Infecté par winantivirus+pleins d'autre!!!!

OURASI · le 18 février 2007

Bonjour a tous.

J'ai pleins de soucis avec le pc.Pub intempestive du genre Winantiviruspro,games,crazy girls,etc....

Alors je vous poste mon rapport et s'il vous plait HELP ME!!!!!!

Logfile of HijackThis v1.99.1

Scan saved at 23:34:05, on 16/12/2001

Platform: Windows XP (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Apps\ActivBoard\nhksrv.exe

C:\Program Files\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe

C:\WINDOWS\System32\FTRTSVC.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\system32\slserv.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE

C:\Apps\ActivBoard\MMKeybd.exe

C:\apps\ActivSurf\4448364\Program\backweb-4448364.exe

C:\WINDOWS\wt\wcmdmgr.exe

C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb03.exe

C:\Program Files\ZTE Corporation\ZXDSL852\CnxDslTb.exe

C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe

C:\Program Files\HbTools\Bin\4.8.4.0\HbtWeatherOnTray.exe

C:\Program Files\HbTools\Bin\4.8.4.0\HbtOEAddOn.exe

C:\PROGRA~1\Wanadoo\TaskBarIcon.exe

C:\Program Files\Messenger\msmsgs.exe

C:\PROGRA~1\Wanadoo\EspaceWanadoo.exe

C:\Program Files\Hbtools\HBTV\HBTV.exe

C:\Apps\ActivBoard\TrayMon.exe

C:\Program Files\jetspeed\AUTOSTAR.EXE

C:\Apps\ActivBoard\OSD.exe

C:\PROGRA~1\Wanadoo\ComComp.exe

C:\PROGRA~1\Wanadoo\Toaster.exe

C:\PROGRA~1\Wanadoo\Inactivity.exe

C:\PROGRA~1\Wanadoo\PollingModule.exe

C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE

C:\PROGRA~1\Wanadoo\Watch.exe

C:\PROGRA~1\Wanadoo\WOOBrowser\WOOBrowser.exe

C:\WINDOWS\System32prodsrvs.exe

C:\PROGRA~1\Wanadoo\WOOBRO~1\DownloadManager.exe

C:\Program Files\HbTools\Bin\4.8.4.0\HbtSrv.exe

C:\Documents and Settings\sylvie\Local Settings\Temp\Répertoire temporaire 1 pour hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchgateway.net/search/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.wanadoo.fr

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://resultsmaster.com/SmartOffers/Servi...omeLeftPane.htm

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.searchgateway.net/search/%s

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\apps\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

O2 - BHO: TVEngine Helper /fleok=1D8A83A5C2E6107C91A475760EA83FA5EF80752B94E2DE765C784E293AC5 - {4B18DD50-C996-44fc-AC52-0FECFF82ED58} - c:\program files\hbtools\hbtv\hbtvhelper.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: GamesBar - {6F282B65-56BF-4BD1-A8B2-A4449A05863D} - C:\Program Files\GamesBar\oberontb.dll

O2 - BHO: HbTools - {74CC49F7-EB32-4A08-B204-948962A6E3DB} - C:\Program Files\HbTools\Bin\4.8.4.0\HbtHostIE.dll

O2 - BHO: SurfairyHlp Class - {E0B9B5FE-B66E-4FB0-A1D9-726F0E743CFD} - C:\Program Files\Surfairy\SurfairyPP.dll (file missing)

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O3 - Toolbar: GamesBar - {6F282B65-56BF-4BD1-A8B2-A4449A05863D} - C:\Program Files\GamesBar\oberontb.dll

O3 - Toolbar: H&otbar - {74CC49F7-EB32-4A08-B204-948962A6E3DB} - C:\Program Files\HbTools\Bin\4.8.4.0\HbtHostIE.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize

O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE

O4 - HKLM\..\Run: [ACTIVBOARD] C:\Apps\ActivBoard\MMKeybd.exe

O4 - HKLM\..\Run: [wcmdmgr] C:\WINDOWS\wt\wcmdmgrl.exe -launch

O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER

O4 - HKLM\..\Run: [ActivSurf] C:\apps\ActivSurf\4448364\Program\backweb-4448364.exe

O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb03.exe

O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Program Files\ZTE Corporation\ZXDSL852\CnxDslTb.exe" "ZTE Corporation\ZXDSL852"

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe

O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe

O4 - HKLM\..\Run: [WeatherOnTray] C:\Program Files\HbTools\Bin\4.8.4.0\HbtWeatherOnTray.exe

O4 - HKLM\..\Run: [HbTools] C:\Program Files\HbTools\Bin\4.8.4.0\HbtOEAddOn.exe

O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"

O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\GestMaj.exe EspaceWanadoo.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [instant Access] C:\WINDOWS\System32\prodsrvs.exe /res

O4 - HKCU\..\Run: [update Service] C:\PROGRA~1\FICHIE~1\TEKNUM~1\update.exe /startup

O4 - HKCU\..\Run: [Windows Registry Repair Pro] C:\Program Files\3B Software\Windows Registry Repair Pro\RegistryRepairPro.exe 4

O4 - Startup: HP JetSpeed Autostart.lnk = C:\Program Files\jetspeed\AUTOSTAR.EXE

O9 - Extra button: (no name) - {1A93C934-025B-4c3a-B38E-9654A7003239} - C:\Program Files\GamesBar\oberontb.dll

O9 - Extra 'Tools' menuitem: GamesBar - {1A93C934-025B-4c3a-B38E-9654A7003239} - C:\Program Files\GamesBar\oberontb.dll

O9 - Extra button: Suggestions - {2223664C-1942-4276-9A2D-E8D8F547C5D2} - res://EffiPeled (file missing)

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.wanadoo.fr (file missing) (HKCU)

O14 - IERESET.INF: START_PAGE_URL=http://www.wanadoo.fr

O16 - DPF: {09C21411-B9A2-4DE6-8416-4E3B58577BE0} (France Telecom MDM ActiveX Control) - http://minitelweb.minitel.com/imin_data/ocx/MDM.cab

O16 - DPF: {5308E02B-4ABA-48E4-AA9E-8A7693661473} (GameCtl Class) - http://jeuxenligne.orange.fr/GisActiveX/Ax/GameAx.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1168166303203

O16 - DPF: {8C875948-9C60-4381-9248-0DF180542D53} (HbtInstObj) - http://installs.hotbar.com/installs/hbtool...4.0/hbtools.cab

O16 - DPF: {AA59202C-5E41-48FC-AF7D-324F5FD6A9F1} - http://scripts.dlv4.com/binaries/egaccess4..._1070_em_XP.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{59EF1DDE-87A0-46C3-A065-A72742891CAB}: NameServer = 80.10.246.130 80.10.246.3

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe

O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Apps\ActivBoard\nhksrv.exe

O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe

chercheur · le 18 février 2007

Bonjour

Bienvenu sur Zebulon

Poste ce deux rapports qui seront utiles pour la désinfection de ton PC.

$$ Télécharge DiagHelp.zip (de Malekal_Morte) sur ton bureau

http://www.malekal.com/download/DiagHelp.zip

- Fais un clic droit sur le fichier et extraire tout

- Un nouveau dossier chercher va être créé DiagHelp

- Ouvre le et double-clic sur go.cmd (le .cmd peut ne pas apparaître)

- Une fenêtre va s'ouvrir, choisis l'option 1

- L'analyse va commencer, ceci peut durer quelques minutes, laisse faire et appuie sur une touche quand on te le demande

- A la fin de l'analyse, il te sera redemandé de redémarrer l'ordinateur... Une fois l'ordinateur redémarré le rapport va apparaître sur le bloc-note.. Ce dernier se trouve sur C:\resultat.txt

- Copie/colle le contenu du bloc-note qui s'ouvre, pour cela :

-- Dans le bloc-note, cliquez sur le menu Edition / Selectionner tout

-- A nouveau menu Edition / copier

-- Dans un nouveau message ici, faire un clic droit / coller

$$ Télécharge Blacklight (de F-Secure) et sauvegarde le sur ton Bureau.

https://europe.f-secure.com/blacklight/try.shtml

Clique sur "I ACCEPT" au bas de la page. Sauvegarde le sur ton Bureau.

