infection par un Spyware

Question

Bonjour, 
J'avais un message d'alerte de Window comme quoi j' étais infecté par un spyware. en cherchant un peu g trouvé une marche a suivre, voici l'adresse (désoler c pa créer de lien :) http://www.infos-du-net.com/forum/216909-11-system-alert-spyware-detected .
g du utiliser "SMITFRAUDFIX" ensuite "AVG ANTI-SPYWARE" puis "HIJACKTHIS" , g eu d rapport mai étant débutant je ne sais pas les interpréter et donc je ne sais si je suis tjrs infecté. depuis que g réallumé l'ordi le messages d'alerte n'apparait plus. Quelqu'un pourrait-il me dire si j'en suis débarrassé et si non que doi je faire? voici les rapport dans l'ordre d prog ci-dessus.
Merci à vous et bonne soirée.

                                                                    -----------------------------------------------------


SmitFraudFix v2.250

Rapport fait à 21:48:20,28, 06/11/2007
Executé à partir de C:\Documents and Settings\Propri‚taire\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
C:\Program Files\SuperCopier2\SuperCopier2.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcLog.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcAppFlt.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

Fichier hosts corrompu !

127.0.0.1	legal-at-spybot.info
127.0.0.1	www.legal-at-spybot.info

»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

C:\WINDOWS\system32\eulbn.dll PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Propri‚taire


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Propri‚taire\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

C:\DOCUME~1\ALLUSE~1\MENUDM~1\Online Security Guide.url PRESENT !
C:\DOCUME~1\ALLUSE~1\MENUDM~1\Security Troubleshooting.url PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\PROPRI~1\Favoris

C:\DOCUME~1\PROPRI~1\Favoris\Online Security Test.url PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files 


»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
 
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"
 

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{48a7a70a-e118-4506-a373-c9d4e8a212a1}"="arturo"

[HKEY_CLASSES_ROOT\CLSID\{48a7a70a-e118-4506-a373-c9d4e8a212a1}\InProcServer32]
@="C:\WINDOWS\system32\eulbn.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{48a7a70a-e118-4506-a373-c9d4e8a212a1}\InProcServer32]
@="C:\WINDOWS\system32\eulbn.dll"



»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\WINDOWS\system32\__c0068EE2.dat"
"LoadAppInit_DLLs"=dword:00000001


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Rustock



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: NVIDIA nForce Networking Controller - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.1.1
DNS Server Search Order: 192.168.1.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{A67F7D9A-335D-4A79-8E4A-B223687F283F}: DhcpNameServer=208.67.220.220,208.67.222.222 
HKLM\SYSTEM\CCS\Services\Tcpip\..\{CE41E5B6-BE14-4FD8-B2E8-90D5DB8F1029}: DhcpNameServer=192.168.1.1 192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{F830CC7E-5688-4888-8143-B38E64C12629}: DhcpNameServer=208.67.220.220,208.67.222.222 
HKLM\SYSTEM\CS1\Services\Tcpip\..\{A67F7D9A-335D-4A79-8E4A-B223687F283F}: DhcpNameServer=208.67.220.220,208.67.222.222 
HKLM\SYSTEM\CS1\Services\Tcpip\..\{CE41E5B6-BE14-4FD8-B2E8-90D5DB8F1029}: DhcpNameServer=192.168.1.1 192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{F830CC7E-5688-4888-8143-B38E64C12629}: DhcpNameServer=208.67.220.220,208.67.222.222 
HKLM\SYSTEM\CS2\Services\Tcpip\..\{A67F7D9A-335D-4A79-8E4A-B223687F283F}: DhcpNameServer=208.67.220.220,208.67.222.222 
HKLM\SYSTEM\CS2\Services\Tcpip\..\{CE41E5B6-BE14-4FD8-B2E8-90D5DB8F1029}: DhcpNameServer=192.168.1.1 192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{F830CC7E-5688-4888-8143-B38E64C12629}: DhcpNameServer=208.67.220.220,208.67.222.222 
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 192.168.1.1


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin



                                                                        -------------------------------------------------

SmitFraudFix v2.250

Rapport fait à 22:08:44,17, 06/11/2007
Executé à partir de C:\Documents and Settings\Propri‚taire\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode sans echec

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{48a7a70a-e118-4506-a373-c9d4e8a212a1}"="arturo"

[HKEY_CLASSES_ROOT\CLSID\{48a7a70a-e118-4506-a373-c9d4e8a212a1}\InProcServer32]
@="C:\WINDOWS\system32\eulbn.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{48a7a70a-e118-4506-a373-c9d4e8a212a1}\InProcServer32]
@="C:\WINDOWS\system32\eulbn.dll"


