Infection Storageprotector

Alors j'ai éxécuté vundofix... Et voici les rapports:

---------------------------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------------------------

VirtumondoBeGone:

[01/13/2008, 13:06:53] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\RAPHAEL\Bureau\VirtumundoBeGone.exe" )
[01/13/2008, 13:07:07] - Detected System Information:
[01/13/2008, 13:07:07] - Windows Version: 5.1.2600, Service Pack 2
[01/13/2008, 13:07:07] - Current Username: RAPHAEL (Admin)
[01/13/2008, 13:07:07] - Windows is in NORMAL mode.
[01/13/2008, 13:07:07] - Searching for Browser Helper Objects:
[01/13/2008, 13:07:07] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[01/13/2008, 13:07:07] - BHO 2: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
[01/13/2008, 13:07:07] - BHO 3: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[01/13/2008, 13:07:07] - WARNING: BHO has no default name. Checking for Winlogon reference.
[01/13/2008, 13:07:07] - No filename found. Continuing.
[01/13/2008, 13:07:07] - BHO 4: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live)
[01/13/2008, 13:07:07] - BHO 5: {c199d92d-00a2-4617-93fe-5ef6170d9edb} ()
[01/13/2008, 13:07:07] - WARNING: BHO has no default name. Checking for Winlogon reference.
[01/13/2008, 13:07:07] - Checking for HKLM\...\Winlogon\Notify\lisnfsat
[01/13/2008, 13:07:07] - Key not found: HKLM\...\Winlogon\Notify\lisnfsat, continuing.
[01/13/2008, 13:07:07] - BHO 6: {C2C57D64-905C-4139-ABDF-8AA2CE269263} ()
[01/13/2008, 13:07:07] - WARNING: BHO has no default name. Checking for Winlogon reference.
[01/13/2008, 13:07:07] - Checking for HKLM\...\Winlogon\Notify\mljge
[01/13/2008, 13:07:07] - Key not found: HKLM\...\Winlogon\Notify\mljge, continuing.
[01/13/2008, 13:07:07] - BHO 7: {E1759A31-E627-4758-9562-6899DF36C9C2} ()
[01/13/2008, 13:07:07] - WARNING: BHO has no default name. Checking for Winlogon reference.
[01/13/2008, 13:07:07] - Checking for HKLM\...\Winlogon\Notify\urqnkjh
[01/13/2008, 13:07:07] - Key not found: HKLM\...\Winlogon\Notify\urqnkjh, continuing.
[01/13/2008, 13:07:07] - BHO 8: {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} (EpsonToolBandKicker Class)
[01/13/2008, 13:07:07] - Finished Searching Browser Helper Objects
[01/13/2008, 13:07:07] - Finishing up...
[01/13/2008, 13:07:07] - Nothing found! Exiting...

-------------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------------

Combofix:

ComboFix 08-01-13.1 - RAPHAEL 2008-01-13 13:14:11.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.615 [GMT 1:00]
Running from: C:\Documents and Settings\RAPHAEL\Bureau\ComboFix.exe
* Created a new restore point
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\storageprotector
C:\Documents and Settings\All Users\Application Data\storageprotector\Data\ac
C:\Documents and Settings\All Users\Application Data\storageprotector\Data\em
C:\Documents and Settings\All Users\Application Data\storageprotector\Data\oid
C:\Documents and Settings\All Users\Application Data\storageprotector\Data\user
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\StorageProtector
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\StorageProtector\Contact Customer Service.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\StorageProtector\StorageProtector.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\StorageProtector\Uninstall StorageProtector.lnk
C:\Documents and Settings\RAPHAEL\Application Data\setup_en[1].exe
C:\Documents and Settings\RAPHAEL\Application Data\storageprotector
C:\Documents and Settings\RAPHAEL\Application Data\storageprotector\Logs\update.log
C:\pos10.tmp
C:\pos100.tmp
C:\pos101.tmp
C:\pos102.tmp
C:\pos103.tmp
C:\pos104.tmp
C:\pos105.tmp
C:\pos106.tmp
C:\pos107.tmp
C:\pos108.tmp
C:\pos109.tmp
C:\pos10A.tmp
C:\pos10B.tmp
C:\pos10C.tmp
C:\pos10D.tmp
C:\pos10E.tmp
C:\pos10F.tmp
C:\pos11.tmp
C:\pos110.tmp
C:\pos111.tmp
C:\pos112.tmp
C:\pos113.tmp
C:\pos114.tmp
C:\pos115.tmp
C:\pos116.tmp
C:\pos117.tmp
C:\pos118.tmp
C:\pos119.tmp
C:\pos11A.tmp
C:\pos11B.tmp
C:\pos11C.tmp
C:\pos11D.tmp
C:\pos11E.tmp
C:\pos11F.tmp
C:\pos12.tmp
C:\pos120.tmp
C:\pos121.tmp
C:\pos122.tmp
C:\pos123.tmp
C:\pos124.tmp
C:\pos125.tmp
C:\pos126.tmp
C:\pos127.tmp
C:\pos128.tmp
C:\pos129.tmp
C:\pos12A.tmp
C:\pos12B.tmp
C:\pos12C.tmp
C:\pos12D.tmp
C:\pos12E.tmp
C:\pos12F.tmp
C:\pos13.tmp
C:\pos130.tmp
C:\pos131.tmp
C:\pos132.tmp
C:\pos133.tmp
C:\pos134.tmp
C:\pos135.tmp
C:\pos136.tmp
C:\pos137.tmp
C:\pos138.tmp
C:\pos139.tmp
C:\pos13A.tmp
C:\pos13B.tmp
C:\pos13C.tmp
C:\pos13D.tmp
C:\pos13E.tmp
C:\pos13F.tmp
C:\pos14.tmp
C:\pos140.tmp
C:\pos141.tmp
C:\pos142.tmp
C:\pos143.tmp
C:\pos144.tmp
C:\pos145.tmp
C:\pos146.tmp
C:\pos147.tmp
C:\pos148.tmp
C:\pos149.tmp
C:\pos14A.tmp
C:\pos14B.tmp
C:\pos14C.tmp
C:\pos14D.tmp
C:\pos14E.tmp
C:\pos14F.tmp
C:\pos15.tmp
C:\pos150.tmp
C:\pos151.tmp
C:\pos152.tmp
C:\pos153.tmp
C:\pos154.tmp
C:\pos155.tmp
C:\pos156.tmp
C:\pos157.tmp
C:\pos158.tmp
C:\pos159.tmp
C:\pos15A.tmp
C:\pos15B.tmp
C:\pos15C.tmp
C:\pos15D.tmp
C:\pos15E.tmp
C:\pos15F.tmp
C:\pos16.tmp
C:\pos160.tmp
C:\pos161.tmp
C:\pos162.tmp
C:\pos163.tmp
C:\pos164.tmp
C:\pos165.tmp
C:\pos166.tmp
C:\pos167.tmp
C:\pos168.tmp
C:\pos169.tmp
C:\pos16A.tmp
C:\pos16B.tmp
C:\pos16C.tmp
C:\pos16D.tmp
C:\pos16E.tmp
C:\pos16F.tmp
C:\pos17.tmp
C:\pos170.tmp
C:\pos171.tmp
C:\pos172.tmp
C:\pos173.tmp
C:\pos174.tmp
C:\pos175.tmp
C:\pos176.tmp
C:\pos177.tmp
C:\pos178.tmp
C:\pos179.tmp
C:\pos17A.tmp
C:\pos17B.tmp
C:\pos17C.tmp
C:\pos17D.tmp
C:\pos17E.tmp
C:\pos17F.tmp
C:\pos18.tmp
C:\pos180.tmp
C:\pos181.tmp
C:\pos182.tmp
C:\pos183.tmp
C:\pos184.tmp
C:\pos185.tmp
C:\pos186.tmp
C:\pos187.tmp
C:\pos188.tmp
C:\pos189.tmp
C:\pos18A.tmp
C:\pos18B.tmp
C:\pos18C.tmp
C:\pos18D.tmp
C:\pos18E.tmp
C:\pos18F.tmp
C:\pos19.tmp
C:\pos190.tmp
C:\pos191.tmp
C:\pos192.tmp
C:\pos193.tmp
C:\pos194.tmp
C:\pos195.tmp
C:\pos196.tmp
C:\pos197.tmp
C:\pos198.tmp
C:\pos199.tmp
C:\pos19A.tmp
C:\pos19B.tmp
C:\pos19C.tmp
C:\pos19D.tmp
C:\pos19E.tmp
C:\pos19F.tmp
C:\pos1A.tmp
C:\pos1A0.tmp
C:\pos1A1.tmp
C:\pos1A2.tmp
C:\pos1A3.tmp
C:\pos1A4.tmp
C:\pos1A5.tmp
C:\pos1A6.tmp
C:\pos1A7.tmp
C:\pos1A8.tmp
C:\pos1A9.tmp
C:\pos1AA.tmp
C:\pos1AB.tmp
C:\pos1AC.tmp
C:\pos1AD.tmp
C:\pos1AE.tmp
C:\pos1AF.tmp
C:\pos1B.tmp
C:\pos1B0.tmp
C:\pos1B1.tmp
C:\pos1B2.tmp
C:\pos1B3.tmp
C:\pos1B4.tmp
C:\pos1B5.tmp
C:\pos1B6.tmp
C:\pos1B7.tmp
C:\pos1B8.tmp
C:\pos1B9.tmp
C:\pos1BA.tmp
C:\pos1BB.tmp
C:\pos1BC.tmp
C:\pos1BD.tmp
C:\pos1BE.tmp
C:\pos1BF.tmp
C:\pos1C.tmp
C:\pos1C0.tmp
C:\pos1C1.tmp
C:\pos1C2.tmp
C:\pos1C3.tmp
C:\pos1C4.tmp
C:\pos1C5.tmp
C:\pos1C6.tmp
C:\pos1C7.tmp
C:\pos1C8.tmp
C:\pos1C9.tmp
C:\pos1CA.tmp
C:\pos1CB.tmp
C:\pos1CC.tmp
C:\pos1CD.tmp
C:\pos1CE.tmp
C:\pos1CF.tmp
C:\pos1D.tmp
C:\pos1D0.tmp
C:\pos1D1.tmp
C:\pos1D2.tmp
C:\pos1D3.tmp
C:\pos1D4.tmp
C:\pos1D5.tmp
C:\pos1D6.tmp
C:\pos1D7.tmp
C:\pos1D8.tmp
C:\pos1D9.tmp
C:\pos1DA.tmp
C:\pos1DB.tmp
C:\pos1DC.tmp
C:\pos1DD.tmp
C:\pos1DE.tmp
C:\pos1DF.tmp
C:\pos1E.tmp
C:\pos1E0.tmp
C:\pos1E1.tmp
C:\pos1E2.tmp
C:\pos1E3.tmp
C:\pos1E4.tmp
C:\pos1E5.tmp
C:\pos1E6.tmp
C:\pos1E7.tmp
C:\pos1E8.tmp
C:\pos1E9.tmp
C:\pos1EA.tmp
C:\pos1EB.tmp
C:\pos1EC.tmp
C:\pos1ED.tmp
C:\pos1EE.tmp
C:\pos1EF.tmp
C:\pos1F.tmp
C:\pos1F0.tmp
C:\pos1F1.tmp
C:\pos1F2.tmp
C:\pos1F2A.tmp
C:\pos1F2B.tmp
C:\pos1F2D.tmp
C:\pos1F2E.tmp
C:\pos1F2F.tmp
C:\pos1F3.tmp
C:\pos1F30.tmp
C:\pos1F31.tmp
C:\pos1F33.tmp
C:\pos1F34.tmp
C:\pos1F35.tmp
C:\pos1F36.tmp
C:\pos1F37.tmp
C:\pos1F38.tmp
C:\pos1F39.tmp
C:\pos1F3A.tmp
C:\pos1F3B.tmp
C:\pos1F3C.tmp
C:\pos1F3D.tmp
C:\pos1F3E.tmp
C:\pos1F3F.tmp
C:\pos1F4.tmp
C:\pos1F40.tmp
C:\pos1F41.tmp
C:\pos1F42.tmp
C:\pos1F43.tmp
C:\pos1F44.tmp
C:\pos1F45.tmp
C:\pos1F46.tmp
C:\pos1F47.tmp
C:\pos1F48.tmp
C:\pos1F49.tmp
C:\pos1F4A.tmp
C:\pos1F4B.tmp
C:\pos1F4C.tmp
C:\pos1F4E.tmp
C:\pos1F5.tmp
C:\pos1F50.tmp
C:\pos1F51.tmp
C:\pos1F52.tmp
C:\pos1F53.tmp
C:\pos1F54.tmp
C:\pos1F55.tmp
C:\pos1F56.tmp
C:\pos1F57.tmp
C:\pos1F58.tmp
C:\pos1F59.tmp
C:\pos1F5A.tmp
C:\pos1F5B.tmp
C:\pos1F5C.tmp
C:\pos1F5D.tmp
C:\pos1F5E.tmp
C:\pos1F5F.tmp
C:\pos1F6.tmp
C:\pos1F60.tmp
C:\pos1F61.tmp
C:\pos1F62.tmp
C:\pos1F63.tmp
C:\pos1F64.tmp
C:\pos1F65.tmp
C:\pos1F66.tmp
C:\pos1F67.tmp
C:\pos1F68.tmp
C:\pos1F69.tmp
C:\pos1F6A.tmp
C:\pos1F6B.tmp
C:\pos1F6C.tmp
C:\pos1F6D.tmp
C:\pos1F6E.tmp
C:\pos1F6F.tmp
C:\pos1F7.tmp
C:\pos1F70.tmp
C:\pos1F71.tmp
C:\pos1F72.tmp
C:\pos1F73.tmp
C:\pos1F74.tmp
C:\pos1F75.tmp
C:\pos1F76.tmp
C:\pos1F77.tmp
C:\pos1F78.tmp
C:\pos1F79.tmp
C:\pos1F7A.tmp
C:\pos1F7B.tmp
C:\pos1F7C.tmp
C:\pos1F7D.tmp
C:\pos1F7E.tmp
C:\pos1F7F.tmp
C:\pos1F8.tmp
C:\pos1F80.tmp
C:\pos1F81.tmp
C:\pos1F82.tmp
C:\pos1F83.tmp
C:\pos1F84.tmp
C:\pos1F85.tmp
C:\pos1F86.tmp
C:\pos1F87.tmp
C:\pos1F88.tmp
C:\pos1F89.tmp
C:\pos1F8A.tmp
C:\pos1F8B.tmp
C:\pos1F8C.tmp
C:\pos1F8D.tmp
C:\pos1F8E.tmp
C:\pos1F8F.tmp
C:\pos1F9.tmp
C:\pos1F90.tmp
C:\pos1F91.tmp
C:\pos1F92.tmp
C:\pos1F93.tmp
C:\pos1F94.tmp
C:\pos1F95.tmp
C:\pos1F96.tmp
C:\pos1F97.tmp
C:\pos1F98.tmp
C:\pos1F99.tmp
C:\pos1F9A.tmp
C:\pos1F9B.tmp
C:\pos1F9C.tmp
C:\pos1F9D.tmp
C:\pos1F9E.tmp
C:\pos1F9F.tmp
C:\pos1FA.tmp
C:\pos1FA0.tmp
C:\pos1FA1.tmp
C:\pos1FA2.tmp
C:\pos1FA3.tmp
C:\pos1FA4.tmp
C:\pos1FA5.tmp
C:\pos1FA6.tmp
C:\pos1FA7.tmp
C:\pos1FA8.tmp
C:\pos1FA9.tmp
C:\pos1FAA.tmp
C:\pos1FAB.tmp
C:\pos1FAC.tmp
C:\pos1FAD.tmp
C:\pos1FAE.tmp
C:\pos1FAF.tmp
C:\pos1FB.tmp
C:\pos1FB0.tmp
C:\pos1FB1.tmp
C:\pos1FB2.tmp
C:\pos1FB3.tmp
C:\pos1FB4.tmp
C:\pos1FB5.tmp
C:\pos1FB6.tmp
C:\pos1FB7.tmp
C:\pos1FB8.tmp
C:\pos1FB9.tmp
C:\pos1FBA.tmp
C:\pos1FBB.tmp
C:\pos1FBC.tmp
C:\pos1FBD.tmp
C:\pos1FBE.tmp
C:\pos1FBF.tmp
C:\pos1FC.tmp
C:\pos1FC0.tmp
C:\pos1FC1.tmp
C:\pos1FC2.tmp
C:\pos1FC3.tmp
C:\pos1FC4.tmp
C:\pos1FC5.tmp
C:\pos1FC6.tmp
C:\pos1FC7.tmp
C:\pos1FC8.tmp
C:\pos1FC9.tmp
C:\pos1FCA.tmp
C:\pos1FCB.tmp
C:\pos1FCC.tmp
C:\pos1FCD.tmp
C:\pos1FCE.tmp
C:\pos1FCF.tmp
C:\pos1FD.tmp
C:\pos1FD0.tmp
C:\pos1FD1.tmp
C:\pos1FD2.tmp
C:\pos1FD3.tmp
C:\pos1FD4.tmp
C:\pos1FD5.tmp
C:\pos1FD6.tmp
C:\pos1FD7.tmp
C:\pos1FD8.tmp
C:\pos1FD9.tmp
C:\pos1FDA.tmp
C:\pos1FDB.tmp
C:\pos1FDC.tmp
C:\pos1FDD.tmp
C:\pos1FDE.tmp
C:\pos1FDF.tmp
C:\pos1FE.tmp
C:\pos1FE0.tmp
C:\pos1FE1.tmp
C:\pos1FE2.tmp
C:\pos1FE3.tmp
C:\pos1FE4.tmp
C:\pos1FE5.tmp
C:\pos1FE6.tmp
C:\pos1FE7.tmp
C:\pos1FE8.tmp
C:\pos1FE9.tmp
C:\pos1FEA.tmp
C:\pos1FEB.tmp
C:\pos1FEC.tmp
C:\pos1FED.tmp
C:\pos1FEE.tmp
C:\pos1FEF.tmp
C:\pos1FF.tmp
C:\pos1FF0.tmp
C:\pos1FF1.tmp
C:\pos1FF2.tmp
C:\pos1FF3.tmp
C:\pos1FF4.tmp
C:\pos1FF5.tmp
C:\pos1FF6.tmp
C:\pos1FF7.tmp
C:\pos1FF8.tmp
C:\pos1FF9.tmp
C:\pos1FFA.tmp
C:\pos1FFB.tmp
C:\pos1FFC.tmp
C:\pos1FFD.tmp
C:\pos1FFE.tmp
C:\pos1FFF.tmp
C:\pos20.tmp
C:\pos200.tmp
C:\pos2000.tmp
C:\pos2001.tmp
C:\pos2002.tmp
C:\pos2003.tmp
C:\pos2004.tmp
C:\pos2005.tmp
C:\pos2006.tmp
C:\pos2007.tmp
C:\pos2008.tmp
C:\pos2009.tmp
C:\pos200A.tmp
C:\pos200B.tmp
C:\pos200C.tmp
C:\pos200D.tmp
C:\pos200E.tmp
C:\pos200F.tmp
C:\pos201.tmp
C:\pos2010.tmp
C:\pos2011.tmp
C:\pos2012.tmp
C:\pos2013.tmp
C:\pos2014.tmp
C:\pos2015.tmp
C:\pos2016.tmp
C:\pos2017.tmp
C:\pos2018.tmp
C:\pos2019.tmp
C:\pos201A.tmp
C:\pos201B.tmp
C:\pos201C.tmp
C:\pos201D.tmp
C:\pos201E.tmp
C:\pos201F.tmp
C:\pos202.tmp
C:\pos2020.tmp
C:\pos2021.tmp
C:\pos2022.tmp
C:\pos2023.tmp
C:\pos2024.tmp
C:\pos2025.tmp
C:\pos2026.tmp
C:\pos2027.tmp
C:\pos2028.tmp
C:\pos2029.tmp
C:\pos202A.tmp
C:\pos202B.tmp
C:\pos202C.tmp
C:\pos202D.tmp
C:\pos202E.tmp
C:\pos202F.tmp
C:\pos203.tmp
C:\pos2030.tmp
C:\pos2031.tmp
C:\pos2032.tmp
C:\pos2033.tmp
C:\pos2034.tmp
C:\pos2035.tmp
C:\pos2036.tmp
C:\pos2037.tmp
C:\pos2038.tmp
C:\pos2039.tmp
C:\pos203A.tmp
C:\pos203B.tmp
C:\pos203C.tmp
C:\pos203D.tmp
C:\pos203E.tmp
C:\pos203F.tmp
C:\pos204.tmp
C:\pos2040.tmp
C:\pos2041.tmp
C:\pos2042.tmp
C:\pos2043.tmp
C:\pos2044.tmp
C:\pos2045.tmp
C:\pos2046.tmp
C:\pos2047.tmp
C:\pos2048.tmp
C:\pos2049.tmp
C:\pos204A.tmp
C:\pos204B.tmp
C:\pos204C.tmp
C:\pos204D.tmp
C:\pos204E.tmp
C:\pos204F.tmp
C:\pos205.tmp
C:\pos2050.tmp
C:\pos2051.tmp
C:\pos2052.tmp
C:\pos2053.tmp
C:\pos2054.tmp
C:\pos2055.tmp
C:\pos2056.tmp
C:\pos2057.tmp
C:\pos2058.tmp
C:\pos2059.tmp
C:\pos205A.tmp
C:\pos205B.tmp
C:\pos205C.tmp
C:\pos205D.tmp
C:\pos205E.tmp
C:\pos205F.tmp
C:\pos206.tmp
C:\pos2060.tmp
C:\pos2061.tmp
C:\pos2062.tmp
C:\pos2063.tmp
C:\pos2064.tmp
C:\pos2065.tmp
C:\pos2066.tmp
C:\pos2067.tmp
C:\pos2068.tmp
C:\pos2069.tmp
C:\pos206A.tmp
C:\pos206B.tmp
C:\pos206C.tmp
C:\pos206D.tmp
C:\pos206E.tmp
C:\pos206F.tmp
C:\pos207.tmp
C:\pos2070.tmp
C:\pos2071.tmp
C:\pos2072.tmp
C:\pos2073.tmp
C:\pos2074.tmp
C:\pos2075.tmp
C:\pos2076.tmp
C:\pos2077.tmp
C:\pos2078.tmp
C:\pos2079.tmp
C:\pos207A.tmp
C:\pos207B.tmp
C:\pos207C.tmp
C:\pos207D.tmp
C:\pos207E.tmp
C:\pos207F.tmp
C:\pos208.tmp
C:\pos2080.tmp
C:\pos2081.tmp
C:\pos2082.tmp
C:\pos2083.tmp
C:\pos2084.tmp
C:\pos2085.tmp
C:\pos2086.tmp
C:\pos2087.tmp
C:\pos2088.tmp
C:\pos2089.tmp
C:\pos208A.tmp
C:\pos208B.tmp
C:\pos208C.tmp
C:\pos208D.tmp
C:\pos208E.tmp
C:\pos208F.tmp
C:\pos209.tmp
C:\pos2090.tmp
C:\pos2091.tmp
C:\pos2092.tmp
C:\pos2093.tmp
C:\pos2094.tmp
C:\pos2095.tmp
C:\pos2096.tmp
C:\pos2097.tmp
C:\pos2098.tmp
C:\pos2099.tmp
C:\pos209A.tmp
C:\pos209B.tmp
C:\pos209C.tmp
C:\pos209D.tmp
C:\pos209E.tmp
C:\pos209F.tmp
C:\pos20A.tmp
C:\pos20A0.tmp
C:\pos20A1.tmp
C:\pos20A2.tmp
C:\pos20A3.tmp
C:\pos20A4.tmp
C:\pos20A5.tmp
C:\pos20A6.tmp
C:\pos20A7.tmp
C:\pos20A8.tmp
C:\pos20A9.tmp
C:\pos20AA.tmp
C:\pos20AB.tmp
C:\pos20AC.tmp
C:\pos20AD.tmp
C:\pos20AE.tmp
C:\pos20AF.tmp
C:\pos20B.tmp
C:\pos20B0.tmp
C:\pos20B1.tmp
C:\pos20B2.tmp
C:\pos20B3.tmp
C:\pos20B4.tmp
C:\pos20B5.tmp
C:\pos20B6.tmp
C:\pos20B7.tmp
C:\pos20B8.tmp
C:\pos20B9.tmp
C:\pos20BA.tmp
C:\pos20BB.tmp
C:\pos20BC.tmp
C:\pos20BD.tmp
C:\pos20BE.tmp
C:\pos20BF.tmp
C:\pos20C.tmp
C:\pos20C0.tmp
C:\pos20C1.tmp
C:\pos20C2.tmp
C:\pos20C3.tmp
C:\pos20C4.tmp
C:\pos20C5.tmp
C:\pos20C6.tmp
C:\pos20C7.tmp
C:\pos20C8.tmp
C:\pos20C9.tmp
C:\pos20CA.tmp
C:\pos20CB.tmp
C:\pos20CC.tmp
C:\pos20CD.tmp
C:\pos20CE.tmp
C:\pos20CF.tmp
C:\pos20D.tmp
C:\pos20D0.tmp
C:\pos20D1.tmp
C:\pos20D2.tmp
C:\pos20D3.tmp
C:\pos20D4.tmp
C:\pos20D5.tmp
C:\pos20D6.tmp
C:\pos20D7.tmp
C:\pos20D8.tmp
C:\pos20D9.tmp
C:\pos20DA.tmp
C:\pos20DB.tmp
C:\pos20DC.tmp
C:\pos20DD.tmp
C:\pos20DE.tmp
C:\pos20DF.tmp
C:\pos20E.tmp
C:\pos20E0.tmp
C:\pos20E1.tmp
C:\pos20E2.tmp
C:\pos20E3.tmp
C:\pos20E4.tmp
C:\pos20E5.tmp
C:\pos20E6.tmp
C:\pos20E7.tmp
C:\pos20E8.tmp
C:\pos20E9.tmp
C:\pos20EA.tmp
C:\pos20EB.tmp
C:\pos20EC.tmp
C:\pos20ED.tmp
C:\pos20EE.tmp
C:\pos20EF.tmp
C:\pos20F.tmp
C:\pos20F0.tmp
C:\pos20F1.tmp
C:\pos20F2.tmp
C:\pos20F3.tmp
C:\pos20F4.tmp
C:\pos20F5.tmp
C:\pos20F6.tmp
C:\pos20F7.tmp
C:\pos20F8.tmp
C:\pos20F9.tmp
C:\pos20FA.tmp
C:\pos20FB.tmp
C:\pos20FC.tmp
C:\pos20FD.tmp
C:\pos20FE.tmp
C:\pos20FF.tmp
C:\pos21.tmp
C:\pos210.tmp
C:\pos2100.tmp
C:\pos2101.tmp
C:\pos2102.tmp
C:\pos2103.tmp
C:\pos2104.tmp
C:\pos2105.tmp
C:\pos2106.tmp
C:\pos2107.tmp
C:\pos2108.tmp
C:\pos2109.tmp
C:\pos210A.tmp
C:\pos210B.tmp
C:\pos210C.tmp
C:\pos210D.tmp
C:\pos210E.tmp
C:\pos210F.tmp
C:\pos211.tmp
C:\pos2110.tmp
C:\pos2111.tmp
C:\pos2112.tmp
C:\pos2113.tmp
C:\pos2114.tmp
C:\pos2115.tmp
C:\pos2116.tmp
C:\pos2117.tmp
C:\pos2118.tmp
C:\pos2119.tmp
C:\pos211A.tmp
C:\pos211B.tmp
C:\pos211C.tmp
C:\pos211D.tmp
C:\pos211E.tmp
C:\pos211F.tmp
C:\pos212.tmp
C:\pos2120.tmp
C:\pos2121.tmp
C:\pos213.tmp
C:\pos214.tmp
C:\pos215.tmp
C:\pos216.tmp
C:\pos217.tmp
C:\pos218.tmp
C:\pos219.tmp
C:\pos21A.tmp
C:\pos21B.tmp
C:\pos21C.tmp
C:\pos21D.tmp
C:\pos21E.tmp
C:\pos21F.tmp
C:\pos22.tmp
C:\pos220.tmp
C:\pos221.tmp
C:\pos222.tmp
C:\pos223.tmp
C:\pos224.tmp
C:\pos225.tmp
C:\pos226.tmp
C:\pos227.tmp
C:\pos228.tmp
C:\pos229.tmp
C:\pos22A.tmp
C:\pos22B.tmp
C:\pos22C.tmp
C:\pos22D.tmp
C:\pos22E.tmp
C:\pos22F.tmp
C:\pos23.tmp
C:\pos230.tmp
C:\pos231.tmp
C:\pos232.tmp
C:\pos233.tmp
C:\pos234.tmp
C:\pos235.tmp
C:\pos236.tmp
C:\pos237.tmp
C:\pos238.tmp
C:\pos239.tmp
C:\pos23A.tmp
C:\pos23B.tmp
C:\pos23C.tmp
C:\pos23D.tmp
C:\pos23E.tmp
C:\pos23F.tmp
C:\pos24.tmp
C:\pos240.tmp
C:\pos241.tmp
C:\pos242.tmp
C:\pos243.tmp
C:\pos244.tmp
C:\pos245.tmp
C:\pos246.tmp
C:\pos247.tmp
C:\pos248.tmp
C:\pos249.tmp
C:\pos24A.tmp
C:\pos24B.tmp
C:\pos24C.tmp
C:\pos24D.tmp
C:\pos24E.tmp
C:\pos24F.tmp
C:\pos24F1.tmp
C:\pos24F2.tmp
C:\pos24F3.tmp
C:\pos24F4.tmp
C:\pos24F5.tmp
C:\pos24F6.tmp
C:\pos24F7.tmp
C:\pos24F8.tmp
C:\pos24F9.tmp
C:\pos24FA.tmp
C:\pos24FB.tmp
C:\pos24FD.tmp
C:\pos24FE.tmp
C:\pos24FF.tmp
C:\pos25.tmp
C:\pos250.tmp
C:\pos2500.tmp
C:\pos2501.tmp
C:\pos2502.tmp
C:\pos2503.tmp
C:\pos2504.tmp
C:\pos2505.tmp
C:\pos2506.tmp
C:\pos2507.tmp
C:\pos2508.tmp
C:\pos2509.tmp
C:\pos250A.tmp
C:\pos250B.tmp
C:\pos250C.tmp
C:\pos250D.tmp
C:\pos250E.tmp
C:\pos250F.tmp
C:\pos251.tmp
C:\pos2510.tmp
C:\pos2511.tmp
C:\pos2512.tmp
C:\pos2513.tmp
C:\pos2514.tmp
C:\pos2515.tmp
C:\pos2516.tmp
C:\pos2517.tmp
C:\pos2518.tmp
C:\pos2519.tmp
C:\pos251A.tmp
C:\pos251B.tmp
C:\pos251C.tmp
C:\pos251F.tmp
C:\pos252.tmp
C:\pos2520.tmp
C:\pos2521.tmp
C:\pos2522.tmp
C:\pos2523.tmp
C:\pos2524.tmp
C:\pos2525.tmp
C:\pos2526.tmp
C:\pos2527.tmp
C:\pos2528.tmp
C:\pos2529.tmp
C:\pos252A.tmp
C:\pos252B.tmp
C:\pos252C.tmp
C:\pos252E.tmp
C:\pos253.tmp
C:\pos2530.tmp
C:\pos2531.tmp
C:\pos2532.tmp
C:\pos2533.tmp
C:\pos2534.tmp
C:\pos2535.tmp
C:\pos2536.tmp
C:\pos2537.tmp
C:\pos2538.tmp
C:\pos2539.tmp
C:\pos253A.tmp
C:\pos253B.tmp
C:\pos253C.tmp
C:\pos253D.tmp
C:\pos253E.tmp
C:\pos253F.tmp
C:\pos254.tmp
C:\pos2540.tmp
C:\pos2541.tmp
C:\pos2542.tmp
C:\pos2543.tmp
C:\pos2544.tmp
C:\pos2545.tmp
C:\pos2546.tmp
C:\pos2547.tmp
C:\pos2548.tmp
C:\pos2549.tmp
C:\pos254A.tmp
C:\pos254B.tmp
C:\pos254C.tmp
C:\pos254D.tmp
C:\pos254E.tmp
C:\pos254F.tmp
C:\pos255.tmp
C:\pos2550.tmp
C:\pos2551.tmp
C:\pos2552.tmp
C:\pos2553.tmp
C:\pos2554.tmp
C:\pos2555.tmp
C:\pos2556.tmp
C:\pos2557.tmp
C:\pos2558.tmp
C:\pos2559.tmp
C:\pos255A.tmp
C:\pos255B.tmp
C:\pos255C.tmp
C:\pos255D.tmp
C:\pos255E.tmp
C:\pos255F.tmp
C:\pos256.tmp
C:\pos2560.tmp
C:\pos2561.tmp
C:\pos2562.tmp
C:\pos2563.tmp
C:\pos2564.tmp
C:\pos2565.tmp
C:\pos2566.tmp
C:\pos2567.tmp
C:\pos2568.tmp
C:\pos2569.tmp
C:\pos256A.tmp
C:\pos256B.tmp
C:\pos256C.tmp
C:\pos256D.tmp
C:\pos256E.tmp
C:\pos256F.tmp
C:\pos257.tmp
C:\pos2570.tmp
C:\pos2571.tmp
C:\pos2572.tmp
C:\pos2573.tmp
C:\pos2574.tmp
C:\pos2575.tmp
C:\pos2576.tmp
C:\pos2577.tmp
C:\pos2578.tmp
C:\pos2579.tmp
C:\pos257A.tmp
C:\pos257B.tmp
C:\pos257C.tmp
C:\pos257D.tmp
C:\pos257E.tmp
C:\pos257F.tmp
C:\pos258.tmp
C:\pos2580.tmp
C:\pos2581.tmp
C:\pos2582.tmp
C:\pos2583.tmp
C:\pos2584.tmp
C:\pos2585.tmp
C:\pos2586.tmp
C:\pos2587.tmp
C:\pos2588.tmp
C:\pos2589.tmp
C:\pos258A.tmp
C:\pos258B.tmp
C:\pos258C.tmp
C:\pos258D.tmp
C:\pos258E.tmp
C:\pos258F.tmp
C:\pos259.tmp
C:\pos2590.tmp
C:\pos2591.tmp
C:\pos2592.tmp
C:\pos2593.tmp
C:\pos2594.tmp
C:\pos2595.tmp
C:\pos2596.tmp
C:\pos2597.tmp
C:\pos2598.tmp
C:\pos2599.tmp
C:\pos259A.tmp
C:\pos259B.tmp
C:\pos259C.tmp
C:\pos259D.tmp
C:\pos259E.tmp
C:\pos259F.tmp
C:\pos25A.tmp
C:\pos25A0.tmp
C:\pos25A1.tmp
C:\pos25A2.tmp
C:\pos25A3.tmp
C:\pos25A4.tmp
C:\pos25A5.tmp
C:\pos25A6.tmp
C:\pos25A7.tmp
C:\pos25A8.tmp
C:\pos25A9.tmp
C:\pos25AA.tmp
C:\pos25AB.tmp
C:\pos25AC.tmp
C:\pos25AD.tmp
C:\pos25AE.tmp
C:\pos25AF.tmp
C:\pos25B.tmp
C:\pos25B0.tmp
C:\pos25B1.tmp
C:\pos25B2.tmp
C:\pos25B3.tmp
C:\pos25B4.tmp
C:\pos25B5.tmp
C:\pos25B6.tmp
C:\pos25B7.tmp
C:\pos25B8.tmp
C:\pos25B9.tmp
C:\pos25BA.tmp
C:\pos25BB.tmp
C:\pos25BC.tmp
C:\pos25BD.tmp
C:\pos25BE.tmp
C:\pos25BF.tmp
C:\pos25C.tmp
C:\pos25C0.tmp
C:\pos25C1.tmp
C:\pos25C2.tmp
C:\pos25C3.tmp
C:\pos25C4.tmp
C:\pos25C5.tmp
C:\pos25C6.tmp
C:\pos25C7.tmp
C:\pos25C8.tmp
C:\pos25C9.tmp
C:\pos25CA.tmp
C:\pos25CB.tmp
C:\pos25CC.tmp
C:\pos25CD.tmp
C:\pos25CE.tmp
C:\pos25CF.tmp
C:\pos25D.tmp
C:\pos25D0.tmp
C:\pos25D1.tmp
C:\pos25D2.tmp
C:\pos25D3.tmp
C:\pos25D4.tmp
C:\pos25D5.tmp
C:\pos25D6.tmp
C:\pos25D7.tmp
C:\pos25D8.tmp
C:\pos25D9.tmp
C:\pos25DA.tmp
C:\pos25DB.tmp
C:\pos25DC.tmp
C:\pos25DD.tmp
C:\pos25DE.tmp
C:\pos25DF.tmp
C:\pos25E.tmp
C:\pos25E0.tmp
C:\pos25E1.tmp
C:\pos25E2.tmp
C:\pos25E3.tmp
C:\pos25E4.tmp
C:\pos25E5.tmp
C:\pos25E6.tmp
C:\pos25E7.tmp
C:\pos25E8.tmp
C:\pos25E9.tmp
C:\pos25EA.tmp
C:\pos25EB.tmp
C:\pos25EC.tmp
C:\pos25ED.tmp
C:\pos25EE.tmp
C:\pos25EF.tmp
C:\pos25F.tmp
C:\pos25F0.tmp
C:\pos25F1.tmp
C:\pos25F2.tmp
C:\pos25F3.tmp
C:\pos25F4.tmp
C:\pos25F5.tmp
C:\pos25F6.tmp
C:\pos25F7.tmp
C:\pos25F8.tmp
C:\pos25F9.tmp
C:\pos25FA.tmp
C:\pos25FB.tmp
C:\pos25FC.tmp
C:\pos25FD.tmp
C:\pos25FE.tmp
C:\pos25FF.tmp
C:\pos26.tmp
C:\pos260.tmp
C:\pos2600.tmp
C:\pos2601.tmp
C:\pos2602.tmp
C:\pos2603.tmp
C:\pos2604.tmp
C:\pos2605.tmp
C:\pos2606.tmp
C:\pos2607.tmp
C:\pos2608.tmp
C:\pos2609.tmp
C:\pos260A.tmp
C:\pos260B.tmp
C:\pos260C.tmp
C:\pos260D.tmp
C:\pos260E.tmp
C:\pos260F.tmp
C:\pos261.tmp
C:\pos2610.tmp
C:\pos2611.tmp
C:\pos2612.tmp
C:\pos2613.tmp
C:\pos2614.tmp
C:\pos2615.tmp
C:\pos2616.tmp
C:\pos2617.tmp
C:\pos2618.tmp
C:\pos2619.tmp
C:\pos261A.tmp
C:\pos261B.tmp
C:\pos261C.tmp
C:\pos261D.tmp
C:\pos261E.tmp
C:\pos261F.tmp
C:\pos262.tmp
C:\pos2620.tmp
C:\pos2621.tmp
C:\pos2622.tmp
C:\pos2623.tmp
C:\pos2624.tmp
C:\pos2625.tmp
C:\pos2626.tmp
C:\pos2627.tmp
C:\pos2628.tmp
C:\pos2629.tmp
C:\pos262A.tmp
C:\pos262B.tmp
C:\pos262C.tmp
C:\pos262D.tmp
C:\pos262E.tmp
C:\pos262F.tmp
C:\pos263.tmp
C:\pos2630.tmp
C:\pos2631.tmp
C:\pos2632.tmp
C:\pos2633.tmp
C:\pos2634.tmp
C:\pos2635.tmp
C:\pos2636.tmp
C:\pos2637.tmp
C:\pos2638.tmp
C:\pos2639.tmp
C:\pos263A.tmp
C:\pos263B.tmp
C:\pos263C.tmp
C:\pos263D.tmp
C:\pos263E.tmp
C:\pos263F.tmp
C:\pos264.tmp
C:\pos2640.tmp
C:\pos2641.tmp
C:\pos2642.tmp
C:\pos2643.tmp
C:\pos2644.tmp
C:\pos2645.tmp
C:\pos2646.tmp
C:\pos2647.tmp
C:\pos2648.tmp
C:\pos2649.tmp
C:\pos264A.tmp
C:\pos264B.tmp
C:\pos264C.tmp
C:\pos264D.tmp
C:\pos264E.tmp
C:\pos264F.tmp
C:\pos265.tmp
C:\pos2650.tmp
C:\pos2651.tmp
C:\pos2652.tmp
C:\pos2653.tmp
C:\pos2654.tmp
C:\pos2655.tmp
C:\pos2656.tmp
C:\pos2657.tmp
C:\pos2658.tmp
C:\pos2659.tmp
C:\pos265A.tmp
C:\pos265B.tmp
C:\pos265C.tmp
C:\pos265D.tmp
C:\pos265E.tmp
C:\pos265F.tmp
C:\pos266.tmp
C:\pos2660.tmp
C:\pos2661.tmp
C:\pos2662.tmp
C:\pos2663.tmp
C:\pos2664.tmp
C:\pos2665.tmp
C:\pos2666.tmp
C:\pos2667.tmp
C:\pos2668.tmp
C:\pos2669.tmp
C:\pos266A.tmp
C:\pos266B.tmp
C:\pos266C.tmp
C:\pos266D.tmp
C:\pos266E.tmp
C:\pos266F.tmp
C:\pos267.tmp
C:\pos2670.tmp
C:\pos2671.tmp
C:\pos2672.tmp
C:\pos2673.tmp
C:\pos2674.tmp
C:\pos2675.tmp
C:\pos2676.tmp
C:\pos2677.tmp
C:\pos2678.tmp
C:\pos2679.tmp
C:\pos267A.tmp
C:\pos267B.tmp
C:\pos267C.tmp
C:\pos267D.tmp
C:\pos267E.tmp
C:\pos267F.tmp
C:\pos268.tmp
C:\pos2680.tmp
C:\pos2681.tmp
C:\pos2682.tmp
C:\pos2683.tmp
C:\pos2684.tmp
C:\pos2685.tmp
C:\pos2686.tmp
C:\pos2687.tmp
C:\pos2688.tmp
C:\pos2689.tmp
C:\pos268A.tmp
C:\pos268B.tmp
C:\pos268C.tmp
C:\pos268D.tmp
C:\pos268E.tmp
C:\pos268F.tmp
C:\pos269.tmp
C:\pos2690.tmp
C:\pos2691.tmp
C:\pos2692.tmp
C:\pos2693.tmp
C:\pos2694.tmp
C:\pos2695.tmp
C:\pos2696.tmp
C:\pos2697.tmp
C:\pos2698.tmp
C:\pos2699.tmp
C:\pos269A.tmp
C:\pos269B.tmp
C:\pos269C.tmp
C:\pos269D.tmp
C:\pos269E.tmp
C:\pos269F.tmp
C:\pos26A.tmp
C:\pos26A0.tmp
C:\pos26A1.tmp
C:\pos26A2.tmp
C:\pos26A3.tmp
C:\pos26A4.tmp
C:\pos26A5.tmp
C:\pos26A6.tmp
C:\pos26A7.tmp
C:\pos26A8.tmp
C:\pos26A9.tmp
C:\pos26AA.tmp
C:\pos26AB.tmp
C:\pos26AC.tmp
C:\pos26AD.tmp
C:\pos26AE.tmp
C:\pos26AF.tmp
C:\pos26B.tmp
C:\pos26B0.tmp
C:\pos26B1.tmp
C:\pos26B2.tmp
C:\pos26B3.tmp
C:\pos26B4.tmp
C:\pos26B5.tmp
C:\pos26B6.tmp
C:\pos26B7.tmp
C:\pos26B8.tmp
C:\pos26B9.tmp
C:\pos26BA.tmp
C:\pos26BB.tmp
C:\pos26BC.tmp
C:\pos26BD.tmp
C:\pos26BE.tmp
C:\pos26BF.tmp
C:\pos26C.tmp
C:\pos26C0.tmp
C:\pos26C1.tmp
C:\pos26C2.tmp
C:\pos26C3.tmp
C:\pos26C4.tmp
C:\pos26C5.tmp
C:\pos26C6.tmp
C:\pos26C7.tmp
C:\pos26C8.tmp
C:\pos26C9.tmp
C:\pos26CA.tmp
C:\pos26CB.tmp
C:\pos26CC.tmp
C:\pos26CD.tmp
C:\pos26CE.tmp
C:\pos26CF.tmp
C:\pos26D.tmp
C:\pos26D0.tmp
C:\pos26D1.tmp
C:\pos26D2.tmp
C:\pos26D3.tmp
C:\pos26D4.tmp
C:\pos26D5.tmp
C:\pos26D6.tmp
C:\pos26D7.tmp
C:\pos26D8.tmp
C:\pos26D9.tmp
C:\pos26DA.tmp
C:\pos26DB.tmp
C:\pos26DC.tmp
C:\pos26DD.tmp
C:\pos26DE.tmp
C:\pos26DF.tmp
C:\pos26E.tmp
C:\pos26E0.tmp
C:\pos26E1.tmp
C:\pos26E2.tmp
C:\pos26E3.tmp
C:\pos26E4.tmp
C:\pos26E5.tmp
C:\pos26E6.tmp
C:\pos26E7.tmp
C:\pos26E8.tmp
C:\pos26E9.tmp
C:\pos26F.tmp
C:\pos27.tmp
C:\pos270.tmp
C:\pos271.tmp
C:\pos272.tmp
C:\pos273.tmp
C:\pos274.tmp
C:\pos275.tmp
C:\pos276.tmp
C:\pos277.tmp
C:\pos278.tmp
C:\pos279.tmp
C:\pos27A.tmp
C:\pos27B.tmp
C:\pos27C.tmp
C:\pos27D.tmp
C:\pos27E.tmp
C:\pos27F.tmp
C:\pos28.tmp
C:\pos280.tmp
C:\pos281.tmp
C:\pos282.tmp
C:\pos283.tmp
C:\pos284.tmp
C:\pos285.tmp
C:\pos286.tmp
C:\pos287.tmp
C:\pos288.tmp
C:\pos289.tmp
C:\pos28A.tmp
C:\pos28B.tmp
C:\pos28C.tmp
C:\pos28D.tmp
C:\pos28E.tmp
C:\pos28F.tmp
C:\pos29.tmp
C:\pos290.tmp
C:\pos291.tmp
C:\pos292.tmp
C:\pos293.tmp
C:\pos294.tmp
C:\pos295.tmp
C:\pos296.tmp
C:\pos297.tmp
C:\pos298.tmp
C:\pos299.tmp
C:\pos29A.tmp
C:\pos29B.tmp
C:\pos29C.tmp
C:\pos29D.tmp
C:\pos29E.tmp
C:\pos29F.tmp
C:\pos2A.tmp
C:\pos2A0.tmp
C:\pos2A1.tmp
C:\pos2A2.tmp
C:\pos2A3.tmp
C:\pos2A4.tmp
C:\pos2A5.tmp
C:\pos2A6.tmp
C:\pos2A7.tmp
C:\pos2A8.tmp
C:\pos2A9.tmp