Double-clique blbeta.exe et accepte la licence; clique Scan puis Next

Tu verras une liste de fichiers détectés apparaître. Tu verras également un rapport, sur ton Bureau, nommé fsbl.xxxxxxx.log (les xxxxxxx sont des chiffres).

Copie et colle le contenu de ce rapport dans ta prochaine réponse.

OURASI · le 18 février 2007

Bonjour chercheur.

te poste ca de suite et merci pour le coup de pouce.

Voici le rapport Dialhelp:

C:\WINDOWS\System32\nvs2.inf -->12/01/2007 17:04:28

C:\WINDOWS\System32\LegitCheckControl.dll -->17/05/2006 11:23:38

C:\WINDOWS\System32\spmsg.dll -->03/04/2006 11:40:10

C:\WINDOWS\System32\sirenacm.dll -->13/10/2005 00:11:06

C:\WINDOWS\System32\wuweb.dll -->26/05/2005 04:19:32

C:\WINDOWS\System32\wucltui.dll -->26/05/2005 04:16:32

C:\WINDOWS\System32\wuaueng1.dll -->26/05/2005 04:16:32

C:\WINDOWS\System32\wuaucpl.cpl -->26/05/2005 04:16:32

C:\WINDOWS\System32\wups2.dll -->26/05/2005 04:16:30

C:\WINDOWS\System32\wups.dll -->26/05/2005 04:16:30

C:\WINDOWS\System32\wuaueng.dll -->26/05/2005 04:16:30

C:\WINDOWS\System32\wuauclt1.exe -->26/05/2005 04:16:30

C:\WINDOWS\System32\wuauclt.exe -->26/05/2005 04:16:30

C:\WINDOWS\System32\wuapi.dll -->26/05/2005 04:16:30

C:\WINDOWS\System32\iuengine.dll -->26/05/2005 04:16:24

C:\WINDOWS\System32\cdm.dll -->26/05/2005 04:16:24

C:\WINDOWS\System32\cnxci.dll -->20/05/2005 18:34:22

C:\WINDOWS\System32\ffJmpWeb.dll -->08/11/2004 15:03:20

C:\WINDOWS\System32\SpOrder.dll -->07/10/2004 13:39:32

C:\WINDOWS\System32\msvcr71.dll -->07/10/2004 13:39:32

C:\WINDOWS\System32\msvcp71.dll -->07/10/2004 13:39:32

C:\WINDOWS\System32\mfc71.dll -->07/10/2004 13:39:32

C:\WINDOWS\System32\atl71.dll -->07/10/2004 13:39:30

C:\WINDOWS\System32\WooDial2000.dll -->23/08/2004 14:50:02

C:\WINDOWS\System32\IfHelper.dll -->23/08/2004 13:49:56

C:\WINDOWS\System32prodsrvs.exe -->02/02/2007 16:18:50

C:\WINDOWS\tmlpwin.exe -->16/01/2007 10:33:27

C:\WINDOWS\pack.epk -->12/01/2007 17:04:20

C:\WINDOWS\WGA.log -->07/01/2007 11:42:38

C:\WINDOWS\CnxDslWz.log -->07/01/2007 11:42:29

C:\WINDOWS\KB842773.log -->07/01/2007 11:42:00

C:\WINDOWS\imsins.BAK -->07/01/2007 11:42:00

C:\WINDOWS\MDM.ocx -->23/06/2005 08:40:30

C:\WINDOWS\KB899588.log -->16/09/2004 16:57:32

C:\WINDOWS\KB896688.log -->23/07/2004 17:17:29

C:\WINDOWS\disney.ini -->23/07/2004 00:47:49

C:\WINDOWS\SIERRA.INI -->23/07/2004 00:45:54

C:\WINDOWS\msoffice.ini -->23/07/2004 00:22:18

C:\WINDOWS\ntbtlog.txt -->24/04/2004 17:37:29

C:\WINDOWS\hegames.ini -->08/01/2004 16:49:09

C:\WINDOWS\aolback.exe |25/09/2002 11:27:00

C:\WINDOWS\bwUnin-6.1.0.145L.exe |24/09/2002 16:28:13

C:\WINDOWS\ciaunwdm.exe |31/12/1979 23:00:00

C:\WINDOWS\epsuninst.exe |23/11/2001 16:28:03

C:\WINDOWS\INSTALL.exe |08/01/2004 16:10:35

C:\WINDOWS\IsUn0407.exe |14/10/2002 18:33:51

C:\WINDOWS\IsUn040c.exe |24/09/2002 16:20:49

C:\WINDOWS\IsUninst.exe |24/09/2002 16:37:06

C:\WINDOWS\iun3405.exe |11/12/2002 18:12:55

C:\WINDOWS\MadUnInst.exe |22/11/2001 16:11:52

C:\WINDOWS\PLAYER.EXE |04/06/2002 15:58:43

C:\WINDOWS\Pp.exe |24/09/2002 16:32:28

C:\WINDOWS\QTINSTAL.EXE |04/06/2002 15:58:40

C:\WINDOWS\QTW16DEL.EXE |04/06/2002 15:58:43

C:\WINDOWS\rmhpjs.exe |16/10/2002 19:18:41

C:\WINDOWS\sllights.exe |31/12/1979 23:00:00

C:\WINDOWS\smcfg.exe |31/12/1979 23:00:00

C:\WINDOWS\System32prodsrvs.exe |04/12/2001 23:49:52

C:\WINDOWS\tmlpwin.exe |16/01/2007 10:33:27

C:\WINDOWS\twunk_16.exe |31/12/1979 23:00:00

C:\WINDOWS\twunk_32.exe |31/12/1979 23:00:00

C:\WINDOWS\Unin.exe |24/09/2002 16:32:29

C:\WINDOWS\unin040c.exe |24/11/2002 16:14:20

C:\WINDOWS\uninst.exe |24/09/2002 16:30:34

C:\WINDOWS\unvise32.exe |29/11/2001 20:11:07

C:\WINDOWS\unvise32qt.exe |01/12/2001 19:15:13

C:\WINDOWS\UNWISE.EXE |16/10/2002 19:15:42

C:\WINDOWS\VIEWER.EXE |04/06/2002 15:58:43

C:\WINDOWS\PLAYENU.DLL |04/06/2002 15:58:43

C:\WINDOWS\twain.dll |31/12/1979 23:00:00

C:\WINDOWS\twain_32.dll |31/12/1979 23:00:00

C:\WINDOWS\uninstBVRP.dll |24/09/2002 16:28:31

C:\WINDOWS\VIEWENU.DLL |04/06/2002 15:58:43

C:\WINDOWS\system32\append.exe |31/12/1979 23:00:00

C:\WINDOWS\system32\debug.exe |31/12/1979 23:00:00

C:\WINDOWS\system32\dosx.exe |31/12/1979 23:00:00

C:\WINDOWS\system32\dvdplay.exe |23/08/2001 16:47:34

C:\WINDOWS\system32\edlin.exe |31/12/1979 23:00:00

C:\WINDOWS\system32\exe2bin.exe |31/12/1979 23:00:00

C:\WINDOWS\system32\fastopen.exe |31/12/1979 23:00:00

C:\WINDOWS\system32\FTRTSVC.exe |13/08/2002 21:51:14

C:\WINDOWS\system32\GkSui18.EXE |17/02/2002 02:26:33

C:\WINDOWS\system32\hpfinsta.exe |03/08/2001 11:46:22

C:\WINDOWS\system32\java.exe |24/12/2001 20:33:11

C:\WINDOWS\system32\javaw.exe |24/12/2001 20:33:11

C:\WINDOWS\system32\mem.exe |31/12/1979 23:00:00

C:\WINDOWS\system32\minirec.exe |31/12/1979 23:00:00

C:\WINDOWS\system32\mscdexnt.exe |31/12/1979 23:00:00

C:\WINDOWS\system32\nlsfunc.exe |31/12/1979 23:00:00