»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus


»»»»»»»»»»»»»»»»»»»»»»»» hosts


127.0.0.1       localhost
127.0.0.1	apmebf.com
127.0.0.1	www.apmebf.com
127.0.0.1	emjcd.com
127.0.0.1	www.emjcd.com
127.0.0.1	kqzyfj.com
127.0.0.1	www.kqzyfj.com
127.0.0.1	registerapi.com
127.0.0.1	gamehouse.com
127.0.0.1	www.gamehouse.com
127.0.0.1	www.xat.com
127.0.0.1	xat.com
127.0.0.1	pipni.cz
127.0.0.1	www.pipni.cz
127.0.0.1	www3.pipni.cz
127.0.0.1	cool.ne.jp
127.0.0.1	urawa.cool.ne.jp
127.0.0.1	cool.ne.jp
127.0.0.1	007guard.com
127.0.0.1	www.007guard.com
127.0.0.1	008i.com
127.0.0.1	008k.com
127.0.0.1	www.008k.com
127.0.0.1	00hq.com
127.0.0.1	www.00hq.com
127.0.0.1	010402.com
127.0.0.1	032439.com
127.0.0.1	www.032439.com
127.0.0.1	1001-search.info
127.0.0.1	www.1001-search.info
127.0.0.1	100888290cs.com
127.0.0.1	www.100888290cs.com
127.0.0.1	100sexlinks.com
127.0.0.1	www.100sexlinks.com
127.0.0.1	10sek.com
127.0.0.1	www.10sek.com
127.0.0.1	123topsearch.com
127.0.0.1	www.123topsearch.com
127.0.0.1	132.com
127.0.0.1	www.132.com
127.0.0.1	136136.net
127.0.0.1	www.136136.net
127.0.0.1	139mm.com
127.0.0.1	www.139mm.com
127.0.0.1	163ns.com
127.0.0.1	www.163ns.com
127.0.0.1	171203.com
127.0.0.1	17-plus.com
127.0.0.1	1800searchonline.com
127.0.0.1	www.1800searchonline.com
127.0.0.1	180searchassistant.com
127.0.0.1	www.180searchassistant.com
127.0.0.1	180solutions.com
127.0.0.1	www.180solutions.com
127.0.0.1	181.365soft.info
127.0.0.1	www.181.365soft.info
127.0.0.1	1987324.com
127.0.0.1	www.1987324.com
127.0.0.1	1-domains-registrations.com
127.0.0.1	www.1-domains-registrations.com
127.0.0.1	1-extreme.biz
127.0.0.1	www.1-extreme.biz
127.0.0.1	1sexparty.com
127.0.0.1	www.1sexparty.com
127.0.0.1	1stantivirus.com
127.0.0.1	www.1stantivirus.com
127.0.0.1	1stpagehere.com
127.0.0.1	www.1stpagehere.com
127.0.0.1	1stsearchportal.com
127.0.0.1	www.1stsearchportal.com
127.0.0.1	2.82211.net
127.0.0.1	www.2006ooo.com
127.0.0.1	2007-download.com
127.0.0.1	www.2007-download.com
127.0.0.1	2020search.com
127.0.0.1	www.2020search.com
127.0.0.1	20x2p.com
127.0.0.1	24.365soft.info
127.0.0.1	www.24.365soft.info
127.0.0.1	24-7pharmacy.info
127.0.0.1	www.24-7pharmacy.info
127.0.0.1	24-7searching-and-more.com
127.0.0.1	www.24-7searching-and-more.com
127.0.0.1	24teen.com
127.0.0.1	www.24teen.com
127.0.0.1	2every.net
127.0.0.1	www.2every.net
127.0.0.1	2ndpower.com
127.0.0.1	2search.com
127.0.0.1	www.2search.com
127.0.0.1	2search.org
127.0.0.1	www.2search.org
127.0.0.1	2squared.com
127.0.0.1	www.2squared.com
127.0.0.1	3322.org
127.0.0.1	www.3322.org
127.0.0.1	365soft.info
127.0.0.1	36site.com
127.0.0.1	www.36site.com
127.0.0.1	3721.com
127.0.0.1	39-93.com
127.0.0.1	3abetterinternet.com
127.0.0.1	www.3abetterinternet.com
127.0.0.1	3bay.it
127.0.0.1	www.3bay.it
127.0.0.1	3ebay.it
127.0.0.1	www.3ebay.it
127.0.0.1	404dns.com
127.0.0.1	www.404dns.com
127.0.0.1	4199.com
127.0.0.1	www.4199.com
127.0.0.1	4corn.net
127.0.0.1	www.4corn.net
127.0.0.1	4ebay.it
127.0.0.1	www.4ebay.it
127.0.0.1	4klm.com
127.0.0.1	4repubblica.it
127.0.0.1	www.4repubblica.it
127.0.0.1	4softget.com
127.0.0.1	www.4softget.com
127.0.0.1	5iscali.it
127.0.0.1	www.5iscali.it
127.0.0.1	5repubblica.it
127.0.0.1	www.5repubblica.it
127.0.0.1	5starvideos.com
127.0.0.1	www.5starvideos.com
127.0.0.1	5tiscali.it
127.0.0.1	www.5tiscali.it
127.0.0.1	5zgmu7o20kt5d8yq.com
127.0.0.1	www.5zgmu7o20kt5d8yq.com
127.0.0.1	6iscali.it
127.0.0.1	www.6iscali.it
127.0.0.1	6sek.com
127.0.0.1	www.6sek.com
127.0.0.1	6tiscali.it
127.0.0.1	www.6tiscali.it
127.0.0.1	7322.com
127.0.0.1	www.7322.com
127.0.0.1	75tz.com
127.0.0.1	777search.com
127.0.0.1	www.777search.com
127.0.0.1	777top.com
127.0.0.1	www.777top.com
127.0.0.1	7939.com
127.0.0.1	www.7939.com
127.0.0.1	7search.com
127.0.0.1	www.7search.com
127.0.0.1	80gw6ry3i3x3qbrkwhxhw.032439.com
127.0.0.1	82211.net
127.0.0.1	8866.org
127.0.0.1	888.com
127.0.0.1	www.888.com
127.0.0.1	8ad.com
127.0.0.1	www.8ad.com
127.0.0.1	9505.com
127.0.0.1	www.9505.com
127.0.0.1	971searchbox.com
127.0.0.1	www.971searchbox.com
127.0.0.1	a.bestmanage.org
127.0.0.1	aaasexypics.com
127.0.0.1	aaawebfinder.com
127.0.0.1	www.aaawebfinder.com
127.0.0.1	aavc.com
127.0.0.1	abc-find.info
127.0.0.1	www.abc-find.info
127.0.0.1	abetterinternet.com
127.0.0.1	www.abetterinternet.com
127.0.0.1	abnetsoft.info
127.0.0.1	www.abnetsoft.info
127.0.0.1	aboutclicker.com
127.0.0.1	www.aboutclicker.com
127.0.0.1	abrp.net
127.0.0.1	www.abrp.net
127.0.0.1	absolutee.com
127.0.0.1	www.absolutee.com
127.0.0.1	abyssmedia.com
127.0.0.1	www.abyssmedia.com
127.0.0.1	ac66.cn
127.0.0.1	www.ac66.cn
127.0.0.1	access.Navinetwork.com
127.0.0.1	access.rapid-pass.net
127.0.0.1	accessactivexvideo.com
127.0.0.1	www.accessactivexvideo.com
127.0.0.1	accessclips.com
127.0.0.1	www.accessclips.com
127.0.0.1	access-dvd.com
127.0.0.1	www.access-dvd.com
127.0.0.1	accesskeygenerator.com
127.0.0.1	www.accesskeygenerator.com
127.0.0.1	accessorygeeks.com
127.0.0.1	www.accessorygeeks.com
127.0.0.1	accessthefuture.net
127.0.0.1	www.accessthefuture.net
127.0.0.1	accessvid.net
127.0.0.1	www.accessvid.net
127.0.0.1	acemedic.com
127.0.0.1	www.acemedic.com
127.0.0.1	ace-webmaster.com
127.0.0.1	www.ace-webmaster.com
127.0.0.1	acjp.com
127.0.0.1	acrobat-2007.com
127.0.0.1	www.acrobat-2007.com
127.0.0.1	acrobat-8.com
127.0.0.1	www.acrobat-8.com
127.0.0.1	acrobat-center.com
127.0.0.1	www.acrobat-center.com
127.0.0.1	acrobat-hq.com
127.0.0.1	www.acrobat-hq.com
127.0.0.1	acrobatreader-8.com
127.0.0.1	www.acrobatreader-8.com
127.0.0.1	acrobat-reader-8.de
127.0.0.1	www.acrobat-reader-8.de
127.0.0.1	acrobat-stop.com
127.0.0.1	www.acrobat-stop.com
127.0.0.1	actionbreastcancer.org
127.0.0.1	www.actionbreastcancer.org
127.0.0.1	activesearcher.info
127.0.0.1	www.activesearcher.info
127.0.0.1	activexaccessobject.com
127.0.0.1	www.activexaccessobject.com
127.0.0.1	activexaccessvideo.com
127.0.0.1	www.activexaccessvideo.com
127.0.0.1	activexemedia.com
127.0.0.1	www.activexemedia.com
127.0.0.1	activexmediaobject.com
127.0.0.1	www.activexmediaobject.com
127.0.0.1	activexmediapro.com
127.0.0.1	www.activexmediapro.com
127.0.0.1	activexmediasite.com
127.0.0.1	www.activexmediasite.com
127.0.0.1	activexmediasoftware.com
127.0.0.1	www.activexmediasoftware.com
127.0.0.1	activexmediasource.com
127.0.0.1	www.activexmediasource.com
127.0.0.1	activexmediatool.com
127.0.0.1	www.activexmediatool.com
127.0.0.1	activexmediatour.com
127.0.0.1	www.activexmediatour.com
127.0.0.1	activexsoftwares.com
127.0.0.1	www.activexsoftwares.com
127.0.0.1	activexsource.com
127.0.0.1	www.activexsource.com
127.0.0.1	activexupdate.com
127.0.0.1	www.activexupdate.com
127.0.0.1	activexvideo.com
127.0.0.1	www.activexvideo.com
127.0.0.1	activexvideotool.com
127.0.0.1	www.activexvideotool.com
127.0.0.1	ad.marketingsector.com
127.0.0.1	www.ad.marketingsector.com
127.0.0.1	ad.mokead.com
127.0.0.1	www.ad.mokead.com
127.0.0.1	ad.yieldmanager.com
127.0.0.1	www.ad.yieldmanager.com
127.0.0.1	ad25.com
127.0.0.1	ad45.com
127.0.0.1	ad77.com
127.0.0.1	ad86.com
127.0.0.1	adamsupportgroup.org
127.0.0.1	www.adamsupportgroup.org
127.0.0.1	adarmor.com
127.0.0.1	www.adarmor.com
127.0.0.1	adasearch.com
127.0.0.1	www.adasearch.com
127.0.0.1	adaware.cc
127.0.0.1	adawarenow.com
127.0.0.1	www.adawarenow.com
127.0.0.1	addictivetechnologies.com
127.0.0.1	www.addictivetechnologies.com
127.0.0.1	addictivetechnologies.net
127.0.0.1	www.addictivetechnologies.net
127.0.0.1	add-manager.com
127.0.0.1	www.add-manager.com
127.0.0.1	adgate.info
127.0.0.1	www.adgate.info
127.0.0.1	adipics.com
127.0.0.1	www.adipics.com
127.0.0.1	admin2cash.biz
127.0.0.1	www.admin2cash.biz
127.0.0.1	adnet-plus.com
127.0.0.1	adobe-download-now.com
127.0.0.1	adobe-downloads.com
127.0.0.1	www.adobe-downloads.com
127.0.0.1	adobe-reader-8.fr
127.0.0.1	www.adobe-reader-8.fr
127.0.0.1	adprotect.com
127.0.0.1	www.adprotect.com
127.0.0.1	ads.centralmedia.ws
127.0.0.1	ads.k8l.info
127.0.0.1	ads.kmpads.com
127.0.0.1	ads.marketingsector.com
127.0.0.1	ads.searchingbooth.com
127.0.0.1	ads.z-quest.com
127.0.0.1	ads183.com
127.0.0.1	www.ads183.com
127.0.0.1	adscontex.com
127.0.0.1	www.adscontex.com
127.0.0.1	adservices1.enhance.com
127.0.0.1	www.adservices1.enhance.com
127.0.0.1	adservs.com
127.0.0.1	adsextend.net
127.0.0.1	www.adsextend.net
127.0.0.1	adshttp.com
127.0.0.1	www.adshttp.com
127.0.0.1	adsonwww.com
127.0.0.1	www.adsonwww.com
127.0.0.1	adspics.com
127.0.0.1	www.adspics.com
127.0.0.1	adtrak.net
127.0.0.1	www.adtrak.net
127.0.0.1	adtrgt.com
127.0.0.1	adult777search.info
127.0.0.1	www.adult777search.info
127.0.0.1	adultan.com
127.0.0.1	www.adultan.com
127.0.0.1	adult-engine-search.com
127.0.0.1	www.adult-engine-search.com
127.0.0.1	adult-erotic-guide.net
127.0.0.1	www.adult-erotic-guide.net
127.0.0.1	adultfilmsite.com
127.0.0.1	www.adultfilmsite.com
127.0.0.1	adult-friends-finder.net
127.0.0.1	www.adult-friends-finder.net
127.0.0.1	adultgambling.org
127.0.0.1	adult-host.org
127.0.0.1	adulthyperlinks.com
127.0.0.1	www.adulthyperlinks.com
127.0.0.1	adultmovieplus.com
127.0.0.1	www.adultmovieplus.com
127.0.0.1	adult-personal.us
127.0.0.1	adultsgames.net
127.0.0.1	adultsper.com
127.0.0.1	www.adultsper.com
127.0.0.1	adulttds.com
127.0.0.1	www.adulttds.com
127.0.0.1	adultzoneworld.com
127.0.0.1	www.adultzoneworld.com
127.0.0.1	advcash.biz
127.0.0.1	www.advcash.biz
127.0.0.1	advert.exaccess.ru
127.0.0.1	advertisemoney.info
127.0.0.1	www.advertisemoney.info
127.0.0.1	advertising.paltalk.com
127.0.0.1	advertising-money.info
127.0.0.1	www.advertising-money.info
127.0.0.1	ad-ware.cc
127.0.0.1	ad-w-a-r-e.com
127.0.0.1	www.ad-w-a-r-e.com
127.0.0.1	a-d-w-a-r-e.com
127.0.0.1	www.a-d-w-a-r-e.com
127.0.0.1	adwarebazooka.com
127.0.0.1	www.adwarebazooka.com
127.0.0.1	adwarefinder.com
127.0.0.1	www.adwarefinder.com
127.0.0.1	adwareprotectionsite.com
127.0.0.1	www.adwareprotectionsite.com
127.0.0.1	adwarepunisher.com
127.0.0.1	www.adwarepunisher.com
127.0.0.1	aflgate.com
127.0.0.1	www.aflgate.com
127.0.0.1	africaspromise.org
127.0.0.1	agava.com
127.0.0.1	agava.ru
127.0.0.1	agentstudio.com
127.0.0.1	aginegialle.it
127.0.0.1	www.aginegialle.it
127.0.0.1	www.aifind.info
127.0.0.1	aifind.info
127.0.0.1	airtleworld.com
127.0.0.1	www.airtleworld.com
127.0.0.1	aitalia.it
127.0.0.1	www.aitalia.it
127.0.0.1	akamai.downloadv3.com
127.0.0.1	aklitalia.it
127.0.0.1	www.aklitalia.it
127.0.0.1	akril.com
127.0.0.1	alcatel.ws
127.0.0.1	alfacleaner.com
127.0.0.1	www.alfacleaner.com
127.0.0.1	alfa-search.com
127.0.0.1	alialia.it
127.0.0.1	www.alialia.it
127.0.0.1	aliotalia.it
127.0.0.1	www.aliotalia.it
127.0.0.1	alirtalia.it
127.0.0.1	www.alirtalia.it
127.0.0.1	alitaia.it
127.0.0.1	www.alitaia.it
127.0.0.1	alitaklia.it
127.0.0.1	www.alitaklia.it
127.0.0.1	alitala.it
127.0.0.1	www.alitala.it
127.0.0.1	alitali.it
127.0.0.1	www.alitali.it
127.0.0.1	alitaliaq.it
127.0.0.1	www.alitaliaq.it
127.0.0.1	alitalias.it
127.0.0.1	www.alitalias.it
127.0.0.1	alitaliaz.it
127.0.0.1	www.alitaliaz.it
127.0.0.1	alitalioa.it
127.0.0.1	www.alitalioa.it
127.0.0.1	alitalisa.it
127.0.0.1	www.alitalisa.it
127.0.0.1	alitaliua.it
127.0.0.1	www.alitaliua.it
127.0.0.1	alitalkia.it
127.0.0.1	www.alitalkia.it
127.0.0.1	alitaloia.it
127.0.0.1	www.alitaloia.it
127.0.0.1	alitaluia.it
127.0.0.1	www.alitaluia.it
127.0.0.1	alitaslia.it
127.0.0.1	www.alitaslia.it
127.0.0.1	alitlia.it
127.0.0.1	www.alitlia.it
127.0.0.1	alitralia.it
127.0.0.1	www.alitralia.it
127.0.0.1	alitsalia.it
127.0.0.1	www.alitsalia.it
127.0.0.1	aliutalia.it
127.0.0.1	www.aliutalia.it
127.0.0.1	ALL1COUNT.NET
127.0.0.1	www.ALL1COUNT.NET
127.0.0.1	all4internet.com
127.0.0.1	www.all4internet.com
127.0.0.1	allabtcars.com
127.0.0.1	allabtjeeps.com
127.0.0.1	all-bittorrent.com
127.0.0.1	www.all-bittorrent.com
127.0.0.1	www.allcybersearch.com
127.0.0.1	allcybersearch.com
127.0.0.1	alldnserrors.com
127.0.0.1	www.alldnserrors.com
127.0.0.1	all-downloads-now.com
127.0.0.1	www.all-downloads-now.com
127.0.0.1	all-edonkey.com
127.0.0.1	www.all-edonkey.com
127.0.0.1	allforadult.com
127.0.0.1	allhyperlinks.com
127.0.0.1	alliesecurity.com
127.0.0.1	www.alliesecurity.com
127.0.0.1	all-inet.com
127.0.0.1	allinternetbusiness.com
127.0.0.1	all-limewire.com
127.0.0.1	www.all-limewire.com
127.0.0.1	allmegabucks.com
127.0.0.1	www.allmegabucks.com
127.0.0.1	allprotections.com
127.0.0.1	www.allprotections.com
127.0.0.1	allresultz.net
127.0.0.1	www.allresultz.net
127.0.0.1	allsecuritynotes.com
127.0.0.1	www.allsecuritynotes.com
127.0.0.1	allsecuritysite.com
127.0.0.1	www.allsecuritysite.com
127.0.0.1	allstarsvideos.net
127.0.0.1	www.allstarsvideos.net
127.0.0.1	alltruesoftware.com
127.0.0.1	www.alltruesoftware.com
127.0.0.1	allvideoactivex.com
127.0.0.1	www.allvideoactivex.com
127.0.0.1	almanah.biz
127.0.0.1	www.almanah.biz
127.0.0.1	almarvideos.com
127.0.0.1	aloitalia.it
127.0.0.1	www.aloitalia.it
127.0.0.1	aluitalia.it
127.0.0.1	www.aluitalia.it
127.0.0.1	amaena.com
127.0.0.1	www.amaena.com
127.0.0.1	amandamountains.com
127.0.0.1	amateurliveshow.com
127.0.0.1	www.amateurliveshow.com
127.0.0.1	amediasoftware.com
127.0.0.1	www.amediasoftware.com
127.0.0.1	amediasource.com
127.0.0.1	www.amediasource.com
127.0.0.1	americancarbargains.com
127.0.0.1	www.americancarbargains.com
127.0.0.1	american-teens.net
127.0.0.1	amigeek.com
127.0.0.1	amisbusiness.com
127.0.0.1	ampmsearch.com
127.0.0.1	www.ampmsearch.com
127.0.0.1	analcord.com
127.0.0.1	www.analcord.com
127.0.0.1	analmovi.com
127.0.0.1	anarchylolita.com
127.0.0.1	www.anarchylolita.com
127.0.0.1	anarchyporn.com
127.0.0.1	andromedical.com
127.0.0.1	www.andromedical.com
127.0.0.1	animepornmag.com
127.0.0.1	www.animepornmag.com
127.0.0.1	anin.org
127.0.0.1	anjpn-avxiz.biz
127.0.0.1	www.anjpn-avxiz.biz
127.0.0.1	anjpnzqav.biz
127.0.0.1	www.anjpnzqav.biz
127.0.0.1	anjpn-zqav.biz
127.0.0.1	www.anjpn-zqav.biz
127.0.0.1	annaromeo.com
127.0.0.1	antiddos.us
127.0.0.1	www.antiddos.us
127.0.0.1	Antiespiadorado.com
127.0.0.1	www.Antiespiadorado.com
127.0.0.1	Antiespionspack.com
127.0.0.1	www.Antiespionspack.com
127.0.0.1	Antigusanos2008.com
127.0.0.1	www.Antigusanos2008.com
127.0.0.1	Antispionage.com
127.0.0.1	www.Antispionage.com
127.0.0.1	Antispionagepro.com
127.0.0.1	www.Antispionagepro.com
127.0.0.1	antispydns.biz
127.0.0.1	www.antispydns.biz
127.0.0.1	antispylab.com
127.0.0.1	www.antispylab.com
127.0.0.1	antispysolutions.com
127.0.0.1	www.antispysolutions.com
127.0.0.1	antispyware.com
127.0.0.1	www.antispyware.com
127.0.0.1	antispywarebot.com
127.0.0.1	www.antispywarebot.com
127.0.0.1	antispywarebox.com
127.0.0.1	www.antispywarebox.com
127.0.0.1	antispywaredownloads.com
127.0.0.1	www.antispywaredownloads.com
127.0.0.1	Antispywaresuite.com
127.0.0.1	www.Antispywaresuite.com
127.0.0.1	Antispyweb.net
127.0.0.1	www.Antispyweb.net
127.0.0.1	Antiver2008.com
127.0.0.1	www.Antiver2008.com
127.0.0.1	antivermins.com
127.0.0.1	www.antivermins.com
127.0.0.1	anti-vermins.com
127.0.0.1	www.anti-vermins.com
127.0.0.1	antivir2007.com
127.0.0.1	www.antivir2007.com
127.0.0.1	antivirgear.com
127.0.0.1	www.antivirgear.com
127.0.0.1	antivirus.fastfreedownload.com
127.0.0.1	www.antivirus.fastfreedownload.com
127.0.0.1	antivirusgolden.com
127.0.0.1	www.antivirusgolden.com
127.0.0.1	antivirus-hq.net
127.0.0.1	www.antivirus-hq.net
127.0.0.1	anti-virus-pro.com
127.0.0.1	www.anti-virus-pro.com
127.0.0.1	antivirusprotector.com
127.0.0.1	www.antivirusprotector.com
127.0.0.1	antivirussecuritypro.com
127.0.0.1	www.antivirussecuritypro.com
127.0.0.1	antivirus-stop.com
127.0.0.1	www.antivirus-stop.com
127.0.0.1	Antiworm2008.com
127.0.0.1	www.Antiworm2008.com
127.0.0.1	Antiwurm2008.com
127.0.0.1	www.Antiwurm2008.com
127.0.0.1	antrocity.com
127.0.0.1	anyofus.com
127.0.0.1	www.anyofus.com
127.0.0.1	anysn.seproger.com
127.0.0.1	www.anysn.seproger.com
127.0.0.1	anything4health.com
127.0.0.1	apicpreview.com
127.0.0.1	www.apicpreview.com
127.0.0.1	appealcircuit.com
127.0.0.1	www.appealcircuit.com
127.0.0.1	approvedlinks.com
127.0.0.1	www.approvedlinks.com
127.0.0.1	apps.deskwizz.com
127.0.0.1	apps.webservicehost.com
127.0.0.1	aprotectedpage.com
127.0.0.1	www.aprotectedpage.com
127.0.0.1	apsua.com
127.0.0.1	archiviosex.net
127.0.0.1	www.archiviosex.net
127.0.0.1	aregay.com
127.0.0.1	ares-freebie.com
127.0.0.1	www.ares-freebie.com
127.0.0.1	arespro2007.com
127.0.0.1	www.arespro2007.com
127.0.0.1	aresultra.com
127.0.0.1	www.aresultra.com
127.0.0.1	ares-usa.com
127.0.0.1	www.ares-usa.com
127.0.0.1	arheo.com
127.0.0.1	arizonaweb.org
127.0.0.1	armitageinn.com
127.0.0.1	arquivojpgs.smtp.ru
127.0.0.1	www.arquivojpgs.smtp.ru
127.0.0.1	artachnid.com
127.0.0.1	art-func.com
127.0.0.1	art-xxx.com
127.0.0.1	asafebrowser.com
127.0.0.1	www.asafebrowser.com
127.0.0.1	asafetynotice.com
127.0.0.1	www.asafetynotice.com
127.0.0.1	asafetypage.com
127.0.0.1	www.asafetypage.com
127.0.0.1	asdbiz.biz
127.0.0.1	www.asdbiz.biz
127.0.0.1	asdeykuddq.com
127.0.0.1	www.asdeykuddq.com
127.0.0.1	asecurebar.com
127.0.0.1	www.asecurebar.com
127.0.0.1	asecureboard.com
127.0.0.1	www.asecureboard.com
127.0.0.1	asecurevalue.com
127.0.0.1	www.asecurevalue.com
127.0.0.1	asecurityissue.com
127.0.0.1	www.asecurityissue.com
127.0.0.1	asecuritynotice.com
127.0.0.1	www.asecuritynotice.com
127.0.0.1	asecuritypaper.com
127.0.0.1	www.asecuritypaper.com
127.0.0.1	asecuritystuff.com
127.0.0.1	www.asecuritystuff.com
127.0.0.1	asiankingkong.com
127.0.0.1	asianpornmag.com
127.0.0.1	www.asianpornmag.com
127.0.0.1	asiantoolbar.com
127.0.0.1	www.asiantoolbar.com
127.0.0.1	asidseiupc.com
127.0.0.1	www.asidseiupc.com
127.0.0.1	aslitalia.it
127.0.0.1	www.aslitalia.it
127.0.0.1	ass-gals.com
127.0.0.1	assureprotection.com
127.0.0.1	www.assureprotection.com
127.0.0.1	asta-killer.com
127.0.0.1	asupereva.it
127.0.0.1	www.asupereva.it
127.0.0.1	athenrye.com
127.0.0.1	atotalsafety.com
127.0.0.1	www.atotalsafety.com
127.0.0.1	atrueprotection.com
127.0.0.1	www.atrueprotection.com
127.0.0.1	atruesecurity.com
127.0.0.1	www.atruesecurity.com
127.0.0.1	attackware.com
127.0.0.1	www.attackware.com
127.0.0.1	attrezzi.biz
127.0.0.1	www.attrezzi.biz
127.0.0.1	aulde.net
127.0.0.1	www.aulde.net
127.0.0.1	aupereva.it
127.0.0.1	www.aupereva.it
127.0.0.1	autocontext.begun.ru
127.0.0.1	www.autocontext.begun.ru
127.0.0.1	autoescrowpay.com
127.0.0.1	avast.free-software-center.com
127.0.0.1	www.avast.free-software-center.com
127.0.0.1	avast-2007.com
127.0.0.1	www.avast-2007.com
127.0.0.1	avast-downloads.com
127.0.0.1	www.avast-downloads.com
127.0.0.1	avast-hq.com
127.0.0.1	www.avast-hq.com
127.0.0.1	avforce.com
127.0.0.1	www.avforce.com
127.0.0.1	avg.grab-it-today.net
127.0.0.1	www.avg.grab-it-today.net
127.0.0.1	avg.softwarecenterz.com
127.0.0.1	www.avg.softwarecenterz.com
127.0.0.1	avg-secure.com
127.0.0.1	www.avg-secure.com
127.0.0.1	avian-ads.com
127.0.0.1	avideoaxaccess.com
127.0.0.1	www.avideoaxaccess.com
127.0.0.1	avideosurfer.com
127.0.0.1	www.avideosurfer.com
127.0.0.1	aviewersoft.com
127.0.0.1	www.aviewersoft.com
127.0.0.1	avpcheckupdate.com
127.0.0.1	www.avpcheckupdate.com
127.0.0.1	avxizaaqada.biz
127.0.0.1	www.avxizaaqada.biz
127.0.0.1	avxiz-anjpn.biz
127.0.0.1	www.avxiz-anjpn.biz
127.0.0.1	avxizueorn.biz
127.0.0.1	www.avxizueorn.biz
127.0.0.1	avxiz-ueorn.biz
127.0.0.1	www.avxiz-ueorn.biz
127.0.0.1	avxiz-vtvcp.biz
127.0.0.1	www.avxiz-vtvcp.biz
127.0.0.1	avxiz-ygco.biz
127.0.0.1	www.avxiz-ygco.biz
127.0.0.1	avxiz-zqav.biz
127.0.0.1	www.avxiz-zqav.biz
127.0.0.1	awarninglist.com
127.0.0.1	www.awarninglist.com
127.0.0.1	awbeta.net-nucleus.com
127.0.0.1	awesomehomepage.com
127.0.0.1	www.awesomehomepage.com
127.0.0.1	awmcash.biz
127.0.0.1	awmdabest.com
127.0.0.1	axemediasoftware.com
127.0.0.1	www.axemediasoftware.com
127.0.0.1	aximageobject.com
127.0.0.1	www.aximageobject.com
127.0.0.1	axmediaproject.com
127.0.0.1	www.axmediaproject.com
127.0.0.1	axmediasoftware.com
127.0.0.1	www.axmediasoftware.com
127.0.0.1	axmediasolutions.com
127.0.0.1	www.axmediasolutions.com
127.0.0.1	axobjectpage.com
127.0.0.1	www.axobjectpage.com
127.0.0.1	axobjectsource.com
127.0.0.1	www.axobjectsource.com
127.0.0.1	axsoftwaretool.com
127.0.0.1	www.axsoftwaretool.com
127.0.0.1	axvideoproject.com
127.0.0.1	www.axvideoproject.com
127.0.0.1	axvideosetup.com
127.0.0.1	www.axvideosetup.com
127.0.0.1	ayakawamura.com
127.0.0.1	ayb.dns-look-up.com
127.0.0.1	ayb.netbios-wait.com
127.0.0.1	ayumitaniguchi.com
127.0.0.1	azebar.com
127.0.0.1	azureusclub.com
127.0.0.1	www.azureusclub.com
127.0.0.1	azureus-freebie.com
127.0.0.1	www.azureus-freebie.com
127.0.0.1	azzetta.it
127.0.0.1	www.azzetta.it
127.0.0.1	b.casalemedia.com
127.0.0.1	babe.k-lined.com
127.0.0.1	www.babe.k-lined.com
127.0.0.1	babe.the-killer.bz
127.0.0.1	www.babe.the-killer.bz
127.0.0.1	babenet.com
127.0.0.1	www.babenet.com
127.0.0.1	babespornmag.com
127.0.0.1	www.babespornmag.com
127.0.0.1	babeweb.de
127.0.0.1	www.babeweb.de
127.0.0.1	baccarat-other.info
127.0.0.1	www.baccarat-other.info
127.0.0.1	Backstripgirls.com
127.0.0.1	www.Backstripgirls.com
127.0.0.1	backup.mabou.org
127.0.0.1	balotierra.com
127.0.0.1	www.balotierra.com
127.0.0.1	bannedhost.net
127.0.0.1	barbudafarms.com
127.0.0.1	bardownload.com
127.0.0.1	www.bardownload.com
127.0.0.1	barnandfence.com
127.0.0.1	batsearch.com
127.0.0.1	baygraphicsllc.com
127.0.0.1	bbbsearch.com
127.0.0.1	bb-search.com
127.0.0.1	bdsmlibrary.net
127.0.0.1	bdsmpornmag.com
127.0.0.1	www.bdsmpornmag.com
127.0.0.1	bearshare.download-me.info
127.0.0.1	www.bearshare.download-me.info
127.0.0.1	bearshare.mp3-muzic.com
127.0.0.1	www.bearshare.mp3-muzic.com
127.0.0.1	bearshare-download.org
127.0.0.1	www.bearshare-download.org
127.0.0.1	bearshare-downloads.net
127.0.0.1	www.bearshare-downloads.net
127.0.0.1	bearsharelive.co.uk
127.0.0.1	www.bearsharelive.co.uk
127.0.0.1	bearshare-music-downloads.com
127.0.0.1	www.bearshare-music-downloads.com
127.0.0.1	bearsharepro2007.com
127.0.0.1	www.bearsharepro2007.com
127.0.0.1	bearshare-usa.com
127.0.0.1	www.bearshare-usa.com
127.0.0.1	bedhome.com
127.0.0.1	bediadance.com
127.0.0.1	beebappyy.biz
127.0.0.1	www.beebappyy.biz
127.0.0.1	begin2search.com
127.0.0.1	www.begin2search.com
127.0.0.1	bellabasketsfl.com
127.0.0.1	bernaolatwin.com
127.0.0.1	best-counter.com
127.0.0.1	bestcrawler.com
127.0.0.1	bestfor.ru
127.0.0.1	best-hardpics.com
127.0.0.1	bestmanage.org
127.0.0.1	www.bestmanage.org
127.0.0.1	bestmanage0.org
127.0.0.1	www.bestmanage0.org
127.0.0.1	bestmanage1.org
127.0.0.1	www.bestmanage1.org
127.0.0.1	bestmanage2.org
127.0.0.1	www.bestmanage2.org
127.0.0.1	bestmanage3.org
127.0.0.1	www.bestmanage3.org
127.0.0.1	bestmanage4.org
127.0.0.1	www.bestmanage4.org
127.0.0.1	bestmanage5.org
127.0.0.1	www.bestmanage5.org
127.0.0.1	bestmanage6.org
127.0.0.1	www.bestmanage6.org
127.0.0.1	bestmanage7.org
127.0.0.1	www.bestmanage7.org
127.0.0.1	bestmanage8.org
127.0.0.1	www.bestmanage8.org
127.0.0.1	bestmanage9.org
127.0.0.1	www.bestmanage9.org
127.0.0.1	bestporngate.com
127.0.0.1	bestsafetyguide.net
127.0.0.1	www.bestsafetyguide.net
127.0.0.1	best-spyware.info
127.0.0.1	www.best-spyware.info
127.0.0.1	best-targeted-traffic.com
127.0.0.1	www.best-targeted-traffic.com
127.0.0.1	best-voyeur.info
127.0.0.1	www.best-voyeur.info
127.0.0.1	bestweblinks.com
127.0.0.1	best-winning-casino.com
127.0.0.1	bestworldgirls-for-u.net
127.0.0.1	www.bestworldgirls-for-u.net
127.0.0.1	bestxporno.com
127.0.0.1	bettersearch.biz
127.0.0.1	www.bettersearch.biz
127.0.0.1	bgazzetta.it
127.0.0.1	www.bgazzetta.it
127.0.0.1	bgoogle.it
127.0.0.1	www.bgoogle.it
127.0.0.1	bigtrafficnetwork.com
127.0.0.1	www.bigtrafficnetwork.com
127.0.0.1	bigwww.com
127.0.0.1	www.bigwww.com
127.0.0.1	bin.errorprotector.com
127.0.0.1	bins.media-motor.net
127.0.0.1	bins2.media-motor.net
127.0.0.1	bis.180solutions.com
127.0.0.1	bitchesonline.net
127.0.0.1	bitcomet-freebie.com
127.0.0.1	www.bitcomet-freebie.com
127.0.0.1	biz.biz
127.0.0.1	blackblues00.com
127.0.0.1	www.blackblues00.com
127.0.0.1	blackhats.tc
127.0.0.1	www.blackhats.tc
127.0.0.1	blackhawksoftware.com
127.0.0.1	www.blackhawksoftware.com
127.0.0.1	blackjack-free.net
127.0.0.1	blazefind.com
127.0.0.1	blender.xu.pl
127.0.0.1	blondetgp.com
127.0.0.1	blue-elefant.com
127.0.0.1	www.blue-elefant.com
127.0.0.1	bm.theaimonline.com
127.0.0.1	www.bm.theaimonline.com
127.0.0.1	bnmgate.com
127.0.0.1	www.bnmgate.com
127.0.0.1	bodaciousbabette.com
127.0.0.1	bonzi.com
127.0.0.1	www.bonzi.com
127.0.0.1	boobdoll.com
127.0.0.1	boobsandtits.com
127.0.0.1	boobsclub.com
127.0.0.1	bookedspace.com
127.0.0.1	www.bookedspace.com
127.0.0.1	boom.com.vn
127.0.0.1	www.boom.com.vn
127.0.0.1	boredlife.com
127.0.0.1	bowlofogumbo.com
127.0.0.1	bpfq02.com
127.0.0.1	www.bpfq02.com
127.0.0.1	bqgate.com
127.0.0.1	www.bqgate.com
127.0.0.1	br.errorsafe.com
127.0.0.1	br.winantivirus.com
127.0.0.1	br.winfixer.com
127.0.0.1	bradcoem.org
127.0.0.1	braincodec.com
127.0.0.1	www.braincodec.com
127.0.0.1	brandiyoung.com
127.0.0.1	bravesentry.com
127.0.0.1	www.bravesentry.com
127.0.0.1	breenten.biz
127.0.0.1	www.breenten.biz
127.0.0.1	brodbfm.net
127.0.0.1	www.brodbfm.net
127.0.0.1	brookeburn.com
127.0.0.1	browserwise.com
127.0.0.1	www.browserwise.com
127.0.0.1	bucps.com
127.0.0.1	buhartes.info
127.0.0.1	buldog-stats.com
127.0.0.1	bullseye-network.com
127.0.0.1	www.bullseye-network.com
127.0.0.1	burgerkingbigscreen.com
127.0.0.1	burnsrecyclinginc.com
127.0.0.1	www.burnsrecyclinginc.com
127.0.0.1	buscards.net
127.0.0.1	bustyrussell.com
127.0.0.1	busysearch.net
127.0.0.1	www.busysearch.net
127.0.0.1	buttejazz.org
127.0.0.1	buy-find.info
127.0.0.1	www.buy-find.info
127.0.0.1	buyselldomain.net
127.0.0.1	buytraff.biz
127.0.0.1	www.buytraff.biz
127.0.0.1	buz.ru
127.0.0.1	bvirgilio.it
127.0.0.1	www.bvirgilio.it
127.0.0.1	c.centralmedia.ws
127.0.0.1	c.enhance.com
127.0.0.1	www.c.enhance.com
127.0.0.1	c.goclick.com
127.0.0.1	c4tdownload.com
127.0.0.1	www.c4tdownload.com
127.0.0.1	c5.www4free.info
127.0.0.1	www.c5.www4free.info
127.0.0.1	cache.surfaccuracy.com
127.0.0.1	www.cache.surfaccuracy.com
127.0.0.1	cache.ysbweb.com
127.0.0.1	calcioturris.com
127.0.0.1	calendaralerts.net
127.0.0.1	www.calendaralerts.net
127.0.0.1	cameouk.co.uk
127.0.0.1	www.cameouk.co.uk
127.0.0.1	cameup.com
127.0.0.1	camouflageclothingonline.net
127.0.0.1	www.camouflageclothingonline.net
127.0.0.1	camup.net
127.0.0.1	canberracricketcoaching.com
127.0.0.1	candycantaloupes.com
127.0.0.1	canidetect.org
127.0.0.1	www.canidetect.org
127.0.0.1	cantfind.com
127.0.0.1	www.cantfind.com
127.0.0.1	careers.dulcineasystems.net
127.0.0.1	carsands.com
127.0.0.1	carsrentals.net
127.0.0.1	cartoes.uol.com.br
127.0.0.1	casalemedia.com
127.0.0.1	www.casalemedia.com
127.0.0.1	cashdeluxe.net
127.0.0.1	www.cashdeluxe.net
127.0.0.1	cashengines.com
127.0.0.1	www.cashengines.com
127.0.0.1	cashsearch.biz
127.0.0.1	cashsurfers.com
127.0.0.1	www.cashsurfers.com
127.0.0.1	CashUnlim.com
127.0.0.1	www.CashUnlim.com
127.0.0.1	casino.com.free.game.pogo.gratisdownloads.nl
127.0.0.1	casino2win.net
127.0.0.1	casino-gambling-1.net
127.0.0.1	casino-gambling-2.net
127.0.0.1	casinomidas.net
127.0.0.1	casinonline.net
127.0.0.1	casino-onlines.net
127.0.0.1	castingsamateur.com
127.0.0.1	www.castingsamateur.com
127.0.0.1	catallogue.com
127.0.0.1	catch-dc.info
127.0.0.1	www.catch-dc.info
127.0.0.1	categories.mygeek.com
127.0.0.1	catsss.da.ru
127.0.0.1	caxa.ru
127.0.0.1	cc.panet.org
127.0.0.1	ccecaedbebfcaf.com
127.0.0.1	www.ccecaedbebfcaf.com
127.0.0.1	cclebali.org
127.0.0.1	ccorriere.it
127.0.0.1	www.ccorriere.it
127.0.0.1	cdegate.com
127.0.0.1	www.cdegate.com
127.0.0.1	cdn.drivecleaner.com
127.0.0.1	cdn.errorsafe.com
127.0.0.1	cdn.movies-etc.com
127.0.0.1	cdn.winsoftware.com
127.0.0.1	cdn2.movies-etc.com
127.0.0.1	cdorriere.it
127.0.0.1	www.cdorriere.it
127.0.0.1	ceewawires.org
127.0.0.1	centralmedia.ws
127.0.0.1	certumgroup.com
127.0.0.1	cforriere.it
127.0.0.1	www.cforriere.it
127.0.0.1	check.jupitersatellites.biz
127.0.0.1	www.check.jupitersatellites.biz
127.0.0.1	checkin100.com
127.0.0.1	www.checkin100.com
127.0.0.1	checkssecurity.com
127.0.0.1	www.checkssecurity.com
127.0.0.1	chelancatering.com
127.0.0.1	chenshijituan.com
127.0.0.1	www.chenshijituan.com
127.0.0.1	childrenvilla.com
127.0.0.1	chips-4-free.com
127.0.0.1	chrisswasey.com
127.0.0.1	chriswallace.net
127.0.0.1	cia-trjn.myvnc.com
127.0.0.1	www.cia-trjn.myvnc.com
127.0.0.1	ciorriere.it
127.0.0.1	www.ciorriere.it
127.0.0.1	cirriere.it
127.0.0.1	www.cirriere.it
127.0.0.1	ckick4thumbs.com
127.0.0.1	cl55.biz
127.0.0.1	clackamasliteraryreview.com
127.0.0.1	cleansoftwares.com
127.0.0.1	www.cleansoftwares.com
127.0.0.1	clearsearch.cc
127.0.0.1	clearsearch.net
127.0.0.1	clickaire.com
127.0.0.1	click-codec.com
127.0.0.1	www.click-codec.com
127.0.0.1	clickhere4search.com
127.0.0.1	www.clickhere4search.com
127.0.0.1	click-now.net
127.0.0.1	clickspring.net
127.0.0.1	www.clickspring.net
127.0.0.1	click-to-download.com
127.0.0.1	www.click-to-download.com
127.0.0.1	clicktomakeasearch.com
127.0.0.1	www.clicktomakeasearch.com
127.0.0.1	clickyestoenter.net
127.0.0.1	client.exeupdate.com
127.0.0.1	client.myadultexplorer.com
127.0.0.1	cliks.org
127.0.0.1	www.cliks.org
127.0.0.1	clorriere.it
127.0.0.1	www.clorriere.it
127.0.0.1	clrsch.com
127.0.0.1	clubxxxvideo.com
127.0.0.1	www.clubxxxvideo.com
127.0.0.1	clusif.free.fr
127.0.0.1	cmtapestry.com
127.0.0.1	cnetadd.com
127.0.0.1	www.cnetadd.com
127.0.0.1	cnzz.com
127.0.0.1	www.cnzz.com
127.0.0.1	code.ignphrases.com
127.0.0.1	codec.ninoa.com
127.0.0.1	codecdvd.net
127.0.0.1	www.codecdvd.net
127.0.0.1	codec-fun.com
127.0.0.1	www.codec-fun.com
127.0.0.1	codecsoft.net
127.0.0.1	www.codecsoft.net
127.0.0.1	codrriere.it
127.0.0.1	www.codrriere.it
127.0.0.1	coeriere.it
127.0.0.1	www.coeriere.it
127.0.0.1	coerriere.it
127.0.0.1	www.coerriere.it
127.0.0.1	cofrriere.it
127.0.0.1	www.cofrriere.it
127.0.0.1	cogrriere.it
127.0.0.1	www.cogrriere.it
127.0.0.1	coirriere.it
127.0.0.1	www.coirriere.it
127.0.0.1	command.adservs.com
127.0.0.1	www.commonname.com
127.0.0.1	computerpcgames.net
127.0.0.1	www.computerpcgames.net
127.0.0.1	computerrecover.com
127.0.0.1	www.computerrecover.com
127.0.0.1	config.180solutions.com
127.0.0.1	content.dollarrevenue.com
127.0.0.1	www.content.dollarrevenue.com
127.0.0.1	content.ireit.com
127.0.0.1	www.content.ireit.com
127.0.0.1	content.onerateld.com
127.0.0.1	contentmatch.net
127.0.0.1	www.contentmatch.net
127.0.0.1	contra-virus.com
127.0.0.1	www.contra-virus.com
127.0.0.1	controlmeh.com
127.0.0.1	www.controlmeh.com
127.0.0.1	cooldeskalert.com
127.0.0.1	www.cooldeskalert.com
127.0.0.1	coolfetishsite.com
127.0.0.1	coolfreehost.com
127.0.0.1	coolfreepage.com
127.0.0.1	coolfreepages.com
127.0.0.1	cool-homepage.co
127.0.0.1	cool-homepage.com
127.0.0.1	coolmoneysearch.com
127.0.0.1	coolpornsearch.com
127.0.0.1	cool-search.net
127.0.0.1	cool-search.netfartpost.com
127.0.0.1	coolsearcher.info
127.0.0.1	coolservecorp.net
127.0.0.1	www.coolservecorp.net
127.0.0.1	coolwebsearch.com
127.0.0.1	www.coolwebsearch.com
127.0.0.1	cool-web-search.com
127.0.0.1	coolwebsearsh.com
127.0.0.1	coolwwwsearch.com
127.0.0.1	www.coolwwwsearch.com
127.0.0.1	cool-xxx.net
127.0.0.1	coorriere.it
127.0.0.1	www.coorriere.it
127.0.0.1	copmtraine.com
127.0.0.1	coprriere.it
127.0.0.1	www.coprriere.it
127.0.0.1	core.psyche-evolution.com
127.0.0.1	www.core.psyche-evolution.com
127.0.0.1	coreiere.it
127.0.0.1	www.coreiere.it
127.0.0.1	coreriere.it
127.0.0.1	www.coreriere.it
127.0.0.1	corrdiere.it
127.0.0.1	www.corrdiere.it
127.0.0.1	correiere.it
127.0.0.1	www.correiere.it
127.0.0.1	corrfiere.it
127.0.0.1	www.corrfiere.it
127.0.0.1	corrgiere.it
127.0.0.1	www.corrgiere.it
127.0.0.1	corridere.it
127.0.0.1	www.corridere.it
127.0.0.1	corriedre.it
127.0.0.1	www.corriedre.it
127.0.0.1	corriee.it
127.0.0.1	www.corriee.it
127.0.0.1	corrieere.it
127.0.0.1	www.corrieere.it
127.0.0.1	corriefre.it
127.0.0.1	www.corriefre.it
127.0.0.1	corriegre.it
127.0.0.1	www.corriegre.it
127.0.0.1	corrierde.it
127.0.0.1	www.corrierde.it
127.0.0.1	corriered.it
127.0.0.1	www.corriered.it
127.0.0.1	corrieree.it
127.0.0.1	www.corrieree.it
127.0.0.1	corrieref.it
127.0.0.1	www.corrieref.it
127.0.0.1	corrierer.it
127.0.0.1	www.corrierer.it
127.0.0.1	corrieres.it
127.0.0.1	www.corrieres.it
127.0.0.1	corrierew.it
127.0.0.1	www.corrierew.it
127.0.0.1	corrierfe.it
127.0.0.1	www.corrierfe.it
127.0.0.1	corrierge.it
127.0.0.1	www.corrierge.it
127.0.0.1	corrierr.it
127.0.0.1	www.corrierr.it
127.0.0.1	corrierre.it
127.0.0.1	www.corrierre.it
127.0.0.1	corrierse.it
127.0.0.1	www.corrierse.it
127.0.0.1	corrierte.it
127.0.0.1	www.corrierte.it
127.0.0.1	corrierw.it
127.0.0.1	www.corrierw.it
127.0.0.1	corrierwe.it
127.0.0.1	www.corrierwe.it
127.0.0.1	corriesre.it
127.0.0.1	www.corriesre.it
127.0.0.1	corriete.it
127.0.0.1	www.corriete.it
127.0.0.1	corrietre.it
127.0.0.1	www.corrietre.it
127.0.0.1	corriewre.it
127.0.0.1	www.corriewre.it
127.0.0.1	corrifere.it
127.0.0.1	www.corrifere.it
127.0.0.1	corriiere.it
127.0.0.1	www.corriiere.it
127.0.0.1	corrilere.it
127.0.0.1	www.corrilere.it
127.0.0.1	corrioere.it
127.0.0.1	www.corrioere.it
127.0.0.1	corrire.it
127.0.0.1	www.corrire.it
127.0.0.1	corrirere.it
127.0.0.1	www.corrirere.it
127.0.0.1	corrirre.it
127.0.0.1	www.corrirre.it
127.0.0.1	corrisere.it
127.0.0.1	www.corrisere.it
127.0.0.1	corriuere.it
127.0.0.1	www.corriuere.it
127.0.0.1	corriwere.it
127.0.0.1	www.corriwere.it
127.0.0.1	corriwre.it
127.0.0.1	www.corriwre.it
127.0.0.1	corrliere.it
127.0.0.1	www.corrliere.it
127.0.0.1	corroere.it
127.0.0.1	www.corroere.it
127.0.0.1	corroiere.it
127.0.0.1	www.corroiere.it
127.0.0.1	corrriere.it
127.0.0.1	www.corrriere.it
127.0.0.1	corrtiere.it
127.0.0.1	www.corrtiere.it
127.0.0.1	corruere.it
127.0.0.1	www.corruere.it
127.0.0.1	corruiere.it
127.0.0.1	www.corruiere.it
127.0.0.1	cortiere.it
127.0.0.1	www.cortiere.it
127.0.0.1	cortriere.it
127.0.0.1	www.cortriere.it
127.0.0.1	costrike.com
127.0.0.1	www.costrike.com
127.0.0.1	cotriere.it
127.0.0.1	www.cotriere.it
127.0.0.1	cotrriere.it
127.0.0.1	www.cotrriere.it
127.0.0.1	couldnotfind.com
127.0.0.1	count.cc
127.0.0.1	count.hitscount.net
127.0.0.1	count-all.com
127.0.0.1	countdutycall.info
127.0.0.1	www.countdutycall.info
127.0.0.1	counter.sexmaniack.com
127.0.0.1	cporriere.it
127.0.0.1	www.cporriere.it
127.0.0.1	cprriere.it
127.0.0.1	www.cprriere.it
127.0.0.1	cpvfeed.com
127.0.0.1	cracks.me.uk
127.0.0.1	cracks4all.com
127.0.0.1	www.cracks4all.com
127.0.0.1	crapsgold.info
127.0.0.1	www.crapsgold.info
127.0.0.1	Crazygirls-world.com
127.0.0.1	crazywinnings.com
127.0.0.1	www.crazywinnings.com
127.0.0.1	creamedcutties.com
127.0.0.1	createaccesskey.com
127.0.0.1	www.createaccesskey.com
127.0.0.1	creditsearchonline.com
127.0.0.1	crestring.com
127.0.0.1	crooder.com
127.0.0.1	crriere.it
127.0.0.1	www.crriere.it
127.0.0.1	crystalysmedia.com
127.0.0.1	www.crystalysmedia.com
127.0.0.1	csx.adservs.com
127.0.0.1	www.csx.adservs.com
127.0.0.1	cts.180solutions.com
127.0.0.1	cuisinartoven.com
127.0.0.1	www.cuisinartoven.com
127.0.0.1	curedc.info
127.0.0.1	www.curedc.info
127.0.0.1	curepcsolutions.com
127.0.0.1	www.curepcsolutions.com
127.0.0.1	curvedspaces.com
127.0.0.1	cutadult.com
127.0.0.1	www.cutadult.com
127.0.0.1	cvirgilio.it
127.0.0.1	www.cvirgilio.it
127.0.0.1	cvorriere.it
127.0.0.1	www.cvorriere.it
127.0.0.1	cvs.jps.ru
127.0.0.1	cvsymphony.com
127.0.0.1	cxorriere.it
127.0.0.1	www.cxorriere.it
127.0.0.1	cyberrape.com
127.0.0.1	www.cyberrape.com
127.0.0.1	cydom.com
127.0.0.1	cydoor.com
127.0.0.1	www.cydoor.com
127.0.0.1	daily-gals.com
127.0.0.1	dailypornmag.com
127.0.0.1	www.dailypornmag.com
127.0.0.1	dailyteenspic.com
127.0.0.1	dailytoolbar.com
127.0.0.1	www.dailytoolbar.com
127.0.0.1	dancingbabycd.com
127.0.0.1	data-hoster.com
127.0.0.1	www.data-hoster.com
127.0.0.1	datanotary.com
127.0.0.1	datareco.com
127.0.0.1	dating-galaxy.info
127.0.0.1	www.dating-galaxy.info
127.0.0.1	dating-search.net
127.0.0.1	davemarshall.org
127.0.0.1	db105.com
127.0.0.1	dbdecicated.com
127.0.0.1	www.dbdecicated.com
127.0.0.1	dbxcompany.com
127.0.0.1	www.dbxcompany.com
127.0.0.1	dcdl.dmcast.com
127.0.0.1	dcfitusa.com
127.0.0.1	dcorriere.it
127.0.0.1	www.dcorriere.it
127.0.0.1	dcurtis.com
127.0.0.1	www.dcurtis.com
127.0.0.1	dcww.dmcast.com
127.0.0.1	de.ag
127.0.0.1	de.drivecleaner.com
127.0.0.1	de.errorsafe.com
127.0.0.1	de.winantivirus.com
127.0.0.1	de98.remsys.org
127.0.0.1	debay.it
127.0.0.1	www.debay.it
127.0.0.1	dedmazay.3322.org
127.0.0.1	dedsearch.com
127.0.0.1	www.dedsearch.com
127.0.0.1	defaultsearch.net
127.0.0.1	Defensaantimalware.com
127.0.0.1	www.Defensaantimalware.com
127.0.0.1	deja-rue.com
127.0.0.1	www.deja-rue.com
127.0.0.1	derklaif.biz
127.0.0.1	www.derklaif.biz
127.0.0.1	derrari.it
127.0.0.1	www.derrari.it
127.0.0.1	desarrollocreativo.com
127.0.0.1	deskbar.worldtostart.com
127.0.0.1	www.deskbar.worldtostart.com
127.0.0.1	deskwizz.com
127.0.0.1	www.deskwizz.com
127.0.0.1	dev.ntcor.com
127.0.0.1	develip.com
127.0.0.1	dewis.spb.ru
127.0.0.1	dewis.us
127.0.0.1	df809jow4wj2304lfd0sf9fsd0a2t4ldf809jow4wj2304lfd0sf9fsd0a2t4ld.biz
127.0.0.1	dgbusiness.com
127.0.0.1	www.dgbusiness.com
127.0.0.1	dialer2004.com
127.0.0.1	dialerclub.com
127.0.0.1	www.dialerclub.com
127.0.0.1	dialer-shop.com
127.0.0.1	www.dialer-shop.com
127.0.0.1	dialoff.com
127.0.0.1	www.dialoff.com
127.0.0.1	did.i-used.cc
127.0.0.1	www.did.i-used.cc
127.0.0.1	dietpills4free.com
127.0.0.1	dietpussy.com
127.0.0.1	digikeygen.com
127.0.0.1	www.digikeygen.com
127.0.0.1	digistreamsa.com
127.0.0.1	digitalcoders.net
127.0.0.1	www.digitalcoders.net
127.0.0.1	www.digitalfan.com
127.0.0.1	digital-pornography.com
127.0.0.1	dionforvalleycouncil.org
127.0.0.1	directdvdpro.com
127.0.0.1	www.directdvdpro.com
127.0.0.1	directporta.info
127.0.0.1	www.directporta.info
127.0.0.1	directsearchzone.com
127.0.0.1	www.directsearchzone.com
127.0.0.1	dist.checkin100.com
127.0.0.1	dl.ad-ware.cc
127.0.0.1	dl.malwarewipe.com
127.0.0.1	dl.targetsaver.com
127.0.0.1	www.dl.targetsaver.com
127.0.0.1	dl.web-nexus.net
127.0.0.1	dl1.antivermins.com
127.0.0.1	dl1.antivirgear.com
127.0.0.1	dl1.spydawn.com
127.0.0.1	dl1.virusprotectpro.com
127.0.0.1	dl10.spyfalcon.com
127.0.0.1	dl16.spyfalcon.com
127.0.0.1	dl2.spyfalcon.com
127.0.0.1	dl2.spyheal.com
127.0.0.1	dl2.spywarestrike.com
127.0.0.1	dl3.spyfalcon.com
127.0.0.1	dl3.spyheal.com
127.0.0.1	dl3.spywarestrike.com
127.0.0.1	dl4.spyfalcon.com
127.0.0.1	dl4.spywarestrike.com
127.0.0.1	dl5.spyfalcon.com
127.0.0.1	dl5.spywarestrike.com
127.0.0.1	dl6.spywarestrike.com
127.0.0.1	dl7.spywarestrike.com
127.0.0.1	dl8.spyheal.com
127.0.0.1	dl8.spywarestrike.com
127.0.0.1	dl9.spyfalcon.com
127.0.0.1	dmcast.com
127.0.0.1	www.dmcast.com
127.0.0.1	dnaads.com
127.0.0.1	www.dnaads.com
127.0.0.1	dnl.mabou.org
127.0.0.1	dns-look-up.com
127.0.0.1	www.dns-look-up.com
127.0.0.1	doctorwaldron.com
127.0.0.1	document-not-found.pornpic.org
127.0.0.1	doggyaction.com
127.0.0.1	dogproblemswebsite.com
127.0.0.1	www.dogproblemswebsite.com
127.0.0.1	doktorxxx.com
127.0.0.1	dollarrevenue.com
127.0.0.1	domaincar.com
127.0.0.1	www.domaincar.com
127.0.0.1	domains2003.net
127.0.0.1	domains-for-you-online.com
127.0.0.1	domain-your-registration.com
127.0.0.1	domkrat.com
127.0.0.1	dotcomtoolbar.com
127.0.0.1	www.dotcomtoolbar.com
127.0.0.1	down.136136.net
127.0.0.1	download.abetterinternet.com
127.0.0.1	download.antispywarebot.com
127.0.0.1	www.download.antispywarebot.com
127.0.0.1	download.bardownload.com
127.0.0.1	www.download.bardownload.com
127.0.0.1	download.bravesentry.com
127.0.0.1	www.download.bravesentry.com
127.0.0.1	download.cdn.drivecleaner.com
127.0.0.1	download.cdn.errorsafe.com
127.0.0.1	download.cdn.winsoftware.com
127.0.0.1	download.errorsafe.com
127.0.0.1	download.jupitersatellites.biz
127.0.0.1	www.download.jupitersatellites.biz
127.0.0.1	download.searchtabs.net
127.0.0.1	download.secureyournet.biz
127.0.0.1	www.download.secureyournet.biz
127.0.0.1	download.spyonthis.net
127.0.0.1	download.spy-shredder.com
127.0.0.1	download.systemdoctor.com
127.0.0.1	download.winantispyware.com
127.0.0.1	download.winantivirus.com
127.0.0.1	download.windrivecleaner.com
127.0.0.1	download.winfixer.com
127.0.0.1	download10.spywarequake.com
127.0.0.1	download11.spywarequake.com
127.0.0.1	download12.spywarequake.com
127.0.0.1	download13.spywarequake.com
127.0.0.1	download15.spywarequake.com
127.0.0.1	download2.spywarequake.com
127.0.0.1	download-2007.com
127.0.0.1	www.download-2007.com
127.0.0.1	download3.spyaxe.com
127.0.0.1	download3.spywarequake.com
127.0.0.1	download4.spyaxe.com
127.0.0.1	download4.spywarequake.com
127.0.0.1	download5.spyaxe.com
127.0.0.1	download5.spywarequake.com
127.0.0.1	download6.spyaxe.com
127.0.0.1	download7.spywarequake.com
127.0.0.1	download8.spywarequake.com
127.0.0.1	download9.spywarequake.com
127.0.0.1	download-ad-aware.com
127.0.0.1	www.download-ad-aware.com
127.0.0.1	download-all-4-free.com
127.0.0.1	www.download-all-4-free.com
127.0.0.1	download-all-area.com
127.0.0.1	www.download-all-area.com
127.0.0.1	download-antivir.com
127.0.0.1	www.download-antivir.com
127.0.0.1	downloadanysong.com
127.0.0.1	www.downloadanysong.com
127.0.0.1	download-avast.com
127.0.0.1	www.download-avast.com
127.0.0.1	downloadcorporation.com
127.0.0.1	www.downloadcorporation.com
127.0.0.1	download-dvdshrink.com
127.0.0.1	www.download-dvdshrink.com
127.0.0.1	download-for-free.net
127.0.0.1	www.download-for-free.net
127.0.0.1	downloadfreesoft.com
127.0.0.1	www.downloadfreesoft.com
127.0.0.1	downloadfreeway.com
127.0.0.1	www.downloadfreeway.com
127.0.0.1	downloadimesh.com
127.0.0.1	www.downloadimesh.com
127.0.0.1	download-itunes-now.com
127.0.0.1	www.download-itunes-now.com
127.0.0.1	download-limewire.org
127.0.0.1	www.download-limewire.org
127.0.0.1	downloadlost.tv
127.0.0.1	www.downloadlost.tv
127.0.0.1	downloadmax.net
127.0.0.1	www.downloadmax.net
127.0.0.1	download-mcafee.com
127.0.0.1	www.download-mcafee.com
127.0.0.1	download-me.info
127.0.0.1	downloadmediaax.com
127.0.0.1	www.downloadmediaax.com
127.0.0.1	downloadpics.net
127.0.0.1	www.downloadpics.net
127.0.0.1	download-real-player.com
127.0.0.1	www.download-real-player.com
127.0.0.1	downloads.180solutions.com
127.0.0.1	downloads.adaware.cc
127.0.0.1	downloadservicearea.com
127.0.0.1	www.downloadservicearea.com
127.0.0.1	downloads-free.org
127.0.0.1	www.downloads-free.org
127.0.0.1	downloadsglobe.com
127.0.0.1	www.downloadsglobe.com
127.0.0.1	download-this.us
127.0.0.1	www.download-this.us
127.0.0.1	download-trillian.com
127.0.0.1	www.download-trillian.com
127.0.0.1	downloadv3.com
127.0.0.1	www.downloadv3.com
127.0.0.1	downloadvax.com
127.0.0.1	www.downloadvax.com
127.0.0.1	download-windvd.com
127.0.0.1	www.download-windvd.com
127.0.0.1	download-winrar.com
127.0.0.1	www.download-winrar.com
127.0.0.1	downloadwizard.com
127.0.0.1	downloadzcenter.com
127.0.0.1	downloadzcentral.com
127.0.0.1	downloadzfree.com
127.0.0.1	www.downloadzfree.com
127.0.0.1	downloadznow.net
127.0.0.1	download-zone-free.com
127.0.0.1	www.download-zone-free.com
127.0.0.1	download-zone-free.net
127.0.0.1	www.download-zone-free.net
127.0.0.1	dp-host.com
127.0.0.1	dr.mcboo.com
127.0.0.1	dr.webhancer.com
127.0.0.1	www.dr.webhancer.com
127.0.0.1	dr2.webhancer.com
127.0.0.1	www.dr2.webhancer.com
127.0.0.1	dr38.mcboo.com
127.0.0.1	dr47.mcboo.com
127.0.0.1	dragqueen.gay-clan.com
127.0.0.1	drepubblica.it
127.0.0.1	www.drepubblica.it
127.0.0.1	drivecleaner.com
127.0.0.1	www.drivecleaner.com
127.0.0.1	drivecleanr.com
127.0.0.1	www.drivecleanr.com
127.0.0.1	drocherway.com
127.0.0.1	dropspam.com
127.0.0.1	www.dropspam.com
127.0.0.1	drug-sources-exposed.com
127.0.0.1	drvvv.com
127.0.0.1	dsupereva.it
127.0.0.1	www.dsupereva.it
127.0.0.1	dtlproduct.com
127.0.0.1	www.dtlproduct.com
127.0.0.1	dudu.com
127.0.0.1	www.dudu.com
127.0.0.1	dulcineasystems.net
127.0.0.1	dumpserv.com
127.0.0.1	duolaimi.net
127.0.0.1	dutch-sex.com
127.0.0.1	dvdaccess.net
127.0.0.1	www.dvdaccess.net
127.0.0.1	dvdbank.org
127.0.0.1	dvdcodec.net
127.0.0.1	www.dvdcodec.net
127.0.0.1	dvdsmovies.net
127.0.0.1	www.dvdsmovies.net
127.0.0.1	dvdsvideos.net
127.0.0.1	www.dvdsvideos.net
127.0.0.1	dvdtocdsite.com
127.0.0.1	www.dvdtocdsite.com
127.0.0.1	dynamique.drivecleaner.com
127.0.0.1	e3bay.it
127.0.0.1	www.e3bay.it
127.0.0.1	e4bay.it
127.0.0.1	www.e4bay.it
127.0.0.1	eager-sex.com
127.0.0.1	earthllnk.net
127.0.0.1	www.earthllnk.net
127.0.0.1	eases.net
127.0.0.1	easyantispy.com
127.0.0.1	easybestdeals.com
127.0.0.1	www.easybestdeals.com
127.0.0.1	easycategories.com
127.0.0.1	easymp3musicnow.com
127.0.0.1	www.easymp3musicnow.com
127.0.0.1	easy-pharmacy.info
127.0.0.1	www.easy-pharmacy.info
127.0.0.1	easy-search.net
127.0.0.1	easysearch4you.com
127.0.0.1	www.easysearch4you.com
127.0.0.1	easysearchingtips.com
127.0.0.1	easyspyware.com
127.0.0.1	www.easyspyware.com
127.0.0.1	easywww.info
127.0.0.1	www.easywww.info
127.0.0.1	eba6y.it
127.0.0.1	www.eba6y.it
127.0.0.1	eba7y.it
127.0.0.1	www.eba7y.it
127.0.0.1	ebaay.it
127.0.0.1	www.ebaay.it
127.0.0.1	ebagy.it
127.0.0.1	www.ebagy.it
127.0.0.1	ebahy.it
127.0.0.1	www.ebahy.it
127.0.0.1	ebajy.it
127.0.0.1	www.ebajy.it
127.0.0.1	ebaqy.it
127.0.0.1	www.ebaqy.it
127.0.0.1	ebasy.it
127.0.0.1	www.ebasy.it
127.0.0.1	ebaty.it
127.0.0.1	www.ebaty.it
127.0.0.1	ebauy.it
127.0.0.1	www.ebauy.it
127.0.0.1	ebav.com
127.0.0.1	ebaw.com
127.0.0.1	ebawy.it
127.0.0.1	www.ebawy.it
127.0.0.1	ebaxy.it
127.0.0.1	www.ebaxy.it
127.0.0.1	ebay6.it
127.0.0.1	www.ebay6.it
127.0.0.1	ebay7.it
127.0.0.1	www.ebay7.it
127.0.0.1	ebayg.it
127.0.0.1	www.ebayg.it
127.0.0.1	ebayh.it
127.0.0.1	www.ebayh.it
127.0.0.1	ebayj.it
127.0.0.1	www.ebayj.it
127.0.0.1	ebayt.it
127.0.0.1	www.ebayt.it
127.0.0.1	ebayu.it
127.0.0.1	www.ebayu.it
127.0.0.1	ebazy.it
127.0.0.1	www.ebazy.it
127.0.0.1	ebch.com
127.0.0.1	ebdv.com
127.0.0.1	ebdw.com
127.0.0.1	ebestfind.org
127.0.0.1	www.ebestfind.org
127.0.0.1	ebgay.it
127.0.0.1	www.ebgay.it
127.0.0.1	ebgo.com
127.0.0.1	ebhay.it
127.0.0.1	www.ebhay.it
127.0.0.1	ebjp.com
127.0.0.1	ebkb.com
127.0.0.1	ebkn.com
127.0.0.1	ebky.com
127.0.0.1	eblv.com
127.0.0.1	ebmu.com
127.0.0.1	ebnay.it
127.0.0.1	www.ebnay.it
127.0.0.1	ebony-pornmag.com
127.0.0.1	www.ebony-pornmag.com
127.0.0.1	ebonypornmag.com
127.0.0.1	www.ebonypornmag.com
127.0.0.1	ebqay.it
127.0.0.1	www.ebqay.it
127.0.0.1	ebsay.it
127.0.0.1	www.ebsay.it
127.0.0.1	ebsy.it
127.0.0.1	www.ebsy.it
127.0.0.1	ebvay.it
127.0.0.1	www.ebvay.it
127.0.0.1	ebvr.com
127.0.0.1	ebway.it
127.0.0.1	www.ebway.it
127.0.0.1	ebxay.it
127.0.0.1	www.ebxay.it
127.0.0.1	ebzay.it
127.0.0.1	www.ebzay.it
127.0.0.1	ecmh.com
127.0.0.1	ecmp.com
127.0.0.1	ecosrioplatenses.org
127.0.0.1	ecpm.com
127.0.0.1	ecstasyporn.net
127.0.0.1	ecwz.com
127.0.0.1	ecyb.com
127.0.0.1	edbay.it
127.0.0.1	www.edbay.it
127.0.0.1	edhq.com
127.0.0.1	edietprogram.com
127.0.0.1	www.edietprogram.com
127.0.0.1	edty.com
127.0.0.1	eduy.com
127.0.0.1	eebay.it
127.0.0.1	www.eebay.it
127.0.0.1	eeev.com
127.0.0.1	eepubblica.it
127.0.0.1	www.eepubblica.it
127.0.0.1	efbay.it
127.0.0.1	www.efbay.it
127.0.0.1	egbay.it
127.0.0.1	www.egbay.it
127.0.0.1	ehbay.it
127.0.0.1	www.ehbay.it
127.0.0.1	eikokoike.com
127.0.0.1	elitecodec.com
127.0.0.1	www.elitecodec.com
127.0.0.1	elitemediagroup.net
127.0.0.1	www.elitemediagroup.net
127.0.0.1	e-localad.com
127.0.0.1	emailicon.org
127.0.0.1	www.emailicon.org
127.0.0.1	emch.com
127.0.0.1	emcodec.com
127.0.0.1	www.emcodec.com
127.0.0.1	emediacodec.com
127.0.0.1	www.emediacodec.com
127.0.0.1	emule.mp3-muzic.com
127.0.0.1	www.emule.mp3-muzic.com
127.0.0.1	emuledownloadhome.com
127.0.0.1	www.emuledownloadhome.com
127.0.0.1	emule-freebie.com
127.0.0.1	www.emule-freebie.com
127.0.0.1	enay.it
127.0.0.1	www.enay.it
127.0.0.1	enbay.it
127.0.0.1	www.enbay.it
127.0.0.1	energy-factor.com
1

