117183}" = Adobe Stock Photos CS3
"{350C97B8-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{5241FB1B-9CF5-448C-3BFD-1AE58B061036}" = Nero 7 Ultra Edition
"{54793AA1-5001-42F4-ABB6-C364617C6078}" = Adobe Linguistics CS3
"{547D4265-AF45-42E9-A62A-C58182AA35B9}" = Sentinel Protection Installer 7.0.0
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{6ABE0BEE-D572-4FE8-B434-9E72A289431B}" = Adobe Fonts All
"{6B708481-748A-4EB4-97C1-CD386244FF77}" = Adobe MotionPicture Color Files
"{6BBAA81D-6A7E-43AD-8889-2F002DCAAFDD}" = AHV content for Acrobat and Flash
"{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}" = Adobe Asset Services CS3
"{73B5D990-04EA-4751-B10F-5534770B91F2}" = Adobe Color EU Recommended Settings
"{802771A9-A856-4A41-ACF7-1450E523C923}" = Adobe XMP Panels CS3
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}" = Adobe Device Central CS3
"{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}" = Adobe Type Support
"{9011040C-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90176341-0A8B-4CCC-A78D-F862228A6B95}" = Adobe Anchor Service CS3
"{9C9824D9-9000-4373-A6A5-D0E5D4831394}" = Adobe Bridge CS3
"{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}" = Adobe CMaps
"{A2D81E70-2A98-4A08-A628-94388B063C5E}" = Adobe Color - Photoshop Specific
"{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}" = PDF Settings
"{AC76BA86-7AD7-1036-7B44-A90000000001}" = Adobe Reader 9 - Français
"{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}" = Adobe Camera Raw 4.0
"{B56B1487-9A26-4AFD-A1FD-949C40F5F2BC}" = Sony Ericsson PC Suite
"{B671CBFD-4109-4D35-9252-3062D3CCB7B2}" = Adobe SING CS3
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{B7F560B3-6EFF-4026-A982-843895A41149}" = Adobe BridgeTalk Plugin CS3
"{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}" = Adobe Default Language CS3
"{BE5F3842-8309-4754-92D5-83E02E6077A3}" = Adobe Extension Manager CS3
"{C2D69781-F392-4118-A5A7-C7E9C38DBFC2}" = Adobe ExtendScript Toolkit 2
"{C5BD220A-EFE8-48A5-B70E-9503D535FACE}" = Adobe WAS CS3
"{CB3F8375-B600-4B9F-83C9-238ED1E583FD}" = Adobe InDesign CS3
"{D0DFF92A-492E-4C40-B862-A74A173C25C5}" = Adobe Version Cue CS3 Client
"{D1C18EDD-571A-4BDD-BE7B-1DD86027D7FF}" = Adobe Creative Suite 3 Design Premium
"{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}" = Adobe PDF Library Files
"{D7A6C517-11F2-419F-B5BB-27772B939698}" = NvMixer
"{DADD7B8A-BCB0-44F5-967A-ECB6B4F2ECD9}" = Adobe Color Common Settings
"{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}" = Adobe Color JA Extra Settings
"{E69AE897-9E0B-485C-8552-7841F48D42D8}" = Adobe Update Manager CS3
"{EA7B3CC4-366D-4CF6-8350-FD7A7034116E}" = Adobe InDesign CS3 Icon Handler
"{FF29A7E2-FF40-4D07-B7E4-2093DE59E10A}" = Adobe Color NA Extra Settings
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Photoshop 7.0" = Adobe Photoshop 7.0
"Adobe_c14ac4070fd9614ffe63f4bb533db2c" = Add or Remove Adobe Creative Suite 3 Design Premium
"AntiVir PersonalEdition Classic" = Avira AntiVir Personal - Free Antivirus
"CCleaner" = CCleaner (remove only)
"C-Media Audio Driver" = C-Media WDM Audio Driver
"CToolbar_UNINSTALL" = Crawler Toolbar with Web Security Guard
"KaraFun_is1" = KaraFun Studio 1.18
"Kaspersky Online Scanner" = Kaspersky Online Scanner
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Mozilla Firefox (3.0.6)" = Mozilla Firefox (3.0.6)
"NVIDIA Drivers" = NVIDIA Drivers
"QuickTime" = QuickTime
"VLC media player" = VideoLAN VLC media player 0.8.4a
"Winamp" = Winamp (remove only)
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows XP Service Pack" = Windows XP Service Pack 2
"WinRAR archiver" = WinRAR archiver
"WinZip" = WinZip
"X Codec Pack" = X Codec Pack
"Yahoo! Companion" = Yahoo! Toolbar avec bloqueur de fenêtres pop-up
"Yahoo! Toolbar" = Yahoo! Toolbar
[color=orange]========== Last 10 Event Log Errors ==========/color
[ Application Events ]
Error - 14/12/2007 17:08:36 | Computer Name = DUDULE | Source = Application Hang | ID = 1002
Description = Application bloquée Photoshop.exe, version 7.0.0.0, module bloqué
hungapp, version 0.0.0.0, adresse de blocage 0x00000000.
Error - 14/02/2008 17:45:29 | Computer Name = DUDULE | Source = Application Error | ID = 1000
Description = Application défaillante AvidStartup.exe, version 2.9.0.0, module défaillant
AvidStartup.exe, version 2.9.0.0, adresse de défaillance 0x0001f75c.
Error - 15/02/2008 03:38:12 | Computer Name = DUDULE | Source = Application Error | ID = 1000
Description = Application défaillante AvidStartup.exe, version 2.9.0.0, module défaillant
AvidStartup.exe, version 2.9.0.0, adresse de défaillance 0x0001f75c.
Error - 02/03/2008 16:48:11 | Computer Name = DUDULE | Source = Application Error | ID = 1005
Description = Windows ne peut pas accéder au fichier F:\CDbrowser\Bin\QuickTime.qts
pour une des raisons suivantes : un problème s'est produit avec la connexion réseau,
le disque sur lequel le fichier est enregistré, ou les pilotes de stockage installés
sur cet ordinateur, ou le disque est manquant. Windows a fermé le programme QuickTime
en raison de cette erreur. Programme : QuickTime Fichier : F:\CDbrowser\Bin\QuickTime.qts
La
valeur de l'erreur est affichée dans la section Données supplémentaires. Action
utilisateur 1. Ouvrez à nouveau le fichier. Cette situation peut résulter d'un problème
temporaire qui se corrigera de lui-même à la prochaine exécution du programme. 2.
Si le fichier est toujours inaccessible et - Il se trouve sur le réseau : votre administrateur
réseau devrait vérifier qu'il n'y a aucun problème avec le réseau et que le serveur
peut être contacté. - Il se trouve sur un disque amovible, par exemple une disquette
ou un CD-ROM : vérifiez que le disque est inséré correctement dans l'ordinateur.
3.
Vérifiez et réparez le système de fichiers en exécutant CHKDSK. Pour exécuter CHKDSK,
cliquez sur Démarrer, Exécuter, entrez CMD puis cliquez sur OK. À l'invite de commandes,
entrez CHKDSK /F et appuyez sur ENTRÉE. 4. Si le problème persiste, restaurez le
fichier à partir d'une copie de sauvegarde. 5. Déterminez si d'autres fichiers du
même disque peuvent être ouverts. Si ce n'est pas le cas, le disque est peut-être
endommagé. S'il s'agit d'un disque dur, contactez votre administrateur ou le distributeur
de votre ordinateur pour obtenir une assistance supplémentaire. Données supplémentaires
Valeur
de l'erreur : C000009C Type du disque : 5
Error - 02/03/2008 16:48:30 | Computer Name = DUDULE | Source = Application Error | ID = 1000
Description = Application défaillante demo32.exe, version 8.0.100.1040, module défaillant
QuickTime.qts, version 6.5.1.17, adresse de défaillance 0x0001c720.
[ System Events ]
Error - 11/02/2009 15:09:49 | Computer Name = DUDULE | Source = sr | ID = 1
Description = Le filtre de restauration du système à rencontré l'erreur inattendue
'0xC000007F' pendant le traitement du fichier 'Dc13.lnk' sur le volume 'HarddiskVolume1'.
Ceci a entraîné l'arrêt de la surveillance du volume.
Error - 12/02/2009 13:58:30 | Computer Name = DUDULE | Source = Service Control Manager | ID = 7026
Description = Le pilote de démarrage système ou d'amorçage suivant n'a pas pu se
charger : i8042prt
Error - 12/02/2009 14:01:02 | Computer Name = DUDULE | Source = Service Control Manager | ID = 7026
Description = Le pilote de démarrage système ou d'amorçage suivant n'a pas pu se
charger : i8042prt
Error - 12/02/2009 14:03:41 | Computer Name = DUDULE | Source = Service Control Manager | ID = 7026
Description = Le pilote de démarrage système ou d'amorçage suivant n'a pas pu se
charger : i8042prt
< End of report > -
de retour,
voila les deux rapports otitlist.
le coup du vaccin pour les clefs c est vraiment bien vu, jai fait tourné l'information autour de moi.
j ai aussi changé internet explorer pour firefox..
voila, merci :-) -
Contributeur sécuritéBonjour Po,
A)- Commence par ceci, et donne des nouvelles.
"remove-spybotsd-settings.reg" donne ceci sur le bureau
https://www.hiboox.fr/
Tu peux également faire un simple clic gauche sur le lien
http://www.safer-networking.org/files/remove-spybotsd-settings.reg
et choisir [Enregister] vers le "Bureau"; ce qui revient au même en l'occurrence.
Sur cette icône du bureau, il faut faire un clic-droit; ce qui donne
https://www.hiboox.fr/
Choisis "Fusionner"
Accepte l'avertissement éventuel.
B)- Je recherche un autre lien pour OTListIt (de OldTimer)
La v2 est sortie. Voilà le lien :
http://oldtimer.geekstogo.com/OTListIt2.exe
L'interface a changé, elle est plus complète, mais contente toi de cliquer sur RunScan.
C)- Cit. « une autre question bête: pour la vaccination des clefs usb et autres disques durs etc,
il faut copier le fichier "a la racine", mais je sais pas ce que ca veut dire, tout du moins ou se trouve concrètement la racine :-) »
Il n'y a pas de bête question ==> de surcroît, ce sont ces questions qui me font avancer.
[Si tu ne sais pas : demande. Si tu sais : partage !
La Connaissance n'est acquise que lorsque que l'on est en mesure de la partager]
Réponse:
Comme Malekal_morte l'a illustré, par "Racine du disque amovible", il faut entendre la lettre de ta clé qui apparaît dans le "Poste de travail" sous le disque local C:\ ( soit E, ou G, ...)
D)- MBAM (Malwarebytes'Anti-<gras>Malware)</gras> est par définition un "Anti-Malware"; il concerne donc non seulement les virus, mais aussi les spywares, les trojans, et les saletés sépcifiques.
Il est un outil précieux et gratuit (actuellement mis régulièrement mis à jour par l'auteur)
==> mise à jour que tu dois lancer manuellement sur la version gratuite.
•- Tu peux déjà t'informer en général à partir de ce lien https://forum.pcastuces.com/virusclassificationpourquoietudeeradication-f25s14911.htm?page=1
Bonne journée
Al. -
ok, super.
jai cependant encore quelques questions avant de te laisser tranquil!
première chose:
le lien vers la page de Ostlistit ne marche pas, je ne peux donc pas tenvoyer de rapport...
puis, en ce qui concerne la fusion du fichier pour desinstaller spybot je narrive pas a trouver loption fusionner en faisant le clik droit.
remove-spybotsd-settings.reg.txt est bien un fichier texte nest ce pas?
jai le meme problème par rapport au fichierautorun_off.reg.txt,
pour eviter la fameuse contamination des supports amovibles;
une autre question bête: pour la vaccination des clefs usb et autres disques durs etc,
il faut copier le fichier "a la racine", mais je sais pas ce que ca veut dire, tout du moins ou se trouve concrètement la racine :-)
enfin , jai telecharger malwarebytes et mapprète a faire un scan rapide.
mais si jai bien compris, ce nest pas une protection en tant reel.
penses tu que je doive installer un parefeu en plus de avira?
un anti spyware? (dailleurs, quelle est la différence?)
et puis pour terminer, te remercier encore grandement pour ton aide,
jen ai beaucoup appris et c 'etait precieux !!
xxxxxxx -
merci pour tout,
je vais suivre tes conseils
je dois bientôt aller travailler, alors
en attendant bonne journée!
xxxxxx -
Contributeur sécuritéBonjour,
Merci.
Voici ce que je t'annonçais:
A)- C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files
C:\Documents and Settings\po\Local Settings\Historique\History.IE5
Pour nettoyer/vider ces répertoires temporaires, je te propose d'installer et d'utiliser CCleaner.
Tout est là bien détaillé https://jesses.pagesperso-orange.fr/Docs/Logiciels/CCleaner.htm
B)- C:\Documents and Settings\All Users\Application Data\Adobe\Acrobat\7.0
C:\Documents and Settings\po\Application Data\Adobe\Acrobat\7.0\
C:\Program Files\Adobe\Acrobat 7.0\
Cette version ancienne est une porte ouverte contre la sécurité de ton PC
Il faut faire la mise à jour version 9 https://get2.adobe.com/reader/otherversions/
L'installation d'une nouvelle version désinstallera l'ancienne si besoin est.
- Si tu n'en as pas usage, décoche "Téléchargez également :Adobe Photoshop® Album Édition"
- Dans "Ajout/Suppression des programmes" du "Panneau de configuration" tu supprimeras toutes les autres versions.
C)- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
Spybot et son Tea-Timer sont totalement dépassés, et ne servent pour le moment qu'à empêcher les outils de désinfections de fonctionner.
Il faut faire un clic-droit sur le lien ci dessous, puis choisir « Enregistrer la cible du lien sous ».
http://www.safer-networking.org/files/remove-spybotsd-settings.reg
Placer le fichier "remove-spybotsd-settings.reg" sur le Bureau.
Faire un clic-droit sur le fichier "remove-spybotsd-settings.reg" ; puis choisir « Fusionner » et accepter la fusion dans le Registre.
Redémarrer impérativement le PC
NOTE: Tu peux garder MBAM (Malwarebytes'Anti-Malware), c'est un outil tout public (contrairement à certains) utilisés pour nettoyer la machine.
Le module résident (qui tourne à l'arrière plan) est payant; mais le programme fonctionne en mode gratuit, ce module ne s'active simplement pas.
Du coup dans sa version gratuite il cohabite avec tout, en tant que scanneur à la demande.
Attention: Le mettre à jour avant chaque utilisation.
Il est bien plus avancé techniquement que Spybot et Ad-aware, qu'il peut remplacer avantageusement.
D)- C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Barre d'outils Crawler <-- supprime cette misère.
Supprime Spyware Terminator; ta version est source de laisser passer un "Rootkit".
MBAM (Malwarebytes'Anti-Malware) le remplace bien (excepté que ce dernier n’a pas de protection résidente).
Mais si tu le souhaites, tu trouveras ici http://forum.spywareterminator.com/Default.aspx?g=forum&c=4 le forum spécialisé « About Spyware Terminator » ; et la dernière version Spyware Terminator 2.5.5.166 (md5: F1B2AEEB5A415B207192752B8BF0760A - size: 646,728) ici http://dnl.spywareterminator.com/dnl/config/338/SpywareTerminatorSetup.exe
Attention, c’est une version fraîchement évoluée ; il ne faut pas accepter « ClamAV », la « Barre d'outils Crawler », et « Web Security Guard ».
E)- C:\Documents and Settings\po\Application Data\Macromedia\Flash Player
Tiens, lis ceci http://www.secuser.com/vulnerabilite/2009/090225-flash-player.htm
Je ne sais pas si tu pourras installer une version supérieure à 10 à cause de ta version Windows.
F)- C:\Documents and Settings\po\Application Data\OpenOffice.org2
Regarde, http://fr.openoffice.org/ ; la version 3.0.1 en français vient de sortir fin janvier.
Tu en seras enchantée.
G)- Relance _OTMoveIt et appuie sur le bouton radio [CleanUp!].
Il ne servirait à rien de garder les logiciels utilisés pour la désinfection.
Constamment remis à jour, ils seraient obsolètes (voire dangereux pour le fonctionnement de votre PC) sous 10 jours. (C'est le cas de ComboFix, par exemple)
H)- Dès que ce petit rafraîchissement est terminé, utilise OTListIt (de OldTimer) comme ceci:
Télécharger OTListIt.exe depuis http://oldtimer.geekstogo.com/OTListIt.exe
Enregistrer ce fichier sur le Bureau.
Il ne faut pas de processus de contrôle en temps réel (Désactiver le module résident de ANTIVIR; le réactiver dès après cette application).
Fermer toutes les fenêtres de programme ouvertes.
Faire un double clic sur OTListIt.exe pour lancer l'outil.
Cocher la case située devant Scan All Users.
Cliquer sur le bouton Run Scan et laisser l'outil travailler sans l'interrompre.
Lorsque l'outil a terminé, il y a ouverture d'une fenêtre du bloc-notes contenant l'un des deux rapports.
Fermer le Bloc-notes.
Le second rapport est visible dans la "Barre des tâches" (au bas de l'écran). Le fermer également.
Fermer la fenêtre de OTListIt.
Envoyer ensuite en réponse, dans deux messages distincts (à cause de la longueur des logs), les deux rapports de OTListIt (contenu des fichiers OTListIt.txt et Extras.txt situés sur le Bureau).
Courage, c'est ton intérêt.
Prends ton temps; rien ne sert de courir.
N'oublie pas d'activer ANTIVIR en protection continue, avec sa fonction anti-rootkits comme indiquée dans ton rapport (bravo) ==> Recherche de Rootkits..: marche
Bonne journée
Al.
EDIT: ATTENTION: À propos des clés USB
A)- /!\ Ne double clique surtout pas sur les icônes pour les ouvrir, sous peine de relancer l'infection.
Il est souhaitable de prendre l'habitude de faire "clic-droit > ouvrir"./!\
Citation (merci Malekal_morte):
1°- QUESTION: si j'ai bien compris, quand je vais sur un PC qui me semble être à risques, il suffit de ne pas double-cliquer sur les dossiers ou sur ma clé pour éviter d'activer ce virus ?
2°- RÉPONSE: Non, ce serait trop facile.
- Si tu vas avec ta clef USB sur un PC pourri, c'est fini, elle est infectée.
- En revanche, si tu vas sur ton PC à toi qui est propre avec ta clef USB infectée et que tu n'ouvres pas en double-cliquant (ou s'il n'y a pas l'ouverture automatique), alors le PC ne sera pas infecté.
MAIS la clef restera infectée par contre.
Tout est expliqué ici: < https://forum.malekal.com/viewtopic.php?f=45&t=5544 >
B)- Pour le vaccin des clés USB :
http://perso.orange.fr/-Gof/DL/VaccinUSB.exe
https://forum.malekal.com/viewtopic.php?f=45&t=5544
C)- Les infections se propageant par les supports amovibles : USB, Flash, etc. [par Gof]
https://forum.zebulon.fr/topic/131959-infections-par-supports-amovibles/
https://forum.zebulon.fr/topic/131959-infections-par-supports-amovibles
-
voila le rapport.
je sais pas pourquoi mais la recherche a tét arrétée (enfin cest ce que avira raconte car le rapport précise que lanalyse a été faite integralement.
bref, je relance tout de même puis je ractiverais la restauration système.
encore merci pour ton aide, apparement il nya plus de problème!!
je refais un tour sur le forum demain.
merci :-)
Avira AntiVir Personal
Date de création du fichier de rapport : lundi 2 mars 2009 22:22
La recherche porte sur 1277024 souches de virus.