C:\WINDOWS\system32\nvsvc32.exe |31/12/1979 23:00:00

C:\WINDOWS\system32\PackethSvc.exe |08/10/2002 22:13:48

C:\WINDOWS\system32\redir.exe |31/12/1979 23:00:00

C:\WINDOWS\system32\setver.exe |31/12/1979 23:00:00

C:\WINDOWS\system32\share.exe |31/12/1979 23:00:00

C:\WINDOWS\system32\slserv.exe |31/12/1979 23:00:00

C:\WINDOWS\system32\SX53INST.EXE |24/09/2002 16:28:49

C:\WINDOWS\system32\usrmlnka.exe |23/08/2001 16:47:48

C:\WINDOWS\system32\usrprbda.exe |23/08/2001 16:47:48

C:\WINDOWS\system32\usrshuta.exe |23/08/2001 16:47:48

C:\WINDOWS\system32\ActPanel.dll |24/12/2001 20:33:05

C:\WINDOWS\system32\amr_cpl.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\amstream.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\atmfd.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\atmlib.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\avsda.dll |25/12/2001 02:27:46

C:\WINDOWS\system32\Camapi32.dll |06/11/2003 01:45:02

C:\WINDOWS\system32\cncs232.dll |11/04/1999 22:54:20

C:\WINDOWS\system32\cnxci.dll |24/12/2001 20:34:51

C:\WINDOWS\system32\coinst.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\Comm32.dll |06/11/2003 01:45:02

C:\WINDOWS\system32\COMNCTR.DLL |24/09/2002 16:20:14

C:\WINDOWS\system32\compatUI.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\CPUINF32.DLL |06/11/2003 01:45:02

C:\WINDOWS\system32\DC120fc7_32.dll |06/11/2003 01:45:01

C:\WINDOWS\system32\DC210.dll |06/11/2003 01:45:02

C:\WINDOWS\system32\dgrpsetu.dll |24/09/2002 16:07:47

C:\WINDOWS\system32\dgsetup.dll |24/09/2002 16:07:47

C:\WINDOWS\system32\EqnClass.Dll |24/09/2002 16:07:47

C:\WINDOWS\system32\F210.dll |06/11/2003 01:45:01

C:\WINDOWS\system32\ffJmpWeb.dll |24/12/2001 20:32:45

C:\WINDOWS\system32\Fpl.dll |06/11/2003 01:45:03

C:\WINDOWS\system32\FPXLIB.DLL |06/11/2003 01:45:02

C:\WINDOWS\system32\HELLUT32.DLL |06/11/2003 01:45:02

C:\WINDOWS\system32\HHActiveX.dll |17/02/2002 02:33:11

C:\WINDOWS\system32\hpfinst.dll |03/08/2001 11:45:35

C:\WINDOWS\system32\hpzcoi03.dll |03/08/2001 11:46:29

C:\WINDOWS\system32\hpzcon03.dll |03/08/2001 11:46:29

C:\WINDOWS\system32\hpzlnt03.dll |03/08/2001 11:46:31

C:\WINDOWS\system32\hticons.dll |24/09/2002 16:11:53

C:\WINDOWS\system32\hypertrm.dll |24/09/2002 16:11:53

C:\WINDOWS\system32\Iacenc.dll |27/09/2002 18:25:14

C:\WINDOWS\system32\iccvid.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\IfHelper.dll |13/08/2002 21:51:14

C:\WINDOWS\system32\Inetwh32.dll |25/09/2002 11:26:25

C:\WINDOWS\system32\ipubgrnd.dll |06/11/2003 01:45:03

C:\WINDOWS\system32\Ir32_32.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\ir41_qc.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\ir41_qcx.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\Ir50_32.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\ir50_qc.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\ir50_qcx.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\isrdbg32.dll |24/09/2002 16:13:18

C:\WINDOWS\system32\Iyvu9_32.dll |27/09/2002 18:25:14

C:\WINDOWS\system32\jgaw400.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\jgdw400.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\jgmd400.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\jgpl400.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\jgsd400.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\jgsh400.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\JPEGLIB.DLL |06/11/2003 01:45:02

C:\WINDOWS\system32\LCoInst.dll |24/09/2002 16:20:13

C:\WINDOWS\system32\lfbmp12n.dll |17/02/2002 02:33:12

C:\WINDOWS\system32\LFCMP12n.DLL |17/02/2002 02:33:12

C:\WINDOWS\system32\LGUICOM.DLL |24/09/2002 16:20:14

C:\WINDOWS\system32\lmoufrc.dll |24/09/2002 16:20:13

C:\WINDOWS\system32\LMOUSE16.DLL |24/09/2002 16:20:14

C:\WINDOWS\system32\LMOUSE32.DLL |24/09/2002 16:20:14

C:\WINDOWS\system32\LOGILANG.DLL |24/09/2002 16:20:14

C:\WINDOWS\system32\LPControl.dll |06/11/2003 01:45:03

C:\WINDOWS\system32\LTDIS12n.dll |17/02/2002 02:33:12

C:\WINDOWS\system32\ltfil12n.DLL |17/02/2002 02:33:12

C:\WINDOWS\system32\ltimg12n.dll |17/02/2002 02:33:12

C:\WINDOWS\system32\ltkrn12n.dll |17/02/2002 02:33:12

C:\WINDOWS\system32\lttwn12n.dll |17/02/2002 02:33:12

C:\WINDOWS\system32\Ltwvc12n.dll |17/02/2002 02:33:12

C:\WINDOWS\system32\mdwmdmsp.dll |23/08/2001 16:47:06

C:\WINDOWS\system32\MGIIpl4.dll |06/11/2003 01:45:03

C:\WINDOWS\system32\MGIIpl4M5.dll |06/11/2003 01:45:24

C:\WINDOWS\system32\MGIIpl4M6.dll |06/11/2003 01:45:24

C:\WINDOWS\system32\MGIIpl4P6.dll |06/11/2003 01:45:24

C:\WINDOWS\system32\MGIIpl4PX.dll |06/11/2003 01:45:02

C:\WINDOWS\system32\MGIIpl4W7.dll |06/11/2003 01:45:25

C:\WINDOWS\system32\msdmo.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\msencode.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\msikbd.dll |24/09/2002 16:29:46