kris6943 · Answer

tu ferais peut-être bien de poster un rapport hijackthis pour voir si ton problème est totalement résolu ou pas.

Ton lien n'apporte pas grand chose et peux en trouver des centaines du même style ici même sur CCM

Necras · Answer

désolé j connai rien alor g mi tt ce que j'avai. voici un scan hijackthis que je vien de faire:

Logfile of HijackThis v1.99.1
Scan saved at 01:27:31, on 07/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\SuperCopier2\SuperCopier2.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Club-Internet\Le Compagnon Club\bin\mpbtn.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcLog.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcAppFlt.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer avec Club-Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE	oolbar.dll
O2 - BHO: (no name) - {01618486-4FC8-412D-B22D-8BCC5D58AC14} - C:\WINDOWS\system32\ddcca.dll
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {116D0E8F-4D3F-40DC-8DFC-42503C0227BB} - (no file)
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1	oolbar.dll
O2 - BHO: (no name) - {3FF9F441-7480-4938-8794-394F3F4A6656} - C:\WINDOWS\system32\mllji.dll (file missing)
O2 - BHO: (no name) - {43BF8E0C-886D-4103-8DDB-2DFE0E8A0168} - (no file)
O2 - BHO: (no name) - {44CC9203-34A2-4DE5-9917-A7F7818938DD} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {63475DD7-4E5F-46D3-8C0F-68B1CDBFC819} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7B0A9923-5D94-430A-B9CC-BDABAB7BCDC5} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {89AD4D75-2429-462e-BD4E-443F233F6033} - C:\WINDOWS\system32eqjdoor.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {9818E8FE-0AD8-4847-97AE-D9E0541304E3} - C:\WINDOWS\system32\geebx.dll (file missing)
O2 - BHO: (no name) - {D5730568-C8BD-4678-8F25-D53D1CF3C3D8} - (no file)
O2 - BHO: (no name) - {E8194DE7-90CD-469A-8D58-E090EACD0E78} - (no file)
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE	oolbar.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [64c6fddd] rundll32.exe "C:\WINDOWS\system32\fkygqegq.dll",b
O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: LE COMPAGNON CLUB.lnk = C:\Program Files\Club-Internet\Le Compagnon Club\bin\matcli.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Livre de reliures HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Sélection intelligente HP - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32
vappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32
vappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32
vappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32
vappfilter.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\__c0068EE2.dat
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\ehvetaad.exe (file missing)
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcLog.exe

kris6943 · Answer

tu as (ou tu as eu...)le  Trojan-Downloader.Zlob.Media-Codec ainsi qu'une infection Vundo

# Téléchargez VundoFix.exe

    * Double-cliquez sur VundoFix.exe
    * Cliquez sur le bouton Scan for Vundo
    * Si le programme vous demande de supprimer des fichiers, faites oui
    * Lorsque le programme a fini de scanner votre ordinateur, arrêter puis redémarrer le PC

Necras · Answer

Merci ,VundoFix n'a rien trouvé. 
Dois je en conclure que tout est maintenant désinfecté?
Merci de ton aide tu m'a bien appris.

kris6943 · Answer

il est 2 h 15 je vais me coucher 
on continuera demain soir si tu veux

Tu n'es pas encore desinfecté, il faudra affiner totu ça

A+

Necras · Answer

ok moi aussi v me couché. demain je travaille de nuit. pour l'instant ça tourne mieux que ce matin donc on verra le reste jeudi je pense.
Un GRAND merci pour ton aide. bonne nuit.

Necras · Answer

Bonsoir Kris6943.
Comment allez vous?
Tjr ok pour affiner la désinfection?

kris6943 · Answer

va dans  C:\Program Files\Macrogaming et supprime le dossier SweetIMBarForIE

Télécharge OAD http://sosvirus.changelog.fr/OAD.exe
- Enregistre le sur ton bureau

Double clique sur le OAD pour le lancer

- nom de fichier à rechercher tape ou fais un copier coller de : ddcca
- Type de recherche : sélectionne l'option 6 puis valide [entree]

OAD va maintenant rechercher le fichier. Laisse le travailler jusqu'à ce qu'il en ai terminé.
Le rapport de recherche s'affichera automatiquement à dès qu'il en aura terminé.

- Fais un copier / coller de ce rapport dans ton prochain post.

Note importante : Suivant la taille des disques dur cette recherche peut prendre plusieurs minutes. Sois patient(e)

Si possible, ne redémarre pas l'ordi. 


puis recommence en cherchant successivement chacun des mots suivant:
SweetIMBarForIE
mllji
reqjdoor
geebx
fkygqegq
ehvetaad


chaque recherche va créer un rapport 
ramène moi les tous afin que je puisse t'indiquer comment supprimer les fichiers foireux

Necras · Answer

merci voici les rapports:

 10/11/2007 ---- 11:09:43,37  

----------------------------------
§§§§§§ [ddcca] §§§§§§
----------------------------------
[X] Registre
 
-------------- [  ] rapide
-- Fichier --- [  ] disque systeme
 ------------- [X] complete


********************
     [Registre] 
********************


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CB3D07BE-8C7D-4E97-9C5C-8DDA9D108B16}\InprocServer32]
@="C:\WINDOWS\system32\ddcca.dll"

*******************
     [Fichier] 
*******************

c:\WINDOWS\system32\ddcca.dll


*********************
     [Même date] 
*********************

[02/10/2007 ] --- REP ---> C:\Program Files\Samsung   
[02/10/2007 ] ---> C:\WINDOWS\292 hpqins13.dat  
[02/10/2007 ] ---> C:\WINDOWS\drwatson.log   
[02/10/2007 ] ---> C:\WINDOWS\system32\072 ddcca.dll  
[02/10/2007 ] ---> C:\WINDOWS\system32\268 SENT.log  
[02/10/2007 ] ---> C:\WINDOWS\system32\376 reqjdoor.dll  
[02/10/2007 ] ---> C:\WINDOWS\system32\423 RECV.log  
[02/10/2007 ] ---> C:\WINDOWS\system32\486 UnInstall_Sample.ico  
[02/10/2007 ] ---> C:\WINDOWS\system32\526 accdd.bak1  
[02/10/2007 ] ---> C:\WINDOWS\system32\592 framedyn.dll  
[02/10/2007 ] ---> C:\WINDOWS\system32\947 TEST.log  
[02/10/2007 ] ---> C:\WINDOWS\system32\drivers\632 StarOpen.sys  
[02/10/2007 ] ---> C:\WINDOWS\system32\Uninstall.ico   
[02/10/2007 ] ---> C:\WINDOWS\WORDPAD.INI   



Outil Aide Diagnostic By !aur3n7 Version 1.1
----------------------------------
§§§§§ Fin Rapport §§§§§ 
----------------------------------


 10/11/2007 ---- 11:12:51,46  

----------------------------------
§§§§§§ [SweetIMBarForIE] §§§§§§
----------------------------------
[X] Registre
 
-------------- [  ] rapide
-- Fichier --- [  ] disque systeme
 ------------- [X] complete


********************
     [Registre] 
********************


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BC4FFE41-DE9F-46fa-B455-AAD49B9F9938}\InprocServer32]
@="C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{58906392-79C4-497C-ACC6-6942B59F1A08}\1.0\0\win32]
@="C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{58906392-79C4-497C-ACC6-6942B59F1A08}\1.0\HELPDIR]
@="C:\Program Files\Macrogaming\SweetIMBarForIE\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files\Macrogaming\SweetIMBarForIE\Cache\"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files\Macrogaming\SweetIMBarForIE\"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-57989841-1682526488-839522115-1003\Components\96D82BE152767B245B7D948EF9126F46]
"56A36D6F32DB3F649B3A784F24244318"="C:\Program Files\Macrogaming\SweetIMBarForIE\Cache\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-57989841-1682526488-839522115-1003\Components\C34CFCB49C8F0814C88A64469E1A2B9E]
"56A36D6F32DB3F649B3A784F24244318"="C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-57989841-1682526488-839522115-1003\Components\DF75D238060B32E42A452FB5F328222E]
"56A36D6F32DB3F649B3A784F24244318"="C:\Program Files\Macrogaming\SweetIMBarForIE\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-57989841-1682526488-839522115-1003\Products\56A36D6F32DB3F649B3A784F24244318\InstallProperties]
"InstallLocation"="C:\Program Files\Macrogaming\SweetIMBarForIE\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F6D63A65-BD23-46F3-B9A3-87F442423481}]
"InstallLocation"="C:\Program Files\Macrogaming\SweetIMBarForIE\"

*******************
     [Fichier] 
*******************



*********************
     [Même date] 
*********************

Aucun fichier créé à la même date détecté


Outil Aide Diagnostic By !aur3n7 Version 1.1
----------------------------------
§§§§§ Fin Rapport §§§§§ 
----------------------------------


 10/11/2007 ---- 11:16:27,00  

----------------------------------
§§§§§§ [mllji] §§§§§§
----------------------------------
[X] Registre
 
-------------- [  ] rapide
-- Fichier --- [  ] disque systeme
 ------------- [X] complete


********************
     [Registre] 
********************


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3FF9F441-7480-4938-8794-394F3F4A6656}\InprocServer32]
@="C:\WINDOWS\system32\mllji.dll"

*******************
     [Fichier] 
*******************



*********************
     [Même date] 
*********************

Aucun fichier créé à la même date détecté


Outil Aide Diagnostic By !aur3n7 Version 1.1
----------------------------------
§§§§§ Fin Rapport §§§§§ 
----------------------------------

 10/11/2007 ---- 11:19:29,54  

----------------------------------
§§§§§§ [reqjdoor] §§§§§§
----------------------------------
[X] Registre
 
-------------- [  ] rapide
-- Fichier --- [  ] disque systeme
 ------------- [X] complete


********************
     [Registre] 
********************


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{89AD4D75-2429-462e-BD4E-443F233F6033}\InprocServer32]
@="C:\WINDOWS\system32\reqjdoor.dll"

*******************
     [Fichier] 
*******************

c:\WINDOWS\system32eqjdoor.dll


*********************
     [Même date] 
*********************

[02/10/2007 ] --- REP ---> C:\Program Files\Samsung   
[02/10/2007 ] ---> C:\WINDOWS\292 hpqins13.dat  
[02/10/2007 ] ---> C:\WINDOWS\drwatson.log   
[02/10/2007 ] ---> C:\WINDOWS\system32\072 ddcca.dll  
[02/10/2007 ] ---> C:\WINDOWS\system32\268 SENT.log  
[02/10/2007 ] ---> C:\WINDOWS\system32\376 reqjdoor.dll  
[02/10/2007 ] ---> C:\WINDOWS\system32\423 RECV.log  
[02/10/2007 ] ---> C:\WINDOWS\system32\486 UnInstall_Sample.ico  
[02/10/2007 ] ---> C:\WINDOWS\system32\526 accdd.bak1  
[02/10/2007 ] ---> C:\WINDOWS\system32\592 framedyn.dll  
[02/10/2007 ] ---> C:\WINDOWS\system32\947 TEST.log  
[02/10/2007 ] ---> C:\WINDOWS\system32\drivers\632 StarOpen.sys  
[02/10/2007 ] ---> C:\WINDOWS\system32\Uninstall.ico   
[02/10/2007 ] ---> C:\WINDOWS\WORDPAD.INI   



Outil Aide Diagnostic By !aur3n7 Version 1.1
----------------------------------
§§§§§ Fin Rapport §§§§§ 
----------------------------------



 10/11/2007 ---- 11:21:14,48  

----------------------------------
§§§§§§ [geebx] §§§§§§
----------------------------------
[X] Registre
 
-------------- [  ] rapide
-- Fichier --- [  ] disque systeme
 ------------- [X] complete


********************
     [Registre] 
********************


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9818E8FE-0AD8-4847-97AE-D9E0541304E3}\InprocServer32]
@="C:\WINDOWS\system32\geebx.dll"

*******************
     [Fichier] 
*******************



*********************
     [Même date] 
*********************

Aucun fichier créé à la même date détecté


Outil Aide Diagnostic By !aur3n7 Version 1.1
----------------------------------
§§§§§ Fin Rapport §§§§§ 
----------------------------------




 10/11/2007 ---- 11:27:28,75  

----------------------------------
§§§§§§ [fkygqegq] §§§§§§
----------------------------------
[X] Registre
 
-------------- [  ] rapide
-- Fichier --- [  ] disque systeme
 ------------- [X] complete


********************
     [Registre] 
********************

Aucune entrée détectée

*******************
     [Fichier] 
*******************



*********************
     [Même date] 
*********************

Aucun fichier créé à la même date détecté


Outil Aide Diagnostic By !aur3n7 Version 1.1
----------------------------------
§§§§§ Fin Rapport §§§§§ 
----------------------------------


 10/11/2007 ---- 11:29:49,89  

----------------------------------
§§§§§§ [ehvetaad] §§§§§§
----------------------------------
[X] Registre
 
-------------- [  ] rapide
-- Fichier --- [  ] disque systeme
 ------------- [X] complete


********************
     [Registre] 
********************


[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\WINDOWS\system32\ehvetaad.exe"="C:\WINDOWS\system32\ehv"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\WINDOWS\system32\ehvetaad.exe"="C:\WINDOWS\system32\ehv"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\WINDOWS\system32\ehvetaad.exe"="C:\WINDOWS\system32\ehv"

*******************
     [Fichier] 
*******************



*********************
     [Même date] 
*********************

Aucun fichier créé à la même date détecté


Outil Aide Diagnostic By !aur3n7 Version 1.1
----------------------------------
§§§§§ Fin Rapport §§§§§ 
----------------------------------

kris6943 · Answer

coches les lignes suivantes et clique sur fixer ou fix checked

R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE	oolbar.dll
O2 - BHO: (no name) - {01618486-4FC8-412D-B22D-8BCC5D58AC14} - C:\WINDOWS\system32\ddcca.dll
O2 - BHO: (no name) - {116D0E8F-4D3F-40DC-8DFC-42503C0227BB} - (no file)
O2 - BHO: (no name) - {3FF9F441-7480-4938-8794-394F3F4A6656} - C:\WINDOWS\system32\mllji.dll (file missing)
O2 - BHO: (no name) - {43BF8E0C-886D-4103-8DDB-2DFE0E8A0168} - (no file)
O2 - BHO: (no name) - {44CC9203-34A2-4DE5-9917-A7F7818938DD} - (no file)
O2 - BHO: (no name) - {63475DD7-4E5F-46D3-8C0F-68B1CDBFC819} - (no file)
O2 - BHO: (no name) - {7B0A9923-5D94-430A-B9CC-BDABAB7BCDC5} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {89AD4D75-2429-462e-BD4E-443F233F6033} - C:\WINDOWS\system32eqjdoor.dll
O2 - BHO: (no name) - {9818E8FE-0AD8-4847-97AE-D9E0541304E3} - C:\WINDOWS\system32\geebx.dll (file missing)
O2 - BHO: (no name) - {D5730568-C8BD-4678-8F25-D53D1CF3C3D8} - (no file)
O2 - BHO: (no name) - {E8194DE7-90CD-469A-8D58-E090EACD0E78} - (no file)
O4 - HKLM\..\Run: [64c6fddd] rundll32.exe "C:\WINDOWS\system32\fkygqegq.dll",b
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\ehvetaad.exe (file missing)

puis tu redémarres et tu refais un nouveau scan hijackthis et tu ramènes le rapport final

Necras · Answer

excuse moi mais compren pa se que je doi faire. sui novice.
ou doi je les cocher et comment les fixer?
merci.

kris6943 · Answer

tu les coches en début de ligne et tu cliques ensuite sur fix checked ou bien fixer (selon ta version de hijackthis)
puis tu redémarres et tu refais un nouveau scan hijackthis et tu ramènes le rapport final

Necras · Answer

je n'ai pa trouvé:
O2 - BHO: (no name) - {01618486-4FC8-412D-B22D-8BCC5D58AC14} - C:\WINDOWS\system32\ddcca.dll
          mais il y a
O2 - BHO: (no name) - {CB3D07BE-8C7D-9C5C-8DDA9D108B16} - C:\WINDOWS\system32\ddcca.dll


O4 - HKLM\..\Run: [64c6fddd] rundll32.exe "C:\WINDOWS\system32\fkygqegq.dll",b
          mais il y a
O4 - HKLM\..\Run: [64c6fddd] rundll32.exe "C:\WINDOWS\system32\qjbxapyi.dll",b

en fait faut fixer tout les O2 - BHO: (no name) ?

mon HijackThis est le v1.99.1 en Français.

Necras · Answer

voici le rapport HijackThis:

Logfile of HijackThis v1.99.1
Scan saved at 17:00:33, on 10/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\SuperCopier2\SuperCopier2.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Club-Internet\Le Compagnon Club\bin\mpbtn.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcLog.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcAppFlt.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer avec Club-Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1	oolbar.dll (file missing)
O2 - BHO: {d282e2a7-22f5-2728-a6a4-16ca22385582} - {28558322-ac61-4a6a-8272-5f227a2e282d} - C:\WINDOWS\system32\mcrssfhj.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {CB3D07BE-8C7D-4E97-9C5C-8DDA9D108B16} - C:\WINDOWS\system32\ddcca.dll
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE	oolbar.dll (file missing)
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [64c6fddd] rundll32.exe "C:\WINDOWS\system32\qjbxapyi.dll",b
O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: LE COMPAGNON CLUB.lnk = C:\Program Files\Club-Internet\Le Compagnon Club\bin\matcli.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Livre de reliures HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Sélection intelligente HP - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32
vappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32
vappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32
vappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32
vappfilter.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\__c00D3EE2.dat
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcLog.exe

kris6943 · Answer

en fait faut fixer tout les O2 - BHO: (no name) ? 

NON mais on peut systématiquement fixer ceux ou il y a "no file" ou "file missing"
certains "no name" sont parfaitement valides et ne doivent pas être fixés
*************************************************************
tu vas essayer ceci

1.telecharge ComboFix
http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe

2. Double click sur combofix.exe et suis les indications
3. Quand il aura fini, un rapport va se créer que tu colleras dans ta réponse

PS: certains antivirus le détectent comme un virus aussi il faut désactive provisoirementr l'antivirus dans ce cas là

Necras · Answer

Voici le rapport combofix:

ComboFix 07-11-08.1 - Propriétaire 2007-11-10 20:51:39.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.326 [GMT 1:00]
Running from: C:\Documents and Settings\Propriétaire\Bureau\ComboFix.exe
* Created a new restore point
.

Incapable d'obtenir les privilèges Système

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Propriétaire\Application Data\WinTouch
C:\Documents and Settings\Propriétaire\Application Data\WinTouch\wintouch.cfg
C:\Documents and Settings\Propriétaire\Application Data\WinTouch\WinTouch.exe
C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\__c0068EE2.dat
C:\WINDOWS\system32\__c009BACB.dat
C:\WINDOWS\system32\__c00D3EE2.dat
C:\WINDOWS\system32\__c00DC71C.dat
C:\WINDOWS\system32\accdd.bak1
C:\WINDOWS\system32\accdd.bak2
C:\WINDOWS\system32\accdd.ini
C:\WINDOWS\system32\ajbrohmu.dll
C:\WINDOWS\system32\AutoRun.inf
C:\WINDOWS\system32\bciqgxpd.dll
C:\WINDOWS\system32\bggigdhx.dll
C:\WINDOWS\system32\bjdkmlou.dll
C:\WINDOWS\system32\bkskwvwy.dll
C:\WINDOWS\system32\ctkigtbi.dll
C:\WINDOWS\system32\ddcca.dll
C:\WINDOWS\system32\ddcgwbhv.dll
C:\WINDOWS\system32\dhvebjwi.dll
C:\WINDOWS\system32\dlsysuvg.dll
C:\WINDOWS\system32\dmcxxjew.dll
C:\WINDOWS\system32\epoiteyn.dll
C:\WINDOWS\system32\fhdjrnid.dll
C:\WINDOWS\system32\fnwliimf.dll
C:\WINDOWS\system32\gdttcfpl.dll
C:\WINDOWS\system32\giccefoh.dll
C:\WINDOWS\system32\gsqlobgy.dll
C:\WINDOWS\system32\gujvmnpl.dll
C:\WINDOWS\system32\hhorwqtc.dll
C:\WINDOWS\system32\hhtpxsod.dll
C:\WINDOWS\system32\hsrwwink.dll
C:\WINDOWS\system32\hvrtrqyo.dll
C:\WINDOWS\system32\iflfjiti.dll
C:\WINDOWS\system32\ifpxhudn.dll
C:\WINDOWS\system32\ijllm.bak1
C:\WINDOWS\system32\ijllm.bak2
C:\WINDOWS\system32\ijllm.ini
C:\WINDOWS\system32\ijllm.ini2
C:\WINDOWS\system32\ijllm.tmp
C:\WINDOWS\system32\kwovemif.dll
C:\WINDOWS\system32\kwqxljle.dll
C:\WINDOWS\system32\lfmkaoso.dll
C:\WINDOWS\system32\lghalari.dll
C:\WINDOWS\system32\lhhsjnxx.dll
C:\WINDOWS\system32\lhsxdkoq.dll
C:\WINDOWS\system32\lyldevtd.dll
C:\WINDOWS\system32\negqmsak.dll
C:\WINDOWS\system32\nhnobkrr.dll
C:\WINDOWS\system32\nmsthssg.dll
C:\WINDOWS\system32\notkrjkk.dll
C:\WINDOWS\system32\oangirob.dll
C:\WINDOWS\system32\ojadceno.dll
C:\WINDOWS\system32\oryjwyps.dll
C:\WINDOWS\system32\pjglvlaa.dll
C:\WINDOWS\system32\prhhwght.dll
C:\WINDOWS\system32\pujvoojw.dll
C:\WINDOWS\system32\pypvwcyc.dll
C:\WINDOWS\system32\qkukelni.dll
C:\WINDOWS\system32\qkxohnqb.dll
C:\WINDOWS\system32\qqyhfdnp.dll
C:\WINDOWS\system32\raramdhk.dll
C:\WINDOWS\system32\reqjdoor.dll
C:\WINDOWS\system32\rikvngkc.dll
C:\WINDOWS\system32\rpcnwnlj.dll
C:\WINDOWS\system32\ryamdetl.dll
C:\WINDOWS\system32\scvsmmfb.dll
C:\WINDOWS\system32\sdqcviow.dll
C:\WINDOWS\system32\sjirgsps.dll
C:\WINDOWS\system32\spywjyro.ini
C:\WINDOWS\system32\ssqnoop.dll
C:\WINDOWS\system32\swoveags.dll
C:\WINDOWS\system32\tmrmohhe.dll
C:\WINDOWS\system32\ufnrscjr.dll
C:\WINDOWS\system32\ujbkfrhd.dll
C:\WINDOWS\system32\ushyahvh.dll
C:\WINDOWS\system32\vacydlgh.dll
C:\WINDOWS\system32\venllfrj.dll
C:\WINDOWS\system32\vorkivqv.dll
C:\WINDOWS\system32\vuixmnvq.dll
C:\WINDOWS\system32\wgnhdfbs.dll
C:\WINDOWS\system32\wxjyvhkl.dll
C:\WINDOWS\system32\xajfxpva.dll
C:\WINDOWS\system32\xbeeg.bak1
C:\WINDOWS\system32\xbeeg.bak2
C:\WINDOWS\system32\xbeeg.ini
C:\WINDOWS\system32\xhdgiggb.ini
C:\WINDOWS\system32\xyeutprr.dll
C:\WINDOWS\system32\yaivwejp.dll
C:\WINDOWS\system32\yasufehv.dll
C:\WINDOWS\system32\ysydsvco.dll
C:\WINDOWS\system32\yucjclgp.dll
C:\WINDOWS\system32\yytdwrda.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_DOMAINSERVICE
-------\LEGACY_NPF
-------\DomainService

((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-10-10 to 2007-11-10 ))))))))))))))))))))))))))))))))))))
.

2007-11-10 20:50 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-11-10 16:57 81,472 --a------ C:\WINDOWS\system32\mcrssfhj.dll
2007-11-10 12:33 85,056 --a------ C:\WINDOWS\system32\qjbxapyi.dll
2007-11-10 12:24 71,232 --a------ C:\WINDOWS\system32\rbipflan.exe
2007-11-09 16:47 2,388,176 --a------ C:\WINDOWS\system\d3dx9_30.dll
2007-11-09 16:24 <REP> d-------- C:\Program Files\CAPCOM
2007-11-09 12:21 71,232 --a------ C:\WINDOWS\system32\wjkldauc.exe
2007-11-07 23:29 86,080 --a------ C:\WINDOWS\system32\utjvqlkc.dll
2007-11-07 23:17 71,232 --a------ C:\WINDOWS\system32\hqlwtyyu.exe
2007-11-07 01:47 <REP> d-------- C:\VundoFix Backups
2007-11-06 23:21 <REP> d-------- C:\Program Files\Hijackthis Version Fran‡aise
2007-11-06 21:52 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2007-11-06 21:52 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-11-06 21:48 3,770 --a------ C:\WINDOWS\system32\tmp.reg
2007-11-06 21:45 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2007-11-06 21:45 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2007-11-06 21:45 53,248 --a------ C:\WINDOWS\system32\Process.exe
2007-11-06 21:45 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2007-11-06 21:45 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2007-11-06 10:46 <REP> d-------- C:\Program Files\MSXML 4.0
2007-11-05 20:19 <REP> d--h----- C:\WINDOWS\$hf_mig$
2007-11-05 10:34 <REP> d-------- C:\Program Files\AntiSpyGolden 5.1
2007-11-05 10:34 <REP> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2007-10-24 11:46 <REP> d-------- C:\Program Files\Google
2007-10-14 01:48 <REP> d-------- C:\Program Files\Real Alternative
2007-10-14 01:48 <REP> d-------- C:\Program Files\Media Player Classic
2007-10-12 19:00 <REP> d-------- C:\Program Files\Macrogaming
2007-10-12 14:15 872,448 --a------ C:\WINDOWS\system32\libgfl211.dll
2007-10-12 14:15 364,544 --a------ C:\WINDOWS\system32\Xfpx.dll
2007-10-12 14:15 307,200 --a------ C:\WINDOWS\system32\libmng.dll
2007-10-12 14:15 225,280 --a------ C:\WINDOWS\system32\Xjp2.dll
2007-10-12 14:15 114,688 --a------ C:\WINDOWS\system32\Xjpegls.dll
2007-10-12 14:15 81,920 --a------ C:\WINDOWS\system32\Xjbig.dll
2007-10-12 14:15 49,152 --a------ C:\WINDOWS\system32\Xsusie.dll
2007-10-12 14:15 49,152 --a------ C:\WINDOWS\system32\Xjng.dll
2007-10-12 12:51 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage r‚seau
2007-10-12 12:51 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
2007-10-12 12:51 <REP> d--h----- C:\Documents and Settings\Administrateur\ModŠles
2007-10-12 12:51 <REP> d-------- C:\Documents and Settings\Administrateur\Mes documents
2007-10-12 12:51 <REP> dr------- C:\Documents and Settings\Administrateur\Menu D‚marrer
2007-10-12 12:51 <REP> d-------- C:\Documents and Settings\Administrateur\Favoris
2007-10-12 12:51 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
2007-10-11 11:56 <REP> d-------- C:\Program Files\Windows Media Connect 2
2007-10-11 11:54 <REP> d-------- C:\WINDOWS\system32\drivers\UMDF

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-10 16:00 --------- d-----w C:\Program Files\Hijackthis Version Française
2007-11-09 17:41 --------- d-----w C:\Program Files\Money Manager Ex
2007-11-09 17:24 --------- d-----w C:\Program Files\uTorrent
2007-11-09 15:24 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-11-09 15:13 --------- d-----w C:\Program Files\DAEMON Tools
2007-10-08 12:24 --------- d-----w C:\Program Files\Square Soft, Inc
2007-10-06 03:07 --------- d-----w C:\Program Files\Java
2007-10-05 19:41 --------- d-----w C:\Program Files\QuickTime
2007-10-05 19:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2007-10-05 19:39 --------- d-----w C:\Program Files\Apple Software Update
2007-10-05 19:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2007-10-04 21:01 --------- d-----w C:\Program Files\Audacity
2007-10-04 20:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-10-04 20:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avg7
2007-10-04 18:47 --------- d-----w C:\Program Files\SuperCopier2
2007-10-04 18:47 --------- d-----w C:\Program Files\Skype
2007-10-04 18:47 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype
2007-10-04 18:46 --------- d-----w C:\Program Files\Fichiers communs\Skype
2007-10-02 14:06 --------- d-----w C:\Program Files\Samsung
2007-09-29 14:23 --------- d-----w C:\Program Files\Rockstar Games
2007-09-21 01:09 --------- d-----w C:\Program Files\Corel
2007-09-21 01:08 --------- d-----w C:\Program Files\Fichiers communs\Corel
2007-09-21 01:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\Corel
2007-09-18 17:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\Babylon
2007-09-17 13:05 --------- d-----r C:\Program Files\Program Files
2007-09-14 03:31 --------- d-----w C:\Program Files\MSN Messenger
2007-09-10 10:47 --------- d-----w C:\Program Files\Alwil Software
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0347C33E-8762-4905-BF09-768834316C61}]
2007-03-02 15:52 1298024 -ra------ C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{053F9267-DC04-4294-A72C-58F732D338C0}]
2007-03-02 15:52 177768 -ra------ C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{28558322-ac61-4a6a-8272-5f227a2e282d}]
2007-11-10 16:57 81472 --a------ C:\WINDOWS\system32\mcrssfhj.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{32EDD432-F509-46D6-86A4-1CD7033A5156}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-05 13:00]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-05 13:00]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-05 13:00]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-09-25 08:12]
"SoundMAX"="C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [2006-05-18 14:26]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50]
"BJCFD"="C:\Program Files\BroadJump\Client Foundation\CFD.exe" [2003-01-27 16:16]
"StandardInstall"="" []
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 02:06]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 20:34]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 11:06]
"hpqSRMon"="C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe" [2007-08-22 15:31]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 05:24]
"SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe" [2007-08-12 10:02]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2006-05-18 07:22]
"64c6fddd"="C:\WINDOWS\system32\qjbxapyi.dll" [2007-11-10 12:33]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SuperCopier2.exe"="C:\Program Files\SuperCopier2\SuperCopier2.exe" [2006-07-07 17:45]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 15:46]
"SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe" [2007-08-12 10:02]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)

R3 RTLWUSB;Realtek RTL8187 Wireless 802.11g 54Mbps USB 2.0 Network Adapter;C:\WINDOWS\system32\DRIVERS\RTL8187.sys
S3 bDMusicb;bDMusicb;\??\C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\bDMusicb.sys

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt hpqcxs08 hpqddsvc

.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-10 20:59:31
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-10 21:01:05 - machine was rebooted
.
--- E O F ---

Necras · Answer

Depuis que je suis les manip que tu m'indique, à chaque fois Spybot m'informe de modif à effectuer que j'autorise suivant les conseil que l'on m'avait donné. dois-je le laisser actif et lui faire confiance dans son travail?

kris6943 · Answer

Ca devrait aller beaucoup mieux je suppose depuis la manœuvre combofix? 

remet moi un log hijackthis pour vérifier la progression de la désinfection.


Oui laisse Spybot actif. C'est normal qu'il te prévienne, il est fait pour ça. Chaque fois qu'une modification est effectuée dans la base de registre il te prévient et demande l'autorisation de le faire. Or toutes les modifs que je t'ai fait faire visent à modifier la bdr pour y supprimer ce qui est foireux. Donc pas de soucis de ce coté là

Necras · Answer

voici le rapport HijackThis:

Logfile of HijackThis v1.99.1
Scan saved at 12:35, on 2007-11-11
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\SuperCopier2\SuperCopier2.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Club-Internet\Le Compagnon Club\bin\mpbtn.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcLog.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcAppFlt.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1	oolbar.dll (file missing)
O2 - BHO: {d282e2a7-22f5-2728-a6a4-16ca22385582} - {28558322-ac61-4a6a-8272-5f227a2e282d} - C:\WINDOWS\system32\mcrssfhj.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE	oolbar.dll (file missing)
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [64c6fddd] rundll32.exe "C:\WINDOWS\system32\qjbxapyi.dll",b
O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: LE COMPAGNON CLUB.lnk = C:\Program Files\Club-Internet\Le Compagnon Club\bin\matcli.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Livre de reliures HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Sélection intelligente HP - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32
vappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32
vappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32
vappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32
vappfilter.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcLog.exe



Depuis l'infection mon internet est plus lent, il rame pour afficher les pages, mais le reste va mieux, il plante moins mon son a été réparer. Merci de ton aide.

Si g bien compris d'après ce rapport je devrai fixer:

O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1	oolbar.dll (file missing)
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE	oolbar.dll (file missing)
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

kris6943 · Answer

Si g bien compris d'après ce rapport je devrai fixer:

O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1	oolbar.dll (file missing)
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE	oolbar.dll (file missing)
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

Oui absolument
--------------------------------------------------
Il ya toujours des choses complètement anormales dans ton log hijackthis
Alors, essaye de refaire un combofix mais cette fois, effectue le en mode sans echec

Pour cela au démarrage du Pc, tu tapotes sans interruption sur F8 
puis, avec les flèches du clavier, tu te positionnes sur "mode sans echec"  et tu valides.
tu choisiras ta session habituelle et pas la session administrateur
puis tu me refais un combofix , et tu me ramènes le rapport combofix et un nouvel hijackthis

Infection par un Spyware

37 réponses

Newsletters