C:\pos2AA.tmp
C:\pos2AB.tmp
C:\pos2AC.tmp
C:\pos2AD.tmp
C:\pos2AE.tmp
C:\pos2AF.tmp
C:\pos2B.tmp
C:\pos2B0.tmp
C:\pos2B1.tmp
C:\pos2B2.tmp
C:\pos2B3.tmp
C:\pos2B4.tmp
C:\pos2B5.tmp
C:\pos2B6.tmp
C:\pos2B7.tmp
C:\pos2B8.tmp
C:\pos2B9.tmp
C:\pos2BA.tmp
C:\pos2BB.tmp
C:\pos2BC.tmp
C:\pos2BD.tmp
C:\pos2BE.tmp
C:\pos2BF.tmp
C:\pos2C.tmp
C:\pos2C0.tmp
C:\pos2C1.tmp
C:\pos2C2.tmp
C:\pos2C3.tmp
C:\pos2C4.tmp
C:\pos2C5.tmp
C:\pos2C6.tmp
C:\pos2C7.tmp
C:\pos2C8.tmp
C:\pos2C9.tmp
C:\pos2CA.tmp
C:\pos2CB.tmp
C:\pos2CC.tmp
C:\pos2CD.tmp
C:\pos2CE.tmp
C:\pos2CF.tmp
C:\pos2D.tmp
C:\pos2D0.tmp
C:\pos2D1.tmp
C:\pos2D2.tmp
C:\pos2D3.tmp
C:\pos2D4.tmp
C:\pos2D5.tmp
C:\pos2D6.tmp
C:\pos2D7.tmp
C:\pos2D8.tmp
C:\pos2D9.tmp
C:\pos2DA.tmp
C:\pos2DB.tmp
C:\pos2DC.tmp
C:\pos2DD.tmp
C:\pos2DE.tmp
C:\pos2DF.tmp
C:\pos2E.tmp
C:\pos2E0.tmp
C:\pos2E1.tmp
C:\pos2E2.tmp
C:\pos2E3.tmp
C:\pos2E4.tmp
C:\pos2E5.tmp
C:\pos2E6.tmp
C:\pos2E7.tmp
C:\pos2E8.tmp
C:\pos2E9.tmp
C:\pos2EA.tmp
C:\pos2EB.tmp
C:\pos2EC.tmp
C:\pos2ED.tmp
C:\pos2EE.tmp
C:\pos2EF.tmp
C:\pos2F.tmp
C:\pos2F0.tmp
C:\pos2F1.tmp
C:\pos2F2.tmp
C:\pos2F3.tmp
C:\pos2F4.tmp
C:\pos2F5.tmp
C:\pos2F6.tmp
C:\pos2F7.tmp
C:\pos2F8.tmp
C:\pos2F9.tmp
C:\pos2FA.tmp
C:\pos2FB.tmp
C:\pos2FC.tmp
C:\pos2FD.tmp
C:\pos2FE.tmp
C:\pos2FF.tmp
C:\pos3.tmp
C:\pos30.tmp
C:\pos300.tmp
C:\pos301.tmp
C:\pos302.tmp
C:\pos303.tmp
C:\pos304.tmp
C:\pos305.tmp
C:\pos306.tmp
C:\pos307.tmp
C:\pos308.tmp
C:\pos309.tmp
C:\pos30A.tmp
C:\pos30B.tmp
C:\pos30C.tmp
C:\pos30D.tmp
C:\pos30E.tmp
C:\pos30F.tmp
C:\pos31.tmp
C:\pos310.tmp
C:\pos311.tmp
C:\pos312.tmp
C:\pos313.tmp
C:\pos314.tmp
C:\pos315.tmp
C:\pos316.tmp
C:\pos317.tmp
C:\pos318.tmp
C:\pos319.tmp
C:\pos31A.tmp
C:\pos31B.tmp
C:\pos31C.tmp
C:\pos31D.tmp
C:\pos31E.tmp
C:\pos31F.tmp
C:\pos32.tmp
C:\pos320.tmp
C:\pos321.tmp
C:\pos322.tmp
C:\pos323.tmp
C:\pos324.tmp
C:\pos325.tmp
C:\pos326.tmp
C:\pos327.tmp
C:\pos328.tmp
C:\pos329.tmp
C:\pos32A.tmp
C:\pos32B.tmp
C:\pos32C.tmp
C:\pos32D.tmp
C:\pos32E.tmp
C:\pos32F.tmp
C:\pos33.tmp
C:\pos330.tmp
C:\pos331.tmp
C:\pos332.tmp
C:\pos333.tmp
C:\pos334.tmp
C:\pos335.tmp
C:\pos336.tmp
C:\pos337.tmp
C:\pos338.tmp
C:\pos339.tmp
C:\pos33A.tmp
C:\pos33B.tmp
C:\pos33C.tmp
C:\pos33D.tmp
C:\pos33E.tmp
C:\pos33F.tmp
C:\pos34.tmp
C:\pos340.tmp
C:\pos341.tmp
C:\pos342.tmp
C:\pos343.tmp
C:\pos344.tmp
C:\pos345.tmp
C:\pos346.tmp
C:\pos347.tmp
C:\pos348.tmp
C:\pos349.tmp
C:\pos34A.tmp
C:\pos34B.tmp
C:\pos34C.tmp
C:\pos34D.tmp
C:\pos34E.tmp
C:\pos34F.tmp
C:\pos35.tmp
C:\pos350.tmp
C:\pos351.tmp
C:\pos352.tmp
C:\pos353.tmp
C:\pos354.tmp
C:\pos355.tmp
C:\pos356.tmp
C:\pos357.tmp
C:\pos358.tmp
C:\pos359.tmp
C:\pos35A.tmp
C:\pos35B.tmp
C:\pos35C.tmp
C:\pos35D.tmp
C:\pos35E.tmp
C:\pos35F.tmp
C:\pos36.tmp
C:\pos360.tmp
C:\pos361.tmp
C:\pos362.tmp
C:\pos363.tmp
C:\pos364.tmp
C:\pos365.tmp
C:\pos366.tmp
C:\pos367.tmp
C:\pos368.tmp
C:\pos369.tmp
C:\pos36A.tmp
C:\pos36B.tmp
C:\pos36C.tmp
C:\pos36D.tmp
C:\pos36E.tmp
C:\pos36F.tmp
C:\pos37.tmp
C:\pos370.tmp
C:\pos371.tmp
C:\pos372.tmp
C:\pos373.tmp
C:\pos374.tmp
C:\pos375.tmp
C:\pos376.tmp
C:\pos377.tmp
C:\pos378.tmp
C:\pos379.tmp
C:\pos37A.tmp
C:\pos37B.tmp
C:\pos37C.tmp
C:\pos37D.tmp
C:\pos37E.tmp
C:\pos37F.tmp
C:\pos38.tmp
C:\pos380.tmp
C:\pos381.tmp
C:\pos382.tmp
C:\pos383.tmp
C:\pos384.tmp
C:\pos385.tmp
C:\pos386.tmp
C:\pos387.tmp
C:\pos388.tmp
C:\pos389.tmp
C:\pos38A.tmp
C:\pos38B.tmp
C:\pos38C.tmp
C:\pos38D.tmp
C:\pos38E.tmp
C:\pos38F.tmp
C:\pos39.tmp
C:\pos390.tmp
C:\pos391.tmp
C:\pos392.tmp
C:\pos393.tmp
C:\pos394.tmp
C:\pos395.tmp
C:\pos396.tmp
C:\pos397.tmp
C:\pos398.tmp
C:\pos399.tmp
C:\pos39A.tmp
C:\pos39B.tmp
C:\pos39C.tmp
C:\pos39D.tmp
C:\pos39E.tmp
C:\pos39F.tmp
C:\pos3A.tmp
C:\pos3A0.tmp
C:\pos3A1.tmp
C:\pos3A2.tmp
C:\pos3A3.tmp
C:\pos3A4.tmp
C:\pos3A5.tmp
C:\pos3A6.tmp
C:\pos3A7.tmp
C:\pos3A8.tmp
C:\pos3A9.tmp
C:\pos3AA.tmp
C:\pos3AB.tmp
C:\pos3AC.tmp
C:\pos3AD.tmp
C:\pos3AE.tmp
C:\pos3AF.tmp
C:\pos3B.tmp
C:\pos3B0.tmp
C:\pos3B1.tmp
C:\pos3B2.tmp
C:\pos3B3.tmp
C:\pos3B4.tmp
C:\pos3B5.tmp
C:\pos3B6.tmp
C:\pos3B7.tmp
C:\pos3B8.tmp
C:\pos3B9.tmp
C:\pos3BA.tmp
C:\pos3BB.tmp
C:\pos3BC.tmp
C:\pos3BD.tmp
C:\pos3BE.tmp
C:\pos3BF.tmp
C:\pos3C.tmp
C:\pos3C0.tmp
C:\pos3C1.tmp
C:\pos3C2.tmp
C:\pos3C3.tmp
C:\pos3C4.tmp
C:\pos3C5.tmp
C:\pos3C6.tmp
C:\pos3C7.tmp
C:\pos3C8.tmp
C:\pos3C9.tmp
C:\pos3CA.tmp
C:\pos3CB.tmp
C:\pos3CC.tmp
C:\pos3CD.tmp
C:\pos3CE.tmp
C:\pos3CF.tmp
C:\pos3D.tmp
C:\pos3D0.tmp
C:\pos3D1.tmp
C:\pos3D2.tmp
C:\pos3D3.tmp
C:\pos3D4.tmp
C:\pos3D5.tmp
C:\pos3D6.tmp
C:\pos3D7.tmp
C:\pos3D8.tmp
C:\pos3D9.tmp
C:\pos3DA.tmp
C:\pos3DB.tmp
C:\pos3DC.tmp
C:\pos3DD.tmp
C:\pos3DE.tmp
C:\pos3DF.tmp
C:\pos3E.tmp
C:\pos3E0.tmp
C:\pos3E1.tmp
C:\pos3E2.tmp
C:\pos3E3.tmp
C:\pos3E4.tmp
C:\pos3E5.tmp
C:\pos3E6.tmp
C:\pos3E7.tmp
C:\pos3E8.tmp
C:\pos3E9.tmp
C:\pos3EA.tmp
C:\pos3EB.tmp
C:\pos3EC.tmp
C:\pos3ED.tmp
C:\pos3EE.tmp
C:\pos3EF.tmp
C:\pos3F.tmp
C:\pos3F0.tmp
C:\pos3F1.tmp
C:\pos3F2.tmp
C:\pos3F3.tmp
C:\pos3F4.tmp
C:\pos3F5.tmp
C:\pos3F6.tmp
C:\pos3F7.tmp
C:\pos3F8.tmp
C:\pos3F9.tmp
C:\pos3FA.tmp
C:\pos3FB.tmp
C:\pos3FC.tmp
C:\pos3FD.tmp
C:\pos3FE.tmp
C:\pos3FF.tmp
C:\pos4.tmp
C:\pos40.tmp
C:\pos400.tmp
C:\pos401.tmp
C:\pos402.tmp
C:\pos403.tmp
C:\pos404.tmp
C:\pos405.tmp
C:\pos406.tmp
C:\pos407.tmp
C:\pos408.tmp
C:\pos409.tmp
C:\pos40A.tmp
C:\pos40B.tmp
C:\pos40C.tmp
C:\pos40D.tmp
C:\pos40E.tmp
C:\pos40F.tmp
C:\pos41.tmp
C:\pos410.tmp
C:\pos411.tmp
C:\pos412.tmp
C:\pos413.tmp
C:\pos414.tmp
C:\pos415.tmp
C:\pos416.tmp
C:\pos417.tmp
C:\pos418.tmp
C:\pos419.tmp
C:\pos41A.tmp
C:\pos41B.tmp
C:\pos41C.tmp
C:\pos41D.tmp
C:\pos41E.tmp
C:\pos41F.tmp
C:\pos42.tmp
C:\pos420.tmp
C:\pos421.tmp
C:\pos422.tmp
C:\pos423.tmp
C:\pos424.tmp
C:\pos425.tmp
C:\pos426.tmp
C:\pos427.tmp
C:\pos428.tmp
C:\pos429.tmp
C:\pos42A.tmp
C:\pos42B.tmp
C:\pos42C.tmp
C:\pos42D.tmp
C:\pos42E.tmp
C:\pos42F.tmp
C:\pos43.tmp
C:\pos430.tmp
C:\pos431.tmp
C:\pos432.tmp
C:\pos433.tmp
C:\pos434.tmp
C:\pos435.tmp
C:\pos436.tmp
C:\pos437.tmp
C:\pos438.tmp
C:\pos439.tmp
C:\pos43A.tmp
C:\pos43B.tmp
C:\pos43C.tmp
C:\pos43D.tmp
C:\pos43E.tmp
C:\pos43F.tmp
C:\pos44.tmp
C:\pos440.tmp
C:\pos441.tmp
C:\pos442.tmp
C:\pos443.tmp
C:\pos444.tmp
C:\pos445.tmp
C:\pos446.tmp
C:\pos447.tmp
C:\pos448.tmp
C:\pos449.tmp
C:\pos44A.tmp
C:\pos44B.tmp
C:\pos44C.tmp
C:\pos44D.tmp
C:\pos44E.tmp
C:\pos44F.tmp
C:\pos45.tmp
C:\pos450.tmp
C:\pos451.tmp
C:\pos452.tmp
C:\pos453.tmp
C:\pos454.tmp
C:\pos455.tmp
C:\pos456.tmp
C:\pos457.tmp
C:\pos458.tmp
C:\pos459.tmp
C:\pos45A.tmp
C:\pos45B.tmp
C:\pos45C.tmp
C:\pos45D.tmp
C:\pos45E.tmp
C:\pos45F.tmp
C:\pos46.tmp
C:\pos460.tmp
C:\pos461.tmp
C:\pos462.tmp
C:\pos463.tmp
C:\pos464.tmp
C:\pos465.tmp
C:\pos466.tmp
C:\pos467.tmp
C:\pos468.tmp
C:\pos469.tmp
C:\pos46A.tmp
C:\pos46B.tmp
C:\pos46C.tmp
C:\pos46D.tmp
C:\pos46E.tmp
C:\pos46F.tmp
C:\pos47.tmp
C:\pos470.tmp
C:\pos471.tmp
C:\pos472.tmp
C:\pos473.tmp
C:\pos474.tmp
C:\pos475.tmp
C:\pos476.tmp
C:\pos477.tmp
C:\pos478.tmp
C:\pos479.tmp
C:\pos47A.tmp
C:\pos47B.tmp
C:\pos47C.tmp
C:\pos47D.tmp
C:\pos47E.tmp
C:\pos47F.tmp
C:\pos48.tmp
C:\pos480.tmp
C:\pos481.tmp
C:\pos482.tmp
C:\pos483.tmp
C:\pos484.tmp
C:\pos485.tmp
C:\pos486.tmp
C:\pos487.tmp
C:\pos488.tmp
C:\pos489.tmp
C:\pos48A.tmp
C:\pos48B.tmp
C:\pos48C.tmp
C:\pos48D.tmp
C:\pos48E.tmp
C:\pos48F.tmp
C:\pos49.tmp
C:\pos490.tmp
C:\pos491.tmp
C:\pos492.tmp
C:\pos493.tmp
C:\pos494.tmp
C:\pos495.tmp
C:\pos496.tmp
C:\pos497.tmp
C:\pos498.tmp
C:\pos499.tmp
C:\pos49A.tmp
C:\pos49B.tmp
C:\pos49C.tmp
C:\pos49D.tmp
C:\pos49E.tmp
C:\pos49F.tmp
C:\pos4A.tmp
C:\pos4A0.tmp
C:\pos4A1.tmp
C:\pos4A2.tmp
C:\pos4A3.tmp
C:\pos4A4.tmp
C:\pos4A5.tmp
C:\pos4A6.tmp
C:\pos4A7.tmp
C:\pos4A8.tmp
C:\pos4A9.tmp
C:\pos4AA.tmp
C:\pos4AB.tmp
C:\pos4AC.tmp
C:\pos4AD.tmp
C:\pos4AE.tmp
C:\pos4AF.tmp
C:\pos4B.tmp
C:\pos4B0.tmp
C:\pos4B1.tmp
C:\pos4B2.tmp
C:\pos4B3.tmp
C:\pos4B4.tmp
C:\pos4B5.tmp
C:\pos4B6.tmp
C:\pos4B7.tmp
C:\pos4B8.tmp
C:\pos4B9.tmp
C:\pos4BA.tmp
C:\pos4BB.tmp
C:\pos4BC.tmp
C:\pos4BD.tmp
C:\pos4BE.tmp
C:\pos4BF.tmp
C:\pos4C.tmp
C:\pos4C0.tmp
C:\pos4C1.tmp
C:\pos4C2.tmp
C:\pos4C3.tmp
C:\pos4C4.tmp
C:\pos4C5.tmp
C:\pos4C6.tmp
C:\pos4C7.tmp
C:\pos4C8.tmp
C:\pos4C9.tmp
C:\pos4CA.tmp
C:\pos4CB.tmp
C:\pos4CC.tmp
C:\pos4CD.tmp
C:\pos4CE.tmp
C:\pos4CF.tmp
C:\pos4D.tmp
C:\pos4D0.tmp
C:\pos4D1.tmp
C:\pos4D2.tmp
C:\pos4D3.tmp
C:\pos4D4.tmp
C:\pos4D5.tmp
C:\pos4D6.tmp
C:\pos4D7.tmp
C:\pos4D8.tmp
C:\pos4D9.tmp
C:\pos4DA.tmp
C:\pos4DB.tmp
C:\pos4DC.tmp
C:\pos4DD.tmp
C:\pos4DE.tmp
C:\pos4DF.tmp
C:\pos4E.tmp
C:\pos4E0.tmp
C:\pos4E1.tmp
C:\pos4E2.tmp
C:\pos4E3.tmp
C:\pos4E4.tmp
C:\pos4E5.tmp
C:\pos4E6.tmp
C:\pos4E7.tmp
C:\pos4E8.tmp
C:\pos4E9.tmp
C:\pos4EA.tmp
C:\pos4EB.tmp
C:\pos4EC.tmp
C:\pos4ED.tmp
C:\pos4EE.tmp
C:\pos4EF.tmp
C:\pos4F.tmp
C:\pos4F0.tmp
C:\pos4F1.tmp
C:\pos4F2.tmp
C:\pos4F3.tmp
C:\pos4F4.tmp
C:\pos4F5.tmp
C:\pos4F6.tmp
C:\pos4F7.tmp
C:\pos4F8.tmp
C:\pos4F9.tmp
C:\pos4FA.tmp
C:\pos4FB.tmp
C:\pos4FC.tmp
C:\pos4FD.tmp
C:\pos4FE.tmp
C:\pos4FF.tmp
C:\pos5.tmp
C:\pos50.tmp
C:\pos500.tmp
C:\pos501.tmp
C:\pos502.tmp
C:\pos503.tmp
C:\pos504.tmp
C:\pos505.tmp
C:\pos506.tmp
C:\pos507.tmp
C:\pos508.tmp
C:\pos509.tmp
C:\pos50A.tmp
C:\pos50B.tmp
C:\pos50C.tmp
C:\pos50D.tmp
C:\pos50E.tmp
C:\pos50F.tmp
C:\pos51.tmp
C:\pos510.tmp
C:\pos511.tmp
C:\pos512.tmp
C:\pos513.tmp
C:\pos514.tmp
C:\pos515.tmp
C:\pos516.tmp
C:\pos517.tmp
C:\pos518.tmp
C:\pos519.tmp
C:\pos51A.tmp
C:\pos51B.tmp
C:\pos51C.tmp
C:\pos51D.tmp
C:\pos51E.tmp
C:\pos51F.tmp
C:\pos52.tmp
C:\pos520.tmp
C:\pos521.tmp
C:\pos522.tmp
C:\pos523.tmp
C:\pos524.tmp
C:\pos525.tmp
C:\pos526.tmp
C:\pos527.tmp
C:\pos528.tmp
C:\pos529.tmp
C:\pos52A.tmp
C:\pos52B.tmp
C:\pos52C.tmp
C:\pos52D.tmp
C:\pos52E.tmp
C:\pos52F.tmp
C:\pos53.tmp
C:\pos530.tmp
C:\pos531.tmp
C:\pos532.tmp
C:\pos533.tmp
C:\pos534.tmp
C:\pos535.tmp
C:\pos536.tmp
C:\pos537.tmp
C:\pos538.tmp
C:\pos539.tmp
C:\pos53A.tmp
C:\pos53B.tmp
C:\pos53C.tmp
C:\pos53D.tmp
C:\pos53E.tmp
C:\pos53F.tmp
C:\pos54.tmp
C:\pos540.tmp
C:\pos541.tmp
C:\pos542.tmp
C:\pos543.tmp
C:\pos544.tmp
C:\pos545.tmp
C:\pos546.tmp
C:\pos547.tmp
C:\pos548.tmp
C:\pos549.tmp
C:\pos54A.tmp
C:\pos54B.tmp
C:\pos54C.tmp
C:\pos54D.tmp
C:\pos54E.tmp
C:\pos54F.tmp
C:\pos55.tmp
C:\pos550.tmp
C:\pos551.tmp
C:\pos552.tmp
C:\pos553.tmp
C:\pos554.tmp
C:\pos555.tmp
C:\pos556.tmp
C:\pos557.tmp
C:\pos558.tmp
C:\pos559.tmp
C:\pos55A.tmp
C:\pos55B.tmp
C:\pos55C.tmp
C:\pos55D.tmp
C:\pos55E.tmp
C:\pos55F.tmp
C:\pos56.tmp
C:\pos560.tmp
C:\pos561.tmp
C:\pos562.tmp
C:\pos563.tmp
C:\pos564.tmp
C:\pos565.tmp
C:\pos566.tmp
C:\pos567.tmp
C:\pos568.tmp
C:\pos569.tmp
C:\pos56A.tmp
C:\pos56B.tmp
C:\pos56C.tmp
C:\pos56D.tmp
C:\pos56E.tmp
C:\pos56F.tmp
C:\pos57.tmp
C:\pos570.tmp
C:\pos571.tmp
C:\pos572.tmp
C:\pos573.tmp
C:\pos574.tmp
C:\pos575.tmp
C:\pos576.tmp
C:\pos577.tmp
C:\pos578.tmp
C:\pos579.tmp
C:\pos57A.tmp
C:\pos57B.tmp
C:\pos57C.tmp
C:\pos57D.tmp
C:\pos57E.tmp
C:\pos57F.tmp
C:\pos58.tmp
C:\pos580.tmp
C:\pos581.tmp
C:\pos582.tmp
C:\pos583.tmp
C:\pos584.tmp
C:\pos585.tmp
C:\pos586.tmp
C:\pos587.tmp
C:\pos588.tmp
C:\pos589.tmp
C:\pos58A.tmp
C:\pos58B.tmp
C:\pos58C.tmp
C:\pos58D.tmp
C:\pos58E.tmp
C:\pos58F.tmp
C:\pos59.tmp
C:\pos590.tmp
C:\pos591.tmp
C:\pos592.tmp
C:\pos593.tmp
C:\pos594.tmp
C:\pos595.tmp
C:\pos596.tmp
C:\pos597.tmp
C:\pos598.tmp
C:\pos599.tmp
C:\pos59A.tmp
C:\pos59B.tmp
C:\pos59C.tmp
C:\pos59D.tmp
C:\pos59E.tmp
C:\pos59F.tmp
C:\pos5A.tmp
C:\pos5A0.tmp
C:\pos5A1.tmp
C:\pos5A2.tmp
C:\pos5A3.tmp
C:\pos5A4.tmp
C:\pos5A5.tmp
C:\pos5A6.tmp
C:\pos5A7.tmp
C:\pos5A8.tmp
C:\pos5A9.tmp
C:\pos5AA.tmp
C:\pos5AB.tmp
C:\pos5AC.tmp
C:\pos5AD.tmp
C:\pos5AE.tmp
C:\pos5AF.tmp
C:\pos5B.tmp
C:\pos5B0.tmp
C:\pos5B1.tmp
C:\pos5B2.tmp
C:\pos5B3.tmp
C:\pos5B4.tmp
C:\pos5B5.tmp
C:\pos5B6.tmp
C:\pos5B7.tmp
C:\pos5B8.tmp
C:\pos5B9.tmp
C:\pos5BA.tmp
C:\pos5BB.tmp
C:\pos5BC.tmp
C:\pos5BD.tmp
C:\pos5BE.tmp
C:\pos5BF.tmp
C:\pos5C.tmp
C:\pos5C0.tmp
C:\pos5C1.tmp
C:\pos5C2.tmp
C:\pos5C3.tmp
C:\pos5C4.tmp
C:\pos5C5.tmp
C:\pos5C6.tmp
C:\pos5C7.tmp
C:\pos5C8.tmp
C:\pos5C9.tmp
C:\pos5CA.tmp
C:\pos5CB.tmp
C:\pos5CC.tmp
C:\pos5CD.tmp
C:\pos5CE.tmp
C:\pos5CF.tmp
C:\pos5D.tmp
C:\pos5D0.tmp
C:\pos5D1.tmp
C:\pos5D2.tmp
C:\pos5D3.tmp
C:\pos5D4.tmp
C:\pos5D5.tmp
C:\pos5D6.tmp
C:\pos5D7.tmp
C:\pos5D8.tmp
C:\pos5D9.tmp
C:\pos5DA.tmp
C:\pos5DB.tmp
C:\pos5DC.tmp
C:\pos5DD.tmp
C:\pos5DE.tmp
C:\pos5E.tmp
C:\pos5F.tmp
C:\pos6.tmp
C:\pos60.tmp
C:\pos61.tmp
C:\pos62.tmp
C:\pos63.tmp
C:\pos64.tmp
C:\pos65.tmp
C:\pos66.tmp
C:\pos67.tmp
C:\pos68.tmp
C:\pos69.tmp
C:\pos6A.tmp
C:\pos6B.tmp
C:\pos6C.tmp
C:\pos6D.tmp
C:\pos6E.tmp
C:\pos6F.tmp
C:\pos7.tmp
C:\pos70.tmp
C:\pos71.tmp
C:\pos72.tmp
C:\pos73.tmp
C:\pos74.tmp
C:\pos75.tmp
C:\pos76.tmp
C:\pos77.tmp
C:\pos77B.tmp
C:\pos77C.tmp
C:\pos77D.tmp
C:\pos77E.tmp
C:\pos77F.tmp
C:\pos78.tmp
C:\pos780.tmp
C:\pos781.tmp
C:\pos782.tmp
C:\pos783.tmp
C:\pos784.tmp
C:\pos785.tmp
C:\pos786.tmp
C:\pos787.tmp
C:\pos788.tmp
C:\pos789.tmp
C:\pos78A.tmp
C:\pos78B.tmp
C:\pos78C.tmp
C:\pos78D.tmp
C:\pos78E.tmp
C:\pos78F.tmp
C:\pos79.tmp
C:\pos790.tmp
C:\pos791.tmp
C:\pos792.tmp
C:\pos793.tmp
C:\pos794.tmp
C:\pos795.tmp
C:\pos796.tmp
C:\pos797.tmp
C:\pos798.tmp
C:\pos799.tmp
C:\pos79A.tmp
C:\pos79B.tmp
C:\pos79C.tmp
C:\pos79D.tmp
C:\pos79E.tmp
C:\pos79F.tmp
C:\pos7A.tmp
C:\pos7A0.tmp
C:\pos7A1.tmp
C:\pos7A2.tmp
C:\pos7A3.tmp
C:\pos7A4.tmp
C:\pos7A5.tmp
C:\pos7A6.tmp
C:\pos7A7.tmp
C:\pos7A8.tmp
C:\pos7A9.tmp
C:\pos7AA.tmp
C:\pos7AB.tmp
C:\pos7AC.tmp
C:\pos7AD.tmp
C:\pos7AE.tmp
C:\pos7AF.tmp
C:\pos7B.tmp
C:\pos7B0.tmp
C:\pos7B1.tmp
C:\pos7B2.tmp
C:\pos7B3.tmp
C:\pos7B4.tmp
C:\pos7B5.tmp
C:\pos7B6.tmp
C:\pos7B7.tmp
C:\pos7B8.tmp
C:\pos7B9.tmp
C:\pos7BA.tmp
C:\pos7BB.tmp
C:\pos7BC.tmp
C:\pos7BD.tmp
C:\pos7BE.tmp
C:\pos7BF.tmp
C:\pos7C.tmp
C:\pos7C0.tmp
C:\pos7C1.tmp
C:\pos7C2.tmp
C:\pos7C3.tmp
C:\pos7C4.tmp
C:\pos7C5.tmp
C:\pos7C6.tmp
C:\pos7C7.tmp
C:\pos7C8.tmp
C:\pos7C9.tmp
C:\pos7CA.tmp
C:\pos7CB.tmp
C:\pos7CC.tmp
C:\pos7CD.tmp
C:\pos7CE.tmp
C:\pos7CF.tmp
C:\pos7D.tmp
C:\pos7D0.tmp
C:\pos7D1.tmp
C:\pos7D2.tmp
C:\pos7D3.tmp
C:\pos7D4.tmp
C:\pos7D5.tmp
C:\pos7D6.tmp
C:\pos7D7.tmp
C:\pos7D8.tmp
C:\pos7D9.tmp
C:\pos7DA.tmp
C:\pos7DB.tmp
C:\pos7DC.tmp
C:\pos7DD.tmp
C:\pos7DE.tmp
C:\pos7DF.tmp
C:\pos7E.tmp
C:\pos7E0.tmp
C:\pos7E1.tmp
C:\pos7E2.tmp
C:\pos7E3.tmp
C:\pos7E4.tmp
C:\pos7E5.tmp
C:\pos7E6.tmp
C:\pos7E7.tmp
C:\pos7E8.tmp
C:\pos7E9.tmp
C:\pos7EA.tmp
C:\pos7EB.tmp
C:\pos7EC.tmp
C:\pos7ED.tmp
C:\pos7EE.tmp
C:\pos7EF.tmp
C:\pos7F.tmp
C:\pos7F0.tmp
C:\pos7F1.tmp
C:\pos7F2.tmp
C:\pos7F3.tmp
C:\pos7F4.tmp
C:\pos7F5.tmp
C:\pos7F6.tmp
C:\pos7F7.tmp
C:\pos7F8.tmp
C:\pos7F9.tmp
C:\pos7FA.tmp
C:\pos7FB.tmp
C:\pos7FC.tmp
C:\pos7FD.tmp
C:\pos7FE.tmp
C:\pos7FF.tmp
C:\pos8.tmp
C:\pos80.tmp
C:\pos800.tmp
C:\pos801.tmp
C:\pos802.tmp
C:\pos803.tmp
C:\pos804.tmp
C:\pos805.tmp
C:\pos806.tmp
C:\pos807.tmp
C:\pos808.tmp
C:\pos809.tmp
C:\pos80A.tmp
C:\pos80B.tmp
C:\pos80C.tmp
C:\pos80D.tmp
C:\pos80E.tmp
C:\pos80F.tmp
C:\pos81.tmp
C:\pos810.tmp
C:\pos811.tmp
C:\pos812.tmp
C:\pos813.tmp
C:\pos814.tmp
C:\pos815.tmp
C:\pos816.tmp
C:\pos817.tmp
C:\pos818.tmp
C:\pos819.tmp
C:\pos81A.tmp
C:\pos81B.tmp
C:\pos81C.tmp
C:\pos81D.tmp
C:\pos81E.tmp
C:\pos81F.tmp
C:\pos82.tmp
C:\pos820.tmp
C:\pos821.tmp
C:\pos822.tmp
C:\pos823.tmp
C:\pos824.tmp
C:\pos825.tmp
C:\pos826.tmp
C:\pos827.tmp
C:\pos828.tmp
C:\pos829.tmp
C:\pos82A.tmp
C:\pos82B.tmp
C:\pos82C.tmp
C:\pos82D.tmp
C:\pos82E.tmp
C:\pos82F.tmp
C:\pos83.tmp
C:\pos830.tmp
C:\pos831.tmp
C:\pos832.tmp
C:\pos833.tmp
C:\pos834.tmp
C:\pos835.tmp
C:\pos836.tmp
C:\pos837.tmp
C:\pos838.tmp
C:\pos839.tmp
C:\pos83A.tmp
C:\pos83B.tmp
C:\pos83C.tmp
C:\pos83D.tmp
C:\pos83E.tmp
C:\pos83F.tmp
C:\pos84.tmp
C:\pos840.tmp
C:\pos841.tmp
C:\pos842.tmp
C:\pos843.tmp
C:\pos844.tmp
C:\pos845.tmp
C:\pos846.tmp
C:\pos847.tmp
C:\pos848.tmp
C:\pos849.tmp
C:\pos84A.tmp
C:\pos84B.tmp
C:\pos84C.tmp
C:\pos84D.tmp
C:\pos84E.tmp
C:\pos84F.tmp
C:\pos85.tmp
C:\pos850.tmp
C:\pos851.tmp
C:\pos852.tmp
C:\pos853.tmp
C:\pos854.tmp
C:\pos855.tmp
C:\pos856.tmp
C:\pos857.tmp
C:\pos858.tmp
C:\pos859.tmp
C:\pos85A.tmp
C:\pos85B.tmp
C:\pos85C.tmp
C:\pos85D.tmp
C:\pos85E.tmp
C:\pos85F.tmp
C:\pos86.tmp
C:\pos860.tmp
C:\pos861.tmp
C:\pos862.tmp
C:\pos863.tmp
C:\pos864.tmp
C:\pos865.tmp
C:\pos866.tmp
C:\pos867.tmp
C:\pos868.tmp
C:\pos869.tmp
C:\pos86A.tmp
C:\pos86B.tmp
C:\pos86C.tmp
C:\pos86D.tmp
C:\pos86E.tmp
C:\pos86F.tmp
C:\pos87.tmp
C:\pos870.tmp
C:\pos871.tmp
C:\pos872.tmp
C:\pos873.tmp
C:\pos874.tmp
C:\pos875.tmp
C:\pos876.tmp
C:\pos877.tmp
C:\pos878.tmp
C:\pos879.tmp
C:\pos87A.tmp
C:\pos87B.tmp
C:\pos87C.tmp
C:\pos87D.tmp
C:\pos87E.tmp
C:\pos87F.tmp
C:\pos88.tmp
C:\pos880.tmp
C:\pos881.tmp
C:\pos882.tmp
C:\pos883.tmp
C:\pos884.tmp
C:\pos885.tmp
C:\pos886.tmp
C:\pos887.tmp
C:\pos888.tmp
C:\pos889.tmp
C:\pos88A.tmp
C:\pos88B.tmp
C:\pos88C.tmp
C:\pos88D.tmp
C:\pos88E.tmp
C:\pos88F.tmp
C:\pos89.tmp
C:\pos890.tmp
C:\pos891.tmp
C:\pos892.tmp
C:\pos893.tmp
C:\pos894.tmp
C:\pos895.tmp
C:\pos896.tmp
C:\pos897.tmp
C:\pos898.tmp
C:\pos899.tmp
C:\pos89A.tmp
C:\pos89B.tmp
C:\pos89C.tmp
C:\pos89D.tmp
C:\pos89E.tmp
C:\pos89F.tmp
C:\pos8A.tmp
C:\pos8A0.tmp
C:\pos8A1.tmp
C:\pos8A2.tmp
C:\pos8A3.tmp
C:\pos8A4.tmp
C:\pos8A5.tmp
C:\pos8A6.tmp
C:\pos8A7.tmp
C:\pos8A8.tmp
C:\pos8A9.tmp
C:\pos8AA.tmp
C:\pos8AB.tmp
C:\pos8AC.tmp
C:\pos8AD.tmp
C:\pos8AE.tmp
C:\pos8AF.tmp
C:\pos8B.tmp
C:\pos8B0.tmp
C:\pos8B1.tmp
C:\pos8B2.tmp
C:\pos8B3.tmp
C:\pos8B4.tmp
C:\pos8B5.tmp
C:\pos8B6.tmp
C:\pos8B7.tmp
C:\pos8B8.tmp
C:\pos8B9.tmp
C:\pos8BA.tmp
C:\pos8BB.tmp
C:\pos8BC.tmp
C:\pos8BD.tmp
C:\pos8BE.tmp
C:\pos8BF.tmp
C:\pos8C.tmp
C:\pos8C0.tmp
C:\pos8C1.tmp
C:\pos8C2.tmp
C:\pos8C3.tmp
C:\pos8C4.tmp
C:\pos8C5.tmp
C:\pos8C6.tmp
C:\pos8C7.tmp
C:\pos8C8.tmp
C:\pos8C9.tmp
C:\pos8CA.tmp
C:\pos8CB.tmp
C:\pos8CC.tmp
C:\pos8CD.tmp
C:\pos8CE.tmp
C:\pos8CF.tmp
C:\pos8D.tmp
C:\pos8D0.tmp
C:\pos8D1.tmp
C:\pos8D2.tmp
C:\pos8D3.tmp
C:\pos8D4.tmp
C:\pos8D5.tmp
C:\pos8D6.tmp
C:\pos8D7.tmp
C:\pos8D8.tmp
C:\pos8D9.tmp
C:\pos8DA.tmp
C:\pos8DB.tmp
C:\pos8DC.tmp
C:\pos8DD.tmp
C:\pos8DE.tmp
C:\pos8DF.tmp
C:\pos8E.tmp
C:\pos8E0.tmp
C:\pos8E1.tmp
C:\pos8E2.tmp
C:\pos8E3.tmp
C:\pos8E4.tmp
C:\pos8E5.tmp
C:\pos8E6.tmp
C:\pos8E7.tmp
C:\pos8E8.tmp
C:\pos8E9.tmp
C:\pos8EA.tmp
C:\pos8EB.tmp
C:\pos8EC.tmp
C:\pos8ED.tmp
C:\pos8EE.tmp
C:\pos8EF.tmp
C:\pos8F.tmp
C:\pos8F0.tmp
C:\pos8F1.tmp
C:\pos8F2.tmp
C:\pos8F3.tmp
C:\pos8F4.tmp
C:\pos8F5.tmp
C:\pos8F6.tmp
C:\pos8F7.tmp
C:\pos8F8.tmp
C:\pos8F9.tmp
C:\pos8FA.tmp
C:\pos8FB.tmp
C:\pos8FC.tmp
C:\pos8FD.tmp
C:\pos8FE.tmp
C:\pos8FF.tmp
C:\pos9.tmp
C:\pos90.tmp
C:\pos900.tmp
C:\pos901.tmp
C:\pos902.tmp
C:\pos903.tmp
C:\pos904.tmp
C:\pos905.tmp
C:\pos906.tmp
C:\pos907.tmp
C:\pos908.tmp
C:\pos909.tmp
C:\pos90A.tmp
C:\pos90B.tmp
C:\pos90C.tmp
C:\pos90D.tmp
C:\pos90E.tmp
C:\pos90F.tmp
C:\pos91.tmp
C:\pos910.tmp
C:\pos911.tmp
C:\pos912.tmp
C:\pos913.tmp
C:\pos914.tmp
C:\pos915.tmp
C:\pos916.tmp
C:\pos917.tmp
C:\pos918.tmp
C:\pos919.tmp
C:\pos91A.tmp
C:\pos91B.tmp
C:\pos91C.tmp
C:\pos91D.tmp
C:\pos91E.tmp
C:\pos91F.tmp
C:\pos92.tmp
C:\pos920.tmp
C:\pos921.tmp
C:\pos922.tmp
C:\pos923.tmp
C:\pos924.tmp
C:\pos925.tmp
C:\pos926.tmp
C:\pos927.tmp
C:\pos928.tmp
C:\pos929.tmp
C:\pos92A.tmp
C:\pos92B.tmp
C:\pos92C.tmp
C:\pos92D.tmp
C:\pos92E.tmp
C:\pos92F.tmp
C:\pos93.tmp
C:\pos930.tmp
C:\pos931.tmp
C:\pos932.tmp
C:\pos933.tmp
C:\pos934.tmp
C:\pos935.tmp
C:\pos936.tmp
C:\pos937.tmp
C:\pos938.tmp
C:\pos939.tmp
C:\pos93A.tmp
C:\pos93B.tmp
C:\pos93C.tmp
C:\pos93D.tmp
C:\pos93E.tmp
C:\pos93F.tmp
C:\pos94.tmp
C:\pos940.tmp
C:\pos941.tmp
C:\pos942.tmp
C:\pos943.tmp
C:\pos944.tmp
C:\pos945.tmp
C:\pos946.tmp
C:\pos947.tmp
C:\pos948.tmp
C:\pos949.tmp
C:\pos94A.tmp
C:\pos94B.tmp
C:\pos94C.tmp
C:\pos94D.tmp
C:\pos94E.tmp
C:\pos94F.tmp
C:\pos95.tmp
C:\pos950.tmp
C:\pos951.tmp
C:\pos952.tmp
C:\pos953.tmp
C:\pos954.tmp
C:\pos955.tmp
C:\pos956.tmp
C:\pos957.tmp
C:\pos958.tmp
C:\pos959.tmp
C:\pos95A.tmp
C:\pos95B.tmp
C:\pos95C.tmp
C:\pos95D.tmp
C:\pos95E.tmp
C:\pos95F.tmp
C:\pos96.tmp
C:\pos960.tmp
C:\pos961.tmp
C:\pos962.tmp
C:\pos963.tmp
C:\pos964.tmp
C:\pos965.tmp
C:\pos966.tmp
C:\pos967.tmp
C:\pos968.tmp
C:\pos969.tmp
C:\pos96A.tmp
C:\pos96B.tmp
C:\pos96C.tmp
C:\pos96D.tmp
C:\pos96E.tmp
C:\pos97.tmp
C:\pos98.tmp
C:\pos99.tmp
C:\pos9A.tmp
C:\pos9B.tmp
C:\pos9C.tmp
C:\pos9D.tmp
C:\pos9E.tmp
C:\pos9F.tmp
C:\posA.tmp
C:\posA0.tmp
C:\posA1.tmp
C:\posA2.tmp
C:\posA3.tmp
C:\posA4.tmp
C:\posA5.tmp
C:\posA6.tmp
C:\posA7.tmp
C:\posA8.tmp
C:\posA9.tmp
C:\posAA.tmp
C:\posAB.tmp
C:\posAC.tmp
C:\posAD.tmp
C:\posAE.tmp
C:\posAF.tmp
C:\posB.tmp
C:\posB0.tmp
C:\posB1.tmp
C:\posB2.tmp
C:\posB3.tmp
C:\posB4.tmp
C:\posB5.tmp
C:\posB6.tmp
C:\posB7.tmp
C:\posB8.tmp
C:\posB9.tmp
C:\posBA.tmp
C:\posBB.tmp
C:\posBC.tmp
C:\posBD.tmp
C:\posBE.tmp
C:\posBF.tmp
C:\posC.tmp
C:\posC0.tmp
C:\posC1.tmp
C:\posC2.tmp
C:\posC3.tmp
C:\posC4.tmp
C:\posC5.tmp
C:\posC6.tmp
C:\posC7.tmp
C:\posC8.tmp
C:\posC9.tmp
C:\posCA.tmp
C:\posCB.tmp
C:\posCC.tmp
C:\posCD.tmp
C:\posCE.tmp
C:\posCF.tmp
C:\posD.tmp
C:\posD0.tmp
C:\posD1.tmp
C:\posD2.tmp
C:\posD3.tmp
C:\posD4.tmp
C:\posD5.tmp
C:\posD6.tmp
C:\posD7.tmp
C:\posD8.tmp
C:\posD9.tmp
C:\posDA.tmp
C:\posDB.tmp
C:\posDC.tmp
C:\posDD.tmp
C:\posDE.tmp
C:\posDF.tmp
C:\posE.tmp
C:\posE0.tmp
C:\posE1.tmp
C:\posE2.tmp
C:\posE3.tmp
C:\posE4.tmp
C:\posE5.tmp
C:\posE6.tmp
C:\posE7.tmp
C:\posE8.tmp
C:\posE9.tmp
C:\posEA.tmp
C:\posEB.tmp
C:\posEC.tmp
C:\posED.tmp
C:\posEE.tmp
C:\posEF.tmp
C:\posF.tmp
C:\posF0.tmp
C:\posF1.tmp
C:\posF2.tmp
C:\posF3.tmp
C:\posF4.tmp
C:\posF5.tmp
C:\posF6.tmp
C:\posF7.tmp
C:\posF8.tmp
C:\posF9.tmp
C:\posFA.tmp
C:\posFB.tmp
C:\posFC.tmp
C:\posFD.tmp
C:\posFE.tmp
C:\posFF.tmp
C:\Program Files\Fichiers communs\StorageProtector
C:\Program Files\StorageProtector
C:\Program Files\StorageProtector\atl71.dll
C:\Program Files\StorageProtector\License.rtf
C:\Program Files\StorageProtector\mfc71.dll
C:\Program Files\StorageProtector\msvcp71.dll
C:\Program Files\StorageProtector\msvcr71.dll
C:\Program Files\StorageProtector\Readme.rtf
C:\Program Files\StorageProtector\Res\Main.ico
C:\Program Files\StorageProtector\Res\RecycleBin.ico
C:\Program Files\StorageProtector\rm.url
C:\Program Files\StorageProtector\sr.log
C:\Program Files\StorageProtector\swupd.log
C:\Program Files\StorageProtector\SysRep.exe.cer
C:\Program Files\StorageProtector\SysRep.exe.Log
C:\Program Files\StorageProtector\SysRep.exe.xml
C:\Program Files\StorageProtector\SysRep.url
C:\Program Files\StorageProtector\transpaid.exe
C:\Program Files\StorageProtector\unins000.dat
C:\Program Files\StorageProtector\unins000.exe
C:\Program Files\StorageProtector\urls.ini
C:\WINDOWS\system32\bbeeg.ini
C:\WINDOWS\system32\bbeeg.ini2
C:\WINDOWS\system32\geebb.dll
C:\WINDOWS\system32\urqnkjh.dll