Détenteur de la licence :Avira AntiVir PersonalEdition Classic
Numéro de série : 0000149996-ADJIE-0001
Plateforme : Windows XP
Version de Windows :(Service Pack 2) [5.1.2600]
Mode Boot : Démarré normalement
Identifiant : po
Nom de l'ordinateur :DUDULE
Informations de version :
BUILD.DAT : 8.2.0.52 16931 Bytes 02/12/2008 14:55:00
AVSCAN.EXE : 8.1.4.10 315649 Bytes 18/11/2008 08:21:00
AVSCAN.DLL : 8.1.4.1 49921 Bytes 21/07/2008 13:44:27
LUKE.DLL : 8.1.4.5 164097 Bytes 12/06/2008 12:44:16
LUKERES.DLL : 8.1.4.0 13057 Bytes 04/07/2008 07:30:27
ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 27/10/2008 11:30:36
ANTIVIR1.VDF : 7.1.2.12 3336192 Bytes 11/02/2009 21:17:22
ANTIVIR2.VDF : 7.1.2.55 248832 Bytes 20/02/2009 21:17:24
ANTIVIR3.VDF : 7.1.2.104 275456 Bytes 02/03/2009 21:17:25
Version du moteur: 8.2.0.98
AEVDF.DLL : 8.1.1.0 106868 Bytes 02/03/2009 21:17:38
AESCRIPT.DLL : 8.1.1.56 352634 Bytes 02/03/2009 21:17:36
AESCN.DLL : 8.1.1.7 127347 Bytes 02/03/2009 21:17:35
AERDL.DLL : 8.1.1.3 438645 Bytes 04/11/2008 13:58:38
AEPACK.DLL : 8.1.3.8 397684 Bytes 02/03/2009 21:17:35
AEOFFICE.DLL : 8.1.0.36 196987 Bytes 02/03/2009 21:17:33
AEHEUR.DLL : 8.1.0.100 1618295 Bytes 02/03/2009 21:17:32
AEHELP.DLL : 8.1.2.2 119158 Bytes 02/03/2009 21:17:29
AEGEN.DLL : 8.1.1.22 336245 Bytes 02/03/2009 21:17:28
AEEMU.DLL : 8.1.0.9 393588 Bytes 14/10/2008 10:05:56
AECORE.DLL : 8.1.6.6 176501 Bytes 02/03/2009 21:17:26
AEBB.DLL : 8.1.0.3 53618 Bytes 14/10/2008 10:05:56
AVWINLL.DLL : 1.0.0.12 15105 Bytes 09/07/2008 08:40:02
AVPREF.DLL : 8.0.2.0 38657 Bytes 16/05/2008 09:27:58
AVREP.DLL : 8.0.0.2 98344 Bytes 31/07/2008 12:02:15
AVREG.DLL : 8.0.0.1 33537 Bytes 09/05/2008 11:26:37
AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:19
AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 12/06/2008 12:27:46
SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02
SMTPLIB.DLL : 1.2.0.23 28929 Bytes 12/06/2008 12:49:36
NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:07
RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 04/07/2008 07:23:16
RCTEXT.DLL : 8.0.52.1 86273 Bytes 17/07/2008 10:08:43
Configuration pour la recherche actuelle :
Nom de la tâche..................: Sélection manuelle
Fichier de configuration.........: C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\PROFILES\folder.avp
Documentation....................: moyen
Action principale................: interactif
Action secondaire................: ignorer
Recherche sur les secteurs d'amorçage maître: marche
Recherche sur les secteurs d'amorçage: marche
Secteurs d'amorçage..............: A:, C:, D:, E:, F:, G:, H:, I:, J:, K:,
Recherche dans les programmes actifs: marche
Recherche en cours sur l'enregistrement: marche
Recherche de Rootkits............: marche
Fichier mode de recherche........: Tous les fichiers
Recherche sur les archives.......: marche
Limiter la profondeur de récursivité: 20
Archive Smart Extensions.........: marche
Heuristique de macrovirus........: marche
Heuristique fichier..............: moyen
Catégories de dangers divergentes: +APPL,+GAME,+JOKE,+PCK,+SPR,
Début de la recherche : lundi 2 mars 2009 22:22
La recherche d'objets cachés commence.
'32497' objets ont été contrôlés, '0' objets cachés ont été trouvés.
La recherche sur les processus démarrés commence :
Processus de recherche 'avscan.exe' - '1' module(s) sont contrôlés
Processus de recherche 'avcenter.exe' - '1' module(s) sont contrôlés
Processus de recherche 'avgnt.exe' - '1' module(s) sont contrôlés
Processus de recherche 'avguard.exe' - '1' module(s) sont contrôlés
Processus de recherche 'sched.exe' - '1' module(s) sont contrôlés
Processus de recherche 'wuauclt.exe' - '1' module(s) sont contrôlés
Processus de recherche 'epmworker.exe' - '1' module(s) sont contrôlés
Processus de recherche 'Generic.exe' - '1' module(s) sont contrôlés
Processus de recherche 'unsecapp.exe' - '1' module(s) sont contrôlés
Processus de recherche 'wmiprvse.exe' - '1' module(s) sont contrôlés
Processus de recherche 'CapabilityManager.exe' - '1' module(s) sont contrôlés
Processus de recherche 'msmsgs.exe' - '1' module(s) sont contrôlés
Processus de recherche 'ctfmon.exe' - '1' module(s) sont contrôlés
Processus de recherche 'Application Launcher.exe' - '1' module(s) sont contrôlés
Processus de recherche 'qttask.exe' - '1' module(s) sont contrôlés
Processus de recherche 'winampa.exe' - '1' module(s) sont contrôlés
Processus de recherche 'acrotray.exe' - '1' module(s) sont contrôlés
Processus de recherche 'nvraidservice.exe' - '1' module(s) sont contrôlés
Processus de recherche 'explorer.exe' - '1' module(s) sont contrôlés
Processus de recherche 'alg.exe' - '1' module(s) sont contrôlés
Processus de recherche 'wdfmgr.exe' - '1' module(s) sont contrôlés
Processus de recherche 'mDNSResponder.exe' - '1' module(s) sont contrôlés
Processus de recherche 'spoolsv.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'lsass.exe' - '1' module(s) sont contrôlés
Processus de recherche 'services.exe' - '1' module(s) sont contrôlés
Processus de recherche 'winlogon.exe' - '1' module(s) sont contrôlés
Processus de recherche 'csrss.exe' - '1' module(s) sont contrôlés
Processus de recherche 'smss.exe' - '1' module(s) sont contrôlés
'33' processus ont été contrôlés avec '33' modules
La recherche sur les secteurs d'amorçage maître commence :
Secteur d'amorçage maître HD0
[INFO] Aucun virus trouvé !
Secteur d'amorçage maître HD1
[INFO] Aucun virus trouvé !
Secteur d'amorçage maître HD2
[INFO] Aucun virus trouvé !
Secteur d'amorçage maître HD3
[INFO] Aucun virus trouvé !
La recherche sur les secteurs d'amorçage commence :
Secteur d'amorçage 'A:\'
[INFO] Aucun support de données inséré dans le lecteur 'A:\' !
Secteur d'amorçage 'C:\'
[INFO] Aucun virus trouvé !
Secteur d'amorçage 'D:\'
[INFO] Aucun virus trouvé !
Secteur d'amorçage 'E:\'
[INFO] Aucun virus trouvé !
Secteur d'amorçage 'H:\'
[INFO] Aucun virus trouvé !
Secteur d'amorçage 'I:\'
[INFO] Aucun virus trouvé !
Secteur d'amorçage 'J:\'
[INFO] Aucun virus trouvé !
Secteur d'amorçage 'K:\'
[INFO] Aucun virus trouvé !
La recherche sur les renvois aux fichiers exécutables (registre) commence.
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\Program Files\Fichiers communs\Ahead\Lib\
C:\WINDOWS\system32\
C:\Program Files\Winamp\
C:\Program Files\Microsoft Office\OFFICE11\
C:\Program Files\Microsoft Office\OFFICE11\
C:\Program Files\Messenger\
C:\Program Files\Messenger\
C:\WINDOWS\inf\
C:\WINDOWS\
C:\WINDOWS\
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\WINDOWS\inf\
C:\WINDOWS\inf\
C:\WINDOWS\inf\
C:\WINDOWS\inf\
C:\WINDOWS\system32\
C:\WINDOWS\inf\
C:\WINDOWS\inf\
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\
C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\
C:\Program Files\Fichiers communs\Adobe\Calibration\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\Documents and Settings\po\Menu Démarrer\Programmes\Démarrage\
C:\Documents and Settings\po\Menu Démarrer\Programmes\Démarrage\
C:\WINDOWS\system32\config\systemprofile\Menu Démarrer\Programmes\Démarrage\
Le registre a été contrôlé ( '49' fichiers).
La recherche sur les fichiers sélectionnés commence :
Recherche débutant dans 'A:\'
Impossible d'ouvrir le chemin à contrôler A:\ !
Erreur système [21]: Le périphérique n'est pas prêt.
Recherche débutant dans 'C:\' <systeme>
C:\
C:\pagefile.sys
[AVERTISSEMENT] Impossible d'ouvrir le fichier !
C:\cmdcons\
C:\cmdcons\SYSTEM32\
C:\Documents and Settings\All Users\Application Data\
C:\Documents and Settings\All Users\Application Data\Adobe\Acrobat\7.0\Replicate\Security\
C:\Documents and Settings\All Users\Application Data\Adobe\Adobe PDF\Extras\
C:\Documents and Settings\All Users\Application Data\Adobe\Adobe PDF\Settings\
C:\Documents and Settings\All Users\Application Data\Adobe\InDesign\Version 5.0\Scripting Support\5.0\
C:\Documents and Settings\All Users\Application Data\Adobe\SING\datastore\
C:\Documents and Settings\All Users\Application Data\Adobe Systems\Product licenses\
C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\
C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\EVENTDB\
C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\IDX\
C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\JOBS\
C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\LOGFILES\
C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\PROFILES\
C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\REPORTS\
C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\iPower\
C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\iPower\dynamic\english\images\news_letter\
C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\iPower\dynamic\images\P\
C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\iPower\dynamic\skin_archive\00000021\
C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\iPower\images\
C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\iPower\images\bottom\
C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\iPower\images\bullet\
C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\iPower\images\button\
C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\iPower\images\hd\
C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\iPower\images\left\
C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\iPower\images\right\
C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\iPower\images\top\
C:\Documents and Settings\All Users\Application Data\FLEXnet\
C:\Documents and Settings\All Users\Application Data\Macromedia\Licensing\Licenses\Studio 8.0\
C:\Documents and Settings\All Users\Application Data\Macromedia\Licensing\Products\Contribute 3.0\
C:\Documents and Settings\All Users\Application Data\Macromedia\Licensing\Products\Dreamweaver 8.0\
C:\Documents and Settings\All Users\Application Data\Macromedia\Licensing\Products\Fireworks 8.0\
C:\Documents and Settings\All Users\Application Data\Macromedia\Licensing\Products\Flash 8 Video Encoder 1.0\
C:\Documents and Settings\All Users\Application Data\Macromedia\Licensing\Products\Flash 8.0\
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\S-1-5-18\
C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\
C:\Documents and Settings\All Users\Application Data\Microsoft\Media Index\
C:\Documents and Settings\All Users\Application Data\Microsoft\Media Player\
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Pbk\
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\
C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\DATA\
C:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\
C:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\
C:\Documents and Settings\All Users\Application Data\QuickTime\
C:\Documents and Settings\All Users\Application Data\Recisio\KaraFun\
C:\Documents and Settings\All Users\Application Data\Sony Ericsson\Capability Manager\Data\
C:\Documents and Settings\All Users\Application Data\Sony Ericsson\Mobile\MPM\
C:\Documents and Settings\All Users\Application Data\Sony Ericsson\Sync Station\
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\
C:\Documents and Settings\All Users\Application Data\Teleca\Capability Manager\Applications\
C:\Documents and Settings\All Users\Application Data\Teleca\Capability Manager\Devices\
C:\Documents and Settings\All Users\Application Data\Teleca\Capability Manager\Networks\
C:\Documents and Settings\All Users\Application Data\Teleca\DM\DEVREP\
C:\Documents and Settings\All Users\Application Data\Teleca\Tlib\Logging\
C:\Documents and Settings\All Users\Application Data\TEMP
C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage\data\
C:\Documents and Settings\All Users\Application Data\Yahoo! Companion\Data\default\
C:\Documents and Settings\All Users\Application Data\Yahoo! Companion\Data\fr-FR\
C:\Documents and Settings\All Users\Application Data\Yahoo! Companion\Data\paulinepayen\
C:\Documents and Settings\All Users\Application Data\Yahoo! Companion\Icons\
C:\Documents and Settings\All Users\Application Data\Yahoo! Companion\Media\
C:\Documents and Settings\All Users\Bureau\
C:\Documents and Settings\All Users\Documents\
C:\Documents and Settings\All Users\Documents\Adobe PDF\Data\
C:\Documents and Settings\All Users\Documents\Adobe PDF\Example Files\
C:\Documents and Settings\All Users\Documents\Adobe PDF\Extras\
C:\Documents and Settings\All Users\Documents\Adobe PDF\Settings\
C:\Documents and Settings\All Users\Documents\Adobe PDF\Startup\
C:\Documents and Settings\All Users\Documents\Ma musique\
C:\Documents and Settings\All Users\Documents\Ma musique\My Playlists\
C:\Documents and Settings\All Users\Documents\Ma musique\Sample Playlists\00160BEB\
C:\Documents and Settings\All Users\Documents\Ma musique\Échantillons de musique\
C:\Documents and Settings\All Users\Documents\Mes images\
C:\Documents and Settings\All Users\Documents\Mes images\Échantillons d'images\
C:\Documents and Settings\All Users\Documents\Mes vidéos\
C:\Documents and Settings\All Users\DRM\
C:\Documents and Settings\All Users\Menu Démarrer\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Accessoires\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Accessoires\Accessibilité\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Accessoires\Communications\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Accessoires\Divertissement\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Accessoires\Outils système\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Adobe Design Premium CS3\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\AntiVir PersonalEdition Classic\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Avid\FatalErrorReports\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Barre d'outils Crawler\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\CyberLink PowerDVD\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\DivX\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\DivX\DivX Player\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\DivX\DivX Player\Liens\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\DivX\DivX Web Player\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\DivX\Liens\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Jeux\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\KaraFun\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Microsoft Office\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Microsoft Office\Outils Microsoft Office\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Nero 7 Ultra Edition\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Nero 7 Ultra Edition\audio\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Nero 7 Ultra Edition\données\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Nero 7 Ultra Edition\Jouer\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Nero 7 Ultra Edition\Manuels\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Nero 7 Ultra Edition\Outils\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Nero 7 Ultra Edition\Partager\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Nero 7 Ultra Edition\Photo et vidéo\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Nero 7 Ultra Edition\Étiquettes\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\NVIDIA Corporation\NvMixer\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\NVIDIA Corporation\RAID Manager\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Outils d'administration\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\QuickTime\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Sony Ericsson\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\VideoLAN\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\WinRAR\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\WinZip\
C:\Documents and Settings\Default User\
C:\Documents and Settings\Default User\Application Data\
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\
C:\Documents and Settings\Default User\Local Settings\
C:\Documents and Settings\Default User\Local Settings\Historique\
C:\Documents and Settings\Default User\Local Settings\Historique\History.IE5\
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\C96BKXEN\
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\CPURWPY3\
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\OH67GDAV\
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\S52R4PIN\
C:\Documents and Settings\Default User\Menu Démarrer\
C:\Documents and Settings\Default User\Menu Démarrer\Programmes\
C:\Documents and Settings\Default User\Menu Démarrer\Programmes\Accessoires\
C:\Documents and Settings\Default User\Menu Démarrer\Programmes\Accessoires\Accessibilité\
C:\Documents and Settings\Default User\Menu Démarrer\Programmes\Accessoires\Divertissement\
C:\Documents and Settings\Default User\Menu Démarrer\Programmes\Démarrage\
C:\Documents and Settings\Default User\Modèles\
C:\Documents and Settings\Default User\SendTo\
C:\Documents and Settings\LocalService\
C:\Documents and Settings\LocalService\NTUSER.DAT
[AVERTISSEMENT] Impossible d'ouvrir le fichier !
C:\Documents and Settings\LocalService\ntuser.dat.LOG
[AVERTISSEMENT] Impossible d'ouvrir le fichier !
C:\Documents and Settings\LocalService\Cookies\
C:\Documents and Settings\LocalService\Local Settings\
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
[AVERTISSEMENT] Impossible d'ouvrir le fichier !
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG
[AVERTISSEMENT] Impossible d'ouvrir le fichier !
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows Media\9.0\
C:\Documents and Settings\LocalService\Local Settings\Historique\
C:\Documents and Settings\LocalService\Local Settings\Historique\History.IE5\
C:\Documents and Settings\LocalService\Local Settings\temp\Cookies\
C:\Documents and Settings\LocalService\Local Settings\temp\Historique\History.IE5\
C:\Documents and Settings\LocalService\Local Settings\temp\Temporary Internet Files\Content.IE5\
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\
C:\Documents and Settings\LocalService\Menu Démarrer\Programmes\
C:\Documents and Settings\NetworkService\
C:\Documents and Settings\NetworkService\NTUSER.DAT
[AVERTISSEMENT] Impossible d'ouvrir le fichier !
C:\Documents and Settings\NetworkService\ntuser.dat.LOG
[AVERTISSEMENT] Impossible d'ouvrir le fichier !
C:\Documents and Settings\NetworkService\Local Settings\
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
[AVERTISSEMENT] Impossible d'ouvrir le fichier !
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG
[AVERTISSEMENT] Impossible d'ouvrir le fichier !
C:\Documents and Settings\NetworkService\Local Settings\Historique\
C:\Documents and Settings\NetworkService\Local Settings\Historique\History.IE5\
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\
C:\Documents and Settings\po\
C:\Documents and Settings\po\NTUSER.DAT
[AVERTISSEMENT] Impossible d'ouvrir le fichier !
C:\Documents and Settings\po\ntuser.dat.LOG
[AVERTISSEMENT] Impossible d'ouvrir le fichier !