C:\WINDOWS\system32\msiosd32.dll |24/09/2002 16:29:46

C:\WINDOWS\system32\nv4_disp.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\nvcpl.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\nvdesk32.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\nvdmcpl.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\nvinstnt.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\nvoglnt.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\nvqtwk.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\nvrsar.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\nvrscs.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\nvrsda.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\nvrsde.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\nvrsel.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\nvrseng.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\nvrses.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\nvrsfi.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\nvrsfr.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\nvrshe.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\nvrshu.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\nvrsit.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\nvrsja.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\nvrsko.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\nvrsnl.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\nvrsno.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\nvrspl.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\nvrspt.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\nvrsptb.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\nvrsru.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\nvrssk.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\nvrssl.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\nvrssv.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\nvrstr.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\nvrszhc.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\nvrszht.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\opccli32.dll |06/11/2003 01:45:02

C:\WINDOWS\system32\paqsp.dll |23/08/2001 16:47:16

C:\WINDOWS\system32\PCDLIB32.DLL |09/12/1998 02:53:58

C:\WINDOWS\system32\PICN11.DLL |06/11/2003 01:45:02

C:\WINDOWS\system32\PICN1111.DLL |06/11/2003 01:45:02

C:\WINDOWS\system32\Px.dll |24/09/2002 16:32:28

C:\WINDOWS\system32\PxMas.dll |24/09/2002 16:32:28

C:\WINDOWS\system32\PxSub.dll |24/09/2002 16:32:28

C:\WINDOWS\system32\PxWave.dll |24/09/2002 16:32:28

C:\WINDOWS\system32\qedwipes.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\RhinoShExt.dll |18/02/2002 20:18:05

C:\WINDOWS\system32\roboex32.dll |25/09/2002 11:26:25

C:\WINDOWS\system32\SFWIUDLL.DLL |06/11/2003 01:45:02

C:\WINDOWS\system32\SFWUTS20.DLL |06/11/2003 01:45:02

C:\WINDOWS\system32\SheriffNet.dll |17/02/2002 02:33:11

C:\WINDOWS\system32\SierraNW.dll |11/01/2002 17:44:05

C:\WINDOWS\system32\slbcsp.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\slbiop.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\slbrccsp.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\slextspk.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\SNWValid.dll |11/01/2002 17:44:04

C:\WINDOWS\system32\spnike.dll |23/08/2001 16:47:18

C:\WINDOWS\system32\sprio600.dll |23/08/2001 16:47:18

C:\WINDOWS\system32\sprio800.dll |23/08/2001 16:47:18

C:\WINDOWS\system32\spxcoins.dll |24/09/2002 16:07:47

C:\WINDOWS\system32\tsd32.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\tsseCryp.dll |17/09/2001 11:00:00

C:\WINDOWS\system32\usrcntra.dll |23/08/2001 16:47:20

C:\WINDOWS\system32\usrcoina.dll |23/08/2001 16:47:20

C:\WINDOWS\system32\usrdpa.dll |23/08/2001 16:47:20

C:\WINDOWS\system32\usrdtea.dll |23/08/2001 16:47:20

C:\WINDOWS\system32\usrfaxa.dll |23/08/2001 16:47:20

C:\WINDOWS\system32\usrlbva.dll |23/08/2001 16:47:20

C:\WINDOWS\system32\usrrtosa.dll |23/08/2001 16:47:20

C:\WINDOWS\system32\usrsdpia.dll |23/08/2001 16:47:20

C:\WINDOWS\system32\usrsvpia.dll |23/08/2001 16:47:20

C:\WINDOWS\system32\usrv42a.dll |23/08/2001 16:47:20

C:\WINDOWS\system32\usrv80a.dll |23/08/2001 16:47:20

C:\WINDOWS\system32\usrvoica.dll |23/08/2001 16:47:20

C:\WINDOWS\system32\usrvpa.dll |23/08/2001 16:47:20

C:\WINDOWS\system32\vidx16.dll |25/11/2002 19:12:43

C:\WINDOWS\system32\VxBlock.dll |24/09/2002 16:32:29

C:\WINDOWS\system32\win87em.dll |31/12/1979 23:00:00

C:\WINDOWS\system32\winsusrm.dll |17/02/2002 02:33:18

C:\WINDOWS\system32\winsusrx.dll |17/02/2002 02:33:18

C:\WINDOWS\system32\WooDial2000.dll |24/12/2001 20:35:09

C:\WINDOWS\system32\xmlparse.dll |30/11/2001 17:32:53

C:\WINDOWS\system32\xmltok.dll |30/11/2001 17:32:53

Le volume dans le lecteur C s'appelle HDD

Le numéro de série du volume est 4879-C189

Répertoire de C:\WINDOWS\system

05/04/1996 01:11 4 176 QTNOTIFY.EXE

1 fichier(s) 4 176 octets

0 Rép(s) 25 704 284 160 octets libres

Le volume dans le lecteur C s'appelle HDD

Le numéro de série du volume est 4879-C189

Répertoire de C:\WINDOWS\system32

28/08/2001 11:00 4 096 csrss.exe

1 fichier(s) 4 096 octets

0 Rép(s) 25 704 284 160 octets libres

Contenu de Downloaded Program Files

Le volume dans le lecteur C s'appelle HDD

Le numéro de série du volume est 4879-C189

Répertoire de C:\WINDOWS\Downloaded Program Files

17/12/2001 01:16 <REP> .

17/12/2001 01:16 <REP> ..

24/09/2002 16:13 65 desktop.ini

21/06/2006 14:54 233 472 GameAx.dll

26/06/2006 18:32 386 GameAx.inf

29/05/2006 15:59 139 264 GameEvents.dll

16/05/2006 09:14 248 IaLdr32.inf

08/08/2006 11:45 576 kavwebscan.inf

30/01/2002 02:00 497 MDM.inf

20/01/2000 14:25 1 162 Microsoft XML Parser for Java.osd

09/11/2006 13:36 5 019 swflash.inf

26/05/2005 04:19 291 wuweb.inf

10 fichier(s) 380 980 octets

Total des fichiers listés :

10 fichier(s) 380 980 octets

2 Rép(s) 25 704 284 160 octets libres

Recherche de rootkit! (Merci S!Ri)

infection possible Magic.Control : un scan F-Secure BlackLight est recommandé

Recherche d'infections connues

Liste des programmes installes

3D Browser 5

3D Canvas

3D DesertRun from manicmoo.com

AC3D 3.6

Action Man Destruction X (mini-game)

Adobe Acrobat 4.0

Adobe Acrobat Reader 3.01

Adobe Flash Player 9 ActiveX

AVG Free Edition

Avira AntiVir PersonalEdition Classic

Blitzkrieg Demo

CharacterFX (remove only)

Companion wizard

Correctif Windows XP - KB842773

CyberMotion 3D-Designer

Dark Reign 2

Desperados - Une aventure au Far West 1.01

Echelon

eMule

EVEREST Ultimate Edition v3.50

Flanker 2.0

Freeride Thrash

FuzzBusters

GamesBar 1.0.0.9

Glass Eye 2000

Grey Olltwit's Go Karts

Haegemonia_Demo (remove only)

HijackThis 1.99.1

Hovercraft Racing

hp deskjet 656c series (Supprimer uniquement)

IGI 2 Covert Strike Demo

Indeo® software

Instant Access

Java 2 Runtime Environment, SE v1.4.0_03

Kaspersky On-line Scanner

Kaspersky Online Scanner

Kit de connexion Tiscali

LudoRace

MGI PhotoSuite 4 (suppression seulement)

Microsoft Midtown Madness 2

Microsoft Motocross Madness

Microsoft Motocross Madness 2 Trial

Microsoft Word 2000 SR-1

MilkShape 3D 1.6.6

MSN Messenger 7.5

my-world - FunRun

Navigateur Wanadoo

NVIDIA Windows 2000/XP Display Drivers

Outil de connexion Wanadoo

QuickTime

Rhinoceros 3.0 Evaluation

Robin Hood - La Légende de Sherwood (Démo)

Runaway DEMO

Speed Delight : time attack

Spybot - Search & Destroy 1.4

Su-Doku Quest

Supprimer Wanadoo

Times of Conflict

Tonka Garage Français

TrickStyle Preview

Urban Chaos

Utilitaires Sierra

Vampirjagd 2: NightRace

Viewpoint Media Player (Remove Only)

Virtual Stratton

Wanadoo Messager

WARM UP !