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-12-13 to 2008-01-13 ))))))))))))))))))))))))))))))))))))
.

2008-01-13 13:12 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-13 12:48 . 2008-01-13 12:48 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-01-13 12:46 . 2008-01-13 13:03 <REP> d-------- C:\VundoFix Backups
2008-01-13 12:43 . 2008-01-13 12:43 <REP> d-------- C:\Program Files\Trend Micro
2008-01-13 12:29 . 2008-01-13 12:33 <REP> d-------- C:\Program Files\OmniBack
2008-01-12 12:16 . 2008-01-12 12:16 268 --ah----- C:\sqmdata10.sqm
2008-01-12 12:16 . 2008-01-12 12:16 244 --ah----- C:\sqmnoopt10.sqm
2008-01-10 01:06 . 2008-01-10 01:08 32,764 --a------ C:\WINDOWS\17PHolmes572.exe
2008-01-10 00:15 . 2004-08-04 00:54 83,968 --a------ C:\WINDOWS\system32\CNBJMON2.DLL
2008-01-10 00:15 . 2001-08-23 15:46 58,276 --a------ C:\WINDOWS\system32\CNBJHLP2.HLP
2008-01-10 00:15 . 2001-08-23 15:46 1,312 --a------ C:\WINDOWS\system32\CNBJHLP2.CNT
2008-01-09 21:47 . 2008-01-09 21:47 <REP> d-------- C:\Program Files\Valve
2008-01-09 18:02 . 2008-01-09 18:02 <REP> d-------- C:\Program Files\ImTOO
2008-01-09 16:07 . 2008-01-09 16:07 <REP> d-------- C:\Documents and Settings\RAPHAEL\Application Data\AdobeUM
2008-01-08 20:03 . 2008-01-08 20:03 <REP> d-------- C:\Program Files\RapidSolution
2008-01-08 20:03 . 2008-01-08 20:15 <REP> d-------- C:\Documents and Settings\RAPHAEL\Application Data\Tunebite
2008-01-08 20:03 . 2008-01-08 20:03 <REP> d-------- C:\Documents and Settings\All Users\Application Data\RapidSolution
2008-01-08 20:03 . 2007-12-11 09:52 26,784 --a------ C:\WINDOWS\system32\drivers\tbhsd.sys
2008-01-06 22:23 . 2008-01-06 22:24 <REP> d-------- C:\Program Files\Everest Poker
2008-01-03 19:53 . 2008-01-03 19:57 <REP> d-------- C:\Documents and Sett

Bonjour tt le monde!
J'ai le même virus!
Je télécharge tous les programmes (vundo, combofix etc) Je fais les scans et je colle les rapports!!
Et j'ai le mm problème que toi Jerome_J !!! L'icône de mon disque local dans le poste de travail est une croix rouge!!

ok

bonne continuation!