C:\Documents and Settings\po\Application Data\
C:\Documents and Settings\po\Application Data\Adobe\Acrobat\7.0\
C:\Documents and Settings\po\Application Data\Adobe\Acrobat\7.0\Collab\
C:\Documents and Settings\po\Application Data\Adobe\Acrobat\7.0\JavaScripts\
C:\Documents and Settings\po\Application Data\Adobe\Acrobat\7.0\organizer70\
C:\Documents and Settings\po\Application Data\Adobe\Acrobat\7.0\Preferences\
C:\Documents and Settings\po\Application Data\Adobe\Acrobat\7.0\Updater\
C:\Documents and Settings\po\Application Data\Adobe\Acrobat\Distiller 7\
C:\Documents and Settings\po\Application Data\Adobe\Acrobat\Distiller 7\Cache\
C:\Documents and Settings\po\Application Data\Adobe\Designer\
C:\Documents and Settings\po\Application Data\Adobe\Designer\en\
C:\Documents and Settings\po\Application Data\Adobe\Designer\en\objects\
C:\Documents and Settings\po\Application Data\Adobe\Designer\en\objects\barcodes\
C:\Documents and Settings\po\Application Data\Adobe\Designer\en\objects\custom\
C:\Documents and Settings\po\Application Data\Adobe\Designer\en\objects\standard\
C:\Documents and Settings\po\Application Data\Adobe\Designer\en\Templates\
C:\Documents and Settings\po\Application Data\Adobe\Designer\en\Templates\Sample\
C:\Documents and Settings\po\Application Data\Adobe\Designer\en\Templates\Standard\
C:\Documents and Settings\po\Application Data\Adobe\FileBrowser\Photoshop7\
C:\Documents and Settings\po\Application Data\Adobe\Flash Player\AssetCache\PDLWPNFF\
C:\Documents and Settings\po\Application Data\Adobe\ImageReady\7.0\Paramètres\
C:\Documents and Settings\po\Application Data\Adobe\ImageReady\7.0\Paramètres\ImageReady Actions\
C:\Documents and Settings\po\Application Data\Adobe\InDesign\Version 5.0\
C:\Documents and Settings\po\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\brt\
C:\Documents and Settings\po\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\eng\
C:\Documents and Settings\po\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\frn\
C:\Documents and Settings\po\Application Data\Adobe\Photoshop\7.0\Adobe Photoshop 7.0 Settings\
C:\Documents and Settings\po\Application Data\Adobe\Photoshop\7.0\Paramètres Adobe Photoshop 7.0\
C:\Documents and Settings\po\Application Data\Adobe\Premiere Pro\7.0\
C:\Documents and Settings\po\Application Data\Adobe\Workflow\
C:\Documents and Settings\po\Application Data\Ahead\
C:\Documents and Settings\po\Application Data\Ahead\Nero BackItUp\
C:\Documents and Settings\po\Application Data\Ahead\Nero BackItUp\Cache\
C:\Documents and Settings\po\Application Data\Ahead\Nero Burning ROM\
C:\Documents and Settings\po\Application Data\dvdcss\
C:\Documents and Settings\po\Application Data\dvdcss\DROIT_DE_VIVRE-2004101811425800-ba63dd6c4f\
C:\Documents and Settings\po\Application Data\dvdcss\DS_JONZE_A-2004022314370000-10dd2ba5fd\
C:\Documents and Settings\po\Application Data\dvdcss\DS_JONZE_B-2003110612324200-10dd2ec710\
C:\Documents and Settings\po\Application Data\dvdcss\DVD_VIDEO-2006111119102500-61088fa532\
C:\Documents and Settings\po\Application Data\dvdcss\DVD_VIDEO-2006111312031500-82305be499\
C:\Documents and Settings\po\Application Data\dvdcss\EC_100465-2002071520175300-9060efa6fd\
C:\Documents and Settings\po\Application Data\dvdcss\EC_110271-0000000000000000-2e97321f22\
C:\Documents and Settings\po\Application Data\dvdcss\EU_109950-2002090620003100-549233682b\
C:\Documents and Settings\po\Application Data\dvdcss\FARGO_KIOSK_D125-2003112019484500-2e97321f22\
C:\Documents and Settings\po\Application Data\dvdcss\FEDERICO_SCN-2003080512063100-07aef40a64\
C:\Documents and Settings\po\Application Data\dvdcss\FRISSONS_DE_L_ANGOISSE_DVD1-2004061618093700-ba63dd6c4f\
C:\Documents and Settings\po\Application Data\dvdcss\FUTURAMA_SEASON3_DISC1-2003040212310900-0000000397\
C:\Documents and Settings\po\Application Data\dvdcss\GOODNIGHT-2006072112032000-0bcf1ffdfa\
C:\Documents and Settings\po\Application Data\dvdcss\INDEX_004-2004100315091300-3c1dd3a3a9\
C:\Documents and Settings\po\Application Data\dvdcss\JULES_ET_JIM-2007062710195600-0005f5e107\
C:\Documents and Settings\po\Application Data\dvdcss\LA_BOITE_NOIRE-2006033112294200-ba63dd6c4f\
C:\Documents and Settings\po\Application Data\dvdcss\LE_DECALOGUE_1-2003122316181500-000000026c\
C:\Documents and Settings\po\Application Data\dvdcss\LE_DECALOGUE_2-2003122313014600-0000000262\
C:\Documents and Settings\po\Application Data\dvdcss\LUCIA_Y_EL_SEXO-2005100613305400-000061bbc0\
C:\Documents and Settings\po\Application Data\dvdcss\MULHOLLAND_DRIVE-0000000000000000-ba63dd6c4f\
C:\Documents and Settings\po\Application Data\dvdcss\OLDBOY_DISQUE_1-0000000000000000-ba63dd6c4f\
C:\Documents and Settings\po\Application Data\dvdcss\PERFECT_WORLD_D4-2002093012264000-0000000a1b\
C:\Documents and Settings\po\Application Data\dvdcss\WHO_FRAMED_ROGER_RABBIT-2003021812561600-000000000b\
C:\Documents and Settings\po\Application Data\dvdcss\WHO_FRAMED_ROGER_RABBIT-2003021818004600-2e97321f48\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\beacon.sina.com.cn\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\bin.clearspring.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\broadcast.piximedia.fr\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\cache.reverbnation.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\cache.reverbnation.com\widgets\serve_unprotected\28\widget.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\cache.reverbnation.com\widgets\swf\31\widgetPlayerMicro.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\cdn.widgetserver.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\d.scribd.com\ScribdViewer.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\e.blip.tv\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\embed.hobnox.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\flash.gydget.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\flash.quantserve.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\googleads.g.doubleclick.net\pagead\googleadplayer.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\images.video.msn.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\js.tudouui.com\bin\player_online\TudouVideoPlayer_Homer_38.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\lads.myspace.com\videos\Main.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\lads.myspace.com\videos\vplayer.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\login.yahoo.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\media.mtvu.com\global\apps\player\flex\Loader.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\media.mtvu.com\global\apps\player\gui\com\mtvnservices\media\player\gui\FFMod.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\media.mtvu.com\IMPORT\media.mtvnservices.com\player\release\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\pan.fotovista.com\pixmania\grafx\fr\fr\home_univers\player\player5.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\pan4.fotovista.com\pixmania\grafx\multipays\flashAS\Bann_580_100.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\pan5.fotovista.com\pixmania\grafx\multipays\flashAS\Bann_580_100.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\pan6.fotovista.com\pixmania\grafx\multipays\flashAS\Bann_580_100.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\pan7.fotovista.com\pixmania\grafx\multipays\flashAS\Bann_580_100.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\pan9.fotovista.com\pixmania\grafx\multipays\flashAS\Bann_580_100.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\pixmania.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\pub.widgetbox.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\pubhdstats2.msvp.net\campagnes\2004\RC.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\s.ytimg.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\serving-sys.com\BurstingRes\Site-4318\Type-2\AC776433-D982-4C19-A9C0-93D213629BD3.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\slide.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\static.wix.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\static.youku.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\tubemogul.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\video.google.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\video.google.com\googleplayer.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\www.56.com\flashApp\v_player_site_wide.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\www.blogger.com\img\videoplayer.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\www.dailymotion.com\flash\dmplayer\dmplayer-fr.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\www.deezer.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\www.he.playlist.com\mc\mp3player_new.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\www.pixmania.com\dev\gui_web\shopping\flashAS\Bann_580_100.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\www.pixmania.com\dev\gui_web\shopping\flashAS\Mac_180_150.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\www.youtube.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\wwwstatic.megavideo.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\localhost\Documents and Settings\po\Application Data\Macromedia\Flash MX\Configuration\AnswersPanel\answers.swf\#FlashMX\answers\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#beacon.sina.com.cn\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#broadcast.piximedia.fr\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#cache.reverbnation.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#cdn.widgetserver.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#d.scribd.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#e.blip.tv\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#embed.hobnox.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#facebook.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#flash.gydget.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#flash.quantserve.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#googleads.g.doubleclick.net\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#images.video.msn.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#js.tudouui.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#lads.myspace.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#local\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#login.yahoo.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#macromedia.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#media.mtvu.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#pan.fotovista.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#pan4.fotovista.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#pan5.fotovista.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#pan6.fotovista.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#pan7.fotovista.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#pan9.fotovista.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#pixmania.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#pub.widgetbox.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#pubhdstats2.msvp.net\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#resources-p2.imeem.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#rutube.ru\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#s.ytimg.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#serving-sys.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#slide.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#static.wix.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#static.youku.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#tubemogul.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#video.google.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#widgets.clearspring.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.56.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.blogger.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.dailymotion.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.deezer.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.he.playlist.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.pixmania.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.youtube.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#wwwstatic.megavideo.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\
C:\Documents and Settings\po\Application Data\Media Player Classic\
C:\Documents and Settings\po\Application Data\Microsoft\Address Book\
C:\Documents and Settings\po\Application Data\Microsoft\Clip Organizer\
C:\Documents and Settings\po\Application Data\Microsoft\CryptnetUrlCache\Content\
C:\Documents and Settings\po\Application Data\Microsoft\CryptnetUrlCache\MetaData\
C:\Documents and Settings\po\Application Data\Microsoft\Crypto\RSA\S-1-5-21-602162358-796845957-725345543-1003\
C:\Documents and Settings\po\Application Data\Microsoft\HTML Help\
C:\Documents and Settings\po\Application Data\Microsoft\Installer\{547D4265-AF45-42E9-A62A-C58182AA35B9}\
C:\Documents and Settings\po\Application Data\Microsoft\Installer\{88D422DB-E9C7-4E16-9D80-2999F4FD6AD9}\
C:\Documents and Settings\po\Application Data\Microsoft\Internet Explorer\
C:\Documents and Settings\po\Application Data\Microsoft\Internet Explorer\Quick Launch\
C:\Documents and Settings\po\Application Data\Microsoft\Media Player\
C:\Documents and Settings\po\Application Data\Microsoft\MMC\
C:\Documents and Settings\po\Application Data\Microsoft\Office\
C:\Documents and Settings\po\Application Data\Microsoft\Office\Récent\
C:\Documents and Settings\po\Application Data\Microsoft\PowerPoint\
C:\Documents and Settings\po\Application Data\Microsoft\Protect\
C:\Documents and Settings\po\Application Data\Microsoft\Protect\S-1-5-21-602162358-796845957-725345543-1003\
C:\Documents and Settings\po\Application Data\Microsoft\Windows\Themes\
C:\Documents and Settings\po\Application Data\Microsoft\Épreuve\
C:\Documents and Settings\po\Application Data\OpenOffice.org2\user\autotext\
C:\Documents and Settings\po\Application Data\OpenOffice.org2\user\basic\
C:\Documents and Settings\po\Application Data\OpenOffice.org2\user\basic\Standard\
C:\Documents and Settings\po\Application Data\OpenOffice.org2\user\config\
C:\Documents and Settings\po\Application Data\OpenOffice.org2\user\config\imagecache\
C:\Documents and Settings\po\Application Data\OpenOffice.org2\user\config\soffice.cfg\global\accelerator\fr\
C:\Documents and Settings\po\Application Data\OpenOffice.org2\user\config\soffice.cfg\modules\swriter\accelerator\fr\
C:\Documents and Settings\po\Application Data\OpenOffice.org2\user\database\
C:\Documents and Settings\po\Application Data\OpenOffice.org2\user\database\biblio\
C:\Documents and Settings\po\Application Data\OpenOffice.org2\user\gallery\
C:\Documents and Settings\po\Application Data\OpenOffice.org2\user\registry\cache\
C:\Documents and Settings\po\Application Data\OpenOffice.org2\user\registry\data\org\openoffice\
C:\Documents and Settings\po\Application Data\OpenOffice.org2\user\registry\data\org\openoffice\Office\
C:\Documents and Settings\po\Application Data\OpenOffice.org2\user\registry\data\org\openoffice\Office\UI\
C:\Documents and Settings\po\Application Data\Sony Ericsson\Teleca\Telecalib\Logging\
C:\Documents and Settings\po\Application Data\Sony Ericsson\Teleca\Telecalib\Logging\Application logs\
C:\Documents and Settings\po\Application Data\Teleca\DM\DEVREP\
C:\Documents and Settings\po\Application Data\Teleca\Telecalib\Logging\
C:\Documents and Settings\po\Application Data\Teleca\Telecalib\Logging\Application logs\
C:\Documents and Settings\po\Application Data\vlc\
C:\Documents and Settings\po\Application Data\vlc\cache\
C:\Documents and Settings\po\Bureau\
C:\Documents and Settings\po\Bureau\ComboFix.exe
[0] Type d'archive: RAR SFX (self extracting)
--> 32788R22FWJFW\psexec.cfexe
[1] Type d'archive: RSRC
--> Object
[RESULTAT] Contient le modèle de détection de l'application APPL/PsExec.E
[AVERTISSEMENT] Impossible de réparer les fichiers dans les archives
[AVERTISSEMENT] Fichier ignoré.
C:\Documents and Settings\po\Bureau\Flash_Disinfector.exe
[0] Type d'archive: RAR SFX (self extracting)
--> nircmd.exe
[RESULTAT] Contient le modèle de détection de l'application APPL/NirCmd.2
[RESULTAT] Contient le modèle de détection du ver WORM/Generic.4084
[AVERTISSEMENT] Fichier ignoré.
C:\Documents and Settings\po\Bureau\APPLICATION CALL!\
C:\Documents and Settings\po\Bureau\Nouveau dossier\
C:\Documents and Settings\po\Cookies\
C:\Documents and Settings\po\Favoris\
C:\Documents and Settings\po\Favoris\Liens\
C:\Documents and Settings\po\Local Settings\
C:\Documents and Settings\po\Local Settings\Application Data\
C:\Documents and Settings\po\Local Settings\Application Data\Adobe\Acrobat\7.0\Cache\
C:\Documents and Settings\po\Local Settings\Application Data\Adobe\Color\
C:\Documents and Settings\po\Local Settings\Application Data\Adobe\Fonts\
C:\Documents and Settings\po\Local Settings\Application Data\Adobe\InDesign\Version 5.0\Caches\
C:\Documents and Settings\po\Local Settings\Application Data\Adobe\InDesign\Version 5.0\Caches\InDesign Recovery\
C:\Documents and Settings\po\Local Settings\Application Data\Adobe\InDesign\Version 5.0\Caches\Scripting Support\5.0\
C:\Documents and Settings\po\Local Settings\Application Data\Adobe\TypeSpt\
C:\Documents and Settings\po\Local Settings\Application Data\Adobe\TypeSupport\
C:\Documents and Settings\po\Local Settings\Application Data\Adobe\TypeSupport\CMaps\
C:\Documents and Settings\po\Local Settings\Application Data\Ahead\Nero Home\
C:\Documents and Settings\po\Local Settings\Application Data\Ahead\Nero Home\idx\
C:\Documents and Settings\po\Local Settings\Application Data\Ahead\Nero StartSmart\cache\
C:\Documents and Settings\po\Local Settings\Application Data\Identities\{ED548CCE-67E9-4AE6-9BF0-985772535C53}\Microsoft\Outlook Express\
C:\Documents and Settings\po\Local Settings\Application Data\Macromedia\Flash 8\fr\Configuration\
C:\Documents and Settings\po\Local Settings\Application Data\Macromedia\Flash 8\fr\Configuration\Debugger\
C:\Documents and Settings\po\Local Settings\Application Data\Microsoft\
C:\Documents and Settings\po\Local Settings\Application Data\Microsoft\HelpCtr\
C:\Documents and Settings\po\Local Settings\Application Data\Microsoft\Internet Explorer\
C:\Documents and Settings\po\Local Settings\Application Data\Microsoft\Media Player\
C:\Documents and Settings\po\Local Settings\Application Data\Microsoft\Windows\
C:\Documents and Settings\po\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
[AVERTISSEMENT] Impossible d'ouvrir le fichier !
C:\Documents and Settings\po\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG
[AVERTISSEMENT] Impossible d'ouvrir le fichier !
C:\Documents and Settings\po\Local Settings\Application Data\Microsoft\Windows Media\10.0\
C:\Documents and Settings\po\Local Settings\Application Data\Microsoft\Windows Media\9.0\
C:\Documents and Settings\po\Local Settings\Historique\
C:\Documents and Settings\po\Local Settings\Historique\History.IE5\
C:\Documents and Settings\po\Local Settings\Historique\History.IE5\MSHist012009020920090216\
C:\Documents and Settings\po\Local Settings\Historique\History.IE5\MSHist012009021620090223\
C:\Documents and Settings\po\Local Settings\Historique\History.IE5\MSHist012009022320090302\
C:\Documents and Settings\po\Local Settings\Historique\History.IE5\MSHist012009030220090303\
C:\Documents and Settings\po\Local Settings\Temporary Internet Files\
C:\Documents and Settings\po\Local Settings\Temporary Internet Files\Content.IE5\
C:\Documents and Settings\po\Local Settings\Temporary Internet Files\Content.IE5\0RMLU589\
C:\Documents and Settings\po\Local Settings\Temporary Internet Files\Content.IE5\41C5OBC5\
C:\Documents and Settings\po\Local Settings\Temporary Internet Files\Content.IE5\6LQH0HMV\
C:\Documents and Settings\po\Local Settings\Temporary Internet Files\Content.IE5\A9U5MNW9\
C:\Documents and Settings\po\Local Settings\Temporary Internet Files\Content.IE5\G7Y3QAKW\
C:\Documents and Settings\po\Local Settings\Temporary Internet Files\Content.IE5\MBIL2JGZ\
C:\Documents and Settings\po\Local Settings\Temporary Internet Files\Content.IE5\MBIL2JGZ\LegitCheckControl[1].cab
[0] Type d'archive: CAB (Microsoft)
--> LegitCheckControl.dll
[REMARQUE] L'en-tête d'archive est défectueux
--> LegitCheckControl.inf
[AVERTISSEMENT] Aucun autre fichier n'a pu être décompressé de cette archive. L'archive est refermée.