WebFldrs XP

Windows Genuine Advantage Validation Tool (KB892130)

Windows Registry Repair Pro

ZTE ZXDSL852

Le volume dans le lecteur C s'appelle HDD

Le numéro de série du volume est 4879-C189

Répertoire de C:\Program Files

17/12/2001 01:31 <REP> .

17/12/2001 01:31 <REP> ..

03/12/2001 00:30 <REP> 3B Software

12/01/2007 16:54 <REP> 3D Browser 5

18/02/2002 20:14 <REP> AC3D3.6

19/10/2002 17:15 <REP> Acclaim Entertainment

30/06/2002 02:28 <REP> Adobe

23/05/2002 22:21 <REP> Amabilis

13/12/2001 00:05 <REP> AntiVir PersonalEdition Classic

24/09/2002 16:30 <REP> Audioneer

24/09/2002 16:28 <REP> BackWeb

11/01/2002 19:46 <REP> Blitzkrieg Demo

22/11/2001 16:05 <REP> Buka

17/02/2002 02:39 <REP> CharacterFX

16/06/2002 19:21 <REP> CMBB Demo

23/11/2001 07:24 <REP> Common Files

24/09/2002 16:12 <REP> ComPlus Applications

28/06/2002 00:37 <REP> Core Design

13/12/2001 22:13 <REP> Cyanide

22/09/2002 02:44 <REP> CyberMotion 3D-Designer V8.0

28/03/2002 18:32 <REP> Dark Reign 2

24/09/2002 16:36 <REP> DesignPro 2000

16/06/2002 20:36 <REP> directx

28/12/2001 15:21 <REP> Disney Interactive

17/02/2002 02:33 <REP> Dragonfly

03/08/2003 01:44 <REP> EHMINSTALL

28/03/2002 01:44 <REP> Eidos Interactive

01/12/2001 01:17 <REP> eMule

23/11/2001 00:29 <REP> Fichiers communs

24/08/2002 21:40 <REP> GamesBar

08/02/2003 17:55 <REP> GLtron

17/12/2001 00:33 <REP> Grisoft

17/01/2003 16:26 <REP> GT Interactive

05/12/2001 00:02 <REP> gta3mta

24/09/2002 16:36 <REP> HandyBits

12/01/2007 16:52 <REP> HbTools

21/06/2002 17:43 <REP> Hewlett-Packard

21/06/2002 17:45 <REP> hp deskjet 656c series

23/05/2002 22:22 <REP> HTC

30/11/2001 18:03 <REP> IGI 2 Covert Strike Demo

21/11/2001 00:04 <REP> Infogrames

17/12/2001 01:31 <REP> Instant Access

27/09/2002 18:25 <REP> Intel

24/11/2002 16:16 <REP> Internet Explorer

24/12/2001 20:33 <REP> Java

24/11/2002 17:17 <REP> jetspeed

07/01/2007 12:04 <REP> Lavalys

06/02/2003 15:29 <REP> LudoRace

14/10/2002 18:11 <REP> manicmoo

24/09/2002 16:12 <REP> Messenger

05/12/2001 00:11 <REP> MessengerSkinner

06/11/2003 01:45 <REP> MGI

27/09/2002 18:21 <REP> Microïds

24/09/2002 16:15 <REP> microsoft frontpage

23/07/2004 00:43 <REP> Microsoft Games

24/09/2002 16:36 <REP> Microsoft Money

24/09/2002 16:34 <REP> Microsoft Office

18/02/2002 20:15 <REP> MilkShape 3D 1.6.6

24/09/2002 16:20 <REP> MouseWare

24/09/2002 16:13 <REP> Movie Maker

24/09/2002 16:11 <REP> MSN

24/09/2002 16:11 <REP> MSN Gaming Zone

17/12/2001 18:18 <REP> MSN Messenger

14/10/2002 18:33 <REP> my-world

23/07/2004 17:48 <REP> NetMeeting

09/05/2002 00:48 <REP> NovaLogic

24/08/2002 21:40 <REP> orange

24/09/2002 16:13 <REP> Outlook Express

11/01/2002 01:07 <REP> Pendulo Studios

30/11/2001 17:51 <REP> Pinnacle

01/12/2001 19:15 <REP> QuickTime

19/10/2002 17:34 <REP> Real

18/02/2002 20:18 <REP> Rhinoceros 3.0 Evaluation

15/08/2003 05:53 <REP> Robin Hood - La Légende de Sherwood (Démo)

24/09/2002 16:37 <REP> SBApps

09/05/2002 18:56 <REP> SCi

16/10/2002 19:18 <REP> SDelight

16/07/2002 20:58 <REP> Securitoo

24/09/2002 16:12 <REP> Services en ligne

12/01/2002 16:30 <REP> Sierra On-Line

24/11/2002 17:45 <REP> Soul Ride

17/12/2001 00:45 <REP> Spybot - Search & Destroy

14/05/2002 23:06 <REP> SSI

15/11/2001 19:30 <REP> starsnues

14/10/2002 18:21 <REP> Sylvain Seccia

27/09/2002 18:59 <REP> The Learning Company

07/10/2002 21:10 <REP> Tiscali

30/11/2001 17:32 <REP> Ubi Soft

13/12/2001 22:34 <REP> Ubi Soft Entertainment

16/10/2002 19:15 <REP> Vampirjagd2

25/09/2002 11:26 <REP> Viewpoint

17/12/2001 01:27 <REP> Wanadoo

24/12/2001 20:32 <REP> Wanadoo Messager

25/11/2002 19:12 <REP> Windows Media Player

24/09/2002 16:11 <REP> Windows NT

24/09/2002 16:15 <REP> xerox

24/12/2001 20:33 <REP> ZTE Corporation

0 fichier(s) 0 octets

97 Rép(s) 25 704 194 048 octets libres

Le volume dans le lecteur C s'appelle HDD

Le numéro de série du volume est 4879-C189

Répertoire de C:\Program Files\fichiers communs

23/11/2001 00:29 <REP> .

23/11/2001 00:29 <REP> ..

24/09/2002 16:38 <REP> Adobe

24/09/2002 16:35 <REP> Designer

29/11/2001 18:54 <REP> InstallShield

24/09/2002 16:20 <REP> Logitech

06/11/2003 01:45 <REP> MGI Shared

24/09/2002 16:36 <REP> Microsoft Shared

24/09/2002 16:13 <REP> MSSoap

24/08/2002 21:40 <REP> Oberon Media

24/09/2002 16:07 <REP> ODBC

07/01/2007 11:13 <REP> Real

24/09/2002 16:13 <REP> Services

24/09/2002 16:07 <REP> SpeechEngines

07/06/2004 17:07 <REP> SWF Studio

24/09/2002 16:13 <REP> System

0 fichier(s) 0 octets

16 Rép(s) 25 704 194 048 octets libres

Le volume dans le lecteur C s'appelle HDD

Le numéro de série du volume est 4879-C189

Répertoire de C:\Program Files\fichiers communs\Microsoft Shared\Web Folders

24/09/2002 16:19 <REP> .