MERCI !!!!!!!

Je ne me permet pas de récapituler la solution , parce que je n'ai pas tout bien compris !!!!!

ok c'est bon pour toi!!

tu peux cocher resolu au dessus de ton premier message enfin

pour protéger gratos ton ordi

http://www.commentcamarche.net/telecharger/logiciel 4 securite

mettre un antivirus

AVAST en français ou ANTIVIR (en anglais mais très efficace)
https://www.malekal.com/avira-free-security-antivirus-gratuit/ (merci Malekal)
-------------
des anti-espions :
AD AWARE + SPYBOT +/- si tea timer non active de spybot: WINDOWS DEFENDER (si ordi avec au moins 1g de ram)

+/-
SPYWAREBLASTER pour immuniser le système contre vundo notamment mais en anglais (mais facile d'utilisation : il suffit de faire "update" pour mettre à jour tous les mois et ensuite" enable all protection" pour immuniser)...

Rq : spybot et ad-aware on sorti de nouvelles versions cette année vérifiez que vous avez la dernière version
--------
un pare feu :
celui de Windows ou mieux KERIO/ sunbelt ou JETICO ou ZONE ALARM (mettre que le parefeu gratuit)

https://www.clubic.com/telecharger-fiche11071-sunbelt-personal-firewall-ex-kerio.html
https://manuelsdaide.com/contact/
http://www.open-files.com/forum/index.php?showtopic=29277
http://www.commentcamarche.net/telecharger/telecharger 157 zonealarm

-----------

CCLEANER pour effacer les traces de surf

Alors, le rapport OTmoveit :

File/Folder C:\WINDOWS\System32\lssas.exe not found.

Created on 12/26/2007 19:15:54

_________________________
Mise à jour internet effectuée...

_________________________
Et le rapport Hitjackhis :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:09:06, on 26/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas .exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.01net.com/telecharger/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-fr7.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.01net.com/telecharger/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.01net.com/telecharger/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-fr7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.01net.com/telecharger/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.hpe.com/h41271/404D.aspx?cc=us&ll=en&url=http://domainredirects.ext.hpe.com/fr7.hpwis.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [KYE_Showicon] "C:\Program Files\USB Storage RW\shwicon.exe" -t"KYE\USB Storage RW"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas .exe" /minimized
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (TotalScan Installer Class) - https://www.pandasecurity.com/en/homeusers/online-antivirus/?ref=activescan
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: VundoFix Service (VundoFixSvc) - Atribune.org - C:\WINDOWS\SYSTEM32\VundoFixSVC.exe

Tout à l'air de bien se passer sur le comportement général du PC.
Sophie.

Relance HijackThis, choisis "do a scan only" coche la case devant les lignes ci-dessous et clic en bas sur "fix checked".

O4 - HKLM\..\Run: [Local Security Authority Service] C:\WINDOWS\System32\lssas.exe

_________________

télécharge OTMoveIt http://download.bleepingcomputer.com/oldtimer/OTMoveIt.exe (de Old_Timer) sur ton Bureau.
double-clique sur OTMoveIt.exe pour le lancer.
copie la liste qui se trouve en citation ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved.

Citation :

C:\WINDOWS\System32\lssas.exe

clique sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre "Results".
clique sur Exit pour fermer.
poste le rapport situé dans C:\_OTMoveIt\MovedFiles.

il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.
___________________

mets a jour internet explorer:

https://www.01net.com/telecharger/windows/Internet/navigateur/fiches/33081.html

___________________

recolle un rapport hiajckhtis et dis tes soucis

Alors !!!!

________________________________________________________________________________________

Le rapport d'anitivir est nickel, pas d'infection décelée. je ne le poste pas, car il fait au minimun 50 pages!!!!

__________________________________________________________________________________________

Le rapport Hitjackhis :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:44:07, on 26/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas .exe
C:\Program Files\a-squared Free\a2service.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-fr7.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.hpe.com/h41271/404D.aspx?cc=us&ll=en&url=http://domainredirects.ext.hpe.com/fr7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-fr7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-fr7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-fr7.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.hpe.com/h41271/404D.aspx?cc=us&ll=en&url=http://domainredirects.ext.hpe.com/fr7.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.hpe.com/h41271/404D.aspx?cc=us&ll=en&url=http://domainredirects.ext.hpe.com/fr7.hpwis.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [KYE_Showicon] "C:\Program Files\USB Storage RW\shwicon.exe" -t"KYE\USB Storage RW"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas .exe" /minimized
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Local Security Authority Service] C:\WINDOWS\System32\lssas.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (TotalScan Installer Class) - https://www.pandasecurity.com/en/homeusers/online-antivirus/?ref=activescan
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: VundoFix Service (VundoFixSvc) - Atribune.org - C:\WINDOWS\SYSTEM32\VundoFixSVC.exe

_____________________________________________________________________________________________________

Je laisse à JlpJlp le soin de marquer "Résolu" si c''est le cas, dans le cas contraire et bien on continue !!!!
Et je le remercie encore beaucoup pour son aide patiente !!!

Bonsn soirée.
Sophie

ok passe a la suite:

_________________________

nettoie ton registre avec regcleaner
http://manuelsdaide.com/RegCleaner/RegCleaner.htm
________________________

installe:
SPYWAREBLASTER pour immuniser le système contre vundo notamment(l'infection que tu avais) mais en anglais (mais facile d'utilisation : il suffit de faire "update" pour mettre à jour tous les mois et ensuite" enable all protection" pour immuniser)
________________________
colle le rapport d'un scan avec antivir et un rapport hijackthis

Alors, j'en suis à fixer le registre et j'ai le message, "impossible d'importer c:\..... Erreur d'accès au registre"

J'ai pourtant tout suivi pas à pas, je ne vois pas où j'ai foiré le truc ?

lance hijackhtis et fix ces lignes:

O2 - BHO: {8e67a85c-e1d4-eca9-1f94-519271e0c874} - {478c0e17-2915-49f1-9ace-4d1ec58a76e8} - C:\WINDOWS\System32\cwbkwlxw.dll (file missing)

O2 - BHO: (no name) - {86BE360E-D40E-4212-B495-307A65FBAA89} - C:\WINDOWS\System32\ddcyy.dll (file missing)
O2 - BHO: (no name) - {97E2CE47-CA37-4E19-9780-7C15B780F4AA} - C:\WINDOWS\System32\ddcca.dll (file missing)
O2 - BHO: (no name) - {F9C77AE8-BC56-4554-9A70-FB2C975521F6} - C:\WINDOWS\System32\jkhfe.dll (file missing)

O4 - Global Startup: hp center.lnk = C:\Program Files\hp center\137903\Program\BackWeb-137903.exe

O20 - Winlogon Notify: wvuvsrq - C:\WINDOWS\

______________________________

Ouvre le bloc-notes (click droit sur le bureau > dans l´arborescence choisie nouveau et nouveau fichier texte) et fais un copier coller de ce qui est en citation ci-dessous (copie tout d'un trait-sans les barres(X)) :

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{478c0e17-2915-49f1-9ace-4d1ec58a76e8}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{86BE360E-D40E-4212-B495-307A65FBAA89}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{97E2CE47-CA37-4E19-9780-7C15B780F4AA}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F9C77AE8-BC56-4554-9A70-FB2C975521F6}]

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX X

note : regedit4 doit etre sur la premiere ligne dans le bloc note et a la fin il y a une ligne blanche

Puis click sur "fichier"/"enregistrer sous" :
dans : sur le bureau
Nom du fichier : fix.reg
Type de fichier : "tous les fichiers"
clique sur "enregistrer"

ca doit ressembler a ca une fois enrregistré :

http://img520.imageshack.us/img520/4251/screenshot005ps2.png

quitte internet et double clique sur fix.reg => tu dois obligatoirement avoir un message "voulez-vous vraiment ajouter les informations contenues dans ce fichier .reg au registre ?"
Si c'est bien le cas, clique sur "oui"

_________________________

nettoie ton registre avec regcleaner
http://manuelsdaide.com/RegCleaner/RegCleaner.htm
________________________

installe:
SPYWAREBLASTER pour immuniser le système contre vundo notamment(l'infection que tu avais) mais en anglais (mais facile d'utilisation : il suffit de faire "update" pour mettre à jour tous les mois et ensuite" enable all protection" pour immuniser)
________________________
colle le rapport d'un scan avec antivir et un rapport hijackthis

Les choses ont l'air de se régler, au moins au niveau de l'utilisation de l'ordinateur, il n'y a plus de messages intempestifs, plus de bugs (pour le moment !!!)

Voici les rapports de ce que j'ai executé sur ton conseil :

J'ai tout analysé avec le site Virus Total...

--------------------------------------------------------------------------------------------------------------
Résultats de OTMovit :

C:\WINDOWS\system32\sexfvf.exe moved successfully.
C:\WINDOWS\system32\hnqhx.exe moved successfully.

Created on 12/25/2007 18:04:21

------------------------------------------------------------------------------------------------

Rapport hitjackhis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:08:55, on 25/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas .exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Thunderbird\thunderbird.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-fr7.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.hpe.com/h41271/404D.aspx?cc=us&ll=en&url=http://domainredirects.ext.hpe.com/fr7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.hpe.com/h41271/404D.aspx?cc=us&ll=en&url=http://domainredirects.ext.hpe.com/fr7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-fr7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-fr7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-fr7.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.hpe.com/h41271/404D.aspx?cc=us&ll=en&url=http://domainredirects.ext.hpe.com/fr7.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.hpe.com/h41271/404D.aspx?cc=us&ll=en&url=http://domainredirects.ext.hpe.com/fr7.hpwis.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: {8e67a85c-e1d4-eca9-1f94-519271e0c874} - {478c0e17-2915-49f1-9ace-4d1ec58a76e8} - C:\WINDOWS\System32\cwbkwlxw.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {86BE360E-D40E-4212-B495-307A65FBAA89} - C:\WINDOWS\System32\ddcyy.dll (file missing)
O2 - BHO: (no name) - {97E2CE47-CA37-4E19-9780-7C15B780F4AA} - C:\WINDOWS\System32\ddcca.dll (file missing)
O2 - BHO: (no name) - {F9C77AE8-BC56-4554-9A70-FB2C975521F6} - C:\WINDOWS\System32\jkhfe.dll (file missing)
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [KYE_Showicon] "C:\Program Files\USB Storage RW\shwicon.exe" -t"KYE\USB Storage RW"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas .exe" /minimized
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Local Security Authority Service] C:\WINDOWS\System32\lssas.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - Global Startup: hp center.lnk = C:\Program Files\hp center\137903\Program\BackWeb-137903.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (TotalScan Installer Class) - https://www.pandasecurity.com/en/homeusers/online-antivirus/?ref=activescan
O20 - Winlogon Notify: wvuvsrq - C:\WINDOWS\
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: VundoFix Service (VundoFixSvc) - Atribune.org - C:\WINDOWS\SYSTEM32\VundoFixSVC.exe

-----------------------------------------------------------------------

Le rapport combofix :

ComboFix 07-12-21.4 - Propriétaire 2007-12-25 18:13:25.5 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.78 [GMT 1:00]
Running from: C:\Documents and Settings\Propriétaire\Bureau\Programmes desinfectionvirus\ComboFix.exe
.

((((((((((((((((((((((((((((( Fichiers créés 2007-11-25 to 2007-12-25 ))))))))))))))))))))))))))))))))))))
.

2007-12-23 22:48 . 2007-12-23 22:48 <REP> d-------- C:\Program Files\Avira
2007-12-23 22:48 . 2007-12-23 22:48 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2007-12-23 21:08 . 2007-12-23 21:09 <REP> d-------- C:\Program Files\Panda Security
2007-12-23 20:41 . 2007-12-23 20:41 24,576 --a------ C:\WINDOWS\system32\VundoFixSVC.exe
2007-12-23 20:37 . 2007-12-25 12:32 <REP> d-------- C:\VundoFix Backups
2007-12-23 20:12 . 2007-12-23 20:12 <REP> d-------- C:\Documents and Settings\LocalService\Menu Démarrer
2007-12-23 18:00 . 2004-08-20 00:09 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2007-12-23 17:50 . 2007-12-23 17:50 <REP> d-------- C:\WINDOWS\provisioning
2007-12-23 17:50 . 2007-12-23 17:50 <REP> d-------- C:\WINDOWS\peernet
2007-12-23 17:42 . 2007-12-23 17:42 <REP> d-------- C:\WINDOWS\ServicePackFiles
2007-12-23 17:20 . 2007-12-23 17:20 <REP> d-------- C:\WINDOWS\EHome
2007-12-23 16:47 . 2007-12-23 16:47 <REP> d-------- C:\Program Files\TresorNet
2007-12-23 16:46 . 2007-12-23 16:47 1,429,032 --a------ C:\WINDOWS\system32\Noël Cadeaux.scr
2007-12-23 15:25 . 2002-04-15 21:11 67,866 --------- C:\WINDOWS\system32\drivers\netwlan5.img
2007-12-23 15:25 . 2004-08-19 16:10 11,776 --------- C:\WINDOWS\system32\spnpinst.exe
2007-12-23 15:25 . 2004-08-02 14:20 7,208 --------- C:\WINDOWS\system32\secupd.sig
2007-12-23 15:25 . 2004-08-02 14:20 4,569 --------- C:\WINDOWS\system32\secupd.dat
2007-12-23 13:58 . 2004-08-20 00:09 614,912 --a------ C:\WINDOWS\system32\h323msp.dll
2007-12-23 13:58 . 2004-08-20 00:09 332,800 --a------ C:\WINDOWS\system32\ipnathlp.dll
2007-12-23 13:58 . 2004-08-20 00:10 266,752 --a------ C:\WINDOWS\system32\h323.tsp
2007-12-23 13:58 . 2004-03-30 02:49 40,960 -----c--- C:\WINDOWS\system32\dllcache\evtgprov.dll
2007-12-23 13:07 . 2003-02-28 16:34 313,856 --a------ C:\WINDOWS\system32\dx3j.dll
2007-12-23 13:07 . 2003-02-28 18:26 171,280 --a------ C:\WINDOWS\system32\jit.dll
2007-12-23 13:07 . 2003-02-28 18:26 139,536 --a------ C:\WINDOWS\system32\javaee.dll
2007-12-23 13:07 . 2003-02-28 18:26 46,352 --a------ C:\WINDOWS\setdebug.exe
2007-12-23 13:07 . 2003-02-28 16:54 7,315 --a------ C:\WINDOWS\system32\javasup.vxd
2007-12-23 13:07 . 2003-02-28 16:35 6,550 --a------ C:\WINDOWS\jautoexp.dat
2007-12-23 09:59 . 2007-12-23 09:59 118 --a------ C:\WINDOWS\system32\wujjdpch.bat
2007-12-23 09:46 . 2007-12-23 13:26 <REP> d-------- C:\Program Files\a-squared Free
2007-12-22 22:52 . 2007-12-22 22:52 121 --a------ C:\WINDOWS\system32\wcamd.bat
2007-12-22 22:40 . 2007-12-22 22:40 123 --a------ C:\WINDOWS\system32\qqydyjm.bat
2007-12-22 22:31 . 2007-12-22 22:31 128 --a------ C:\WINDOWS\system32\mtcdqq.bat
2007-12-22 22:31 . 2007-12-22 22:31 124 --a------ C:\WINDOWS\system32\htrfx.bat
2007-12-22 21:55 . 2007-12-23 22:07 52,736 --a------ C:\WINDOWS\system\hpsysdrv .exe
2007-12-22 21:55 . 2007-12-23 23:54 181 --a------ C:\WINDOWS\system\hpsysdrv .DAT
2007-12-22 21:35 . 2007-12-22 21:35 16,308 --ah----- C:\WINDOWS\system32\nippom.exe
2007-12-22 21:19 . 2007-12-22 21:19 0 --ah----- C:\WINDOWS\system32\yedh.exe
2007-12-22 21:18 . 2007-12-22 21:18 127 --a------ C:\WINDOWS\system32\yyiwk.bat
2007-12-22 21:18 . 2007-12-22 21:18 118 --a------ C:\WINDOWS\system32\ixfwg.bat
2007-12-22 20:01 . 2005-10-20 23:25 1,097,728 --a------ C:\WINDOWS\system32\esent.dll
2007-12-22 13:13 . 2007-12-22 13:13 <REP> d-------- C:\Program Files\Trend Micro
2007-12-22 13:04 . 2007-12-22 13:04 <REP> d-------- C:\WINDOWS\system32\bits
2007-12-22 13:01 . 2007-12-25 11:23 <REP> d--h----- C:\WINDOWS\$hf_mig$
2007-12-22 13:01 . 2005-06-28 09:21 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2007-12-22 12:55 . 2004-08-20 00:09 351,232 --a------ C:\WINDOWS\system32\winhttp.dll
2007-12-22 12:55 . 2004-08-20 00:09 18,944 --a------ C:\WINDOWS\system32\qmgrprxy.dll
2007-12-22 12:55 . 2004-08-20 00:09 8,192 --------- C:\WINDOWS\system32\bitsprx2.dll
2007-12-22 12:55 . 2004-08-20 00:09 7,168 --------- C:\WINDOWS\system32\bitsprx3.dll
2007-12-22 10:54 . 2007-12-22 10:57 256 --a------ C:\WINDOWS\wininit.ini
2007-12-21 17:16 . 2007-12-21 17:17 714 ---hs---- C:\WINDOWS\system32\iffruoww.ini
2007-12-19 20:17 . 2007-12-21 17:08 654 ---hs---- C:\WINDOWS\system32\ijlhiqto.ini
2007-12-19 14:18 . 2007-12-19 14:19 <REP> d-------- C:\Program Files\pfoc
2007-12-18 20:15 . 2007-12-19 20:15 474 ---hs---- C:\WINDOWS\system32\boxxabdd.ini
2007-12-18 18:59 . 2007-12-18 18:59 482 --a------ C:\WINDOWS\Disney.ini
2007-12-18 18:58 . 2007-12-18 18:58 <REP> d-------- C:\Program Files\Disney Interactive
2007-12-17 20:13 . 2007-12-18 20:13 354 ---hs---- C:\WINDOWS\system32\ofihltxw.ini
2007-12-16 10:47 . 2007-12-22 18:44 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2007-12-16 10:47 . 2007-12-16 10:47 1,409 --a------ C:\WINDOWS\QTFont.for
2007-12-14 20:10 . 2007-12-15 20:13 354 ---hs---- C:\WINDOWS\system32\imvlpwmp.ini
2007-12-14 19:57 . 2007-12-14 19:57 <REP> d-------- C:\Documents and Settings\All Users\Application Data\nView_Profiles
2007-12-14 19:49 . 2007-12-25 16:46 88,566 --a------ C:\WINDOWS\system32\nvapps.xml
2007-12-14 19:47 . 2006-10-22 12:22 208,896 --a------ C:\WINDOWS\system32\nvudisp.exe
2007-12-14 19:47 . 2006-10-22 12:22 17,056 --a------ C:\WINDOWS\system32\nvdisp.nvu
2007-12-14 19:46 . 2006-10-22 15:06 208,896 --a------ C:\WINDOWS\system32\NVUNINST.EXE
2007-12-14 19:38 . 2007-12-14 19:54 <REP> d-------- C:\WINDOWS\nview
2007-12-14 18:49 . 2007-12-14 18:49 <REP> d-------- C:\Documents and Settings\All Users\Application Data\NVIDIA
2007-12-13 21:03 . 2007-12-14 20:11 8 --a------ C:\WINDOWS\system32\nvModes.dat
2007-12-13 20:33 . 2007-12-13 20:33 <REP> d-------- C:\NVIDIA
2007-12-13 20:03 . 2007-12-13 20:03 294 ---hs---- C:\WINDOWS\system32\saipnoks.ini
2007-12-12 20:06 . 2007-12-12 20:06 1,409 --a------ C:\WINDOWS\system32\tmp2DBDD.FOT
2007-12-12 19:58 . 2007-12-12 19:58 714 ---hs---- C:\WINDOWS\system32\bjrsofky.ini
2007-12-12 19:31 . 2007-07-30 19:19 549,720 --a------ C:\WINDOWS\system32\wuapi.dll
2007-12-12 19:31 . 2007-07-30 19:19 325,976 --a------ C:\WINDOWS\system32\wucltui.dll
2007-12-12 19:31 . 2007-07-30 19:19 216,408 --a------ C:\WINDOWS\system32\wuaucpl.cpl
2007-12-12 19:31 . 2007-07-30 19:19 43,352 --a------ C:\WINDOWS\system32\wups2.dll
2007-12-12 19:31 . 2007-07-30 19:19 38,232 --a------ C:\WINDOWS\system32\wucltui.dll.mui
2007-12-12 19:31 . 2007-07-30 19:18 33,624 --a------ C:\WINDOWS\system32\wups.dll
2007-12-12 19:31 . 2007-07-30 19:20 30,040 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui
2007-12-12 19:31 . 2007-07-30 19:19 30,040 --a------ C:\WINDOWS\system32\wuapi.dll.mui
2007-12-12 19:31 . 2007-07-30 19:18 21,336 --a------ C:\WINDOWS\system32\wuaueng.dll.mui
2007-12-12 19:27 . 2007-12-12 19:27 <REP> d---s---- C:\Documents and Settings\Propriétaire\UserData
2007-12-12 19:27 . 2007-12-12 19:27 <REP> d---s---- C:\Documents and Settings\Propriétaire\UserData
2007-12-12 12:29 . 2007-12-12 12:29 <REP> d-------- C:\Program Files\Avery Dennison
2007-12-12 12:29 . 2007-12-12 12:29 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avery
2007-12-11 20:00 . 2007-12-12 12:17 654 ---hs---- C:\WINDOWS\system32\uvkxqfom.ini
2007-12-11 18:33 . 2007-12-11 18:33 1,409 --a------ C:\WINDOWS\system32\tmp72774.FOT
2007-12-10 20:46 . 2007-12-10 20:46 <REP> d-------- C:\Documents and Settings\Propriétaire\Application Data\Avanquest
2007-12-10 20:46 . 2007-12-10 20:46 <REP> d-------- C:\Documents and Settings\Propriétaire\Application Data\Avanquest
2007-12-10 20:46 . 2007-12-10 20:46 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avanquest
2007-12-10 20:00 . 2007-12-11 17:39 414 ---hs---- C:\WINDOWS\system32\cuigirqx.ini
2007-12-10 19:26 . 2007-12-10 19:26 <REP> d-------- C:\Documents and Settings\All Users\Application Data\BVRP Software
2007-12-10 19:24 . 2007-12-10 19:24 <REP> dr-hs---- C:\_Backup.RC
2007-12-10 19:24 . 2007-12-23 10:48 <REP> d--h----- C:\_Backup
2007-12-10 19:20 . 2007-12-10 19:20 <REP> d-------- C:\Documents and Settings\Propriétaire\Application Data\VCOM
2007-12-10 19:20 . 2007-12-10 19:20 <REP> d-------- C:\Documents and Settings\Propriétaire\Application Data\VCOM
2007-12-10 19:17 . 2007-12-10 19:17 <REP> d-------- C:\Program Files\VCOM
2007-12-09 19:07 . 1994-09-21 01:00 12,800 --a------ C:\WINDOWS\system32\WING32.DLL
2007-12-09 19:06 . 2007-12-09 19:06 <REP> d-------- C:\TLCWIN
2007-12-09 11:19 . 2002-09-27 08:56 249,136 -r-hs---- C:\cmldr
2007-12-09 11:19 . 2007-11-18 02:56 184 -rahs---- C:\BOOT.BAK

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-25 17:06 --------- d-----w C:\Program Files\Mozilla Thunderbird
2007-12-25 10:44 1,503 ----a-w C:\WINDOWS\system32\drivers\fwdrv.err
2007-12-23 22:33 --------- d---a-w C:\Program Files\USB Storage RW
2007-12-19 18:30 --------- d-----w C:\Program Files\eMule
2007-12-12 11:33 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-12 11:27 --------- d---a-w C:\Program Files\Fichiers communs\InstallShield
2007-11-20 21:59 --------- d-----w C:\Documents and Settings\Propriétaire\Application Data\vlc
2007-11-20 21:59 --------- d-----w C:\Documents and Settings\Propriétaire\Application Data\vlc
2007-11-20 19:01 --------- d-----w C:\Program Files\QuickTime
2007-11-20 19:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\QuickTime
2007-11-20 18:23 --------- d---a-w C:\Program Files\Fichiers communs\Adobe
2007-11-20 13:08 --------- d-----w C:\Program Files\EPSON
2007-11-18 20:27 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\Grisoft
2007-11-18 20:21 --------- d-----w C:\Documents and Settings\Propriétaire\Application Data\Grisoft
2007-11-18 20:21 --------- d-----w C:\Documents and Settings\Propriétaire\Application Data\Grisoft
2007-11-18 20:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
2007-11-18 09:45 --------- d-----w C:\Program Files\Java
2007-11-18 09:43 --------- d-----w C:\Program Files\Fichiers communs\Java
2007-11-18 09:12 --------- d-----w C:\Program Files\VideoLAN
2007-11-18 08:56 --------- d-----w C:\Documents and Settings\Propriétaire\Application Data\Thunderbird
2007-11-18 08:56 --------- d-----w C:\Documents and Settings\Propriétaire\Application Data\Thunderbird
2007-11-18 08:52 --------- d-----w C:\Documents and Settings\Propriétaire\Application Data\Talkback
2007-11-18 08:52 --------- d-----w C:\Documents and Settings\Propriétaire\Application Data\Talkback
2007-11-18 08:47 --------- d-----w C:\Program Files\Sunbelt Software
2007-11-18 08:35 17,920 ----a-w C:\WINDOWS\system32\tftp.exe
2007-11-18 08:32 --------- d-----w C:\Program Files\Alwil Software
2007-11-17 22:22 --------- d---a-w C:\Program Files\InterVideo
2007-11-17 22:22 --------- d---a-w C:\Documents and Settings\Propriétaire\Application Data\VERITAS
2007-11-17 22:22 --------- d---a-w C:\Documents and Settings\Propriétaire\Application Data\VERITAS
2007-11-17 22:21 --------- d-----w C:\Documents and Settings\Propriétaire\Application Data\InterVideo
2007-11-17 22:21 --------- d-----w C:\Documents and Settings\Propriétaire\Application Data\InterVideo
2007-11-17 22:04 65,308 ---ha-w C:\WINDOWS\system32\hekpkpz.exe
2007-11-17 21:59 --------- d---a-w C:\Program Files\Symantec
2007-11-17 21:59 --------- d---a-w C:\Program Files\Fichiers communs\Symantec Shared
2007-11-17 21:59 --------- d---a-w C:\Documents and Settings\All Users\Application Data\Symantec
2007-11-17 21:48 3,458 --sha-r C:\WINDOWS\system32\drivers\HP_DF101A-ABF 415_YC_Pavi_QCZB318_E32FRheBLF2_4_IKM266-8235_S_V_BAM37312_T030317_W1_L40C_M256_J40_7AMD_8Athlon XP 2000+_91,66_1_N10EC8139_P_Z14F12F00_K_A11063059_U11063038_G10DE0172.MRK
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{478c0e17-2915-49f1-9ace-4d1ec58a76e8}]
C:\WINDOWS\System32\cwbkwlxw.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{86BE360E-D40E-4212-B495-307A65FBAA89}]
C:\WINDOWS\System32\ddcyy.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{97E2CE47-CA37-4E19-9780-7C15B780F4AA}]
C:\WINDOWS\System32\ddcca.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F9C77AE8-BC56-4554-9A70-FB2C975521F6}]
C:\WINDOWS\System32\jkhfe.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" []
"KYE_Showicon"="C:\Program Files\USB Storage RW\shwicon.exe" []
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas .exe" [2007-12-25 10:11]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-20 00:10 C:\WINDOWS\system32\rundll32.exe]
"NvMediaCenter"="RunDLL32.exe" [2004-08-20 00:10 C:\WINDOWS\system32\rundll32.exe]
"Local Security Authority Service"="C:\WINDOWS\System32\lssas.exe" []

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wvuvsrq]

R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys [2007-04-26 10:21]
R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys [2007-04-26 10:21]
S2 SPF4;Sunbelt Personal Firewall 4;C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe [2007-04-26 10:21]
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-04 06:58]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 07:08]

.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-25 18:21:12
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-25 18:24:08
C:\ComboFix2.txt ... 2007-12-25 11:19
C:\ComboFix3.txt ... 2007-12-23 22:20
.
2007-12-23 19:00:59 --- E O F ---

En tout cas, un grand merci pour ton aide et ta disponibilité.
Sophie

y a du boulot!

analyse chque fichier suivant sur virus total : https://www.virustotal.com/gui/

ceux qui sont inféctés tu les vires avec otmovit en les mettant dans la citation comme precedemment et tu me colle le rapport

C:\WINDOWS\system32\wmpns.dll
C:\WINDOWS\system32\spnpinst.exe
C:\WINDOWS\system32\secupd.sig
C:\WINDOWS\system32\secupd.dat
C:\WINDOWS\system32\h323msp.dll
C:\WINDOWS\system32\ipnathlp.dll
C:\WINDOWS\system32\h323.tsp
C:\WINDOWS\system32\dllcache\evtgprov.dll
C:\WINDOWS\system32\dx3j.dll
C:\WINDOWS\system32\jit.dll
C:\WINDOWS\system32\javaee.dll
C:\WINDOWS\setdebug.exe
C:\WINDOWS\system32\javasup.vxd
C:\WINDOWS\jautoexp.dat
C:\WINDOWS\system32\yrtrpuda.exe
C:\WINDOWS\system32\ptapdjp.exe
C:\WINDOWS\system32\mcqgqob.exe
C:\WINDOWS\system32\wchxl.exe
C:\WINDOWS\system32\wujjdpch.bat
C:\WINDOWS\system32\zzezdyu.exe
C:\WINDOWS\system32\rmdp.exe
C:\Program Files\a-squared Free
C:\WINDOWS\system32\mjrfqd.exe
C:\WINDOWS\system32\lbok.exe
C:\WINDOWS\system32\nnxob.exe
C:\WINDOWS\system32\vrkne.exe
C:\WINDOWS\system32\ymfkvo.exe
C:\WINDOWS\system32\rihxgm.exe
C:\WINDOWS\system32\pfoxs.exe
C:\WINDOWS\system32\ngpmexkj.exe
C:\WINDOWS\system32\wcamd.bat
C:\WINDOWS\system32\qqydyjm.bat
C:\WINDOWS\system32\mrxgpms.exe
C:\WINDOWS\system32\qkaws.exe
C:\WINDOWS\system32\lvkxonr.exe
C:\WINDOWS\system32\yvroe.exe
C:\WINDOWS\system32\vniswk.exe
C:\WINDOWS\system32\mtcdqq.bat
C:\WINDOWS\system32\htrfx.bat
C:\WINDOWS\system32\xnsvb.exe
C:\WINDOWS\system32\vuwip.exe
C:\WINDOWS\system32\sexfvf.exe
C:\WINDOWS\system32\xpyreb.exe
C:\WINDOWS\system32\zrxylezj.exe
C:\WINDOWS\system32\nippom.exe
C:\WINDOWS\system32\ygngoo.exe
C:\WINDOWS\system32\xzkiwwsr.exe
C:\WINDOWS\system32\hnqhx.exe
C:\WINDOWS\system32\xhzczwrf.exe
C:\WINDOWS\system32\yedh.exe
C:\WINDOWS\system32\yyiwk.bat
C:\WINDOWS\system32\ixfwg.bat
C:\WINDOWS\system32\tjilus.exe
C:\WINDOWS\system32\lvyppnbv.exe
C:\WINDOWS\system32\esent.dll
C:\WINDOWS\system32\spupdsvc.exe
C:\WINDOWS\system32\winhttp.dll
C:\WINDOWS\system32\qmgrprxy.dll
C:\WINDOWS\system32\bitsprx2.dll
C:\WINDOWS\system32\bitsprx3.dll
C:\WINDOWS\system32\iffruoww.ini
C:\WINDOWS\system32\ijlhiqto.ini
C:\WINDOWS\system32\boxxabdd.ini

________________

ensuite recolle un rapport hijackhtis, combofix et dis tes soucis
C:\WINDOWS\system32\ofihltxw.ini
C:\WINDOWS\system32\imvlpwmp.ini

Tout d'abord, Joyeux Noël à vous....

Et si un modérateur pouvait effacer le message juste avant, j'ai plantouillé...Merci !!!!

Je n'ai pas retrouvé le rapport FV monde ;-) mais il n'y avait rien de notable.
A ce qui était précisé...

-------------------------------------------------------------------

Pour Symantec Trojan.Vundo.B removal Tool :
Il n'a rien trouvé, alors qu'il a déclenché antivir plusieurs dizaines de fois ???

--------------------------------------------------------------------

Pour OT mOVE IT :

File/Folder C:\WINDOWS\SYSTEM32\wvuvsrq.dll not found.
File/Folder C:\WINDOWS\System32\nymjljoq.dll not found.
File/Folder C:\WINDOWS\bukmon.exe not found.
File/Folder C:\WINDOWS\system32\wvuvsrq.dll not found.
C:\WINDOWS\system32\tvtd.exe moved successfully.
C:\WINDOWS\system32\cly.exe moved successfully.
C:\WINDOWS\system32\slotnkmc.dll unregistered successfully.
C:\WINDOWS\system32\slotnkmc.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\System32\awtss.dll
C:\WINDOWS\System32\awtss.dll NOT unregistered.
File move failed. C:\WINDOWS\System32\awtss.dll scheduled to be moved on reboot.
File/Folder C:\WINDOWS\System32\cwbkwlxw.dll not found.
File/Folder C:\WINDOWS\System32\ddcyy.dll not found.
File/Folder C:\WINDOWS\System32\ddcca.dll not found.
File/Folder C:\WINDOWS\System32\jkhfe.dll not found.

Created on 12/23/2007 23:54:41

--------------------------------------------------------------------

Pour Combofit :

ComboFix 07-12-21.4 - Propriétaire 2007-12-25 10:53:01.4 - NTFSx86
Running from: C:\Documents and Settings\Propriétaire\Bureau\Programmes desinfectionvirus\ComboFix.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\awtss.dll
C:\WINDOWS\system32\sstwa.ini
C:\WINDOWS\system32\sstwa.ini2

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-11-25 to 2007-12-25 ))))))))))))))))))))))))))))))))))))
.

2007-12-23 22:48 . 2007-12-23 22:48 <REP> d-------- C:\Program Files\Avira
2007-12-23 22:48 . 2007-12-23 22:48 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2007-12-23 21:08 . 2007-12-23 21:09 <REP> d-------- C:\Program Files\Panda Security
2007-12-23 20:41 . 2007-12-23 20:41 24,576 --a------ C:\WINDOWS\system32\VundoFixSVC.exe
2007-12-23 20:37 . 2007-12-23 21:56 <REP> d-------- C:\VundoFix Backups
2007-12-23 20:12 . 2007-12-23 20:12 <REP> d-------- C:\Documents and Settings\LocalService\Menu D‚marrer
2007-12-23 18:00 . 2004-08-20 00:09 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2007-12-23 17:50 . 2007-12-23 17:50 <REP> d-------- C:\WINDOWS\provisioning
2007-12-23 17:50 . 2007-12-23 17:50 <REP> d-------- C:\WINDOWS\peernet
2007-12-23 17:42 . 2007-12-23 17:42 <REP> d-------- C:\WINDOWS\ServicePackFiles
2007-12-23 17:20 . 2007-12-23 17:20 <REP> d-------- C:\WINDOWS\EHome
2007-12-23 16:47 . 2007-12-23 16:47 <REP> d-------- C:\Program Files\TresorNet
2007-12-23 16:46 . 2007-12-23 16:47 1,429,032 --a------ C:\WINDOWS\system32\No‰l Cadeaux.scr
2007-12-23 15:25 . 2002-04-15 21:11 67,866 --------- C:\WINDOWS\system32\drivers\netwlan5.img
2007-12-23 15:25 . 2004-08-19 16:10 11,776 --------- C:\WINDOWS\system32\spnpinst.exe
2007-12-23 15:25 . 2004-08-02 14:20 7,208 --------- C:\WINDOWS\system32\secupd.sig
2007-12-23 15:25 . 2004-08-02 14:20 4,569 --------- C:\WINDOWS\system32\secupd.dat
2007-12-23 13:58 . 2004-08-20 00:09 614,912 --a------ C:\WINDOWS\system32\h323msp.dll
2007-12-23 13:58 . 2004-08-20 00:09 332,800 --a------ C:\WINDOWS\system32\ipnathlp.dll
2007-12-23 13:58 . 2004-08-20 00:10 266,752 --a------ C:\WINDOWS\system32\h323.tsp
2007-12-23 13:58 . 2004-03-30 02:49 40,960 -----c--- C:\WINDOWS\system32\dllcache\evtgprov.dll
2007-12-23 13:07 . 2003-02-28 16:34 313,856 --a------ C:\WINDOWS\system32\dx3j.dll
2007-12-23 13:07 . 2003-02-28 18:26 171,280 --a------ C:\WINDOWS\system32\jit.dll
2007-12-23 13:07 . 2003-02-28 18:26 139,536 --a------ C:\WINDOWS\system32\javaee.dll
2007-12-23 13:07 . 2003-02-28 18:26 46,352 --a------ C:\WINDOWS\setdebug.exe
2007-12-23 13:07 . 2003-02-28 16:54 7,315 --a------ C:\WINDOWS\system32\javasup.vxd
2007-12-23 13:07 . 2003-02-28 16:35 6,550 --a------ C:\WINDOWS\jautoexp.dat
2007-12-23 10:23 . 2007-12-23 10:24 267,624 --ah----- C:\WINDOWS\system32\yrtrpuda.exe
2007-12-23 10:22 . 2007-12-23 10:23 397,312 --ah----- C:\WINDOWS\system32\ptapdjp.exe
2007-12-23 10:21 . 2007-12-23 10:22 397,312 --ah----- C:\WINDOWS\system32\mcqgqob.exe
2007-12-23 10:12 . 2007-12-23 10:13 397,312 --ah----- C:\WINDOWS\system32\wchxl.exe
2007-12-23 09:59 . 2007-12-23 09:59 118 --a------ C:\WINDOWS\system32\wujjdpch.bat
2007-12-23 09:58 . 2007-12-23 09:59 397,312 --ah----- C:\WINDOWS\system32\zzezdyu.exe
2007-12-23 09:55 . 2007-12-23 09:56 397,312 --ah----- C:\WINDOWS\system32\rmdp.exe
2007-12-23 09:46 . 2007-12-23 13:26 <REP> d-------- C:\Program Files\a-squared Free
2007-12-23 09:31 . 2007-12-23 09:31 397,312 --ah----- C:\WINDOWS\system32\mjrfqd.exe
2007-12-23 09:30 . 2007-12-23 09:30 406,016 --ah----- C:\WINDOWS\system32\lbok.exe
2007-12-23 09:30 . 2007-12-23 09:31 397,312 --ah----- C:\WINDOWS\system32\nnxob.exe
2007-12-23 09:21 . 2007-12-23 09:22 397,312 --ah----- C:\WINDOWS\system32\vrkne.exe
2007-12-22 22:57 . 2007-12-22 22:58 406,016 --ah----- C:\WINDOWS\system32\ymfkvo.exe
2007-12-22 22:56 . 2007-12-22 22:58 300,444 --ah----- C:\WINDOWS\system32\rihxgm.exe
2007-12-22 22:55 . 2007-12-22 22:56 406,016 --ah----- C:\WINDOWS\system32\pfoxs.exe
2007-12-22 22:55 . 2007-12-22 22:56 406,016 --ah----- C:\WINDOWS\system32\ngpmexkj.exe
2007-12-22 22:52 . 2007-12-22 22:52 121 --a------ C:\WINDOWS\system32\wcamd.bat
2007-12-22 22:40 . 2007-12-22 22:40 123 --a------ C:\WINDOWS\system32\qqydyjm.bat
2007-12-22 22:39 . 2007-12-22 22:40 406,016 --ah----- C:\WINDOWS\system32\mrxgpms.exe
2007-12-22 22:37 . 2007-12-22 22:37 406,016 --ah----- C:\WINDOWS\system32\qkaws.exe
2007-12-22 22:34 . 2007-12-22 22:35 397,312 --ah----- C:\WINDOWS\system32\lvkxonr.exe
2007-12-22 22:33 . 2007-12-22 22:34 416,256 --ah----- C:\WINDOWS\system32\yvroe.exe
2007-12-22 22:32 . 2007-12-22 22:35 339,968 --ah----- C:\WINDOWS\system32\vniswk.exe
2007-12-22 22:31 . 2007-12-22 22:31 128 --a------ C:\WINDOWS\system32\mtcdqq.bat
2007-12-22 22:31 . 2007-12-22 22:31 124 --a------ C:\WINDOWS\system32\htrfx.bat
2007-12-22 22:29 . 2007-12-22 22:31 314,880 --ah----- C:\WINDOWS\system32\vsihhad.exe
2007-12-22 22:18 . 2007-12-22 22:19 119,708 --ah----- C:\WINDOWS\system32\xnsvb.exe
2007-12-22 22:15 . 2007-12-22 22:19 242,364 --ah----- C:\WINDOWS\system32\vuwip.exe
2007-12-22 22:05 . 2007-12-22 22:06 512 --ah----- C:\WINDOWS\system32\sexfvf.exe
2007-12-22 22:04 . 2007-12-22 22:05 134,656 --ah----- C:\WINDOWS\system32\xpyreb.exe
2007-12-22 21:55 . 2007-12-23 22:07 52,736 --a------ C:\WINDOWS\system\hpsysdrv .exe
2007-12-22 21:55 . 2007-12-23 23:54 181 --a------ C:\WINDOWS\system\hpsysdrv .DAT
2007-12-22 21:35 . 2007-12-22 21:35 406,016 --ah----- C:\WINDOWS\system32\zrxylezj.exe
2007-12-22 21:35 . 2007-12-22 21:35 16,308 --ah----- C:\WINDOWS\system32\nippom.exe
2007-12-22 21:33 . 2007-12-22 21:35 263,168 --ah----- C:\WINDOWS\system32\ygngoo.exe
2007-12-22 21:32 . 2007-12-22 21:35 352,768 --ah----- C:\WINDOWS\system32\xzkiwwsr.exe
2007-12-22 21:28 . 2007-12-22 21:28 3,584 --ah----- C:\WINDOWS\system32\hnqhx.exe
2007-12-22 21:22 . 2007-12-22 21:22 40,448 --ah----- C:\WINDOWS\system32\xhzczwrf.exe
2007-12-22 21:19 . 2007-12-22 21:19 0 --ah----- C:\WINDOWS\system32\yedh.exe
2007-12-22 21:18 . 2007-12-22 21:18 127 --a------ C:\WINDOWS\system32\yyiwk.bat
2007-12-22 21:18 . 2007-12-22 21:18 118 --a------ C:\WINDOWS\system32\ixfwg.bat
2007-12-22 21:15 . 2007-12-22 21:17 416,256 --ah----- C:\WINDOWS\system32\tjilus.exe
2007-12-22 21:12 . 2007-12-22 21:15 64,752 --ah----- C:\WINDOWS\system32\lvyppnbv.exe
2007-12-22 20:01 . 2005-10-20 23:25 1,097,728 --a------ C:\WINDOWS\system32\esent.dll
2007-12-22 13:13 . 2007-12-22 13:13 <REP> d-------- C:\Program Files\Trend Micro
2007-12-22 13:04 . 2007-12-22 13:04 <REP> d-------- C:\WINDOWS\system32\bits
2007-12-22 13:01 . 2007-12-25 10:51 <REP> d--h----- C:\WINDOWS\$hf_mig$
2007-12-22 13:01 . 2005-06-28 09:21 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2007-12-22 12:55 . 2004-08-20 00:09 351,232 --a------ C:\WINDOWS\system32\winhttp.dll
2007-12-22 12:55 . 2004-08-20 00:09 18,944 --a------ C:\WINDOWS\system32\qmgrprxy.dll
2007-12-22 12:55 . 2004-08-20 00:09 8,192 --------- C:\WINDOWS\system32\bitsprx2.dll
2007-12-22 12:55 . 2004-08-20 00:09 7,168 --------- C:\WINDOWS\system32\bitsprx3.dll
2007-12-22 10:54 . 2007-12-22 10:57 256 --a------ C:\WINDOWS\wininit.ini
2007-12-21 17:16 . 2007-12-21 17:17 714 ---hs---- C:\WINDOWS\system32\iffruoww.ini
2007-12-19 20:17 . 2007-12-21 17:08 654 ---hs---- C:\WINDOWS\system32\ijlhiqto.ini
2007-12-19 14:18 . 2007-12-19 14:19 <REP> d-------- C:\Program Files\pfoc
2007-12-18 20:15 . 2007-12-19 20:15 474 ---hs---- C:\WINDOWS\system32\boxxabdd.ini
2007-12-18 18:59 . 2007-12-18 18:59 482 --a------ C:\WINDOWS\Disney.ini
2007-12-18 18:58 . 2007-12-18 18:58 <REP> d-------- C:\Program Files\Disney Interactive
2007-12-17 20:13 . 2007-12-18 20:13 354 ---hs---- C:\WINDOWS\system32\ofihltxw.ini
2007-12-16 10:47 . 2007-12-22 18:44 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2007-12-16 10:47 . 2007-12-16 10:47 1,409 --a------ C:\WINDOWS\QTFont.for
2007-12-14 20:10 . 2007-12-15 20:13 354 ---hs---- C:\WINDOWS\system32\imvlpwmp.ini
2007-12-14 19:57 . 2007-12-14 19:57 <REP> d-------- C:\Documents and Settings\All Users\Application Data\nView_Profiles
2007-12-14 19:49 . 2007-12-25 10:11 88,566 --a------ C:\WINDOWS\system32\nvapps.xml
2007-12-14 19:47 . 2006-10-22 12:22 208,896 --a------ C:\WINDOWS\system32\nvudisp.exe
2007-12-14 19:47 . 2006-10-22 12:22 17,056 --a------ C:\WINDOWS\system32\nvdisp.nvu
2007-12-14 19:46 . 2006-10-22 15:06 208,896 --a------ C:\WINDOWS\system32\NVUNINST.EXE
2007-12-14 19:38 . 2007-12-14 19:54 <REP> d-------- C:\WINDOWS\nview
2007-12-14 18:49 . 2007-12-14 18:49 <REP> d-------- C:\Documents and Settings\All Users\Application Data\NVIDIA
2007-12-13 21:03 . 2007-12-14 20:11 8 --a------ C:\WINDOWS\system32\nvModes.dat
2007-12-13 20:33 . 2007-12-13 20:33 <REP> d-------- C:\NVIDIA
2007-12-13 20:03 . 2007-12-13 20:03 294 ---hs---- C:\WINDOWS\system32\saipnoks.ini

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-25 09:58 --------- d-----w C:\Program Files\Mozilla Thunderbird
2007-12-24 16:56 1,336 ----a-w C:\WINDOWS\system32\drivers\fwdrv.err
2007-12-23 22:33 --------- d---a-w C:\Program Files\USB Storage RW
2007-12-19 18:30 --------- d-----w C:\Program Files\eMule
2007-12-12 11:33 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-12 11:27 --------- d---a-w C:\Program Files\Fichiers communs\InstallShield
2007-11-20 19:01 --------- d-----w C:\Program Files\QuickTime
2007-11-20 19:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\QuickTime
2007-11-20 18:23 --------- d---a-w C:\Program Files\Fichiers communs\Adobe
2007-11-20 13:08 --------- d-----w C:\Program Files\EPSON
2007-11-18 20:27 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\Grisoft
2007-11-18 20:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
2007-11-18 09:45 --------- d-----w C:\Program Files\Java
2007-11-18 09:43 --------- d-----w C:\Program Files\Fichiers communs\Java
2007-11-18 09:12 --------- d-----w C:\Program Files\VideoLAN
2007-11-18 08:47 --------- d-----w C:\Program Files\Sunbelt Software
2007-11-18 08:32 --------- d-----w C:\Program Files\Alwil Software
2007-11-17 22:22 --------- d---a-w C:\Program Files\InterVideo
2007-11-17 21:59 --------- d---a-w C:\Program Files\Symantec
2007-11-17 21:59 --------- d---a-w C:\Program Files\Fichiers communs\Symantec Shared
2007-11-17 21:59 --------- d---a-w C:\Documents and Settings\All Users\Application Data\Symantec
2007-11-17 21:48 3,458 --sha-r C:\WINDOWS\system32\drivers\HP_DF101A-ABF 415_YC_Pavi_QCZB318_E32FRheBLF2_4_IKM266-8235_S_V_BAM37312_T030317_W1_L40C_M256_J40_7AMD_8Athlon XP 2000+_91,66_1_N10EC8139_P_Z14F12F00_K_A11063059_U11063038_G10DE0172.MRK
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{478c0e17-2915-49f1-9ace-4d1ec58a76e8}]
C:\WINDOWS\System32\cwbkwlxw.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{86BE360E-D40E-4212-B495-307A65FBAA89}]
C:\WINDOWS\System32\ddcyy.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{97E2CE47-CA37-4E19-9780-7C15B780F4AA}]
C:\WINDOWS\System32\ddcca.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F9C77AE8-BC56-4554-9A70-FB2C975521F6}]
C:\WINDOWS\System32\jkhfe.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" []
"KYE_Showicon"="C:\Program Files\USB Storage RW\shwicon.exe" []
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas .exe" [2007-12-25 10:11]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-20 00:10 C:\WINDOWS\system32\rundll32.exe]
"NvMediaCenter"="RunDLL32.exe" [2004-08-20 00:10 C:\WINDOWS\system32\rundll32.exe]
"Local Security Authority Service"="C:\WINDOWS\System32\lssas.exe" []

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wvuvsrq]

R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys [2007-04-26 10:21]
R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys [2007-04-26 10:21]
R2 SPF4;Sunbelt Personal Firewall 4;C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe [2007-04-26 10:21]
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-04 06:58]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 07:08]

.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-25 11:11:50
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

**************************************************************************
.
Completion time: 2007-12-25 11:19:31 - machine was rebooted [Propri‚taire]
C:\ComboFix2.txt ... 2007-12-23 22:20
.
2007-12-23 19:00:59 --- E O F ---

---------------------------------------------------------------------
Je suis completement paumée là, je ne sais pas si je ne fais pas d'anneries dans mes manipulations...
Je poste tel quel et je file faire le scan en mode sans échec, car je perds régulièrement la connexion, alors, tant que je l'ai...

ComboFix 07-12-21.4 - Propriétaire 2007-12-25 10:53:01.4 - NTFSx86
Running from: C:\Documents and Settings\Propriétaire\Bureau\Programmes desinfectionvirus\ComboFix.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\awtss.dll
C:\WINDOWS\system32\sstwa.ini
C:\WINDOWS\system32\sstwa.ini2

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-11-25 to 2007-12-25 ))))))))))))))))))))))))))))))))))))
.

2007-12-23 22:48 . 2007-12-23 22:48 <REP> d-------- C:\Program Files\Avira
2007-12-23 22:48 . 2007-12-23 22:48 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2007-12-23 21:08 . 2007-12-23 21:09 <REP> d-------- C:\Program Files\Panda Security
2007-12-23 20:41 . 2007-12-23 20:41 24,576 --a------ C:\WINDOWS\system32\VundoFixSVC.exe
2007-12-23 20:37 . 2007-12-23 21:56 <REP> d-------- C:\VundoFix Backups
2007-12-23 20:12 . 2007-12-23 20:12 <REP> d-------- C:\Documents and Settings\LocalService\Menu D‚marrer
2007-12-23 18:00 . 2004-08-20 00:09 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2007-12-23 17:50 . 2007-12-23 17:50 <REP> d-------- C:\WINDOWS\provisioning
2007-12-23 17:50 . 2007-12-23 17:50 <REP> d-------- C:\WINDOWS\peernet
2007-12-23 17:42 . 2007-12-23 17:42 <REP> d-------- C:\WINDOWS\ServicePackFiles
2007-12-23 17:20 . 2007-12-23 17:20 <REP> d-------- C:\WINDOWS\EHome
2007-12-23 16:47 . 2007-12-23 16:47 <REP> d-------- C:\Program Files\TresorNet
2007-12-23 16:46 . 2007-12-23 16:47 1,429,032 --a------ C:\WINDOWS\system32\No‰l Cadeaux.scr
2007-12-23 15:25 . 2002-04-15 21:11 67,866 --------- C:\WINDOWS\system32\drivers\netwlan5.img
2007-12-23 15:25 . 2004-08-19 16:10 11,776 --------- C:\WINDOWS\system32\spnpinst.exe
2007-12-23 15:25 . 2004-08-02 14:20 7,208 --------- C:\WINDOWS\system32\secupd.sig
2007-12-23 15:25 . 2004-08-02 14:20 4,569 --------- C:\WINDOWS\system32\secupd.dat
2007-12-23 13:58 . 2004-08-20 00:09 614,912 --a------ C:\WINDOWS\system32\h323msp.dll
2007-12-23 13:58 . 2004-08-20 00:09 332,800 --a------ C:\WINDOWS\system32\ipnathlp.dll
2007-12-23 13:58 . 2004-08-20 00:10 266,752 --a------ C:\WINDOWS\system32\h323.tsp
2007-12-23 13:58 . 2004-03-30 02:49 40,960 -----c--- C:\WINDOWS\system32\dllcache\evtgprov.dll
2007-12-23 13:07 . 2003-02-28 16:34 313,856 --a------ C:\WINDOWS\system32\dx3j.dll
2007-12-23 13:07 . 2003-02-28 18:26 171,280 --a------ C:\WINDOWS\system32\jit.dll
2007-12-23 13:07 . 2003-02-28 18:26 139,536 --a------ C:\WINDOWS\system32\javaee.dll
2007-12-23 13:07 . 2003-02-28 18:26 46,352 --a------ C:\WINDOWS\setdebug.exe
2007-12-23 13:07 . 2003-02-28 16:54 7,315 --a------ C:\WINDOWS\system32\javasup.vxd
2007-12-23 13:07 . 2003-02-28 16:35 6,550 --a------ C:\WINDOWS\jautoexp.dat
2007-12-23 10:23 . 2007-12-23 10:24 267,624 --ah----- C:\WINDOWS\system32\yrtrpuda.exe
2007-12-23 10:22 . 2007-12-23 10:23 397,312 --ah----- C:\WINDOWS\system32\ptapdjp.exe
2007-12-23 10:21 . 2007-12-23 10:22 397,312 --ah----- C:\WINDOWS\system32\mcqgqob.exe
2007-12-23 10:12 . 2007-12-23 10:13 397,312 --ah----- C:\WINDOWS\system32\wchxl.exe
2007-12-23 09:59 . 2007-12-23 09:59 118 --a------ C:\WINDOWS\system32\wujjdpch.bat
2007-12-23 09:58 . 2007-12-23 09:59 397,312 --ah----- C:\WINDOWS\system32\zzezdyu.exe
2007-12-23 09:55 . 2007-12-23 09:56 397,312 --ah----- C:\WINDOWS\system32\rmdp.exe
2007-12-23 09:46 . 2007-12-23 13:26 <REP> d-------- C:\Program Files\a-squared Free
2007-12-23 09:31 . 2007-12-23 09:31 397,312 --ah----- C:\WINDOWS\system32\mjrfqd.exe
2007-12-23 09:30 . 2007-12-23 09:30 406,016 --ah----- C:\WINDOWS\system32\lbok.exe
2007-12-23 09:30 . 2007-12-23 09:31 397,312 --ah----- C:\WINDOWS\system32\nnxob.exe
2007-12-23 09:21 . 2007-12-23 09:22 397,312 --ah----- C:\WINDOWS\system32\vrkne.exe
2007-12-22 22:57 . 2007-12-22 22:58 406,016 --ah----- C:\WINDOWS\system32\ymfkvo.exe
2007-12-22 22:56 . 2007-12-22 22:58 300,444 --ah----- C:\WINDOWS\system32\rihxgm.exe
2007-12-22 22:55 . 2007-12-22 22:56 406,016 --ah----- C:\WINDOWS\system32\pfoxs.exe
2007-12-22 22:55 . 2007-12-22 22:56 406,016 --ah----- C:\WINDOWS\system32\ngpmexkj.exe
2007-12-22 22:52 . 2007-12-22 22:52 121 --a------ C:\WINDOWS\system32\wcamd.bat
2007-12-22 22:40 . 2007-12-22 22:40 123 --a------ C:\WINDOWS\system32\qqydyjm.bat
2007-12-22 22:39 . 2007-12-22 22:40 406,016 --ah----- C:\WINDOWS\system32\mrxgpms.exe
2007-12-22 22:37 . 2007-12-22 22:37 406,016 --ah----- C:\WINDOWS\system32\qkaws.exe
2007-12-22 22:34 . 2007-12-22 22:35 397,312 --ah----- C:\WINDOWS\system32\lvkxonr.exe
2007-12-22 22:33 . 2007-12-22 22:34 416,256 --ah----- C:\WINDOWS\system32\yvroe.exe
2007-12-22 22:32 . 2007-12-22 22:35 339,968 --ah----- C:\WINDOWS\system32\vniswk.exe
2007-12-22 22:31 . 2007-12-22 22:31 128 --a------ C:\WINDOWS\system32\mtcdqq.bat
2007-12-22 22:31 . 2007-12-22 22:31 124 --a------ C:\WINDOWS\system32\htrfx.bat
2007-12-22 22:29 . 2007-12-22 22:31 314,880 --ah----- C:\WINDOWS\system32\vsihhad.exe
2007-12-22 22:18 . 2007-12-22 22:19 119,708 --ah----- C:\WINDOWS\system32\xnsvb.exe
2007-12-22 22:15 . 2007-12-22 22:19 242,364 --ah----- C:\WINDOWS\system32\vuwip.exe
2007-12-22 22:05 . 2007-12-22 22:06 512 --ah----- C:\WINDOWS\system32\sexfvf.exe
2007-12-22 22:04 . 2007-12-22 22:05 134,656 --ah----- C:\WINDOWS\system32\xpyreb.exe
2007-12-22 21:55 . 2007-12-23 22:07 52,736 --a------ C:\WINDOWS\system\hpsysdrv .exe
2007-12-22 21:55 . 2007-12-23 23:54 181 --a------ C:\WINDOWS\system\hpsysdrv .DAT
2007-12-22 21:35 . 2007-12-22 21:35 406,016 --ah----- C:\WINDOWS\system32\zrxylezj.exe
2007-12-22 21:35 . 2007-12-22 21:35 16,308 --ah----- C:\WINDOWS\system32\nippom.exe
2007-12-22 21:33 . 2007-12-22 21:35 263,168 --ah----- C:\WINDOWS\system32\ygngoo.exe
2007-12-22 21:32 . 2007-12-22 21:35 352,768 --ah----- C:\WINDOWS\system32\xzkiwwsr.exe
2007-12-22 21:28 . 2007-12-22 21:28 3,584 --ah----- C:\WINDOWS\system32\hnqhx.exe
2007-12-22 21:22 . 2007-12-22 21:22 40,448 --ah----- C:\WINDOWS\system32\xhzczwrf.exe
2007-12-22 21:19 . 2007-12-22 21:19 0 --ah----- C:\WINDOWS\system32\yedh.exe
2007-12-22 21:18 . 2007-12-22 21:18 127 --a------ C:\WINDOWS\system32\yyiwk.bat
2007-12-22 21:18 . 2007-12-22 21:18 118 --a------ C:\WINDOWS\system32\ixfwg.bat
2007-12-22 21:15 . 2007-12-22 21:17 416,256 --ah----- C:\WINDOWS\system32\tjilus.exe
2007-12-22 21:12 . 2007-12-22 21:15 64,752 --ah----- C:\WINDOWS\system32\lvyppnbv.exe
2007-12-22 20:01 . 2005-10-20 23:25 1,097,728 --a------ C:\WINDOWS\system32\esent.dll
2007-12-22 13:13 . 2007-12-22 13:13 <REP> d-------- C:\Program Files\Trend Micro
2007-12-22 13:04 . 2007-12-22 13:04 <REP> d-------- C:\WINDOWS\system32\bits
2007-12-22 13:01 . 2007-12-25 10:51 <REP> d--h----- C:\WINDOWS\$hf_mig$
2007-12-22 13:01 . 2005-06-28 09:21 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2007-12-22 12:55 . 2004-08-20 00:09 351,232 --a------ C:\WINDOWS\system32\winhttp.dll
2007-12-22 12:55 . 2004-08-20 00:09 18,944 --a------ C:\WINDOWS\system32\qmgrprxy.dll
2007-12-22 12:55 . 2004-08-20 00:09 8,192 --------- C:\WINDOWS\system32\bitsprx2.dll
2007-12-22 12:55 . 2004-08-20 00:09 7,168 --------- C:\WINDOWS\system32\bitsprx3.dll
2007-12-22 10:54 . 2007-12-22 10:57 256 --a------ C:\WINDOWS\wininit.ini
2007-12-21 17:16 . 2007-12-21 17:17 714 ---hs---- C:\WINDOWS\system32\iffruoww.ini
2007-12-19 20:17 . 2007-12-21 17:08 654 ---hs---- C:\WINDOWS\system32\ijlhiqto.ini
2007-12-19 14:18 . 2007-12-19 14:19 <REP> d-------- C:\Program Files\pfoc
2007-12-18 20:15 . 2007-12-19 20:15 474 ---hs---- C:\WINDOWS\system32\boxxabdd.ini
2007-12-18 18:59 . 2007-12-18 18:59 482 --a------ C:\WINDOWS\Disney.ini
2007-12-18 18:58 . 2007-12-18 18:58 <REP> d-------- C:\Program Files\Disney Interactive
2007-12-17 20:13 . 2007-12-18 20:13 354 ---hs---- C:\WINDOWS\system32\ofihltxw.ini
2007-12-16 10:47 . 2007-12-22 18:44 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2007-12-16 10:47 . 2007-12-16 10:47 1,409 --a------ C:\WINDOWS\QTFont.for
2007-12-14 20:10 . 2007-12-15 20:13 354 ---hs---- C:\WINDOWS\system32\imvlpwmp.ini
2007-12-14 19:57 . 2007-12-14 19:57 <REP> d-------- C:\Documents and Settings\All Users\Application Data\nView_Profiles
2007-12-14 19:49 . 2007-12-25 10:11 88,566 --a------ C:\WINDOWS\system32\nvapps.xml
2007-12-14 19:47 . 2006-10-22 12:22 208,896 --a------ C:\WINDOWS\system32\nvudisp.exe
2007-12-14 19:47 . 2006-10-22 12:22 17,056 --a------ C:\WINDOWS\system32\nvdisp.nvu
2007-12-14 19:46 . 2006-10-22 15:06 208,896 --a------ C:\WINDOWS\system32\NVUNINST.EXE
2007-12-14 19:38 . 2007-12-14 19:54 <REP> d-------- C:\WINDOWS\nview
2007-12-14 18:49 . 2007-12-14 18:49 <REP> d-------- C:\Documents and Settings\All Users\Application Data\NVIDIA
2007-12-13 21:03 . 2007-12-14 20:11 8 --a------ C:\WINDOWS\system32\nvModes.dat
2007-12-13 20:33 . 2007-12-13 20:33 <REP> d-------- C:\NVIDIA
2007-12-13 20:03 . 2007-12-13 20:03 294 ---hs---- C:\WINDOWS\system32\saipnoks.ini

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-25 09:58 --------- d-----w C:\Program Files\Mozilla Thunderbird
2007-12-24 16:56 1,336 ----a-w C:\WINDOWS\system32\drivers\fwdrv.err
2007-12-23 22:33 --------- d---a-w C:\Program Files\USB Storage RW
2007-12-19 18:30 --------- d-----w C:\Program Files\eMule
2007-12-12 11:33 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-12 11:27 --------- d---a-w C:\Program Files\Fichiers communs\InstallShield
2007-11-20 19:01 --------- d-----w C:\Program Files\QuickTime
2007-11-20 19:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\QuickTime
2007-11-20 18:23 --------- d---a-w C:\Program Files\Fichiers communs\Adobe
2007-11-20 13:08 --------- d-----w C:\Program Files\EPSON
2007-11-18 20:27 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\Grisoft
2007-11-18 20:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
2007-11-18 09:45 --------- d-----w C:\Program Files\Java
2007-11-18 09:43 --------- d-----w C:\Program Files\Fichiers communs\Java
2007-11-18 09:12 --------- d-----w C:\Program Files\VideoLAN
2007-11-18 08:47 --------- d-----w C:\Program Files\Sunbelt Software
2007-11-18 08:32 --------- d-----w C:\Program Files\Alwil Software
2007-11-17 22:22 --------- d---a-w C:\Program Files\InterVideo
2007-11-17 21:59 --------- d---a-w C:\Program Files\Symantec
2007-11-17 21:59 --------- d---a-w C:\Program Files\Fichiers communs\Symantec Shared
2007-11-17 21:59 --------- d---a-w C:\Documents and Settings\All Users\Application Data\Symantec
2007-11-17 21:48 3,458 --sha-r C:\WINDOWS\system32\drivers\HP_DF101A-ABF 415_YC_Pavi_QCZB318_E32FRheBLF2_4_IKM266-8235_S_V_BAM37312_T030317_W1_L40C_M256_J40_7AMD_8Athlon XP 2000+_91,66_1_N10EC8139_P_Z14F12F00_K_A11063059_U11063038_G10DE0172.MRK
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{478c0e17-2915-49f1-9ace-4d1ec58a76e8}]
C:\WINDOWS\System32\cwbkwlxw.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{86BE360E-D40E-4212-B495-307A65FBAA89}]
C:\WINDOWS\System32\ddcyy.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{97E2CE47-CA37-4E19-9780-7C15B780F4AA}]
C:\WINDOWS\System32\ddcca.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F9C77AE8-BC56-4554-9A70-FB2C975521F6}]
C:\WINDOWS\System32\jkhfe.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" []
"KYE_Showicon"="C:\Program Files\USB Storage RW\shwicon.exe" []
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas .exe" [2007-12-25 10:11]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-20 00:10 C:\WINDOWS\system32\rundll32.exe]
"NvMediaCenter"="RunDLL32.exe" [2004-08-20 00:10 C:\WINDOWS\system32\rundll32.exe]
"Local Security Authority Service"="C:\WINDOWS\System32\lssas.exe" []

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wvuvsrq]

R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys [2007-04-26 10:21]
R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys [2007-04-26 10:21]
R2 SPF4;Sunbelt Personal Firewall 4;C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe [2007-04-26 10:21]
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-04 06:58]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 07:08]

.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-25 11:11:50
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

**************************************************************************
.
Completion time: 2007-12-25 11:19:31 - machine was rebooted [Propri‚taire]
C:\ComboFix2.txt ... 2007-12-23 22:20
.
2007-12-23 19:00:59 --- E O F ---

Bonne journée.
Sophie

lance antivir en mode sans echec et colle moi le rapport:

http://service1.symantec.com/support/inter/tsgeninfointl.nsf/fr_docid/20020905112131924

Je suis au boulot, le pc a planté cette nuit et les bips d'antivir à 2 heures du mat avec des enfants qui dorment !!!
Bref, je tente de tout refaire ce midi ou demain.
En plus, je suis infectée par un autre spyware qui ne veut pas partir avec antivir, rien à faire ni delete, ni mise en quarantaine, ni rien...
Donc, je ferais un scan de spyware en mode sans échec, une vaccination et après je referais partir antivir, euh, j'espère...

Donc merci pour tout. Je poste au plus vite.

Joyeux Noël

Sophie

ok

lance fvmonde:

http://www.f-secure.com/tools/f-vmonde.zip

________________

puis Symantec Vundo Remove Tool

https://www.broadcom.com/support/security-center

________________

télécharge OTMoveIt http://download.bleepingcomputer.com/oldtimer/OTMoveIt.exe (de Old_Timer) sur ton Bureau.
double-clique sur OTMoveIt.exe pour le lancer.
copie la liste qui se trouve en citation ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved.

Citation :

C:\WINDOWS\SYSTEM32\wvuvsrq.dll
C:\WINDOWS\System32\nymjljoq.dll
C:\WINDOWS\bukmon.exe
C:\WINDOWS\system32\wvuvsrq.dll
C:\WINDOWS\system32\tvtd.exe
C:\WINDOWS\system32\cly.exe
C:\WINDOWS\system32\slotnkmc.dll
C:\WINDOWS\System32\awtss.dll
C:\WINDOWS\System32\cwbkwlxw.dll
C:\WINDOWS\System32\ddcyy.dll
C:\WINDOWS\System32\ddcca.dll
C:\WINDOWS\System32\jkhfe.dll

clique sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre "Results".
clique sur Exit pour fermer.
poste le rapport situé dans C:\_OTMoveIt\MovedFiles.

il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.

___________________

remplace avast par antivir et colle le rapport ainsi qu'un nouveau combofix:

https://www.malekal.com/avira-free-security-antivirus-gratuit/ (merci Malekal)

___________________

a plus

LES RESULTATS de ce que tu m'as conseillé :

-----------------------------------------------------
Alors, dans l'ordre, le premier rapport Vundo Fix, après tout a planté, donc je ne sais pas trop bien...J'ai relancé, re-supprimé le fichier qui restait, mais je ne trouve pas le rapport :

Beginning removal...

Attempting to delete C:\WINDOWS\SYSTEM32\wvuvsrq.dll
C:\WINDOWS\SYSTEM32\wvuvsrq.dll Could not be deleted.

Performing Repairs to the registry.
Done!

Beginning removal...

VundoFix V6.7.7

Checking Java version...

Scan started at 20:53:44 23/12/2007

Listing files found while scanning....

------------------------------------------------------
Puis le log Hijacktis :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:57:53, on 23/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp .exe
C:\windows\system\hpsysdrv .exe
C:\Program Files\USB Storage RW\shwicon .exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas .exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Propriétaire\Bureau\Programmes desinfectionvirus\Vundofix\VundoFix.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-fr7.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.hpe.com/h41271/404D.aspx?cc=us&ll=en&url=http://domainredirects.ext.hpe.com/fr7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.hpe.com/h41271/404D.aspx?cc=us&ll=en&url=http://domainredirects.ext.hpe.com/fr7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-fr7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-fr7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-fr7.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.hpe.com/h41271/404D.aspx?cc=us&ll=en&url=http://domainredirects.ext.hpe.com/fr7.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.hpe.com/h41271/404D.aspx?cc=us&ll=en&url=http://domainredirects.ext.hpe.com/fr7.hpwis.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
F3 - REG:win.ini: load=C:\WINDOWS\System32\awtss.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [KYE_Showicon] "C:\Program Files\USB Storage RW\shwicon.exe" -t"KYE\USB Storage RW"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas .exe" /minimized
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Local Security Authority Service] C:\WINDOWS\System32\lssas.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - Global Startup: hp center.lnk = C:\Program Files\hp center\137903\Program\BackWeb-137903.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: VundoFix Service (VundoFixSvc) - Atribune.org - C:\WINDOWS\SYSTEM32\VundoFixSVC.exe

-------------------------------------------------------------
Le scan du Panda :

;***********************************************************************************************************************************************************************************
ANALYSIS: 2007-12-23 21:32:56
PROTECTIONS: 1
MALWARE: 7
SUSPECTS: 0
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description Version Active Updated
;===================================================================================================================================================================================
avast! antivirus 4.7.1098 [VPS 071223-0] 4.7.1098 No Yes
;===================================================================================================================================================================================
MALWARE
Id Description Type Active Severity Disinfectable Disinfected Location
;===================================================================================================================================================================================
00167749 Cookie/Toplist TrackingCookie No 0 Yes No C:\Documents and Settings\Propriétaire\Cookies\propriétaire@toplist[1].txt
00539174 W32/Sdbot.KMS.worm Virus/Worm No 1 Yes No C:\WINDOWS\system32\eszcd.exe
02857895 Spyware/Virtumonde Spyware No 1 Yes No C:\WINDOWS\bukmon.exe
02883200 Spyware/Vundo Spyware No 0 Yes No C:\WINDOWS\system32\wvuvsrq.dll
02884850 Trj/Ranky.TQ Virus/Trojan No 0 Yes No C:\WINDOWS\system32\tvtd.exe
02886421 Bck/Sdbot.LMB Virus/Trojan No 1 Yes No C:\WINDOWS\system32\cly.exe
02887209 Spyware/Virtumonde Spyware No 1 Yes No C:\WINDOWS\system32\slotnkmc.dll
;===================================================================================================================================================================================
SUSPECTS
Location
;===================================================================================================================================================================================
;===================================================================================================================================================================================

-------------------------------------------------------------
Le rapport hijackhtis :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:36:06, on 23/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp .exe
C:\windows\system\hpsysdrv .exe
C:\Program Files\USB Storage RW\shwicon .exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas .exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Propriétaire\Bureau\Programmes desinfectionvirus\Vundofix\VundoFix.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-fr7.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.hpe.com/h41271/404D.aspx?cc=us&ll=en&url=http://domainredirects.ext.hpe.com/fr7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.hpe.com/h41271/404D.aspx?cc=us&ll=en&url=http://domainredirects.ext.hpe.com/fr7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-fr7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-fr7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-fr7.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.hpe.com/h41271/404D.aspx?cc=us&ll=en&url=http://domainredirects.ext.hpe.com/fr7.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.hpe.com/h41271/404D.aspx?cc=us&ll=en&url=http://domainredirects.ext.hpe.com/fr7.hpwis.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
F3 - REG:win.ini: load=C:\WINDOWS\System32\awtss.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [KYE_Showicon] "C:\Program Files\USB Storage RW\shwicon.exe" -t"KYE\USB Storage RW"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas .exe" /minimized
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Local Security Authority Service] C:\WINDOWS\System32\lssas.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - Global Startup: hp center.lnk = C:\Program Files\hp center\137903\Program\BackWeb-137903.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (TotalScan Installer Class) - https://www.pandasecurity.com/en/homeusers/online-antivirus/?ref=activescan
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: VundoFix Service (VundoFixSvc) - Atribune.org - C:\WINDOWS\SYSTEM32\VundoFixSVC.exe

-------------------------------------------------------------
Le rapport combofix :

ComboFix 07-12-21.4 - Propriétaire 2007-12-23 21:43:02.2 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.31 [GMT 1:00]Running from: C:\Documents and Settings\Propriétaire\Bureau\Programmes desinfectionvirus\ComboFix.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\awtss.dll
C:\WINDOWS\system32\awtst.dll
C:\WINDOWS\system32\csrs.exe
C:\WINDOWS\system32\firewall.exe
C:\WINDOWS\system32\isass.exe
C:\WINDOWS\system32\jkhfg.dll
C:\WINDOWS\system32\jkhhe.dll
C:\WINDOWS\system32\pmkjh.dll
C:\WINDOWS\system32\pmnnn.dll
C:\WINDOWS\system32\sstwa.ini
C:\WINDOWS\system32\sstwa.ini2
C:\WINDOWS\system32\wvuvsrq.dll

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-11-23 to 2007-12-23 ))))))))))))))))))))))))))))))))))))
.

2007-12-23 21:08 . 2007-12-23 21:09 <REP> d-------- C:\Program Files\Panda Security
2007-12-23 20:41 . 2007-12-23 20:41 24,576 --a------ C:\WINDOWS\system32\VundoFixSVC.exe
2007-12-23 20:37 . 2007-12-23 21:56 <REP> d-------- C:\VundoFix Backups
2007-12-23 20:12 . 2007-12-23 20:12 <REP> d-------- C:\Documents and Settings\LocalService\Menu D‚marrer
2007-12-23 18:00 . 2004-08-20 00:09 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2007-12-23 17:50 . 2007-12-23 17:50 <REP> d-------- C:\WINDOWS\provisioning
2007-12-23 17:50 . 2007-12-23 17:50 <REP> d-------- C:\WINDOWS\peernet
2007-12-23 17:42 . 2007-12-23 17:42 <REP> d-------- C:\WINDOWS\ServicePackFiles
2007-12-23 17:20 . 2007-12-23 17:20 <REP> d-------- C:\WINDOWS\EHome
2007-12-23 16:47 . 2007-12-23 16:47 <REP> d-------- C:\Program Files\TresorNet
2007-12-23 16:46 . 2007-12-23 16:47 1,429,032 --a------ C:\WINDOWS\system32\No‰l Cadeaux.scr
2007-12-23 15:25 . 2002-04-15 21:11 67,866 --------- C:\WINDOWS\system32\drivers\netwlan5.img
2007-12-23 15:25 . 2004-08-19 16:10 11,776 --------- C:\WINDOWS\system32\spnpinst.exe
2007-12-23 15:25 . 2004-08-02 14:20 7,208 --------- C:\WINDOWS\system32\secupd.sig
2007-12-23 15:25 . 2004-08-02 14:20 4,569 --------- C:\WINDOWS\system32\secupd.dat
2007-12-23 13:58 . 2004-08-20 00:09 614,912 --a------ C:\WINDOWS\system32\h323msp.dll
2007-12-23 13:58 . 2004-08-20 00:09 332,800 --a------ C:\WINDOWS\system32\ipnathlp.dll
2007-12-23 13:58 . 2004-08-20 00:10 266,752 --a------ C:\WINDOWS\system32\h323.tsp
2007-12-23 13:58 . 2004-03-30 02:49 40,960 -----c--- C:\WINDOWS\system32\dllcache\evtgprov.dll
2007-12-23 13:07 . 2003-02-28 16:34 313,856 --a------ C:\WINDOWS\system32\dx3j.dll
2007-12-23 13:07 . 2003-02-28 18:26 171,280 --a------ C:\WINDOWS\system32\jit.dll
2007-12-23 13:07 . 2003-02-28 18:26 139,536 --a------ C:\WINDOWS\system32\javaee.dll
2007-12-23 13:07 . 2003-02-28 18:26 46,352 --a------ C:\WINDOWS\setdebug.exe
2007-12-23 13:07 . 2003-02-28 16:54 7,315 --a------ C:\WINDOWS\system32\javasup.vxd
2007-12-23 13:07 . 2003-02-28 16:35 6,550 --a------ C:\WINDOWS\jautoexp.dat
2007-12-23 10:37 . 2007-12-23 10:37 59,392 --------- C:\WINDOWS\bukmon.exe
2007-12-23 10:24 . 2007-12-23 10:24 548,352 --a------ C:\WINDOWS\system32\cly.exe
2007-12-23 10:23 . 2007-12-23 10:23 406,016 --ah----- C:\WINDOWS\system32\aiisb.exe
2007-12-23 10:23 . 2007-12-23 10:24 267,624 --ah----- C:\WINDOWS\system32\yrtrpuda.exe
2007-12-23 10:22 . 2007-12-23 10:23 397,312 --ah----- C:\WINDOWS\system32\ptapdjp.exe
2007-12-23 10:21 . 2007-12-23 10:22 397,312 --ah----- C:\WINDOWS\system32\mcqgqob.exe
2007-12-23 10:20 . 2007-12-23 10:22 397,312 --ah----- C:\WINDOWS\system32\fydxzpyz.exe
2007-12-23 10:19 . 2007-12-23 10:20 397,312 --ah----- C:\WINDOWS\system32\caqoqpmd.exe
2007-12-23 10:18 . 2007-12-23 10:19 397,312 --ah----- C:\WINDOWS\system32\jjaw.exe
2007-12-23 10:13 . 2007-12-23 10:14 397,312 --ah----- C:\WINDOWS\system32\aykacyzy.exe
2007-12-23 10:12 . 2007-12-23 10:13 397,312 --ah----- C:\WINDOWS\system32\wchxl.exe
2007-12-23 10:11 . 2007-12-23 10:11 416,256 --ah----- C:\WINDOWS\system32\evyitwd.exe
2007-12-23 10:11 . 2007-12-23 10:12 397,312 --ah----- C:\WINDOWS\system32\cduqiijt.exe
2007-12-23 10:10 . 2007-12-23 10:11 397,312 --ah----- C:\WINDOWS\system32\jokiipr.exe
2007-12-23 10:01 . 2007-12-23 10:01 397,312 --ah----- C:\WINDOWS\system32\awxajpp.exe
2007-12-23 09:59 . 2007-12-23 09:59 118 --a------ C:\WINDOWS\system32\wujjdpch.bat
2007-12-23 09:58 . 2007-12-23 09:59 397,312 --ah----- C:\WINDOWS\system32\zzezdyu.exe
2007-12-23 09:57 . 2007-12-23 09:58 406,016 --ah----- C:\WINDOWS\system32\jabx.exe
2007-12-23 09:55 . 2007-12-23 09:56 397,312 --ah----- C:\WINDOWS\system32\rmdp.exe
2007-12-23 09:53 . 2007-12-23 09:53 406,016 --ah----- C:\WINDOWS\system32\iokvw.exe
2007-12-23 09:51 . 2007-12-23 09:51 397,312 --ah----- C:\WINDOWS\system32\fkbpk.exe
2007-12-23 09:46 . 2007-12-23 13:26 <REP> d-------- C:\Program Files\a-squared Free
2007-12-23 09:31 . 2007-12-23 09:31 397,312 --ah----- C:\WINDOWS\system32\mjrfqd.exe
2007-12-23 09:30 . 2007-12-23 09:30 406,016 --ah----- C:\WINDOWS\system32\lbok.exe
2007-12-23 09:30 . 2007-12-23 09:31 397,312 --ah----- C:\WINDOWS\system32\nnxob.exe
2007-12-23 09:29 . 2007-12-23 09:30 397,312 --ah----- C:\WINDOWS\system32\zjbimhfn.exe
2007-12-23 09:21 . 2007-12-23 09:22 397,312 --ah----- C:\WINDOWS\system32\vrkne.exe
2007-12-22 22:57 . 2007-12-22 22:58 406,016 --ah----- C:\WINDOWS\system32\ymfkvo.exe
2007-12-22 22:57 . 2007-12-22 22:58 7,964 --ah----- C:\WINDOWS\system32\ozhupjsb.exe
2007-12-22 22:56 . 2007-12-22 22:58 300,444 --ah----- C:\WINDOWS\system32\rihxgm.exe
2007-12-22 22:55 . 2007-12-22 22:56 406,016 --ah----- C:\WINDOWS\system32\pfoxs.exe
2007-12-22 22:55 . 2007-12-22 22:56 406,016 --ah----- C:\WINDOWS\system32\ngpmexkj.exe
2007-12-22 22:54 . 2007-12-22 22:58 5,840 --ah----- C:\WINDOWS\system32\uymc.exe
2007-12-22 22:52 . 2007-12-22 22:52 121 --a------ C:\WINDOWS\system32\wcamd.bat
2007-12-22 22:51 . 2007-12-22 22:52 406,016 --ah----- C:\WINDOWS\system32\kfsxzj.exe
2007-12-22 22:40 . 2007-12-22 22:40 123 --a------ C:\WINDOWS\system32\qqydyjm.bat
2007-12-22 22:39 . 2007-12-22 22:40 406,016 --ah----- C:\WINDOWS\system32\mrxgpms.exe
2007-12-22 22:37 . 2007-12-22 22:37 406,016 --ah----- C:\WINDOWS\system32\qkaws.exe
2007-12-22 22:35 . 2007-12-22 22:35 406,016 --ah----- C:\WINDOWS\system32\gnflt.exe
2007-12-22 22:34 . 2007-12-22 22:35 397,312 --ah----- C:\WINDOWS\system32\lvkxonr.exe
2007-12-22 22:33 . 2007-12-22 22:34 416,256 --ah----- C:\WINDOWS\system32\yvroe.exe
2007-12-22 22:33 . 2007-12-22 22:33 406,016 --ah----- C:\WINDOWS\system32\kdwriv.exe
2007-12-22 22:32 . 2007-12-22 22:35 339,968 --ah----- C:\WINDOWS\system32\vniswk.exe
2007-12-22 22:31 . 2007-12-22 22:31 128 --a------ C:\WINDOWS\system32\mtcdqq.bat
2007-12-22 22:31 . 2007-12-22 22:31 124 --a------ C:\WINDOWS\system32\htrfx.bat
2007-12-22 22:29 . 2007-12-22 22:31 314,880 --ah----- C:\WINDOWS\system32\vsihhad.exe
2007-12-22 22:27 . 2007-12-22 22:27 10,240 --ah----- C:\WINDOWS\system32\sicr.exe
2007-12-22 22:18 . 2007-12-22 22:19 119,708 --ah----- C:\WINDOWS\system32\xnsvb.exe
2007-12-22 22:17 . 2007-12-22 22:18 3,072 --ah----- C:\WINDOWS\system32\eszcd.exe
2007-12-22 22:15 . 2007-12-22 22:19 242,364 --ah----- C:\WINDOWS\system32\vuwip.exe
2007-12-22 22:05 . 2007-12-22 22:06 512 --ah----- C:\WINDOWS\system32\sexfvf.exe
2007-12-22 22:04 . 2007-12-22 22:05 134,656 --ah----- C:\WINDOWS\system32\xpyreb.exe
2007-12-22 21:55 . 2007-12-23 22:09 335,360 --a------ C:\WINDOWS\system32\awtss.exe
2007-12-22 21:55 . 2007-12-23 22:07 52,736 --a------ C:\WINDOWS\system\hpsysdrv .exe
2007-12-22 21:55 . 2007-12-23 22:07 180 --a------ C:\WINDOWS\system\hpsysdrv .DAT
2007-12-22 21:35 . 2007-12-22 21:35 406,016 --ah----- C:\WINDOWS\system32\zrxylezj.exe
2007-12-22 21:35 . 2007-12-22 21:35 31,248 --ah----- C:\WINDOWS\system32\auwb.exe
2007-12-22 21:35 . 2007-12-22 21:35 16,308 --ah----- C:\WINDOWS\system32\nippom.exe
2007-12-22 21:33 . 2007-12-22 21:35 263,168 --ah----- C:\WINDOWS\system32\ygngoo.exe
2007-12-22 21:32 . 2007-12-22 21:35 352,768 --ah----- C:\WINDOWS\system32\xzkiwwsr.exe
2007-12-22 21:29 . 2007-12-22 21:32 248,832 --ah----- C:\WINDOWS\system32\jsgzqa.exe
2007-12-22 21:28 . 2007-12-22 21:28 3,584 --ah----- C:\WINDOWS\system32\hnqhx.exe
2007-12-22 21:27 . 2007-12-22 21:27 32,456 --a------ C:\WINDOWS\system32\tvtd.exe
2007-12-22 21:22 . 2007-12-22 21:22 40,448 --ah----- C:\WINDOWS\system32\xhzczwrf.exe
2007-12-22 21:19 . 2007-12-22 21:19 0 --ah----- C:\WINDOWS\system32\yedh.exe
2007-12-22 21:18 . 2007-12-22 21:18 127 --a------ C:\WINDOWS\system32\yyiwk.bat
2007-12-22 21:18 . 2007-12-22 21:18 118 --a------ C:\WINDOWS\system32\ixfwg.bat
2007-12-22 21:15 . 2007-12-22 21:17 416,256 --ah----- C:\WINDOWS\system32\tjilus.exe
2007-12-22 21:12 . 2007-12-22 21:15 64,752 --ah----- C:\WINDOWS\system32\lvyppnbv.exe
2007-12-22 20:01 . 2005-10-20 23:25 1,097,728 --a------ C:\WINDOWS\system32\esent.dll
2007-12-22 13:13 . 2007-12-22 13:13 <REP> d-------- C:\Program Files\Trend Micro
2007-12-22 13:04 . 2007-12-22 13:04 <REP> d-------- C:\WINDOWS\system32\bits
2007-12-22 13:01 . 2007-12-23 20:14 <REP> d--h----- C:\WINDOWS\$hf_mig$
2007-12-22 13:01 . 2005-06-28 09:21 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2007-12-22 12:55 . 2004-08-20 00:09 351,232 --a------ C:\WINDOWS\system32\winhttp.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-23 21:08 --------- d---a-w C:\Program Files\USB Storage RW
2007-12-23 21:07 331,776 ----a-w C:\WINDOWS\system32\awtss.dll
2007-12-23 19:51 --------- d-----w C:\Program Files\Mozilla Thunderbird
2007-12-23 15:47 1,429,032 ----a-w C:\WINDOWS\system32\Noël Cadeaux.scr
2007-12-22 21:59 835 ----a-w C:\WINDOWS\system32\drivers\fwdrv.err
2007-12-19 18:30 --------- d-----w C:\Program Files\eMule
2007-12-12 11:33 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-12 11:27 --------- d---a-w C:\Program Files\Fichiers communs\InstallShield
2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr
2007-11-20 19:01 --------- d-----w C:\Program Files\QuickTime
2007-11-20 19:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\QuickTime
2007-11-20 18:23 --------- d---a-w C:\Program Files\Fichiers communs\Adobe
2007-11-20 13:08 --------- d-----w C:\Program Files\EPSON
2007-11-18 20:27 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\Grisoft
2007-11-18 20:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
2007-11-18 09:45 --------- d-----w C:\Program Files\Java
2007-11-18 09:43 --------- d-----w C:\Program Files\Fichiers communs\Java
2007-11-18 09:12 --------- d-----w C:\Program Files\VideoLAN
2007-11-18 08:47 --------- d-----w C:\Program Files\Sunbelt Software
2007-11-18 08:35 17,920 ----a-w C:\WINDOWS\system32\tftp.exe
2007-11-18 08:32 --------- d-----w C:\Program Files\Alwil Software
2007-11-17 22:22 --------- d---a-w C:\Program Files\InterVideo
2007-11-17 22:04 65,308 ---ha-w C:\WINDOWS\system32\hekpkpz.exe
2007-11-17 21:59 --------- d---a-w C:\Program Files\Symantec
2007-11-17 21:59 --------- d---a-w C:\Program Files\Fichiers communs\Symantec Shared
2007-11-17 21:59 --------- d---a-w C:\Documents and Settings\All Users\Application Data\Symantec
2007-11-17 21:48 3,458 --sha-r C:\WINDOWS\system32\drivers\HP_DF101A-ABF 415_YC_Pavi_QCZB318_E32FRheBLF2_4_IKM266-8235_S_V_BAM37312_T030317_W1_L40C_M256_J40_7AMD_8Athlon XP 2000+_91,66_1_N10EC8139_P_Z14F12F00_K_A11063059_U11063038_G10DE0172.MRK
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{15E9791B-1C83-4E31-9AC9-9B36A9EE2C1C}]
2007-12-23 22:07 331776 --a------ C:\WINDOWS\System32\awtss.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{478c0e17-2915-49f1-9ace-4d1ec58a76e8}]
C:\WINDOWS\System32\cwbkwlxw.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{86BE360E-D40E-4212-B495-307A65FBAA89}]
C:\WINDOWS\System32\ddcyy.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{97E2CE47-CA37-4E19-9780-7C15B780F4AA}]
C:\WINDOWS\System32\ddcca.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C4D88D6A-63F2-4F23-9F19-2C93900F452F}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F9C77AE8-BC56-4554-9A70-FB2C975521F6}]
C:\WINDOWS\System32\jkhfe.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-12-23 22:08]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [2007-12-23 22:08]
"KYE_Showicon"="C:\Program Files\USB Storage RW\shwicon.exe" [2007-12-23 22:08]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-23 22:08]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas .exe" [2007-12-23 22:09]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-20 00:10 C:\WINDOWS\system32\rundll32.exe]
"NvMediaCenter"="RunDLL32.exe" [2004-08-20 00:10 C:\WINDOWS\system32\rundll32.exe]
"Local Security Authority Service"="C:\WINDOWS\System32\lssas.exe" []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wvuvsrq]

[HKEY_CURRENT_USER\software\microsoft\windows nt\currentversion\windows]
"load"=C:\WINDOWS\System32\awtss.exe

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 C:\WINDOWS\System32\awtss

R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys [2007-04-26 10:21]
R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys [2007-04-26 10:21]
S2 SPF4;Sunbelt Personal Firewall 4;C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe [2007-04-26 10:21]
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-04 06:58]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 07:08]

.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-23 22:05:48
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

C:\WINDOWS\system32\sstwa.ini 319 bytes
C:\WINDOWS\system32\sstwa.ini2 319 bytes

scan completed successfully
hidden files: 2

**************************************************************************
.
Completion time: 2007-12-23 22:19:57 - machine was rebooted
.
2007-12-23 19:00:59 --- E O F ---

--------------------------------------------------------------

Voilà, je crois que j'ai tout fais.
Merci de votre aide.
Sophie