C:\Documents and Settings\po\Local Settings\Temporary Internet Files\Content.IE5\P4S018RH\
C:\Documents and Settings\po\Local Settings\Temporary Internet Files\Content.IE5\UGHZ7I1J\
C:\Documents and Settings\po\Menu Démarrer\
C:\Documents and Settings\po\Menu Démarrer\Programmes\
C:\Documents and Settings\po\Menu Démarrer\Programmes\Accessoires\
C:\Documents and Settings\po\Menu Démarrer\Programmes\Accessoires\Accessibilité\
C:\Documents and Settings\po\Menu Démarrer\Programmes\Accessoires\Divertissement\
C:\Documents and Settings\po\Menu Démarrer\Programmes\Démarrage\
C:\Documents and Settings\po\Menu Démarrer\Programmes\Outils d'administration\
C:\Documents and Settings\po\Menu Démarrer\Programmes\Winamp\
C:\Documents and Settings\po\Menu Démarrer\Programmes\WinRAR\
C:\Documents and Settings\po\Menu Démarrer\Programmes\X Codec Pack\
C:\Documents and Settings\po\Mes documents\
C:\Documents and Settings\po\Mes documents\Adobe\Premiere Pro\7.0\
C:\Documents and Settings\po\Mes documents\Adobe\Premiere Pro\7.0\Angeglichene Audiodateien\essai.CFA\
C:\Documents and Settings\po\Mes documents\Adobe\Premiere Pro\7.0\Layouts\
C:\Documents and Settings\po\Mes documents\chachamail\
C:\Documents and Settings\po\Mes documents\chachamail\a queer zine tale\
C:\Documents and Settings\po\Mes documents\chachamail\cantine mautes\
C:\Documents and Settings\po\Mes documents\chachamail\montreal\
C:\Documents and Settings\po\Mes documents\chachamail\photos corine\
C:\Documents and Settings\po\Mes documents\chachamail\raphael\
C:\Documents and Settings\po\Mes documents\Ma musique\
C:\Documents and Settings\po\Mes documents\Ma musique\Artiste inconnu\Album inconnu (01-01-2009 16-54-43)\
C:\Documents and Settings\po\Mes documents\Ma musique\Artiste inconnu\Album inconnu (01-10-2008 19-58-05)\
C:\Documents and Settings\po\Mes documents\Mes images\
C:\Documents and Settings\po\Mes documents\Mes vidéos\
C:\Documents and Settings\po\Modèles\
C:\Documents and Settings\po\Recent\
C:\Documents and Settings\po\SendTo\
C:\Documents and Settings\po\UserData\
C:\Program Files\Adobe\Acrobat 7.0\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Activation\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Activation\da_DK\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Activation\de_DE\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Activation\en_IE\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Activation\en_US\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Activation\es_ES\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Activation\fi_FI\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Activation\fr_FR\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Activation\it_IT\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Activation\ja_JP\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Activation\ko_KR\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Activation\nl_NL\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Activation\no_NO\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Activation\PrivacyStatements\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Activation\pt_BR\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Activation\sv_SE\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Activation\zh_CN\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Activation\zh_TW\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Browser\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\DocTemplates\ENU\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\HowTo\ENU\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\HowTo\ENU\Images\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Javascripts\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Legal\Adobe Acrobat\7.0.0\da_DK\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Legal\Adobe Acrobat\7.0.0\de_DE\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Legal\Adobe Acrobat\7.0.0\en_GB\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Legal\Adobe Acrobat\7.0.0\en_US\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Legal\Adobe Acrobat\7.0.0\es_ES\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Legal\Adobe Acrobat\7.0.0\fi_FI\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Legal\Adobe Acrobat\7.0.0\fr_FR\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Legal\Adobe Acrobat\7.0.0\it_IT\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Legal\Adobe Acrobat\7.0.0\ja_JP\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Legal\Adobe Acrobat\7.0.0\ko_KR\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Legal\Adobe Acrobat\7.0.0\nl_NL\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Legal\Adobe Acrobat\7.0.0\no_NO\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Legal\Adobe Acrobat\7.0.0\pt_BR\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Legal\Adobe Acrobat\7.0.0\sv_SE\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Legal\Adobe Acrobat\7.0.0\zh_CN\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Legal\Adobe Acrobat\7.0.0\zh_TW\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\PalmPilot\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\AcroForm\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\AcroForm\PMP\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\Annotations\Stamps\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\Annotations\Stamps\ENU\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\ImageViewer\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\ImageViewer\en_US\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\Multimedia\MPP\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\PaperCapture\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\PaperCapture\Server\Roman\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\PaperCapture\Server\Roman\Configs\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\PaperCapture\Server\Roman\Dbase\PJCR\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\PaperCapture\Server\Roman\Dbase\PJCRCOMM\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\PaperCapture\Server\Roman\Dictionaries\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\PictureTasks\HowTo\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\PictureTasks\HowTo\Images\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\PictureTasks\OLS\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\PictureTasks\OLS\Locale\ENU\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\PictureTasks\Templates\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\Preflight\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\Preflight\OutputIntent\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\SaveAsXML\DeveloperInfo\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\SaveAsXML\MappingTables\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\Tablepicker\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\VDKHome\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\VDKHome\ENU\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins3d\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Sequences\ENU\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\SPPlugins\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Updater\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\WebSearch\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat Elements\
C:\Program Files\Adobe\Acrobat 7.0\ActiveX\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\cfg\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\ConvertIFD\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\Documentation\EN\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\cfg\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\objects\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\objects\barcodes\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\objects\custom\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\objects\standard\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Dunning Notice\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Dunning Notice\Data\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Dunning Notice\Forms\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Dunning Notice\Images\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Dunning Notice\Outputs\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\E-Ticket\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\E-Ticket\Data\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\E-Ticket\Forms\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\E-Ticket\Images\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\E-Ticket\Outputs\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Grant Application\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Grant Application\Forms\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Purchase Order\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Purchase Order\Dynamic\Data\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Purchase Order\Dynamic\Forms\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Purchase Order\Dynamic\Images\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Purchase Order\Dynamic\Outputs\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Purchase Order\Dynamic Interactive\Forms\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Purchase Order\Dynamic Interactive\Images\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Purchase Order\Interactive\Forms\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Purchase Order\Interactive\Images\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Purchase Order\Schema\Data\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Purchase Order\Schema\Forms\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Purchase Order\Schema\Images\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Purchase Order\Schema\Outputs\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Purchase Order\Schema\Schema\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Scripting\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Scripting\Forms\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\SubformSet\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\SubformSet\Data\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\SubformSet\Forms\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\SubformSet\Outputs\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Tax Receipt\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Tax Receipt\Data\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Tax Receipt\Forms\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Tax Receipt\Images\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Tax Receipt -
voila le rapport.
je sais pas pourquoi mais la recherche a tét arrétée (enfin cest ce que avira raconte car le rapport précise que lanalyse a étét faite integralement.
bref, je relance tout de même puis je ractiverais la restauration système.
encore merci pour ton aide, apparement il nya plus de problème!!
je refais un tour sur le forum demain.
merci :-)
Avira AntiVir Personal
Date de création du fichier de rapport : lundi 2 mars 2009 22:22
La recherche porte sur 1277024 souches de virus.
Détenteur de la licence :Avira AntiVir PersonalEdition Classic
Numéro de série : 0000149996-ADJIE-0001
Plateforme : Windows XP
Version de Windows :(Service Pack 2) [5.1.2600]
Mode Boot : Démarré normalement
Identifiant : po
Nom de l'ordinateur :DUDULE
Informations de version :
BUILD.DAT : 8.2.0.52 16931 Bytes 02/12/2008 14:55:00
AVSCAN.EXE : 8.1.4.10 315649 Bytes 18/11/2008 08:21:00
AVSCAN.DLL : 8.1.4.1 49921 Bytes 21/07/2008 13:44:27
LUKE.DLL : 8.1.4.5 164097 Bytes 12/06/2008 12:44:16
LUKERES.DLL : 8.1.4.0 13057 Bytes 04/07/2008 07:30:27
ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 27/10/2008 11:30:36
ANTIVIR1.VDF : 7.1.2.12 3336192 Bytes 11/02/2009 21:17:22
ANTIVIR2.VDF : 7.1.2.55 248832 Bytes 20/02/2009 21:17:24
ANTIVIR3.VDF : 7.1.2.104 275456 Bytes 02/03/2009 21:17:25
Version du moteur: 8.2.0.98
AEVDF.DLL : 8.1.1.0 106868 Bytes 02/03/2009 21:17:38
AESCRIPT.DLL : 8.1.1.56 352634 Bytes 02/03/2009 21:17:36
AESCN.DLL : 8.1.1.7 127347 Bytes 02/03/2009 21:17:35
AERDL.DLL : 8.1.1.3 438645 Bytes 04/11/2008 13:58:38
AEPACK.DLL : 8.1.3.8 397684 Bytes 02/03/2009 21:17:35
AEOFFICE.DLL : 8.1.0.36 196987 Bytes 02/03/2009 21:17:33
AEHEUR.DLL : 8.1.0.100 1618295 Bytes 02/03/2009 21:17:32
AEHELP.DLL : 8.1.2.2 119158 Bytes 02/03/2009 21:17:29
AEGEN.DLL : 8.1.1.22 336245 Bytes 02/03/2009 21:17:28
AEEMU.DLL : 8.1.0.9 393588 Bytes 14/10/2008 10:05:56
AECORE.DLL : 8.1.6.6 176501 Bytes 02/03/2009 21:17:26
AEBB.DLL : 8.1.0.3 53618 Bytes 14/10/2008 10:05:56
AVWINLL.DLL : 1.0.0.12 15105 Bytes 09/07/2008 08:40:02
AVPREF.DLL : 8.0.2.0 38657 Bytes 16/05/2008 09:27:58
AVREP.DLL : 8.0.0.2 98344 Bytes 31/07/2008 12:02:15
AVREG.DLL : 8.0.0.1 33537 Bytes 09/05/2008 11:26:37
AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:19
AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 12/06/2008 12:27:46
SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02
SMTPLIB.DLL : 1.2.0.23 28929 Bytes 12/06/2008 12:49:36
NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:07
RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 04/07/2008 07:23:16
RCTEXT.DLL : 8.0.52.1 86273 Bytes 17/07/2008 10:08:43
Configuration pour la recherche actuelle :
Nom de la tâche..................: Sélection manuelle
Fichier de configuration.........: C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\PROFILES\folder.avp
Documentation....................: moyen
Action principale................: interactif
Action secondaire................: ignorer
Recherche sur les secteurs d'amorçage maître: marche
Recherche sur les secteurs d'amorçage: marche
Secteurs d'amorçage..............: A:, C:, D:, E:, F:, G:, H:, I:, J:, K:,
Recherche dans les programmes actifs: marche
Recherche en cours sur l'enregistrement: marche
Recherche de Rootkits............: marche
Fichier mode de recherche........: Tous les fichiers
Recherche sur les archives.......: marche
Limiter la profondeur de récursivité: 20
Archive Smart Extensions.........: marche
Heuristique de macrovirus........: marche
Heuristique fichier..............: moyen
Catégories de dangers divergentes: +APPL,+GAME,+JOKE,+PCK,+SPR,
Début de la recherche : lundi 2 mars 2009 22:22
La recherche d'objets cachés commence.
'32497' objets ont été contrôlés, '0' objets cachés ont été trouvés.
La recherche sur les processus démarrés commence :
Processus de recherche 'avscan.exe' - '1' module(s) sont contrôlés
Processus de recherche 'avcenter.exe' - '1' module(s) sont contrôlés
Processus de recherche 'avgnt.exe' - '1' module(s) sont contrôlés
Processus de recherche 'avguard.exe' - '1' module(s) sont contrôlés
Processus de recherche 'sched.exe' - '1' module(s) sont contrôlés
Processus de recherche 'wuauclt.exe' - '1' module(s) sont contrôlés
Processus de recherche 'epmworker.exe' - '1' module(s) sont contrôlés
Processus de recherche 'Generic.exe' - '1' module(s) sont contrôlés
Processus de recherche 'unsecapp.exe' - '1' module(s) sont contrôlés
Processus de recherche 'wmiprvse.exe' - '1' module(s) sont contrôlés
Processus de recherche 'CapabilityManager.exe' - '1' module(s) sont contrôlés
Processus de recherche 'msmsgs.exe' - '1' module(s) sont contrôlés
Processus de recherche 'ctfmon.exe' - '1' module(s) sont contrôlés
Processus de recherche 'Application Launcher.exe' - '1' module(s) sont contrôlés
Processus de recherche 'qttask.exe' - '1' module(s) sont contrôlés
Processus de recherche 'winampa.exe' - '1' module(s) sont contrôlés
Processus de recherche 'acrotray.exe' - '1' module(s) sont contrôlés
Processus de recherche 'nvraidservice.exe' - '1' module(s) sont contrôlés
Processus de recherche 'explorer.exe' - '1' module(s) sont contrôlés
Processus de recherche 'alg.exe' - '1' module(s) sont contrôlés
Processus de recherche 'wdfmgr.exe' - '1' module(s) sont contrôlés
Processus de recherche 'mDNSResponder.exe' - '1' module(s) sont contrôlés
Processus de recherche 'spoolsv.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'lsass.exe' - '1' module(s) sont contrôlés
Processus de recherche 'services.exe' - '1' module(s) sont contrôlés
Processus de recherche 'winlogon.exe' - '1' module(s) sont contrôlés
Processus de recherche 'csrss.exe' - '1' module(s) sont contrôlés
Processus de recherche 'smss.exe' - '1' module(s) sont contrôlés
'33' processus ont été contrôlés avec '33' modules
La recherche sur les secteurs d'amorçage maître commence :
Secteur d'amorçage maître HD0
[INFO] Aucun virus trouvé !
Secteur d'amorçage maître HD1
[INFO] Aucun virus trouvé !
Secteur d'amorçage maître HD2
[INFO] Aucun virus trouvé !
Secteur d'amorçage maître HD3
[INFO] Aucun virus trouvé !
La recherche sur les secteurs d'amorçage commence :
Secteur d'amorçage 'A:\'
[INFO] Aucun support de données inséré dans le lecteur 'A:\' !
Secteur d'amorçage 'C:\'
[INFO] Aucun virus trouvé !
Secteur d'amorçage 'D:\'
[INFO] Aucun virus trouvé !
Secteur d'amorçage 'E:\'
[INFO] Aucun virus trouvé !
Secteur d'amorçage 'H:\'
[INFO] Aucun virus trouvé !
Secteur d'amorçage 'I:\'
[INFO] Aucun virus trouvé !
Secteur d'amorçage 'J:\'
[INFO] Aucun virus trouvé !
Secteur d'amorçage 'K:\'
[INFO] Aucun virus trouvé !
La recherche sur les renvois aux fichiers exécutables (registre) commence.
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\Program Files\Fichiers communs\Ahead\Lib\
C:\WINDOWS\system32\
C:\Program Files\Winamp\
C:\Program Files\Microsoft Office\OFFICE11\
C:\Program Files\Microsoft Office\OFFICE11\
C:\Program Files\Messenger\
C:\Program Files\Messenger\
C:\WINDOWS\inf\
C:\WINDOWS\
C:\WINDOWS\
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\WINDOWS\inf\
C:\WINDOWS\inf\
C:\WINDOWS\inf\
C:\WINDOWS\inf\
C:\WINDOWS\system32\
C:\WINDOWS\inf\
C:\WINDOWS\inf\
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\
C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\
C:\Program Files\Fichiers communs\Adobe\Calibration\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\Documents and Settings\po\Menu Démarrer\Programmes\Démarrage\
C:\Documents and Settings\po\Menu Démarrer\Programmes\Démarrage\
C:\WINDOWS\system32\config\systemprofile\Menu Démarrer\Programmes\Démarrage\
Le registre a été contrôlé ( '49' fichiers).
La recherche sur les fichiers sélectionnés commence :
Recherche débutant dans 'A:\'
Impossible d'ouvrir le chemin à contrôler A:\ !
Erreur système [21]: Le périphérique n'est pas prêt.
Recherche débutant dans 'C:\' <systeme>
C:\
C:\pagefile.sys
[AVERTISSEMENT] Impossible d'ouvrir le fichier !
C:\cmdcons\
C:\cmdcons\SYSTEM32\
C:\Documents and Settings\All Users\Application Data\
C:\Documents and Settings\All Users\Application Data\Adobe\Acrobat\7.0\Replicate\Security\
C:\Documents and Settings\All Users\Application Data\Adobe\Adobe PDF\Extras\
C:\Documents and Settings\All Users\Application Data\Adobe\Adobe PDF\Settings\
C:\Documents and Settings\All Users\Application Data\Adobe\InDesign\Version 5.0\Scripting Support\5.0\
C:\Documents and Settings\All Users\Application Data\Adobe\SING\datastore\
C:\Documents and Settings\All Users\Application Data\Adobe Systems\Product licenses\
C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\
C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\EVENTDB\
C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\IDX\
C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\JOBS\
C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\LOGFILES\
C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\PROFILES\
C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\REPORTS\
C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\iPower\
C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\iPower\dynamic\english\images\news_letter\
C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\iPower\dynamic\images\P\
C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\iPower\dynamic\skin_archive\00000021\
C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\iPower\images\
C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\iPower\images\bottom\
C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\iPower\images\bullet\
C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\iPower\images\button\
C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\iPower\images\hd\
C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\iPower\images\left\
C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\iPower\images\right\
C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\iPower\images\top\
C:\Documents and Settings\All Users\Application Data\FLEXnet\
C:\Documents and Settings\All Users\Application Data\Macromedia\Licensing\Licenses\Studio 8.0\
C:\Documents and Settings\All Users\Application Data\Macromedia\Licensing\Products\Contribute 3.0\
C:\Documents and Settings\All Users\Application Data\Macromedia\Licensing\Products\Dreamweaver 8.0\
C:\Documents and Settings\All Users\Application Data\Macromedia\Licensing\Products\Fireworks 8.0\
C:\Documents and Settings\All Users\Application Data\Macromedia\Licensing\Products\Flash 8 Video Encoder 1.0\
C:\Documents and Settings\All Users\Application Data\Macromedia\Licensing\Products\Flash 8.0\
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\S-1-5-18\
C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\
C:\Documents and Settings\All Users\Application Data\Microsoft\Media Index\
C:\Documents and Settings\All Users\Application Data\Microsoft\Media Player\
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Pbk\
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\
C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\DATA\
C:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\
C:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\
C:\Documents and Settings\All Users\Application Data\QuickTime\
C:\Documents and Settings\All Users\Application Data\Recisio\KaraFun\
C:\Documents and Settings\All Users\Application Data\Sony Ericsson\Capability Manager\Data\
C:\Documents and Settings\All Users\Application Data\Sony Ericsson\Mobile\MPM\
C:\Documents and Settings\All Users\Application Data\Sony Ericsson\Sync Station\
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\
C:\Documents and Settings\All Users\Application Data\Teleca\Capability Manager\Applications\
C:\Documents and Settings\All Users\Application Data\Teleca\Capability Manager\Devices\
C:\Documents and Settings\All Users\Application Data\Teleca\Capability Manager\Networks\
C:\Documents and Settings\All Users\Application Data\Teleca\DM\DEVREP\
C:\Documents and Settings\All Users\Application Data\Teleca\Tlib\Logging\
C:\Documents and Settings\All Users\Application Data\TEMP
C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage\data\
C:\Documents and Settings\All Users\Application Data\Yahoo! Companion\Data\default\
C:\Documents and Settings\All Users\Application Data\Yahoo! Companion\Data\fr-FR\
C:\Documents and Settings\All Users\Application Data\Yahoo! Companion\Data\paulinepayen\
C:\Documents and Settings\All Users\Application Data\Yahoo! Companion\Icons\
C:\Documents and Settings\All Users\Application Data\Yahoo! Companion\Media\
C:\Documents and Settings\All Users\Bureau\
C:\Documents and Settings\All Users\Documents\
C:\Documents and Settings\All Users\Documents\Adobe PDF\Data\
C:\Documents and Settings\All Users\Documents\Adobe PDF\Example Files\
C:\Documents and Settings\All Users\Documents\Adobe PDF\Extras\
C:\Documents and Settings\All Users\Documents\Adobe PDF\Settings\
C:\Documents and Settings\All Users\Documents\Adobe PDF\Startup\
C:\Documents and Settings\All Users\Documents\Ma musique\
C:\Documents and Settings\All Users\Documents\Ma musique\My Playlists\
C:\Documents and Settings\All Users\Documents\Ma musique\Sample Playlists\00160BEB\
C:\Documents and Settings\All Users\Documents\Ma musique\Échantillons de musique\
C:\Documents and Settings\All Users\Documents\Mes images\
C:\Documents and Settings\All Users\Documents\Mes images\Échantillons d'images\
C:\Documents and Settings\All Users\Documents\Mes vidéos\
C:\Documents and Settings\All Users\DRM\
C:\Documents and Settings\All Users\Menu Démarrer\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Accessoires\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Accessoires\Accessibilité\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Accessoires\Communications\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Accessoires\Divertissement\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Accessoires\Outils système\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Adobe Design Premium CS3\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\AntiVir PersonalEdition Classic\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Avid\FatalErrorReports\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Barre d'outils Crawler\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\CyberLink PowerDVD\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\DivX\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\DivX\DivX Player\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\DivX\DivX Player\Liens\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\DivX\DivX Web Player\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\DivX\Liens\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Jeux\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\KaraFun\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Microsoft Office\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Microsoft Office\Outils Microsoft Office\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Nero 7 Ultra Edition\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Nero 7 Ultra Edition\audio\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Nero 7 Ultra Edition\données\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Nero 7 Ultra Edition\Jouer\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Nero 7 Ultra Edition\Manuels\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Nero 7 Ultra Edition\Outils\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Nero 7 Ultra Edition\Partager\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Nero 7 Ultra Edition\Photo et vidéo\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Nero 7 Ultra Edition\Étiquettes\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\NVIDIA Corporation\NvMixer\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\NVIDIA Corporation\RAID Manager\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Outils d'administration\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\QuickTime\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Sony Ericsson\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\VideoLAN\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\WinRAR\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\WinZip\
C:\Documents and Settings\Default User\
C:\Documents and Settings\Default User\Application Data\
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\
C:\Documents and Settings\Default User\Local Settings\
C:\Documents and Settings\Default User\Local Settings\Historique\
C:\Documents and Settings\Default User\Local Settings\Historique\History.IE5\
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\C96BKXEN\
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\CPURWPY3\
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\OH67GDAV\
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\S52R4PIN\
C:\Documents and Settings\Default User\Menu Démarrer\
C:\Documents and Settings\Default User\Menu Démarrer\Programmes\
C:\Documents and Settings\Default User\Menu Démarrer\Programmes\Accessoires\
C:\Documents and Settings\Default User\Menu Démarrer\Programmes\Accessoires\Accessibilité\
C:\Documents and Settings\Default User\Menu Démarrer\Programmes\Accessoires\Divertissement\
C:\Documents and Settings\Default User\Menu Démarrer\Programmes\Démarrage\
C:\Documents and Settings\Default User\Modèles\
C:\Documents and Settings\Default User\SendTo\
C:\Documents and Settings\LocalService\
C:\Documents and Settings\LocalService\NTUSER.DAT
[AVERTISSEMENT] Impossible d'ouvrir le fichier !