24/09/2002 16:19 <REP> ..

18/05/2001 16:57 561 209 MSONSEXT.DLL

03/06/1999 13:09 122 937 MSOWS409.DLL

07/03/2001 08:00 127 033 MSOWS40c.DLL

3 fichier(s) 811 179 octets

2 Rép(s) 25 704 194 048 octets libres

Le volume dans le lecteur C s'appelle HDD

Le numéro de série du volume est 4879-C189

Répertoire de C:\Program Files\common files

23/11/2001 07:24 <REP> .

23/11/2001 07:24 <REP> ..

23/11/2001 07:25 <REP> Companion Wizard

18/02/2002 20:18 <REP> McNeel Shared

0 fichier(s) 0 octets

4 Rép(s) 25 704 194 048 octets libres

Le volume dans le lecteur C s'appelle HDD

Le numéro de série du volume est 4879-C189

Répertoire de C:\

11/11/2001 00:00 68 096 diff.exe

27/08/2006 14:10 103 424 grep.exe

2 fichier(s) 171 520 octets

0 Rép(s) 25 704 194 048 octets libres

c:\Documents and Settings\All Users\Application Data\Tarma Installer\{666A08DD-E48D-478E-B0BB-F5BEE24B2F18}\Setup.exe

c:\Documents and Settings\sylvie\Application Data\winantiviruspro2006freeinstall_fr[1].exe

c:\Documents and Settings\sylvie\Application Data\Microsoft\Installer\{BF244469-F823-4E10-80C0-0DCE7E0F7E44}\_122d3918.exe

c:\Documents and Settings\sylvie\Application Data\Microsoft\Installer\{BF244469-F823-4E10-80C0-0DCE7E0F7E44}\_284c3222.exe

c:\Documents and Settings\sylvie\Bureau\CMBB Demo.exe

c:\Documents and Settings\sylvie\Bureau\stub.exe

c:\Documents and Settings\sylvie\Bureau\WindowsXP-KB896688-x86-FRA.exe

c:\Documents and Settings\sylvie\Bureau\WindowsXP-KB899588-x86-FRA.exe

c:\Documents and Settings\sylvie\Bureau\diaghelp\DiagHelp\diff.exe

c:\Documents and Settings\sylvie\Bureau\diaghelp\DiagHelp\FilesInfoCmd.exe

c:\Documents and Settings\sylvie\Bureau\diaghelp\DiagHelp\Fport.exe

c:\Documents and Settings\sylvie\Bureau\diaghelp\DiagHelp\grep.exe

c:\Documents and Settings\sylvie\Bureau\diaghelp\DiagHelp\LFiles.exe

c:\Documents and Settings\sylvie\Bureau\diaghelp\DiagHelp\LISTDLLS.exe

c:\Documents and Settings\sylvie\Bureau\diaghelp\DiagHelp\pslist.exe

c:\Documents and Settings\sylvie\Bureau\diaghelp\DiagHelp\streams.exe

c:\Documents and Settings\sylvie\Bureau\diaghelp\DiagHelp\swreg.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\~wa6psetup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\EBU12.EXE

c:\Documents and Settings\sylvie\Local Settings\Temp\nsuC.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\nsuD.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\nsuE.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\setup_wm.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\SurfairySetup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\temp.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye10.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye11.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye11.tmp\Disk1\UbiReg\regsetup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye11.tmp\Disk1\UbiReg\register\register.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye11.tmp\Disk1\UbiReg\register\schedule.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye11.tmp\Disk1\UbiReg\register\DLL\xmlinst.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye12.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye12.tmp\Disk1\UbiReg\regsetup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye12.tmp\Disk1\UbiReg\register\register.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye12.tmp\Disk1\UbiReg\register\schedule.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye12.tmp\Disk1\UbiReg\register\DLL\xmlinst.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye13.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye14.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye15.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye15.tmp\Disk1\UbiReg\regsetup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye15.tmp\Disk1\UbiReg\register\register.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye15.tmp\Disk1\UbiReg\register\schedule.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye15.tmp\Disk1\UbiReg\register\DLL\xmlinst.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye16.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye16.tmp\Disk1\UbiReg\regsetup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye16.tmp\Disk1\UbiReg\register\register.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye16.tmp\Disk1\UbiReg\register\schedule.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye16.tmp\Disk1\UbiReg\register\DLL\xmlinst.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye17.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye17.tmp\Disk1\UbiReg\regsetup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye17.tmp\Disk1\UbiReg\register\register.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye17.tmp\Disk1\UbiReg\register\schedule.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye17.tmp\Disk1\UbiReg\register\DLL\xmlinst.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye18.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye18.tmp\Disk1\UbiReg\regsetup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye18.tmp\Disk1\UbiReg\register\register.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye18.tmp\Disk1\UbiReg\register\schedule.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye18.tmp\Disk1\UbiReg\register\DLL\xmlinst.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye19.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye19.tmp\Disk1\UbiReg\regsetup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye19.tmp\Disk1\UbiReg\register\register.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye19.tmp\Disk1\UbiReg\register\schedule.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye19.tmp\Disk1\UbiReg\register\DLL\xmlinst.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye1A.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye1A.tmp\Disk1\UbiReg\regsetup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye1A.tmp\Disk1\UbiReg\register\register.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye1A.tmp\Disk1\UbiReg\register\schedule.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye1A.tmp\Disk1\UbiReg\register\DLL\xmlinst.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye1B.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye1B.tmp\Disk1\UbiReg\regsetup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye1B.tmp\Disk1\UbiReg\register\register.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye1B.tmp\Disk1\UbiReg\register\schedule.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye1B.tmp\Disk1\UbiReg\register\DLL\xmlinst.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye1C.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye1D.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye1D.tmp\Disk1\UbiReg\regsetup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye1D.tmp\Disk1\UbiReg\register\register.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye1D.tmp\Disk1\UbiReg\register\schedule.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye1D.tmp\Disk1\UbiReg\register\DLL\xmlinst.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye1E.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye1E.tmp\Disk1\UbiReg\regsetup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye1E.tmp\Disk1\UbiReg\register\register.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye1E.tmp\Disk1\UbiReg\register\schedule.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye1E.tmp\Disk1\UbiReg\register\DLL\xmlinst.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye1F.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye2.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye20.tmp\Disk1\UbiReg\regsetup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye20.tmp\Disk1\UbiReg\register\register.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye20.tmp\Disk1\UbiReg\register\schedule.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye20.tmp\Disk1\UbiReg\register\DLL\xmlinst.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye22.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye23.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye24.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye25.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye28.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye2B.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye2C.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye31.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye34.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye35.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye37.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye3A.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye3B.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye3D.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye4.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye40.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye42.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye45.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye4A.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye4B.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye4C.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye4D.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye4F.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye5.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye50.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye6.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye7F.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye8.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye8.tmp\Disk1\UbiReg\regsetup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye8.tmp\Disk1\UbiReg\register\register.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye8.tmp\Disk1\UbiReg\register\schedule.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye8.tmp\Disk1\UbiReg\register\DLL\xmlinst.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye82.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye83.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye8B.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye9.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye9.tmp\Disk1\UbiReg\regsetup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye9.tmp\Disk1\UbiReg\register\register.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye9.tmp\Disk1\UbiReg\register\schedule.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye9.tmp\Disk1\UbiReg\register\DLL\xmlinst.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye91.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye9A.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\bye9D.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\byeA.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\byeA0.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\byeA3.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\byeA6.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\byeAC.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\byeB.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\byeB.tmp\Disk1\UbiReg\regsetup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\byeB.tmp\Disk1\UbiReg\register\register.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\byeB.tmp\Disk1\UbiReg\register\schedule.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\byeB.tmp\Disk1\UbiReg\register\DLL\xmlinst.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\byeB2.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\byeB5.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\byeB8.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\byeB9.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\byeBE.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\byeC.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\byeC1.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\byeC2.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\byeC5.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\byeC8.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\byeCD.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\byeCE.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\byeD.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\byeD1.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\byeD4.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\byeD5.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\byeD6.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\byeD7.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\byeDB.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\byeE.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\byeE.tmp\Disk1\UbiReg\regsetup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\byeE.tmp\Disk1\UbiReg\register\register.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\byeE.tmp\Disk1\UbiReg\register\schedule.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\byeE.tmp\Disk1\UbiReg\register\DLL\xmlinst.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\byeE1.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\byeE2.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\byeE3.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\byeE4.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\byeE5.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\byeE6.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\byeE7.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\byeE8.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\byeE9.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\byeEA.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\byeEB.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\byeED.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\byeF.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\byeF.tmp\Disk1\UbiReg\regsetup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\byeF.tmp\Disk1\UbiReg\register\register.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\byeF.tmp\Disk1\UbiReg\register\schedule.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\byeF.tmp\Disk1\UbiReg\register\DLL\xmlinst.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\byeF0.tmp\Disk1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\Freelancer Trial Version\Setup.Exe