C:\Documents and Settings\LocalService\ntuser.dat.LOG
[AVERTISSEMENT] Impossible d'ouvrir le fichier !
C:\Documents and Settings\LocalService\Cookies\
C:\Documents and Settings\LocalService\Local Settings\
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
[AVERTISSEMENT] Impossible d'ouvrir le fichier !
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG
[AVERTISSEMENT] Impossible d'ouvrir le fichier !
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows Media\9.0\
C:\Documents and Settings\LocalService\Local Settings\Historique\
C:\Documents and Settings\LocalService\Local Settings\Historique\History.IE5\
C:\Documents and Settings\LocalService\Local Settings\temp\Cookies\
C:\Documents and Settings\LocalService\Local Settings\temp\Historique\History.IE5\
C:\Documents and Settings\LocalService\Local Settings\temp\Temporary Internet Files\Content.IE5\
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\
C:\Documents and Settings\LocalService\Menu Démarrer\Programmes\
C:\Documents and Settings\NetworkService\
C:\Documents and Settings\NetworkService\NTUSER.DAT
[AVERTISSEMENT] Impossible d'ouvrir le fichier !
C:\Documents and Settings\NetworkService\ntuser.dat.LOG
[AVERTISSEMENT] Impossible d'ouvrir le fichier !
C:\Documents and Settings\NetworkService\Local Settings\
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
[AVERTISSEMENT] Impossible d'ouvrir le fichier !
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG
[AVERTISSEMENT] Impossible d'ouvrir le fichier !
C:\Documents and Settings\NetworkService\Local Settings\Historique\
C:\Documents and Settings\NetworkService\Local Settings\Historique\History.IE5\
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\
C:\Documents and Settings\po\
C:\Documents and Settings\po\NTUSER.DAT
[AVERTISSEMENT] Impossible d'ouvrir le fichier !
C:\Documents and Settings\po\ntuser.dat.LOG
[AVERTISSEMENT] Impossible d'ouvrir le fichier !
C:\Documents and Settings\po\Application Data\
C:\Documents and Settings\po\Application Data\Adobe\Acrobat\7.0\
C:\Documents and Settings\po\Application Data\Adobe\Acrobat\7.0\Collab\
C:\Documents and Settings\po\Application Data\Adobe\Acrobat\7.0\JavaScripts\
C:\Documents and Settings\po\Application Data\Adobe\Acrobat\7.0\organizer70\
C:\Documents and Settings\po\Application Data\Adobe\Acrobat\7.0\Preferences\
C:\Documents and Settings\po\Application Data\Adobe\Acrobat\7.0\Updater\
C:\Documents and Settings\po\Application Data\Adobe\Acrobat\Distiller 7\
C:\Documents and Settings\po\Application Data\Adobe\Acrobat\Distiller 7\Cache\
C:\Documents and Settings\po\Application Data\Adobe\Designer\
C:\Documents and Settings\po\Application Data\Adobe\Designer\en\
C:\Documents and Settings\po\Application Data\Adobe\Designer\en\objects\
C:\Documents and Settings\po\Application Data\Adobe\Designer\en\objects\barcodes\
C:\Documents and Settings\po\Application Data\Adobe\Designer\en\objects\custom\
C:\Documents and Settings\po\Application Data\Adobe\Designer\en\objects\standard\
C:\Documents and Settings\po\Application Data\Adobe\Designer\en\Templates\
C:\Documents and Settings\po\Application Data\Adobe\Designer\en\Templates\Sample\
C:\Documents and Settings\po\Application Data\Adobe\Designer\en\Templates\Standard\
C:\Documents and Settings\po\Application Data\Adobe\FileBrowser\Photoshop7\
C:\Documents and Settings\po\Application Data\Adobe\Flash Player\AssetCache\PDLWPNFF\
C:\Documents and Settings\po\Application Data\Adobe\ImageReady\7.0\Paramètres\
C:\Documents and Settings\po\Application Data\Adobe\ImageReady\7.0\Paramètres\ImageReady Actions\
C:\Documents and Settings\po\Application Data\Adobe\InDesign\Version 5.0\
C:\Documents and Settings\po\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\brt\
C:\Documents and Settings\po\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\eng\
C:\Documents and Settings\po\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\frn\
C:\Documents and Settings\po\Application Data\Adobe\Photoshop\7.0\Adobe Photoshop 7.0 Settings\
C:\Documents and Settings\po\Application Data\Adobe\Photoshop\7.0\Paramètres Adobe Photoshop 7.0\
C:\Documents and Settings\po\Application Data\Adobe\Premiere Pro\7.0\
C:\Documents and Settings\po\Application Data\Adobe\Workflow\
C:\Documents and Settings\po\Application Data\Ahead\
C:\Documents and Settings\po\Application Data\Ahead\Nero BackItUp\
C:\Documents and Settings\po\Application Data\Ahead\Nero BackItUp\Cache\
C:\Documents and Settings\po\Application Data\Ahead\Nero Burning ROM\
C:\Documents and Settings\po\Application Data\dvdcss\
C:\Documents and Settings\po\Application Data\dvdcss\DROIT_DE_VIVRE-2004101811425800-ba63dd6c4f\
C:\Documents and Settings\po\Application Data\dvdcss\DS_JONZE_A-2004022314370000-10dd2ba5fd\
C:\Documents and Settings\po\Application Data\dvdcss\DS_JONZE_B-2003110612324200-10dd2ec710\
C:\Documents and Settings\po\Application Data\dvdcss\DVD_VIDEO-2006111119102500-61088fa532\
C:\Documents and Settings\po\Application Data\dvdcss\DVD_VIDEO-2006111312031500-82305be499\
C:\Documents and Settings\po\Application Data\dvdcss\EC_100465-2002071520175300-9060efa6fd\
C:\Documents and Settings\po\Application Data\dvdcss\EC_110271-0000000000000000-2e97321f22\
C:\Documents and Settings\po\Application Data\dvdcss\EU_109950-2002090620003100-549233682b\
C:\Documents and Settings\po\Application Data\dvdcss\FARGO_KIOSK_D125-2003112019484500-2e97321f22\
C:\Documents and Settings\po\Application Data\dvdcss\FEDERICO_SCN-2003080512063100-07aef40a64\
C:\Documents and Settings\po\Application Data\dvdcss\FRISSONS_DE_L_ANGOISSE_DVD1-2004061618093700-ba63dd6c4f\
C:\Documents and Settings\po\Application Data\dvdcss\FUTURAMA_SEASON3_DISC1-2003040212310900-0000000397\
C:\Documents and Settings\po\Application Data\dvdcss\GOODNIGHT-2006072112032000-0bcf1ffdfa\
C:\Documents and Settings\po\Application Data\dvdcss\INDEX_004-2004100315091300-3c1dd3a3a9\
C:\Documents and Settings\po\Application Data\dvdcss\JULES_ET_JIM-2007062710195600-0005f5e107\
C:\Documents and Settings\po\Application Data\dvdcss\LA_BOITE_NOIRE-2006033112294200-ba63dd6c4f\
C:\Documents and Settings\po\Application Data\dvdcss\LE_DECALOGUE_1-2003122316181500-000000026c\
C:\Documents and Settings\po\Application Data\dvdcss\LE_DECALOGUE_2-2003122313014600-0000000262\
C:\Documents and Settings\po\Application Data\dvdcss\LUCIA_Y_EL_SEXO-2005100613305400-000061bbc0\
C:\Documents and Settings\po\Application Data\dvdcss\MULHOLLAND_DRIVE-0000000000000000-ba63dd6c4f\
C:\Documents and Settings\po\Application Data\dvdcss\OLDBOY_DISQUE_1-0000000000000000-ba63dd6c4f\
C:\Documents and Settings\po\Application Data\dvdcss\PERFECT_WORLD_D4-2002093012264000-0000000a1b\
C:\Documents and Settings\po\Application Data\dvdcss\WHO_FRAMED_ROGER_RABBIT-2003021812561600-000000000b\
C:\Documents and Settings\po\Application Data\dvdcss\WHO_FRAMED_ROGER_RABBIT-2003021818004600-2e97321f48\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\beacon.sina.com.cn\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\bin.clearspring.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\broadcast.piximedia.fr\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\cache.reverbnation.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\cache.reverbnation.com\widgets\serve_unprotected\28\widget.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\cache.reverbnation.com\widgets\swf\31\widgetPlayerMicro.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\cdn.widgetserver.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\d.scribd.com\ScribdViewer.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\e.blip.tv\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\embed.hobnox.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\flash.gydget.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\flash.quantserve.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\googleads.g.doubleclick.net\pagead\googleadplayer.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\images.video.msn.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\js.tudouui.com\bin\player_online\TudouVideoPlayer_Homer_38.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\lads.myspace.com\videos\Main.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\lads.myspace.com\videos\vplayer.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\login.yahoo.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\media.mtvu.com\global\apps\player\flex\Loader.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\media.mtvu.com\global\apps\player\gui\com\mtvnservices\media\player\gui\FFMod.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\media.mtvu.com\IMPORT\media.mtvnservices.com\player\release\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\pan.fotovista.com\pixmania\grafx\fr\fr\home_univers\player\player5.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\pan4.fotovista.com\pixmania\grafx\multipays\flashAS\Bann_580_100.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\pan5.fotovista.com\pixmania\grafx\multipays\flashAS\Bann_580_100.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\pan6.fotovista.com\pixmania\grafx\multipays\flashAS\Bann_580_100.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\pan7.fotovista.com\pixmania\grafx\multipays\flashAS\Bann_580_100.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\pan9.fotovista.com\pixmania\grafx\multipays\flashAS\Bann_580_100.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\pixmania.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\pub.widgetbox.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\pubhdstats2.msvp.net\campagnes\2004\RC.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\s.ytimg.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\serving-sys.com\BurstingRes\Site-4318\Type-2\AC776433-D982-4C19-A9C0-93D213629BD3.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\slide.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\static.wix.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\static.youku.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\tubemogul.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\video.google.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\video.google.com\googleplayer.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\www.56.com\flashApp\v_player_site_wide.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\www.blogger.com\img\videoplayer.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\www.dailymotion.com\flash\dmplayer\dmplayer-fr.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\www.deezer.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\www.he.playlist.com\mc\mp3player_new.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\www.pixmania.com\dev\gui_web\shopping\flashAS\Bann_580_100.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\www.pixmania.com\dev\gui_web\shopping\flashAS\Mac_180_150.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\www.youtube.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\wwwstatic.megavideo.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\localhost\Documents and Settings\po\Application Data\Macromedia\Flash MX\Configuration\AnswersPanel\answers.swf\#FlashMX\answers\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#beacon.sina.com.cn\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#broadcast.piximedia.fr\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#cache.reverbnation.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#cdn.widgetserver.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#d.scribd.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#e.blip.tv\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#embed.hobnox.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#facebook.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#flash.gydget.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#flash.quantserve.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#googleads.g.doubleclick.net\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#images.video.msn.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#js.tudouui.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#lads.myspace.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#local\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#login.yahoo.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#macromedia.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#media.mtvu.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#pan.fotovista.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#pan4.fotovista.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#pan5.fotovista.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#pan6.fotovista.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#pan7.fotovista.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#pan9.fotovista.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#pixmania.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#pub.widgetbox.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#pubhdstats2.msvp.net\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#resources-p2.imeem.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#rutube.ru\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#s.ytimg.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#serving-sys.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#slide.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#static.wix.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#static.youku.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#tubemogul.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#video.google.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#widgets.clearspring.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.56.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.blogger.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.dailymotion.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.deezer.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.he.playlist.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.pixmania.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.youtube.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#wwwstatic.megavideo.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\
C:\Documents and Settings\po\Application Data\Media Player Classic\
C:\Documents and Settings\po\Application Data\Microsoft\Address Book\
C:\Documents and Settings\po\Application Data\Microsoft\Clip Organizer\
C:\Documents and Settings\po\Application Data\Microsoft\CryptnetUrlCache\Content\
C:\Documents and Settings\po\Application Data\Microsoft\CryptnetUrlCache\MetaData\
C:\Documents and Settings\po\Application Data\Microsoft\Crypto\RSA\S-1-5-21-602162358-796845957-725345543-1003\
C:\Documents and Settings\po\Application Data\Microsoft\HTML Help\
C:\Documents and Settings\po\Application Data\Microsoft\Installer\{547D4265-AF45-42E9-A62A-C58182AA35B9}\
C:\Documents and Settings\po\Application Data\Microsoft\Installer\{88D422DB-E9C7-4E16-9D80-2999F4FD6AD9}\
C:\Documents and Settings\po\Application Data\Microsoft\Internet Explorer\
C:\Documents and Settings\po\Application Data\Microsoft\Internet Explorer\Quick Launch\
C:\Documents and Settings\po\Application Data\Microsoft\Media Player\
C:\Documents and Settings\po\Application Data\Microsoft\MMC\
C:\Documents and Settings\po\Application Data\Microsoft\Office\
C:\Documents and Settings\po\Application Data\Microsoft\Office\Récent\
C:\Documents and Settings\po\Application Data\Microsoft\PowerPoint\
C:\Documents and Settings\po\Application Data\Microsoft\Protect\
C:\Documents and Settings\po\Application Data\Microsoft\Protect\S-1-5-21-602162358-796845957-725345543-1003\
C:\Documents and Settings\po\Application Data\Microsoft\Windows\Themes\
C:\Documents and Settings\po\Application Data\Microsoft\Épreuve\
C:\Documents and Settings\po\Application Data\OpenOffice.org2\user\autotext\
C:\Documents and Settings\po\Application Data\OpenOffice.org2\user\basic\
C:\Documents and Settings\po\Application Data\OpenOffice.org2\user\basic\Standard\
C:\Documents and Settings\po\Application Data\OpenOffice.org2\user\config\
C:\Documents and Settings\po\Application Data\OpenOffice.org2\user\config\imagecache\
C:\Documents and Settings\po\Application Data\OpenOffice.org2\user\config\soffice.cfg\global\accelerator\fr\
C:\Documents and Settings\po\Application Data\OpenOffice.org2\user\config\soffice.cfg\modules\swriter\accelerator\fr\
C:\Documents and Settings\po\Application Data\OpenOffice.org2\user\database\
C:\Documents and Settings\po\Application Data\OpenOffice.org2\user\database\biblio\
C:\Documents and Settings\po\Application Data\OpenOffice.org2\user\gallery\
C:\Documents and Settings\po\Application Data\OpenOffice.org2\user\registry\cache\
C:\Documents and Settings\po\Application Data\OpenOffice.org2\user\registry\data\org\openoffice\
C:\Documents and Settings\po\Application Data\OpenOffice.org2\user\registry\data\org\openoffice\Office\
C:\Documents and Settings\po\Application Data\OpenOffice.org2\user\registry\data\org\openoffice\Office\UI\
C:\Documents and Settings\po\Application Data\Sony Ericsson\Teleca\Telecalib\Logging\
C:\Documents and Settings\po\Application Data\Sony Ericsson\Teleca\Telecalib\Logging\Application logs\
C:\Documents and Settings\po\Application Data\Teleca\DM\DEVREP\
C:\Documents and Settings\po\Application Data\Teleca\Telecalib\Logging\
C:\Documents and Settings\po\Application Data\Teleca\Telecalib\Logging\Application logs\
C:\Documents and Settings\po\Application Data\vlc\
C:\Documents and Settings\po\Application Data\vlc\cache\
C:\Documents and Settings\po\Bureau\
C:\Documents and Settings\po\Bureau\ComboFix.exe
[0] Type d'archive: RAR SFX (self extracting)
--> 32788R22FWJFW\psexec.cfexe
[1] Type d'archive: RSRC
--> Object
[RESULTAT] Contient le modèle de détection de l'application APPL/PsExec.E
[AVERTISSEMENT] Impossible de réparer les fichiers dans les archives
[AVERTISSEMENT] Fichier ignoré.
C:\Documents and Settings\po\Bureau\Flash_Disinfector.exe
[0] Type d'archive: RAR SFX (self extracting)
--> nircmd.exe
[RESULTAT] Contient le modèle de détection de l'application APPL/NirCmd.2
[RESULTAT] Contient le modèle de détection du ver WORM/Generic.4084
[AVERTISSEMENT] Fichier ignoré.
C:\Documents and Settings\po\Bureau\APPLICATION CALL!\
C:\Documents and Settings\po\Bureau\Nouveau dossier\
C:\Documents and Settings\po\Cookies\
C:\Documents and Settings\po\Favoris\
C:\Documents and Settings\po\Favoris\Liens\
C:\Documents and Settings\po\Local Settings\
C:\Documents and Settings\po\Local Settings\Application Data\
C:\Documents and Settings\po\Local Settings\Application Data\Adobe\Acrobat\7.0\Cache\
C:\Documents and Settings\po\Local Settings\Application Data\Adobe\Color\
C:\Documents and Settings\po\Local Settings\Application Data\Adobe\Fonts\
C:\Documents and Settings\po\Local Settings\Application Data\Adobe\InDesign\Version 5.0\Caches\
C:\Documents and Settings\po\Local Settings\Application Data\Adobe\InDesign\Version 5.0\Caches\InDesign Recovery\
C:\Documents and Settings\po\Local Settings\Application Data\Adobe\InDesign\Version 5.0\Caches\Scripting Support\5.0\
C:\Documents and Settings\po\Local Settings\Application Data\Adobe\TypeSpt\
C:\Documents and Settings\po\Local Settings\Application Data\Adobe\TypeSupport\
C:\Documents and Settings\po\Local Settings\Application Data\Adobe\TypeSupport\CMaps\
C:\Documents and Settings\po\Local Settings\Application Data\Ahead\Nero Home\
C:\Documents and Settings\po\Local Settings\Application Data\Ahead\Nero Home\idx\
C:\Documents and Settings\po\Local Settings\Application Data\Ahead\Nero StartSmart\cache\
C:\Documents and Settings\po\Local Settings\Application Data\Identities\{ED548CCE-67E9-4AE6-9BF0-985772535C53}\Microsoft\Outlook Express\
C:\Documents and Settings\po\Local Settings\Application Data\Macromedia\Flash 8\fr\Configuration\
C:\Documents and Settings\po\Local Settings\Application Data\Macromedia\Flash 8\fr\Configuration\Debugger\
C:\Documents and Settings\po\Local Settings\Application Data\Microsoft\
C:\Documents and Settings\po\Local Settings\Application Data\Microsoft\HelpCtr\
C:\Documents and Settings\po\Local Settings\Application Data\Microsoft\Internet Explorer\
C:\Documents and Settings\po\Local Settings\Application Data\Microsoft\Media Player\
C:\Documents and Settings\po\Local Settings\Application Data\Microsoft\Windows\
C:\Documents and Settings\po\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
[AVERTISSEMENT] Impossible d'ouvrir le fichier !
C:\Documents and Settings\po\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG
[AVERTISSEMENT] Impossible d'ouvrir le fichier !
C:\Documents and Settings\po\Local Settings\Application Data\Microsoft\Windows Media\10.0\
C:\Documents and Settings\po\Local Settings\Application Data\Microsoft\Windows Media\9.0\
C:\Documents and Settings\po\Local Settings\Historique\
C:\Documents and Settings\po\Local Settings\Historique\History.IE5\
C:\Documents and Settings\po\Local Settings\Historique\History.IE5\MSHist012009020920090216\
C:\Documents and Settings\po\Local Settings\Historique\History.IE5\MSHist012009021620090223\
C:\Documents and Settings\po\Local Settings\Historique\History.IE5\MSHist012009022320090302\
C:\Documents and Settings\po\Local Settings\Historique\History.IE5\MSHist012009030220090303\
C:\Documents and Settings\po\Local Settings\Temporary Internet Files\
C:\Documents and Settings\po\Local Settings\Temporary Internet Files\Content.IE5\
C:\Documents and Settings\po\Local Settings\Temporary Internet Files\Content.IE5\0RMLU589\
C:\Documents and Settings\po\Local Settings\Temporary Internet Files\Content.IE5\41C5OBC5\
C:\Documents and Settings\po\Local Settings\Temporary Internet Files\Content.IE5\6LQH0HMV\
C:\Documents and Settings\po\Local Settings\Temporary Internet Files\Content.IE5\A9U5MNW9\
C:\Documents and Settings\po\Local Settings\Temporary Internet Files\Content.IE5\G7Y3QAKW\
C:\Documents and Settings\po\Local Settings\Temporary Internet Files\Content.IE5\MBIL2JGZ\
C:\Documents and Settings\po\Local Settings\Temporary Internet Files\Content.IE5\MBIL2JGZ\LegitCheckControl[1].cab
[0] Type d'archive: CAB (Microsoft)
--> LegitCheckControl.dll
[REMARQUE] L'en-tête d'archive est défectueux
--> LegitCheckControl.inf
[AVERTISSEMENT] Aucun autre fichier n'a pu être décompressé de cette archive. L'archive est refermée.
C:\Documents and Settings\po\Local Settings\Temporary Internet Files\Content.IE5\P4S018RH\
C:\Documents and Settings\po\Local Settings\Temporary Internet Files\Content.IE5\UGHZ7I1J\
C:\Documents and Settings\po\Menu Démarrer\
C:\Documents and Settings\po\Menu Démarrer\Programmes\
C:\Documents and Settings\po\Menu Démarrer\Programmes\Accessoires\
C:\Documents and Settings\po\Menu Démarrer\Programmes\Accessoires\Accessibilité\
C:\Documents and Settings\po\Menu Démarrer\Programmes\Accessoires\Divertissement\
C:\Documents and Settings\po\Menu Démarrer\Programmes\Démarrage\
C:\Documents and Settings\po\Menu Démarrer\Programmes\Outils d'administration\
C:\Documents and Settings\po\Menu Démarrer\Programmes\Winamp\
C:\Documents and Settings\po\Menu Démarrer\Programmes\WinRAR\
C:\Documents and Settings\po\Menu Démarrer\Programmes\X Codec Pack\
C:\Documents and Settings\po\Mes documents\
C:\Documents and Settings\po\Mes documents\Adobe\Premiere Pro\7.0\
C:\Documents and Settings\po\Mes documents\Adobe\Premiere Pro\7.0\Angeglichene Audiodateien\essai.CFA\
C:\Documents and Settings\po\Mes documents\Adobe\Premiere Pro\7.0\Layouts\
C:\Documents and Settings\po\Mes documents\chachamail\
C:\Documents and Settings\po\Mes documents\chachamail\a queer zine tale\
C:\Documents and Settings\po\Mes documents\chachamail\cantine mautes\
C:\Documents and Settings\po\Mes documents\chachamail\montreal\
C:\Documents and Settings\po\Mes documents\chachamail\photos corine\
C:\Documents and Settings\po\Mes documents\chachamail\raphael\
C:\Documents and Settings\po\Mes documents\Ma musique\
C:\Documents and Settings\po\Mes documents\Ma musique\Artiste inconnu\Album inconnu (01-01-2009 16-54-43)\
C:\Documents and Settings\po\Mes documents\Ma musique\Artiste inconnu\Album inconnu (01-10-2008 19-58-05)\
C:\Documents and Settings\po\Mes documents\Mes images\
C:\Documents and Settings\po\Mes documents\Mes vidéos\
C:\Documents and Settings\po\Modèles\
C:\Documents and Settings\po\Recent\
C:\Documents and Settings\po\SendTo\
C:\Documents and Settings\po\UserData\
C:\Program Files\Adobe\Acrobat 7.0\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Activation\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Activation\da_DK\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Activation\de_DE\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Activation\en_IE\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Activation\en_US\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Activation\es_ES\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Activation\fi_FI\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Activation\fr_FR\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Activation\it_IT\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Activation\ja_JP\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Activation\ko_KR\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Activation\nl_NL\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Activation\no_NO\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Activation\PrivacyStatements\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Activation\pt_BR\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Activation\sv_SE\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Activation\zh_CN\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Activation\zh_TW\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Browser\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\DocTemplates\ENU\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\HowTo\ENU\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\HowTo\ENU\Images\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Javascripts\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Legal\Adobe Acrobat\7.0.0\da_DK\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Legal\Adobe Acrobat\7.0.0\de_DE\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Legal\Adobe Acrobat\7.0.0\en_GB\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Legal\Adobe Acrobat\7.0.0\en_US\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Legal\Adobe Acrobat\7.0.0\es_ES\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Legal\Adobe Acrobat\7.0.0\fi_FI\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Legal\Adobe Acrobat\7.0.0\fr_FR\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Legal\Adobe Acrobat\7.0.0\it_IT\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Legal\Adobe Acrobat\7.0.0\ja_JP\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Legal\Adobe Acrobat\7.0.0\ko_KR\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Legal\Adobe Acrobat\7.0.0\nl_NL\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Legal\Adobe Acrobat\7.0.0\no_NO\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Legal\Adobe Acrobat\7.0.0\pt_BR\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Legal\Adobe Acrobat\7.0.0\sv_SE\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Legal\Adobe Acrobat\7.0.0\zh_CN\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Legal\Adobe Acrobat\7.0.0\zh_TW\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\PalmPilot\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\AcroForm\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\AcroForm\PMP\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\Annotations\Stamps\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\Annotations\Stamps\ENU\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\ImageViewer\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\ImageViewer\en_US\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\Multimedia\MPP\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\PaperCapture\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\PaperCapture\Server\Roman\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\PaperCapture\Server\Roman\Configs\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\PaperCapture\Server\Roman\Dbase\PJCR\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\PaperCapture\Server\Roman\Dbase\PJCRCOMM\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\PaperCapture\Server\Roman\Dictionaries\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\PictureTasks\HowTo\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\PictureTasks\HowTo\Images\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\PictureTasks\OLS\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\PictureTasks\OLS\Locale\ENU\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\PictureTasks\Templates\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\Preflight\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\Preflight\OutputIntent\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\SaveAsXML\DeveloperInfo\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\SaveAsXML\MappingTables\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\Tablepicker\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\VDKHome\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\VDKHome\ENU\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins3d\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Sequences\ENU\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\SPPlugins\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Updater\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\WebSearch\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat Elements\
C:\Program Files\Adobe\Acrobat 7.0\ActiveX\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\cfg\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\ConvertIFD\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\Documentation\EN\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\cfg\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\objects\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\objects\barcodes\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\objects\custom\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\objects\standard\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Dunning Notice\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Dunning Notice\Data\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Dunning Notice\Forms\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Dunning Notice\Images\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Dunning Notice\Outputs\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\E-Ticket\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\E-Ticket\Data\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\E-Ticket\Forms\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\E-Ticket\Images\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\E-Ticket\Outputs\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Grant Application\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Grant Application\Forms\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Purchase Order\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Purchase Order\Dynamic\Data\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Purchase Order\Dynamic\Forms\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Purchase Order\Dynamic\Images\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Purchase Order\Dynamic\Outputs\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Purchase Order\Dynamic Interactive\Forms\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Purchase Order\Dynamic Interactive\Images\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Purchase Order\Interactive\Forms\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Purchase Order\Interactive\Images\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Purchase Order\Schema\Data\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Purchase Order\Schema\Forms\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Purchase Order\Schema\Images\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Purchase Order\Schema\Outputs\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Purchase Order\Schema\Schema\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Scripting\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Scripting\Forms\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\SubformSet\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\SubformSet\Data\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\SubformSet\Forms\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\SubformSet\Outputs\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Tax Receipt\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Tax Receipt\Data\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Tax Receipt\Forms\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Tax Receipt\Images\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Tax Receipt -
voila le rapport.
je sais pas pourquoi mais la recherche a tét arrétée (enfin cest ce que avira raconte car le rapport précise que lanalyse a étét faite integralement.
bref, je relance tout de même puis je ractiverais la restauration système.
encore merci pour ton aide, apparement il nya plus de problème!!
je refais un tour sur le forum demain.
merci :-)
Avira AntiVir Personal
Date de création du fichier de rapport : lundi 2 mars 2009 22:22
La recherche porte sur 1277024 souches de virus.
Détenteur de la licence :Avira AntiVir PersonalEdition Classic
Numéro de série : 0000149996-ADJIE-0001
Plateforme : Windows XP
Version de Windows :(Service Pack 2) [5.1.2600]
Mode Boot : Démarré normalement
Identifiant : po
Nom de l'ordinateur :DUDULE
Informations de version :
BUILD.DAT : 8.2.0.52 16931 Bytes 02/12/2008 14:55:00
AVSCAN.EXE : 8.1.4.10 315649 Bytes 18/11/2008 08:21:00
AVSCAN.DLL : 8.1.4.1 49921 Bytes 21/07/2008 13:44:27
LUKE.DLL : 8.1.4.5 164097 Bytes 12/06/2008 12:44:16
LUKERES.DLL : 8.1.4.0 13057 Bytes 04/07/2008 07:30:27
ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 27/10/2008 11:30:36
ANTIVIR1.VDF : 7.1.2.12 3336192 Bytes 11/02/2009 21:17:22
ANTIVIR2.VDF : 7.1.2.55 248832 Bytes 20/02/2009 21:17:24
ANTIVIR3.VDF : 7.1.2.104 275456 Bytes 02/03/2009 21:17:25
Version du moteur: 8.2.0.98
AEVDF.DLL : 8.1.1.0 106868 Bytes 02/03/2009 21:17:38
AESCRIPT.DLL : 8.1.1.56 352634 Bytes 02/03/2009 21:17:36
AESCN.DLL : 8.1.1.7 127347 Bytes 02/03/2009 21:17:35
AERDL.DLL : 8.1.1.3 438645 Bytes 04/11/2008 13:58:38
AEPACK.DLL : 8.1.3.8 397684 Bytes 02/03/2009 21:17:35
AEOFFICE.DLL : 8.1.0.36 196987 Bytes 02/03/2009 21:17:33
AEHEUR.DLL : 8.1.0.100 1618295 Bytes 02/03/2009 21:17:32
AEHELP.DLL : 8.1.2.2 119158 Bytes 02/03/2009 21:17:29
AEGEN.DLL : 8.1.1.22 336245 Bytes 02/03/2009 21:17:28
AEEMU.DLL : 8.1.0.9 393588 Bytes 14/10/2008 10:05:56
AECORE.DLL : 8.1.6.6 176501 Bytes 02/03/2009 21:17:26
AEBB.DLL : 8.1.0.3 53618 Bytes 14/10/2008 10:05:56
AVWINLL.DLL : 1.0.0.12 15105 Bytes 09/07/2008 08:40:02
AVPREF.DLL : 8.0.2.0 38657 Bytes 16/05/2008 09:27:58
AVREP.DLL : 8.0.0.2 98344 Bytes 31/07/2008 12:02:15
AVREG.DLL : 8.0.0.1 33537 Bytes 09/05/2008 11:26:37
AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:19
AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 12/06/2008 12:27:46
SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02
SMTPLIB.DLL : 1.2.0.23 28929 Bytes 12/06/2008 12:49:36
NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:07
RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 04/07/2008 07:23:16
RCTEXT.DLL : 8.0.52.1 86273 Bytes 17/07/2008 10:08:43
Configuration pour la recherche actuelle :
Nom de la tâche..................: Sélection manuelle
Fichier de configuration.........: C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\PROFILES\folder.avp
Documentation....................: moyen
Action principale................: interactif
Action secondaire................: ignorer
Recherche sur les secteurs d'amorçage maître: marche
Recherche sur les secteurs d'amorçage: marche
Secteurs d'amorçage..............: A:, C:, D:, E:, F:, G:, H:, I:, J:, K:,
Recherche dans les programmes actifs: marche
Recherche en cours sur l'enregistrement: marche
Recherche de Rootkits............: marche
Fichier mode de recherche........: Tous les fichiers
Recherche sur les archives.......: marche
Limiter la profondeur de récursivité: 20
Archive Smart Extensions.........: marche
Heuristique de macrovirus........: marche
Heuristique fichier..............: moyen
Catégories de dangers divergentes: +APPL,+GAME,+JOKE,+PCK,+SPR,
Début de la recherche : lundi 2 mars 2009 22:22
La recherche d'objets cachés commence.
'32497' objets ont été contrôlés, '0' objets cachés ont été trouvés.
La recherche sur les processus démarrés commence :
Processus de recherche 'avscan.exe' - '1' module(s) sont contrôlés
Processus de recherche 'avcenter.exe' - '1' module(s) sont contrôlés
Processus de recherche 'avgnt.exe' - '1' module(s) sont contrôlés
Processus de recherche 'avguard.exe' - '1' module(s) sont contrôlés
Processus de recherche 'sched.exe' - '1' module(s) sont contrôlés
Processus de recherche 'wuauclt.exe' - '1' module(s) sont contrôlés
Processus de recherche 'epmworker.exe' - '1' module(s) sont contrôlés
Processus de recherche 'Generic.exe' - '1' module(s) sont contrôlés
Processus de recherche 'unsecapp.exe' - '1' module(s) sont contrôlés
Processus de recherche 'wmiprvse.exe' - '1' module(s) sont contrôlés
Processus de recherche 'CapabilityManager.exe' - '1' module(s) sont contrôlés
Processus de recherche 'msmsgs.exe' - '1' module(s) sont contrôlés
Processus de recherche 'ctfmon.exe' - '1' module(s) sont contrôlés
Processus de recherche 'Application Launcher.exe' - '1' module(s) sont contrôlés
Processus de recherche 'qttask.exe' - '1' module(s) sont contrôlés
Processus de recherche 'winampa.exe' - '1' module(s) sont contrôlés
Processus de recherche 'acrotray.exe' - '1' module(s) sont contrôlés
Processus de recherche 'nvraidservice.exe' - '1' module(s) sont contrôlés
Processus de recherche 'explorer.exe' - '1' module(s) sont contrôlés
Processus de recherche 'alg.exe' - '1' module(s) sont contrôlés
Processus de recherche 'wdfmgr.exe' - '1' module(s) sont contrôlés
Processus de recherche 'mDNSResponder.exe' - '1' module(s) sont contrôlés
Processus de recherche 'spoolsv.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'lsass.exe' - '1' module(s) sont contrôlés
Processus de recherche 'services.exe' - '1' module(s) sont contrôlés
Processus de recherche 'winlogon.exe' - '1' module(s) sont contrôlés
Processus de recherche 'csrss.exe' - '1' module(s) sont contrôlés
Processus de recherche 'smss.exe' - '1' module(s) sont contrôlés
'33' processus ont été contrôlés avec '33' modules
La recherche sur les secteurs d'amorçage maître commence :
Secteur d'amorçage maître HD0
[INFO] Aucun virus trouvé !
Secteur d'amorçage maître HD1
[INFO] Aucun virus trouvé !
Secteur d'amorçage maître HD2
[INFO] Aucun virus trouvé !
Secteur d'amorçage maître HD3
[INFO] Aucun virus trouvé !
La recherche sur les secteurs d'amorçage commence :
Secteur d'amorçage 'A:\'
[INFO] Aucun support de données inséré dans le lecteur 'A:\' !
Secteur d'amorçage 'C:\'
[INFO] Aucun virus trouvé !
Secteur d'amorçage 'D:\'
[INFO] Aucun virus trouvé !
Secteur d'amorçage 'E:\'
[INFO] Aucun virus trouvé !
Secteur d'amorçage 'H:\'
[INFO] Aucun virus trouvé !
Secteur d'amorçage 'I:\'
[INFO] Aucun virus trouvé !
Secteur d'amorçage 'J:\'
[INFO] Aucun virus trouvé !
Secteur d'amorçage 'K:\'
[INFO] Aucun virus trouvé !
La recherche sur les renvois aux fichiers exécutables (registre) commence.
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\Program Files\Fichiers communs\Ahead\Lib\
C:\WINDOWS\system32\
C:\Program Files\Winamp\
C:\Program Files\Microsoft Office\OFFICE11\
C:\Program Files\Microsoft Office\OFFICE11\
C:\Program Files\Messenger\
C:\Program Files\Messenger\
C:\WINDOWS\inf\
C:\WINDOWS\
C:\WINDOWS\
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\WINDOWS\inf\
C:\WINDOWS\inf\
C:\WINDOWS\inf\
C:\WINDOWS\inf\
C:\WINDOWS\system32\
C:\WINDOWS\inf\
C:\WINDOWS\inf\
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\
C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\
C:\Program Files\Fichiers communs\Adobe\Calibration\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\
C:\WINDOWS\system32\
C:\WINDOWS\system32\
C:\Documents and Settings\po\Menu Démarrer\Programmes\Démarrage\
C:\Documents and Settings\po\Menu Démarrer\Programmes\Démarrage\
C:\WINDOWS\system32\config\systemprofile\Menu Démarrer\Programmes\Démarrage\
Le registre a été contrôlé ( '49' fichiers).
La recherche sur les fichiers sélectionnés commence :
Recherche débutant dans 'A:\'
Impossible d'ouvrir le chemin à contrôler A:\ !
Erreur système [21]: Le périphérique n'est pas prêt.
Recherche débutant dans 'C:\' <systeme>
C:\
C:\pagefile.sys
[AVERTISSEMENT] Impossible d'ouvrir le fichier !
C:\cmdcons\
C:\cmdcons\SYSTEM32\
C:\Documents and Settings\All Users\Application Data\
C:\Documents and Settings\All Users\Application Data\Adobe\Acrobat\7.0\Replicate\Security\
C:\Documents and Settings\All Users\Application Data\Adobe\Adobe PDF\Extras\
C:\Documents and Settings\All Users\Application Data\Adobe\Adobe PDF\Settings\
C:\Documents and Settings\All Users\Application Data\Adobe\InDesign\Version 5.0\Scripting Support\5.0\
C:\Documents and Settings\All Users\Application Data\Adobe\SING\datastore\
C:\Documents and Settings\All Users\Application Data\Adobe Systems\Product licenses\
C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\
C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\EVENTDB\
C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\IDX\
C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\JOBS\
C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\LOGFILES\
C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\PROFILES\
C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\REPORTS\
C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\iPower\
C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\iPower\dynamic\english\images\news_letter\
C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\iPower\dynamic\images\P\
C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\iPower\dynamic\skin_archive\00000021\
C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\iPower\images\
C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\iPower\images\bottom\
C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\iPower\images\bullet\
C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\iPower\images\button\
C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\iPower\images\hd\
C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\iPower\images\left\
C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\iPower\images\right\
C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\iPower\images\top\
C:\Documents and Settings\All Users\Application Data\FLEXnet\
C:\Documents and Settings\All Users\Application Data\Macromedia\Licensing\Licenses\Studio 8.0\
C:\Documents and Settings\All Users\Application Data\Macromedia\Licensing\Products\Contribute 3.0\
C:\Documents and Settings\All Users\Application Data\Macromedia\Licensing\Products\Dreamweaver 8.0\
C:\Documents and Settings\All Users\Application Data\Macromedia\Licensing\Products\Fireworks 8.0\
C:\Documents and Settings\All Users\Application Data\Macromedia\Licensing\Products\Flash 8 Video Encoder 1.0\
C:\Documents and Settings\All Users\Application Data\Macromedia\Licensing\Products\Flash 8.0\
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\S-1-5-18\
C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\
C:\Documents and Settings\All Users\Application Data\Microsoft\Media Index\
C:\Documents and Settings\All Users\Application Data\Microsoft\Media Player\
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Pbk\
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\
C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\DATA\
C:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\
C:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\
C:\Documents and Settings\All Users\Application Data\QuickTime\
C:\Documents and Settings\All Users\Application Data\Recisio\KaraFun\
C:\Documents and Settings\All Users\Application Data\Sony Ericsson\Capability Manager\Data\
C:\Documents and Settings\All Users\Application Data\Sony Ericsson\Mobile\MPM\
C:\Documents and Settings\All Users\Application Data\Sony Ericsson\Sync Station\
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\
C:\Documents and Settings\All Users\Application Data\Teleca\Capability Manager\Applications\
C:\Documents and Settings\All Users\Application Data\Teleca\Capability Manager\Devices\
C:\Documents and Settings\All Users\Application Data\Teleca\Capability Manager\Networks\
C:\Documents and Settings\All Users\Application Data\Teleca\DM\DEVREP\
C:\Documents and Settings\All Users\Application Data\Teleca\Tlib\Logging\
C:\Documents and Settings\All Users\Application Data\TEMP
C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage\data\
C:\Documents and Settings\All Users\Application Data\Yahoo! Companion\Data\default\
C:\Documents and Settings\All Users\Application Data\Yahoo! Companion\Data\fr-FR\
C:\Documents and Settings\All Users\Application Data\Yahoo! Companion\Data\paulinepayen\
C:\Documents and Settings\All Users\Application Data\Yahoo! Companion\Icons\
C:\Documents and Settings\All Users\Application Data\Yahoo! Companion\Media\
C:\Documents and Settings\All Users\Bureau\
C:\Documents and Settings\All Users\Documents\
C:\Documents and Settings\All Users\Documents\Adobe PDF\Data\
C:\Documents and Settings\All Users\Documents\Adobe PDF\Example Files\
C:\Documents and Settings\All Users\Documents\Adobe PDF\Extras\
C:\Documents and Settings\All Users\Documents\Adobe PDF\Settings\
C:\Documents and Settings\All Users\Documents\Adobe PDF\Startup\
C:\Documents and Settings\All Users\Documents\Ma musique\
C:\Documents and Settings\All Users\Documents\Ma musique\My Playlists\
C:\Documents and Settings\All Users\Documents\Ma musique\Sample Playlists\00160BEB\
C:\Documents and Settings\All Users\Documents\Ma musique\Échantillons de musique\
C:\Documents and Settings\All Users\Documents\Mes images\
C:\Documents and Settings\All Users\Documents\Mes images\Échantillons d'images\
C:\Documents and Settings\All Users\Documents\Mes vidéos\
C:\Documents and Settings\All Users\DRM\
C:\Documents and Settings\All Users\Menu Démarrer\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Accessoires\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Accessoires\Accessibilité\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Accessoires\Communications\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Accessoires\Divertissement\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Accessoires\Outils système\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Adobe Design Premium CS3\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\AntiVir PersonalEdition Classic\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Avid\FatalErrorReports\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Barre d'outils Crawler\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\CyberLink PowerDVD\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\DivX\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\DivX\DivX Player\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\DivX\DivX Player\Liens\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\DivX\DivX Web Player\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\DivX\Liens\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Jeux\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\KaraFun\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Microsoft Office\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Microsoft Office\Outils Microsoft Office\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Nero 7 Ultra Edition\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Nero 7 Ultra Edition\audio\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Nero 7 Ultra Edition\données\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Nero 7 Ultra Edition\Jouer\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Nero 7 Ultra Edition\Manuels\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Nero 7 Ultra Edition\Outils\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Nero 7 Ultra Edition\Partager\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Nero 7 Ultra Edition\Photo et vidéo\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Nero 7 Ultra Edition\Étiquettes\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\NVIDIA Corporation\NvMixer\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\NVIDIA Corporation\RAID Manager\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Outils d'administration\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\QuickTime\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Sony Ericsson\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\VideoLAN\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\WinRAR\
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\WinZip\
C:\Documents and Settings\Default User\
C:\Documents and Settings\Default User\Application Data\
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\
C:\Documents and Settings\Default User\Local Settings\
C:\Documents and Settings\Default User\Local Settings\Historique\
C:\Documents and Settings\Default User\Local Settings\Historique\History.IE5\
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\C96BKXEN\
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\CPURWPY3\
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\OH67GDAV\
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\S52R4PIN\
C:\Documents and Settings\Default User\Menu Démarrer\
C:\Documents and Settings\Default User\Menu Démarrer\Programmes\
C:\Documents and Settings\Default User\Menu Démarrer\Programmes\Accessoires\
C:\Documents and Settings\Default User\Menu Démarrer\Programmes\Accessoires\Accessibilité\
C:\Documents and Settings\Default User\Menu Démarrer\Programmes\Accessoires\Divertissement\
C:\Documents and Settings\Default User\Menu Démarrer\Programmes\Démarrage\
C:\Documents and Settings\Default User\Modèles\
C:\Documents and Settings\Default User\SendTo\
C:\Documents and Settings\LocalService\
C:\Documents and Settings\LocalService\NTUSER.DAT
[AVERTISSEMENT] Impossible d'ouvrir le fichier !
C:\Documents and Settings\LocalService\ntuser.dat.LOG
[AVERTISSEMENT] Impossible d'ouvrir le fichier !
C:\Documents and Settings\LocalService\Cookies\
C:\Documents and Settings\LocalService\Local Settings\
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
[AVERTISSEMENT] Impossible d'ouvrir le fichier !
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG
[AVERTISSEMENT] Impossible d'ouvrir le fichier !
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows Media\9.0\
C:\Documents and Settings\LocalService\Local Settings\Historique\
C:\Documents and Settings\LocalService\Local Settings\Historique\History.IE5\
C:\Documents and Settings\LocalService\Local Settings\temp\Cookies\
C:\Documents and Settings\LocalService\Local Settings\temp\Historique\History.IE5\
C:\Documents and Settings\LocalService\Local Settings\temp\Temporary Internet Files\Content.IE5\
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\
C:\Documents and Settings\LocalService\Menu Démarrer\Programmes\
C:\Documents and Settings\NetworkService\
C:\Documents and Settings\NetworkService\NTUSER.DAT
[AVERTISSEMENT] Impossible d'ouvrir le fichier !
C:\Documents and Settings\NetworkService\ntuser.dat.LOG
[AVERTISSEMENT] Impossible d'ouvrir le fichier !
C:\Documents and Settings\NetworkService\Local Settings\
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
[AVERTISSEMENT] Impossible d'ouvrir le fichier !
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG
[AVERTISSEMENT] Impossible d'ouvrir le fichier !
C:\Documents and Settings\NetworkService\Local Settings\Historique\
C:\Documents and Settings\NetworkService\Local Settings\Historique\History.IE5\
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\
C:\Documents and Settings\po\
C:\Documents and Settings\po\NTUSER.DAT
[AVERTISSEMENT] Impossible d'ouvrir le fichier !
C:\Documents and Settings\po\ntuser.dat.LOG
[AVERTISSEMENT] Impossible d'ouvrir le fichier !
C:\Documents and Settings\po\Application Data\
C:\Documents and Settings\po\Application Data\Adobe\Acrobat\7.0\
C:\Documents and Settings\po\Application Data\Adobe\Acrobat\7.0\Collab\
C:\Documents and Settings\po\Application Data\Adobe\Acrobat\7.0\JavaScripts\
C:\Documents and Settings\po\Application Data\Adobe\Acrobat\7.0\organizer70\
C:\Documents and Settings\po\Application Data\Adobe\Acrobat\7.0\Preferences\
C:\Documents and Settings\po\Application Data\Adobe\Acrobat\7.0\Updater\
C:\Documents and Settings\po\Application Data\Adobe\Acrobat\Distiller 7\
C:\Documents and Settings\po\Application Data\Adobe\Acrobat\Distiller 7\Cache\
C:\Documents and Settings\po\Application Data\Adobe\Designer\
C:\Documents and Settings\po\Application Data\Adobe\Designer\en\
C:\Documents and Settings\po\Application Data\Adobe\Designer\en\objects\
C:\Documents and Settings\po\Application Data\Adobe\Designer\en\objects\barcodes\
C:\Documents and Settings\po\Application Data\Adobe\Designer\en\objects\custom\
C:\Documents and Settings\po\Application Data\Adobe\Designer\en\objects\standard\
C:\Documents and Settings\po\Application Data\Adobe\Designer\en\Templates\
C:\Documents and Settings\po\Application Data\Adobe\Designer\en\Templates\Sample\
C:\Documents and Settings\po\Application Data\Adobe\Designer\en\Templates\Standard\
C:\Documents and Settings\po\Application Data\Adobe\FileBrowser\Photoshop7\
C:\Documents and Settings\po\Application Data\Adobe\Flash Player\AssetCache\PDLWPNFF\
C:\Documents and Settings\po\Application Data\Adobe\ImageReady\7.0\Paramètres\
C:\Documents and Settings\po\Application Data\Adobe\ImageReady\7.0\Paramètres\ImageReady Actions\
C:\Documents and Settings\po\Application Data\Adobe\InDesign\Version 5.0\
C:\Documents and Settings\po\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\brt\
C:\Documents and Settings\po\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\eng\
C:\Documents and Settings\po\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\frn\
C:\Documents and Settings\po\Application Data\Adobe\Photoshop\7.0\Adobe Photoshop 7.0 Settings\
C:\Documents and Settings\po\Application Data\Adobe\Photoshop\7.0\Paramètres Adobe Photoshop 7.0\
C:\Documents and Settings\po\Application Data\Adobe\Premiere Pro\7.0\
C:\Documents and Settings\po\Application Data\Adobe\Workflow\
C:\Documents and Settings\po\Application Data\Ahead\
C:\Documents and Settings\po\Application Data\Ahead\Nero BackItUp\
C:\Documents and Settings\po\Application Data\Ahead\Nero BackItUp\Cache\
C:\Documents and Settings\po\Application Data\Ahead\Nero Burning ROM\
C:\Documents and Settings\po\Application Data\dvdcss\
C:\Documents and Settings\po\Application Data\dvdcss\DROIT_DE_VIVRE-2004101811425800-ba63dd6c4f\
C:\Documents and Settings\po\Application Data\dvdcss\DS_JONZE_A-2004022314370000-10dd2ba5fd\
C:\Documents and Settings\po\Application Data\dvdcss\DS_JONZE_B-2003110612324200-10dd2ec710\
C:\Documents and Settings\po\Application Data\dvdcss\DVD_VIDEO-2006111119102500-61088fa532\
C:\Documents and Settings\po\Application Data\dvdcss\DVD_VIDEO-2006111312031500-82305be499\
C:\Documents and Settings\po\Application Data\dvdcss\EC_100465-2002071520175300-9060efa6fd\
C:\Documents and Settings\po\Application Data\dvdcss\EC_110271-0000000000000000-2e97321f22\
C:\Documents and Settings\po\Application Data\dvdcss\EU_109950-2002090620003100-549233682b\
C:\Documents and Settings\po\Application Data\dvdcss\FARGO_KIOSK_D125-2003112019484500-2e97321f22\
C:\Documents and Settings\po\Application Data\dvdcss\FEDERICO_SCN-2003080512063100-07aef40a64\
C:\Documents and Settings\po\Application Data\dvdcss\FRISSONS_DE_L_ANGOISSE_DVD1-2004061618093700-ba63dd6c4f\
C:\Documents and Settings\po\Application Data\dvdcss\FUTURAMA_SEASON3_DISC1-2003040212310900-0000000397\
C:\Documents and Settings\po\Application Data\dvdcss\GOODNIGHT-2006072112032000-0bcf1ffdfa\
C:\Documents and Settings\po\Application Data\dvdcss\INDEX_004-2004100315091300-3c1dd3a3a9\
C:\Documents and Settings\po\Application Data\dvdcss\JULES_ET_JIM-2007062710195600-0005f5e107\
C:\Documents and Settings\po\Application Data\dvdcss\LA_BOITE_NOIRE-2006033112294200-ba63dd6c4f\
C:\Documents and Settings\po\Application Data\dvdcss\LE_DECALOGUE_1-2003122316181500-000000026c\
C:\Documents and Settings\po\Application Data\dvdcss\LE_DECALOGUE_2-2003122313014600-0000000262\
C:\Documents and Settings\po\Application Data\dvdcss\LUCIA_Y_EL_SEXO-2005100613305400-000061bbc0\
C:\Documents and Settings\po\Application Data\dvdcss\MULHOLLAND_DRIVE-0000000000000000-ba63dd6c4f\
C:\Documents and Settings\po\Application Data\dvdcss\OLDBOY_DISQUE_1-0000000000000000-ba63dd6c4f\
C:\Documents and Settings\po\Application Data\dvdcss\PERFECT_WORLD_D4-2002093012264000-0000000a1b\
C:\Documents and Settings\po\Application Data\dvdcss\WHO_FRAMED_ROGER_RABBIT-2003021812561600-000000000b\
C:\Documents and Settings\po\Application Data\dvdcss\WHO_FRAMED_ROGER_RABBIT-2003021818004600-2e97321f48\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\beacon.sina.com.cn\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\bin.clearspring.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\broadcast.piximedia.fr\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\cache.reverbnation.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\cache.reverbnation.com\widgets\serve_unprotected\28\widget.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\cache.reverbnation.com\widgets\swf\31\widgetPlayerMicro.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\cdn.widgetserver.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\d.scribd.com\ScribdViewer.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\e.blip.tv\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\embed.hobnox.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\flash.gydget.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\flash.quantserve.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\googleads.g.doubleclick.net\pagead\googleadplayer.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\images.video.msn.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\js.tudouui.com\bin\player_online\TudouVideoPlayer_Homer_38.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\lads.myspace.com\videos\Main.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\lads.myspace.com\videos\vplayer.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\login.yahoo.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\media.mtvu.com\global\apps\player\flex\Loader.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\media.mtvu.com\global\apps\player\gui\com\mtvnservices\media\player\gui\FFMod.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\media.mtvu.com\IMPORT\media.mtvnservices.com\player\release\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\pan.fotovista.com\pixmania\grafx\fr\fr\home_univers\player\player5.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\pan4.fotovista.com\pixmania\grafx\multipays\flashAS\Bann_580_100.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\pan5.fotovista.com\pixmania\grafx\multipays\flashAS\Bann_580_100.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\pan6.fotovista.com\pixmania\grafx\multipays\flashAS\Bann_580_100.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\pan7.fotovista.com\pixmania\grafx\multipays\flashAS\Bann_580_100.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\pan9.fotovista.com\pixmania\grafx\multipays\flashAS\Bann_580_100.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\pixmania.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\pub.widgetbox.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\pubhdstats2.msvp.net\campagnes\2004\RC.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\s.ytimg.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\serving-sys.com\BurstingRes\Site-4318\Type-2\AC776433-D982-4C19-A9C0-93D213629BD3.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\slide.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\static.wix.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\static.youku.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\tubemogul.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\video.google.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\video.google.com\googleplayer.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\www.56.com\flashApp\v_player_site_wide.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\www.blogger.com\img\videoplayer.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\www.dailymotion.com\flash\dmplayer\dmplayer-fr.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\www.deezer.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\www.he.playlist.com\mc\mp3player_new.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\www.pixmania.com\dev\gui_web\shopping\flashAS\Bann_580_100.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\www.pixmania.com\dev\gui_web\shopping\flashAS\Mac_180_150.swf\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\www.youtube.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\#SharedObjects\YX2Q6P7P\wwwstatic.megavideo.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\localhost\Documents and Settings\po\Application Data\Macromedia\Flash MX\Configuration\AnswersPanel\answers.swf\#FlashMX\answers\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#beacon.sina.com.cn\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#broadcast.piximedia.fr\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#cache.reverbnation.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#cdn.widgetserver.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#d.scribd.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#e.blip.tv\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#embed.hobnox.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#facebook.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#flash.gydget.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#flash.quantserve.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#googleads.g.doubleclick.net\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#images.video.msn.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#js.tudouui.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#lads.myspace.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#local\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#login.yahoo.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#macromedia.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#media.mtvu.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#pan.fotovista.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#pan4.fotovista.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#pan5.fotovista.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#pan6.fotovista.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#pan7.fotovista.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#pan9.fotovista.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#pixmania.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#pub.widgetbox.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#pubhdstats2.msvp.net\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#resources-p2.imeem.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#rutube.ru\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#s.ytimg.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#serving-sys.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#slide.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#static.wix.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#static.youku.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#tubemogul.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#video.google.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#widgets.clearspring.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.56.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.blogger.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.dailymotion.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.deezer.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.he.playlist.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.pixmania.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.youtube.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#wwwstatic.megavideo.com\
C:\Documents and Settings\po\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\
C:\Documents and Settings\po\Application Data\Media Player Classic\
C:\Documents and Settings\po\Application Data\Microsoft\Address Book\
C:\Documents and Settings\po\Application Data\Microsoft\Clip Organizer\
C:\Documents and Settings\po\Application Data\Microsoft\CryptnetUrlCache\Content\
C:\Documents and Settings\po\Application Data\Microsoft\CryptnetUrlCache\MetaData\
C:\Documents and Settings\po\Application Data\Microsoft\Crypto\RSA\S-1-5-21-602162358-796845957-725345543-1003\
C:\Documents and Settings\po\Application Data\Microsoft\HTML Help\
C:\Documents and Settings\po\Application Data\Microsoft\Installer\{547D4265-AF45-42E9-A62A-C58182AA35B9}\
C:\Documents and Settings\po\Application Data\Microsoft\Installer\{88D422DB-E9C7-4E16-9D80-2999F4FD6AD9}\
C:\Documents and Settings\po\Application Data\Microsoft\Internet Explorer\
C:\Documents and Settings\po\Application Data\Microsoft\Internet Explorer\Quick Launch\
C:\Documents and Settings\po\Application Data\Microsoft\Media Player\
C:\Documents and Settings\po\Application Data\Microsoft\MMC\
C:\Documents and Settings\po\Application Data\Microsoft\Office\
C:\Documents and Settings\po\Application Data\Microsoft\Office\Récent\
C:\Documents and Settings\po\Application Data\Microsoft\PowerPoint\
C:\Documents and Settings\po\Application Data\Microsoft\Protect\
C:\Documents and Settings\po\Application Data\Microsoft\Protect\S-1-5-21-602162358-796845957-725345543-1003\
C:\Documents and Settings\po\Application Data\Microsoft\Windows\Themes\
C:\Documents and Settings\po\Application Data\Microsoft\Épreuve\
C:\Documents and Settings\po\Application Data\OpenOffice.org2\user\autotext\
C:\Documents and Settings\po\Application Data\OpenOffice.org2\user\basic\
C:\Documents and Settings\po\Application Data\OpenOffice.org2\user\basic\Standard\
C:\Documents and Settings\po\Application Data\OpenOffice.org2\user\config\
C:\Documents and Settings\po\Application Data\OpenOffice.org2\user\config\imagecache\
C:\Documents and Settings\po\Application Data\OpenOffice.org2\user\config\soffice.cfg\global\accelerator\fr\
C:\Documents and Settings\po\Application Data\OpenOffice.org2\user\config\soffice.cfg\modules\swriter\accelerator\fr\
C:\Documents and Settings\po\Application Data\OpenOffice.org2\user\database\
C:\Documents and Settings\po\Application Data\OpenOffice.org2\user\database\biblio\
C:\Documents and Settings\po\Application Data\OpenOffice.org2\user\gallery\
C:\Documents and Settings\po\Application Data\OpenOffice.org2\user\registry\cache\
C:\Documents and Settings\po\Application Data\OpenOffice.org2\user\registry\data\org\openoffice\
C:\Documents and Settings\po\Application Data\OpenOffice.org2\user\registry\data\org\openoffice\Office\
C:\Documents and Settings\po\Application Data\OpenOffice.org2\user\registry\data\org\openoffice\Office\UI\
C:\Documents and Settings\po\Application Data\Sony Ericsson\Teleca\Telecalib\Logging\
C:\Documents and Settings\po\Application Data\Sony Ericsson\Teleca\Telecalib\Logging\Application logs\
C:\Documents and Settings\po\Application Data\Teleca\DM\DEVREP\
C:\Documents and Settings\po\Application Data\Teleca\Telecalib\Logging\
C:\Documents and Settings\po\Application Data\Teleca\Telecalib\Logging\Application logs\
C:\Documents and Settings\po\Application Data\vlc\
C:\Documents and Settings\po\Application Data\vlc\cache\
C:\Documents and Settings\po\Bureau\
C:\Documents and Settings\po\Bureau\ComboFix.exe
[0] Type d'archive: RAR SFX (self extracting)
--> 32788R22FWJFW\psexec.cfexe
[1] Type d'archive: RSRC
--> Object
[RESULTAT] Contient le modèle de détection de l'application APPL/PsExec.E
[AVERTISSEMENT] Impossible de réparer les fichiers dans les archives
[AVERTISSEMENT] Fichier ignoré.
C:\Documents and Settings\po\Bureau\Flash_Disinfector.exe
[0] Type d'archive: RAR SFX (self extracting)
--> nircmd.exe
[RESULTAT] Contient le modèle de détection de l'application APPL/NirCmd.2
[RESULTAT] Contient le modèle de détection du ver WORM/Generic.4084
[AVERTISSEMENT] Fichier ignoré.
C:\Documents and Settings\po\Bureau\APPLICATION CALL!\
C:\Documents and Settings\po\Bureau\Nouveau dossier\
C:\Documents and Settings\po\Cookies\
C:\Documents and Settings\po\Favoris\
C:\Documents and Settings\po\Favoris\Liens\
C:\Documents and Settings\po\Local Settings\
C:\Documents and Settings\po\Local Settings\Application Data\
C:\Documents and Settings\po\Local Settings\Application Data\Adobe\Acrobat\7.0\Cache\
C:\Documents and Settings\po\Local Settings\Application Data\Adobe\Color\
C:\Documents and Settings\po\Local Settings\Application Data\Adobe\Fonts\
C:\Documents and Settings\po\Local Settings\Application Data\Adobe\InDesign\Version 5.0\Caches\
C:\Documents and Settings\po\Local Settings\Application Data\Adobe\InDesign\Version 5.0\Caches\InDesign Recovery\
C:\Documents and Settings\po\Local Settings\Application Data\Adobe\InDesign\Version 5.0\Caches\Scripting Support\5.0\
C:\Documents and Settings\po\Local Settings\Application Data\Adobe\TypeSpt\
C:\Documents and Settings\po\Local Settings\Application Data\Adobe\TypeSupport\
C:\Documents and Settings\po\Local Settings\Application Data\Adobe\TypeSupport\CMaps\
C:\Documents and Settings\po\Local Settings\Application Data\Ahead\Nero Home\
C:\Documents and Settings\po\Local Settings\Application Data\Ahead\Nero Home\idx\
C:\Documents and Settings\po\Local Settings\Application Data\Ahead\Nero StartSmart\cache\
C:\Documents and Settings\po\Local Settings\Application Data\Identities\{ED548CCE-67E9-4AE6-9BF0-985772535C53}\Microsoft\Outlook Express\
C:\Documents and Settings\po\Local Settings\Application Data\Macromedia\Flash 8\fr\Configuration\
C:\Documents and Settings\po\Local Settings\Application Data\Macromedia\Flash 8\fr\Configuration\Debugger\
C:\Documents and Settings\po\Local Settings\Application Data\Microsoft\
C:\Documents and Settings\po\Local Settings\Application Data\Microsoft\HelpCtr\
C:\Documents and Settings\po\Local Settings\Application Data\Microsoft\Internet Explorer\
C:\Documents and Settings\po\Local Settings\Application Data\Microsoft\Media Player\
C:\Documents and Settings\po\Local Settings\Application Data\Microsoft\Windows\
C:\Documents and Settings\po\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
[AVERTISSEMENT] Impossible d'ouvrir le fichier !
C:\Documents and Settings\po\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG
[AVERTISSEMENT] Impossible d'ouvrir le fichier !
C:\Documents and Settings\po\Local Settings\Application Data\Microsoft\Windows Media\10.0\
C:\Documents and Settings\po\Local Settings\Application Data\Microsoft\Windows Media\9.0\
C:\Documents and Settings\po\Local Settings\Historique\
C:\Documents and Settings\po\Local Settings\Historique\History.IE5\
C:\Documents and Settings\po\Local Settings\Historique\History.IE5\MSHist012009020920090216\
C:\Documents and Settings\po\Local Settings\Historique\History.IE5\MSHist012009021620090223\
C:\Documents and Settings\po\Local Settings\Historique\History.IE5\MSHist012009022320090302\
C:\Documents and Settings\po\Local Settings\Historique\History.IE5\MSHist012009030220090303\
C:\Documents and Settings\po\Local Settings\Temporary Internet Files\
C:\Documents and Settings\po\Local Settings\Temporary Internet Files\Content.IE5\
C:\Documents and Settings\po\Local Settings\Temporary Internet Files\Content.IE5\0RMLU589\
C:\Documents and Settings\po\Local Settings\Temporary Internet Files\Content.IE5\41C5OBC5\
C:\Documents and Settings\po\Local Settings\Temporary Internet Files\Content.IE5\6LQH0HMV\
C:\Documents and Settings\po\Local Settings\Temporary Internet Files\Content.IE5\A9U5MNW9\
C:\Documents and Settings\po\Local Settings\Temporary Internet Files\Content.IE5\G7Y3QAKW\
C:\Documents and Settings\po\Local Settings\Temporary Internet Files\Content.IE5\MBIL2JGZ\
C:\Documents and Settings\po\Local Settings\Temporary Internet Files\Content.IE5\MBIL2JGZ\LegitCheckControl[1].cab
[0] Type d'archive: CAB (Microsoft)
--> LegitCheckControl.dll
[REMARQUE] L'en-tête d'archive est défectueux
--> LegitCheckControl.inf
[AVERTISSEMENT] Aucun autre fichier n'a pu être décompressé de cette archive. L'archive est refermée.
C:\Documents and Settings\po\Local Settings\Temporary Internet Files\Content.IE5\P4S018RH\
C:\Documents and Settings\po\Local Settings\Temporary Internet Files\Content.IE5\UGHZ7I1J\
C:\Documents and Settings\po\Menu Démarrer\
C:\Documents and Settings\po\Menu Démarrer\Programmes\
C:\Documents and Settings\po\Menu Démarrer\Programmes\Accessoires\
C:\Documents and Settings\po\Menu Démarrer\Programmes\Accessoires\Accessibilité\
C:\Documents and Settings\po\Menu Démarrer\Programmes\Accessoires\Divertissement\
C:\Documents and Settings\po\Menu Démarrer\Programmes\Démarrage\
C:\Documents and Settings\po\Menu Démarrer\Programmes\Outils d'administration\
C:\Documents and Settings\po\Menu Démarrer\Programmes\Winamp\
C:\Documents and Settings\po\Menu Démarrer\Programmes\WinRAR\
C:\Documents and Settings\po\Menu Démarrer\Programmes\X Codec Pack\
C:\Documents and Settings\po\Mes documents\
C:\Documents and Settings\po\Mes documents\Adobe\Premiere Pro\7.0\
C:\Documents and Settings\po\Mes documents\Adobe\Premiere Pro\7.0\Angeglichene Audiodateien\essai.CFA\
C:\Documents and Settings\po\Mes documents\Adobe\Premiere Pro\7.0\Layouts\
C:\Documents and Settings\po\Mes documents\chachamail\
C:\Documents and Settings\po\Mes documents\chachamail\a queer zine tale\
C:\Documents and Settings\po\Mes documents\chachamail\cantine mautes\
C:\Documents and Settings\po\Mes documents\chachamail\montreal\
C:\Documents and Settings\po\Mes documents\chachamail\photos corine\
C:\Documents and Settings\po\Mes documents\chachamail\raphael\
C:\Documents and Settings\po\Mes documents\Ma musique\
C:\Documents and Settings\po\Mes documents\Ma musique\Artiste inconnu\Album inconnu (01-01-2009 16-54-43)\
C:\Documents and Settings\po\Mes documents\Ma musique\Artiste inconnu\Album inconnu (01-10-2008 19-58-05)\
C:\Documents and Settings\po\Mes documents\Mes images\
C:\Documents and Settings\po\Mes documents\Mes vidéos\
C:\Documents and Settings\po\Modèles\
C:\Documents and Settings\po\Recent\
C:\Documents and Settings\po\SendTo\
C:\Documents and Settings\po\UserData\
C:\Program Files\Adobe\Acrobat 7.0\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Activation\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Activation\da_DK\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Activation\de_DE\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Activation\en_IE\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Activation\en_US\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Activation\es_ES\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Activation\fi_FI\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Activation\fr_FR\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Activation\it_IT\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Activation\ja_JP\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Activation\ko_KR\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Activation\nl_NL\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Activation\no_NO\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Activation\PrivacyStatements\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Activation\pt_BR\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Activation\sv_SE\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Activation\zh_CN\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Activation\zh_TW\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Browser\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\DocTemplates\ENU\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\HowTo\ENU\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\HowTo\ENU\Images\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Javascripts\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Legal\Adobe Acrobat\7.0.0\da_DK\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Legal\Adobe Acrobat\7.0.0\de_DE\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Legal\Adobe Acrobat\7.0.0\en_GB\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Legal\Adobe Acrobat\7.0.0\en_US\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Legal\Adobe Acrobat\7.0.0\es_ES\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Legal\Adobe Acrobat\7.0.0\fi_FI\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Legal\Adobe Acrobat\7.0.0\fr_FR\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Legal\Adobe Acrobat\7.0.0\it_IT\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Legal\Adobe Acrobat\7.0.0\ja_JP\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Legal\Adobe Acrobat\7.0.0\ko_KR\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Legal\Adobe Acrobat\7.0.0\nl_NL\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Legal\Adobe Acrobat\7.0.0\no_NO\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Legal\Adobe Acrobat\7.0.0\pt_BR\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Legal\Adobe Acrobat\7.0.0\sv_SE\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Legal\Adobe Acrobat\7.0.0\zh_CN\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Legal\Adobe Acrobat\7.0.0\zh_TW\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\PalmPilot\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\AcroForm\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\AcroForm\PMP\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\Annotations\Stamps\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\Annotations\Stamps\ENU\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\ImageViewer\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\ImageViewer\en_US\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\Multimedia\MPP\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\PaperCapture\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\PaperCapture\Server\Roman\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\PaperCapture\Server\Roman\Configs\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\PaperCapture\Server\Roman\Dbase\PJCR\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\PaperCapture\Server\Roman\Dbase\PJCRCOMM\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\PaperCapture\Server\Roman\Dictionaries\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\PictureTasks\HowTo\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\PictureTasks\HowTo\Images\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\PictureTasks\OLS\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\PictureTasks\OLS\Locale\ENU\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\PictureTasks\Templates\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\Preflight\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\Preflight\OutputIntent\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\SaveAsXML\DeveloperInfo\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\SaveAsXML\MappingTables\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\Tablepicker\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\VDKHome\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins\VDKHome\ENU\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\plug_ins3d\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Sequences\ENU\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\SPPlugins\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Updater\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\WebSearch\
C:\Program Files\Adobe\Acrobat 7.0\Acrobat Elements\
C:\Program Files\Adobe\Acrobat 7.0\ActiveX\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\cfg\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\ConvertIFD\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\Documentation\EN\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\cfg\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\objects\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\objects\barcodes\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\objects\custom\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\objects\standard\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Dunning Notice\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Dunning Notice\Data\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Dunning Notice\Forms\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Dunning Notice\Images\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Dunning Notice\Outputs\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\E-Ticket\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\E-Ticket\Data\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\E-Ticket\Forms\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\E-Ticket\Images\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\E-Ticket\Outputs\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Grant Application\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Grant Application\Forms\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Purchase Order\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Purchase Order\Dynamic\Data\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Purchase Order\Dynamic\Forms\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Purchase Order\Dynamic\Images\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Purchase Order\Dynamic\Outputs\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Purchase Order\Dynamic Interactive\Forms\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Purchase Order\Dynamic Interactive\Images\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Purchase Order\Interactive\Forms\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Purchase Order\Interactive\Images\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Purchase Order\Schema\Data\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Purchase Order\Schema\Forms\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Purchase Order\Schema\Images\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Purchase Order\Schema\Outputs\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Purchase Order\Schema\Schema\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Scripting\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Scripting\Forms\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\SubformSet\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\SubformSet\Data\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\SubformSet\Forms\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\SubformSet\Outputs\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Tax Receipt\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Tax Receipt\Data\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Tax Receipt\Forms\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Tax Receipt\Images\
C:\Program Files\Adobe\Acrobat 7.0\Designer 7.0\EN\Samples\Tax Receipt -
Contributeur sécuritéRe,
A)- Laisse tomber BitDefender.
As-tu le nom de ce logiciel qu'on te demande d'acheter ?
B)- Remplacement de AVAST
Tu peux désinstaller avast par le “Panneau de configuration” / “Ajout-suppression de programmes”.
Si ça ne marche pas, il y a aussi (au cas où, mais normalement pas besoin) cet utilitaire officiel :
https://www.avast.com/fr-fr/uninstall-utility
Au besoin en mode sans échec.
C)- Installe ANTIVIR gratuit
Pour Antivir voici un lien de téléchargement direct (version en français) :
http://dl1.avgate.net/down/windows/antivir_workstation_winu_fr_h.exe
Tuto sur la version 8 française : http://www.libellules.ch/tuto_antivir.php
L'analyse:
- Lancer Antivir en Scan complet (analyse avancée) en faisant un click-droit sur l’icône d’Antivir dans la « barre des taches » en bas à droite (= Systray, à côté de l’horloge) puis clic sur « start Antivir »
- Cliquer sur l’onglet « scanner »
- Vérifier pour « RootKit search » et « Manuelle détection » (en développant avec la petite croix devant chacun d'eux) que tous les disques durs soient bien cochés, puis cliquer sur la loupe (en dessous de statut) .
(Note : Pour activer l'antirootkit : aller dans CONFIGURATION puis EXPERT MODE puis SCAN et cocher la case SEARCH FOR ROOTKIT...)- Une fenêtre va s’ouvrir « Luke Filewalker »
- Le scan va démarrer.
- Mettre tout ce qu il trouve en "quarantine"
Lis le tutoriel, et poste le rapport d'analyse.
Prends ton temps
Mais avertis-moi du moment où tu quittes le PC.
Merci
Al.
EDIT: Je quitte le PC. Bonne nuit. -
ok, jarrive vraiment pas a lancer le scan.
y a til une autre possibilité? -
super
par contre jarrive pas a lancer le scan avec Bit defender.
je cherche si cest pas dans la configuration de sécurité par rapport à ces fameux activex, mais je crois plutot que le problème vient du fait que je nai pas de licence windowx valide.
je pense que la personne qui ma filé lordi a installé une contrafacon .
en tous cas, depuis que jai internet je recois sans cesse des messages dalerte de la sorte pour que je rachète le logiciel
bon, a patr le fait que mon image de fond du bureau disparaisse je nai pas eu de soucis pour l instant... -
Contributeur sécuritéRe,
Parfait.
Lance le scan en ligne avec BitDefender.
Garde les clés branchées.
Al. -
non non, lalerte est arrivée pendant que Move it supprimait les fichiers.
jai desactivé avast qui s'affolait , puis move it ma demandé un reboot.
voila son rapport:
Merci :-)
Error: Unable to interpret <:processus > in the current context!
Error: Unable to interpret <explorer.exe > in the current context!
========== FILES ==========
C:\Qoobox\Quarantine\Registry_backups moved successfully.
C:\Qoobox\Quarantine\J moved successfully.
C:\Qoobox\Quarantine\I moved successfully.
C:\Qoobox\Quarantine\E moved successfully.
C:\Qoobox\Quarantine\D moved successfully.
C:\Qoobox\Quarantine\C\WINDOWS moved successfully.
C:\Qoobox\Quarantine\C moved successfully.
C:\Qoobox\Quarantine moved successfully.
D:\wx8o0bt1.com moved successfully.
E:\wx8o0bt1.com moved successfully.
I:\wx8o0bt1.com moved successfully.
J:\wx8o0bt1.com moved successfully.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\po\LOCALS~1\Temp\~DF998D.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Historique\History.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat scheduled to be deleted on reboot.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_58c.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Temp folders emptied.
OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 03022009_203045
Files moved on Reboot...
C:\DOCUME~1\po\LOCALS~1\Temp\~DF998D.tmp moved successfully.
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Historique\History.IE5\index.dat scheduled to be moved on reboot.
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat scheduled to be moved on reboot.
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
C:\WINDOWS\temp\Perflib_Perfdata_58c.dat moved successfully. -
Contributeur sécuritéNon, il trouve là C:\_OTMoveIt\MovedFiles <-- la poubelle de _OTMoveIt
C'est après l'application de _OTMoveIt que tu as reçu cette alerte ? -
Mmm
mais tout de meme c est etrange qu il me ressorte ce vers la, qui etait partout
wx8o0bt1
il le nomme Kavos en plus...
bon, je ne fais rien alors. -
Contributeur sécuritéC'est normal
Avast n'aime pas _OTMoveIt
avast!: clic droit sur l'icône dans la SysBarre (à coté de l'horloge), puis "Arrêter la protection résidente"
C'est pour ça, qu'il faudra optimiser le PC
-
problème:
tout a l'heure je nai pas supprimé avast totalement, je lavais simplement desactiver lors des analyses.
maintenat en lancant OtMoveit, avast m'envoit un avertissement pour me dire que Kavos est entré
DANS les fichiers Moveit!
ici:
C:\_OTMoveIt\MovedFiles\03022009_203045\wx8o0bt1.com
est-ce que je supprime, met en quarantaine?
de toutes facons si ca fait comme avec les autres fois ca ne changera pas le problème...
ayayay///...
- 1
- 2
Suivant