c:\Documents and Settings\sylvie\Local Settings\Temp\Freelancer Trial Version\game\EXE\FREELA_1.EXE

c:\Documents and Settings\sylvie\Local Settings\Temp\Freelancer Trial Version\redist\instmsia.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\Freelancer Trial Version\redist\instmsiw.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\Freelancer Trial Version\redist\ShFolder.Exe

c:\Documents and Settings\sylvie\Local Settings\Temp\Freelancer Trial Version\redist\vcredist.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\Freelancer Trial Version\redist\wmfdist.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\Freelancer Trial Version\redist\wmpcdcs8.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\GLF29.tmpDIR\Start.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\GLF2A.tmpDIR\Start.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\GLF2C.tmpDIR\Start.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\GLF2E.tmpDIR\Start.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\GLF2F.tmpDIR\Start.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\GLF31.tmpDIR\Start.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\GLF32.tmpDIR\Start.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\GLFB.tmpDIR\Start.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\Jgl_Rt\jsave.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\Jgl_Rt\kidstation.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\NI.UWA6PV_0001_N91M2107\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\RarSFX0\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\RarSFX1\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\RarSFX2\setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\WinFast Display Driver\Setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\WinFast Display Driver\WINXP_2K\DMCPL.EXE

c:\Documents and Settings\sylvie\Local Settings\Temp\WinFast Display Driver\WINXP_2K\KEYSTONE.EXE

c:\Documents and Settings\sylvie\Local Settings\Temp\WinFast Display Driver\WINXP_2K\NVSVC32.EXE

c:\Documents and Settings\sylvie\Local Settings\Temp\WinFast Display Driver\WINXP_2K\NWIZ.EXE

c:\Documents and Settings\sylvie\Local Settings\Temp\WinFast Display Driver\WINXP_2K\Setup.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\WZS6.tmp\gamestarter.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\_ISTMP1.DIR\_ISTMP0.DIR\IsUninst.exe

c:\Documents and Settings\sylvie\Local Settings\Temp\_ISTMP2.DIR\_ISTMP0.DIR\IsUninst.exe

c:\Documents and Settings\sylvie\Local Settings\Temporary Internet Files\Content.IE5\CPAF0TAR\spybotsd14[1].exe

c:\Documents and Settings\sylvie\Local Settings\Temporary Internet Files\Content.IE5\GD6JCDEZ\registryrepair_rrfr001[1].exe

c:\Documents and Settings\sylvie\Local Settings\Temporary Internet Files\Content.IE5\GLEZW12F\avg75free_432a904[1].exe

c:\Documents and Settings\sylvie\Local Settings\Temporary Internet Files\Content.IE5\GLEZW12F\spybotsd14[1].exe

c:\Documents and Settings\sylvie\Mes documents\avg75free_432a904.exe

c:\Documents and Settings\sylvie\Mes documents\Barbarossa to Berlin DEMO.exe

c:\Documents and Settings\sylvie\Mes documents\emule0.47c-installer.exe

c:\Documents and Settings\sylvie\Mes documents\spybotsd14.exe

c:\Documents and Settings\sylvie\Mes documents\jean-claude.piovesan\alcool-mie.exe

c:\Documents and Settings\sylvie\Mes documents\jean-claude.piovesan\everestultimate350.exe

c:\Documents and Settings\sylvie\Mes documents\jean-claude.piovesan\humour.exe

c:\Documents and Settings\sylvie\Mes documents\jean-claude.piovesan\install_msn_messenger.exe

c:\Documents and Settings\sylvie\Mes documents\jean-claude.piovesan\messengerskinner.exe

c:\Documents and Settings\sylvie\Mes documents\jean-claude.piovesan\minitel.exe

c:\Documents and Settings\sylvie\Mes documents\jean-claude.piovesan\orangedesktopsearch.exe

c:\Documents and Settings\sylvie\Mes documents\jean-claude.piovesan\spybotsd14.exe

c:\Documents and Settings\sylvie\Mes documents\jean-claude.piovesan\sudoku_quest-setup.exe

c:\Documents and Settings\All Users\Application Data\AntiVir PersonalEdition Classic\BACKUP\FAILSAFE\avewin32.dll

c:\Documents and Settings\All Users\Application Data\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_45abae55\LicTest\avwinll.dll

c:\Documents and Settings\All Users\Application Data\Microsoft\IdentityCRL\ppcrlconfig.dll

c:\Documents and Settings\All Users\Application Data\Tarma Installer\{666A08DD-E48D-478E-B0BB-F5BEE24B2F18}\_Setup.dll

c:\Documents and Settings\All Users\Application Data\Tarma Installer\{666A08DD-E48D-478E-B0BB-F5BEE24B2F18}\_Setupx.dll

c:\Documents and Settings\sylvie\Application Data\Microsoft\IdentityCRL\ppcrlconfig.dll

OURASI · le 18 février 2007

Et voici le rapport Blacklight:

12/17/01 01:42:49 [info]: BlackLight Engine 1.0.55 initialized

12/17/01 01:42:49 [info]: OS: 5.1 build 2600 ()

12/17/01 01:42:50 [Note]: 7019 4

12/17/01 01:42:50 [Note]: 7005 0

12/17/01 01:43:15 [Note]: 7006 0

12/17/01 01:43:15 [Note]: 7011 1528

12/17/01 01:43:15 [Note]: 7026 0

12/17/01 01:43:16 [Note]: 7026 0

12/17/01 01:43:16 [Note]: 7024 3

12/17/01 01:43:16 [info]: Hidden process: C:\windows\system32\zhdpvzflpv.exe

12/17/01 01:43:27 [Note]: FSRAW library version 1.7.1021

12/17/01 01:46:59 [info]: Hidden file: c:\WINDOWS\system32\zhdpvzflpv.dat

12/17/01 01:46:59 [Note]: 10002 1

12/17/01 01:47:00 [info]: Hidden file: C:\windows\system32\zhdpvzflpv.exe

12/17/01 01:47:04 [Note]: 10002 1

12/17/01 01:47:05 [info]: Hidden file: c:\WINDOWS\system32\zhdpvzflpv_nav.dat

12/17/01 01:47:05 [Note]: 10002 1

12/17/01 01:47:05 [info]: Hidden file: c:\WINDOWS\system32\zhdpvzflpv_navps.dat

12/17/01 01:47:05 [Note]: 10002 1

12/17/01 01:51:23 [Note]: 7007 0

chercheur · le 18 février 2007

Re

Une partie de la procédure se déroulera sans avoir accès à internet, prière d'imprimer ces instructions, ou de les coller dans un fichier texte, pour lecture durant cette désinfection.

Les manipulations sont à faire sans interruption et dans l'ordre.

Si tu ne comprends pas quelque chose, demande des explications avant de commencer.

$$ Télécharge Brute Force Uninstaller (de Merijn)

http://www.merijn.org/files/bfu.zip

Créé un nouveau dossier directement sur le C:\ et nomme-le BFU. Décompresse le fichier téléchargé dans ce nouveau dossier (C:\BFU)

$$ FAIS UN CLIC-DROIT sur le lien suivant

http://metallica.geekstogo.com/EGDACCESS.bfu

et choisis "Enregistrer la cible sous..." afin de télécharger EGDACCESS.bfu (de Metallica). Sauvegarde dans le dossier créé (C:\BFU). **Note : si tu utlises Internet Explorer; lors de la sauvegarde, assure-toi que le champs "Type :" affiche "Tous les fichiers". Tu dois maintenant avoir deux fichiers dans le dossier C:\BFU : EGDACCESS.bfu et BFU.exe (très important).

$$ FAIS UN CLIC-DROIT sur le lien suivant

http://perso.orange.fr/Chercheur-perso/scripts/toolbar.bfu

et choisis "Enregistrer la cible sous..." afin de télécharger Toolbar.bfu de Chercheur

Sauvegarde dans le dossier créé (C:\BFU). **Note : si tu utlises Internet Explorer; lors de la sauvegarde, assure-toi que le champs "Type :" affiche "Tous les fichiers". Tu dois maintenant avoir trois fichiers dans le dossier C:\BFU : Toolbar.bfu, EGDACCESS.bfu et BFU.exe (très important).

$$ Télécharge Navipromo.zip

http://perso.numericable.fr/~altshift/Info...avipromo07H.zip

Décompresse-le sur ton bureau

$$ Redémarre en mode Sans Échec : au redémarrage, tapote immédiatement la touche F8 ou F5; tu verras un écran avec choix de démarrages apparaître. Utilisant les flèches du clavier, choisis "Mode Sans Échec" et valide avec "Entrée". Choisis ton compte usuel, et non Administrateur.

$$ Lance le fichier Navipromo.bat qui se trouve dans le dossier Navipromo, sur ton bureau.

* Sélectionne l'option "Recherche et suppression automatique". Patiente.

S'il trouve quelque chose, tu verras défiler des lignes dans la fenêtre de commande et au bout de quelques instants, il faudra que tu appuies sur une touche pour que le nettoyage soit lancé.

* Relance l'outil, Sélectionne l'option "Suppression Heuristique", et patiente quelques minutes. Lorsqu'il a terminé, ferme le rapport qui s'est ouvert

$$ Relance un scan HijackThis et coche les lignes ci-dessous :

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchgateway.net/search/

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://resultsmaster.com/SmartOffers/Servi...omeLeftPane.htm

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.searchgateway.net/search/%s

O2 - BHO: SurfairyHlp Class - {E0B9B5FE-B66E-4FB0-A1D9-726F0E743CFD} - C:\Program Files\Surfairy\SurfairyPP.dll (file missing)

O9 - Extra button: Suggestions - {2223664C-1942-4276-9A2D-E8D8F547C5D2} - res://EffiPeled (file missing)

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

Ferme toutes les fenêtres Windows, Internet explorer, Outlook,sauf le logiciel Hijackthis et clique sur « Fix checked »

$$ Démarre le "Brute Force Uninstaller" en double-cliquant BFU.exe (du dossier C:\BFU)

--- Clique sur le petit dossier jaune, à la droite de la boîte Scriptline to execute, et double-clique sur :

Toolbar.bfu

Dans la boîte "Scriptline to execute", tu devrais maintenant voir ceci : C:\BFU\Toolbar.bfu

Clique sur Execute et laisse-le faire son travail.

Attendre que Complete script execution apparaîsse et clique sur OK.

--- Clique sur le petit dossier jaune, à la droite de la boîte Scriptline to execute, et double-clique sur :

EGDACCESS.bfu

Dans la boîte "Scriptline to execute", tu devrais maintenant voir ceci : C:\BFU\EGDACCESS.bfu

Clique sur Execute et laisse-le faire son travail.

Attendre que Complete script execution apparaîsse et clique sur OK.

Clique Exit pour fermer le programme BFU.

$$ Clique sur Démarrer -> panneau de configuration -> options internet

Clique sur l'onglet "Contenu" puis onglet "Certificats" et si tu trouves ceci, en particulier dans "éditeurs approuvés" :

electronic-group - egroup - Montorgueil - VIP - "Sunny Day Design Ltd"

=> Supprime-les tous

$$ Redémarre normalement

Poste un nouveau hijackthis avec le contenu du fichier Navipromo.txt qui se trouve dans Poste de travail > disque C:\

OURASI · le 18 février 2007

Logfile of HijackThis v1.99.1

Scan saved at 04:13:02, on 17/12/2001

Platform: Windows XP (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Apps\ActivBoard\nhksrv.exe

C:\Program Files\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\FTRTSVC.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\system32\slserv.exe

C:\WINDOWS\System32\svchost.exe

C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE

C:\Apps\ActivBoard\MMKeybd.exe

C:\apps\ActivSurf\4448364\Program\backweb-4448364.exe

C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb03.exe

C:\Program Files\ZTE Corporation\ZXDSL852\CnxDslTb.exe

C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe

C:\Program Files\jetspeed\AUTOSTAR.EXE

C:\PROGRA~1\Wanadoo\TaskBarIcon.exe

C:\Apps\ActivBoard\TrayMon.exe

C:\Apps\ActivBoard\OSD.exe

C:\WINDOWS\System32\wuauclt.exe

C:\Program Files\Wanadoo\EspaceWanadoo.exe

C:\Program Files\Wanadoo\ComComp.exe

C:\PROGRA~1\Wanadoo\Toaster.exe

C:\PROGRA~1\Wanadoo\Inactivity.exe

C:\PROGRA~1\Wanadoo\PollingModule.exe

C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE

C:\Program Files\Wanadoo\Watch.exe

C:\PROGRA~1\Wanadoo\WOOBrowser\WOOBrowser.exe

C:\Documents and Settings\sylvie\Local Settings\Temp\Répertoire temporaire 1 pour hijackthis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.wanadoo.fr

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\apps\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll