Aller au contenu

  • Pas encore inscrit ?

    Pourquoi ne pas vous inscrire ? C'est simple, rapide et gratuit.
    Pour en savoir plus, lisez Les avantages de l'inscription... et la Charte de Zébulon.
    De plus, les messages que vous postez en tant qu'invité restent invisibles tant qu'un modérateur ne les a pas validés. Inscrivez-vous, ce sera un gain de temps pour tout le monde, vous, les helpeurs et les modérateurs ! :wink:

C'est l'enfer

yoshienforce

Par yoshienforce
dans Analyses et éradication malwares

 Partager

Messages recommandés

yoshienforce Junior Member

yoshienforce

Posté(e)
Posté(e)

Salut,

 

C'est l'enfer depuis 3 jours je suis envahi de virus et consort je m'en sort pas

 

J'ai deja virer Vundo via le fix vundo fix

 

voila la log:

VundoFix V6.7.0

 

Checking Java version...

 

Java version is 1.5.0.9

Old versions of java are exploitable and should be removed.

 

Java version is 1.5.0.10

 

Scan started at 19:44:37 11/12/2007

 

Listing files found while scanning....

 

C:\windows\system32\ihhkj.bak1

C:\windows\system32\ihhkj.bak2

C:\windows\system32\ihhkj.ini

C:\windows\system32\jkhhi.dll

 

Beginning removal...

 

Attempting to delete C:\windows\system32\ihhkj.bak1

C:\windows\system32\ihhkj.bak1 Has been deleted!

 

Attempting to delete C:\windows\system32\ihhkj.bak2

C:\windows\system32\ihhkj.bak2 Has been deleted!

 

Attempting to delete C:\windows\system32\ihhkj.ini

C:\windows\system32\ihhkj.ini Has been deleted!

 

Attempting to delete C:\windows\system32\jkhhi.dll

C:\windows\system32\jkhhi.dll Has been deleted!

 

Performing Repairs to the registry.

Done!

 

Et j'ai encore des tentatives de connexions de Tk58 et consort !

J'ai reussi a virer un process : myo....exe dans c:\windows\system32\

 

Mais chaque scan de bitedefender me trouve de nouveau virus

 

Voici une log Hijackthis

Logfile of HijackThis v1.99.1

Scan saved at 01:44:41, on 12/12/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\acs.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe

C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe

C:\Program Files\NetDrive\wdService.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe

C:\Program Files\MSN Messenger\MsnMsgr.Exe

C:\Program Files\Logitech\SetPoint\SetPoint.exe

C:\Program Files\NETGEAR\WG311T\wlancfg5.exe

C:\Program Files\Fichiers communs\Logitech\khalshared\KHALMNPR.EXE

C:\WINDOWS\system32\taskmgr.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\MSN Messenger\usnsvc.exe

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\regedit.exe

C:\Program Files\Internet Explorer\iexplore.exe

F:\Install_prog\Programme\Hijackthis\zouzou.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

O2 - BHO: (no name) - {22E82242-D13C-487F-A3FB-2A7BB8B50B48} - C:\Program Files\Services en ligne\hopezego83122.dll

O2 - BHO: 0 - {51A39CD7-5980-4441-3582-8B3C16312673} - C:\Program Files\Messenger\labu.dll

O2 - BHO: {81daf115-19fb-b179-77f4-4f9968122a55} - {55a22186-99f4-4f77-971b-bf91511fad18} - C:\WINDOWS\system32\yqbqlksl.dll

O2 - BHO: (no name) - {75ED9748-1E4B-4184-8E42-10DEAB36FF76} - C:\WINDOWS\system32\jkhhi.dll (file missing)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll

O2 - BHO: (no name) - {789DE549-80DF-4056-8269-0319E7F8B89F} - \

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: (no name) - {B285004D-6D02-4212-91FC-B8F47B68C254} - C:\WINDOWS\system32\xxyxvuu.dll

O2 - BHO: (no name) - {C31C508C-DF08-4BC6-95C3-CD10B9669FD9} - C:\WINDOWS\system32\pmnnk.dll

O2 - BHO: (no name) - {F0EDF2A6-04C1-46BF-B646-B7961CB7FA25} - C:\Program Files\Services en ligne\hopezego4444.dll

O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE

O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"

O4 - HKLM\..\Run: [fc93dd67] rundll32.exe "C:\WINDOWS\system32\rhjumasy.dll",b

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

O4 - Global Startup: Logitech SetPoint.lnk = ?

O4 - Global Startup: NETGEAR WG311T Wireless Assistant.lnk = C:\Program Files\NETGEAR\WG311T\wlancfg5.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll

O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/bina [...] b31267.cab

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://yoshienforce.spaces.live.co [...] nPUpld.cab

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/re [...] oscan8.cab

O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/micros [...] 3681217328

O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://cid-2a777a255c13d168.spaces [...] nPUpld.cab

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/bina [...] b31267.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{37E5FA79-BD4E-4600-880A-CEF295655B0C}: NameServer = 212.27.32.5,213.228.0.168

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O20 - Winlogon Notify: xxyxvuu - C:\WINDOWS\SYSTEM32\xxyxvuu.dll

O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe

O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\RFVQUkU\command.exe (file missing)

O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\myosqnoe.exe (file missing)

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe

O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - C:\WINDOWS\system32\msasvc.exe (file missing)

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Pinnacle Systems Media Service (PinnacleSys.MediaServer) - Pinnacle Systems - C:\Program Files\Pinnacle\Shared Files\Programs\MediaServer\PMSHost.exe

O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

O23 - Service: SQLAgent$PINNACLESYS - Unknown owner - C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlagent.EXE" -i PINNACLESYS (file missing)

O23 - Service: WebDrive Service (WebDriveService) - Unknown owner - C:\Program Files\NetDrive\wdService.exe

 

 

 

Merci de votre aide

bruce lee Devil Member !

bruce lee

Posté(e)
Posté(e)

Bonjour yoshienforce et bienvenue sur zebulon :P

 

Télécharge SDFix(créé par AndyManchesta) et sauvegarde le sur ton Bureau.

***Si le lien ne fonctionne pas, essaie celui-ci : http://download.bleepingcomputer.com/andymanchesta/SDFix.exe ***

 

Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici :

  • Démarre en mode sans échec
http://cybersecurite.xooit.com/t88-Demarre...s-echec.htm#665
 
Déroule la liste des instructions ci-dessous :
  • Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.cmd pour lancer le script.
  • Appuie sur Y pour commencer le processus de nettoyage.
  • Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
  • Appuie sur une touche pour redémarrer le PC.
  • Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
  • Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
  • Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
  • Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
  • Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum

1. Télécharge combofix.exe (par sUBs) ici :

 

http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe

 

http://download.bleepingcomputer.com/sUBs/Beta/ComboFix.exe

 

sur ton Bureau.

 

2. Double clique sur combofix.exe puis tape 1 pour lancer le scan.

3. Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.

yoshienforce Junior Member

yoshienforce

Posté(e)
  • Auteur
Posté(e)

Dabord merci c vraiment super cool de m'aider :P et voila la suite :

 

SDFix: Version 1.118

 

Run by julien on 12/12/2007 at 20:49

 

Microsoft Windows XP [version 5.1.2600]

 

Running From: C:\SDFix

 

Safe Mode:

Checking Services:

 

Name:

cmdService

MsaSvc

 

Path:

C:\WINDOWS\RFVQUkU\command.exe

C:\WINDOWS\system32\msasvc.exe

 

cmdService - Deleted

MsaSvc - Deleted

 

 

 

Restoring Windows Registry Values

Restoring Windows Default Hosts File

Restoring Missing SharedAccess Service

 

Rebooting...

 

 

Normal Mode:

Checking Files:

 

Trojan Files Found:

 

C:\WINDOWS\SYSTEM32\TOURST~1.EXE - Deleted

C:\WINDOWS\SYSTEM32\DESKMON.DLL - Deleted

C:\PROGRA~1\PAGE~1.HTM - Deleted

C:\PROGRA~1\MESSEN~1\PROKY~1.HTM - Deleted

C:\WINDOWS\17PHolmes572.exe - Deleted

C:\WINDOWS\b122.exe - Deleted

C:\WINDOWS\system32\atmtd.dll - Deleted

C:\WINDOWS\system32\atmtd.dll._ - Deleted

C:\WINDOWS\system32\pac.txt - Deleted

C:\WINDOWS\system32\wsnpoem\video.dll - Deleted

 

 

 

Folder C:\Program Files\Temporary - Removed

Folder C:\WINDOWS\system32\wsnpoem - Removed

 

Removing Temp Files...

 

ADS Check:

 

C:\WINDOWS

No streams found.

 

C:\WINDOWS\system32

No streams found.

 

C:\WINDOWS\system32\svchost.exe

No streams found.

 

C:\WINDOWS\system32\ntoskrnl.exe

No streams found.

 

 

 

Final Check:

 

catchme 0.3.1262.1 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2007-12-12 20:54:31

Windows 5.1.2600 Service Pack 2 NTFS

 

scanning hidden processes ...

 

scanning hidden services & system hive ...

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]

"s1"=dword:21a5afe8

"s2"=dword:9ca3d553

"h0"=dword:00000001

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]

"p0"="C:\Program Files\DAEMON Tools\"

"h0"=dword:00000000

"khjeh"=hex:1e,82,f7,1d,94,ed,a8,74,ef,0e,f5,39,16,78,18,12,f9,98,d2,54,d4,..

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4000001]

"a0"=hex:20,01,00,00,e7,be,ea,3d,fc,14,41,2a,fb,0d,fc,b5,39,a1,c2,73,f9,..

"khjeh"=hex:86,ad,48,43,e2,41,73,72,ba,0a,5a,17,cf,0b,0e,dc,8a,ec,d8,a7,e7,..

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4000001Jf40]

"khjeh"=hex:af,f7,5e,c3,3d,09,66,0f,0d,76,00,1f,13,3e,f3,6e,7b,9b,41,f6,1a,..

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4000001Jf41]

"khjeh"=hex:af,f7,5e,c3,3d,09,66,0f,0d,76,00,1f,13,3e,f3,6e,7b,9b,41,f6,1a,..

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4000001Jf42]

"khjeh"=hex:af,f7,5e,c3,3d,09,66,0f,0d,76,00,1f,13,3e,f3,6e,7b,9b,41,f6,1a,..

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4000001Jf43]

"khjeh"=hex:af,f7,5e,c3,3d,09,66,0f,0d,76,00,1f,13,3e,f3,6e,7b,9b,41,f6,1a,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]

"p0"="C:\Program Files\DAEMON Tools\"

"h0"=dword:00000000

"khjeh"=hex:1e,82,f7,1d,94,ed,a8,74,ef,0e,f5,39,16,78,18,12,f9,98,d2,54,d4,..

 

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4000001]

"a0"=hex:20,01,00,00,e7,be,ea,3d,fc,14,41,2a,fb,0d,fc,b5,39,a1,c2,73,f9,..

"khjeh"=hex:86,ad,48,43,e2,41,73,72,ba,0a,5a,17,cf,0b,0e,dc,8a,ec,d8,a7,e7,..

 

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4000001Jf40]

"khjeh"=hex:af,f7,5e,c3,3d,09,66,0f,0d,76,00,1f,13,3e,f3,6e,7b,9b,41,f6,1a,..

 

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4000001Jf41]

"khjeh"=hex:af,f7,5e,c3,3d,09,66,0f,0d,76,00,1f,13,3e,f3,6e,7b,9b,41,f6,1a,..

 

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4000001Jf42]

"khjeh"=hex:af,f7,5e,c3,3d,09,66,0f,0d,76,00,1f,13,3e,f3,6e,7b,9b,41,f6,1a,..

 

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4000001Jf43]

"khjeh"=hex:af,f7,5e,c3,3d,09,66,0f,0d,76,00,1f,13,3e,f3,6e,7b,9b,41,f6,1a,..

 

scanning hidden registry entries ...

 

scanning hidden files ...

 

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\lnyabou@hotmail.com\DFSR\Staging\CS{0CBE5612-C032-7356-73D8-E69E6AAAE102}1\19-{0CBE5612-C032-7356-73D8-E69E6AAAE102}-v1-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v19-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 8 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\poline-m@hotmail.fr\DFSR\Staging\CS{6350F2D6-CC48-E1F9-F5FB-E2B08591417C}1\20-{6350F2D6-CC48-E1F9-F5FB-E2B08591417C}-v1-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v20-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 8 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\poline-m@hotmail.fr\DFSR\Staging\CS{6350F2D6-CC48-E1F9-F5FB-E2B08591417C}\21\21-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v21-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v21-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 76692 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\poline-m@hotmail.fr\DFSR\Staging\CS{6350F2D6-CC48-E1F9-F5FB-E2B08591417C}\21\21-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v21-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v21-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2 5466 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\poline-m@hotmail.fr\DFSR\Staging\CS{6350F2D6-CC48-E1F9-F5FB-E2B08591417C}\21\21-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v21-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v21-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 8552 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\poline-m@hotmail.fr\DFSR\Staging\CS{6350F2D6-CC48-E1F9-F5FB-E2B08591417C}\22\22-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v22-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v22-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 47910 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\poline-m@hotmail.fr\DFSR\Staging\CS{6350F2D6-CC48-E1F9-F5FB-E2B08591417C}\22\22-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v22-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v22-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2 3450 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\poline-m@hotmail.fr\DFSR\Staging\CS{6350F2D6-CC48-E1F9-F5FB-E2B08591417C}\22\22-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v22-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v22-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 5344 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\poline-m@hotmail.fr\DFSR\Staging\CS{6350F2D6-CC48-E1F9-F5FB-E2B08591417C}\23\23-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v23-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v23-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 50844 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\poline-m@hotmail.fr\DFSR\Staging\CS{6350F2D6-CC48-E1F9-F5FB-E2B08591417C}\23\23-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v23-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v23-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2 3558 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\poline-m@hotmail.fr\DFSR\Staging\CS{6350F2D6-CC48-E1F9-F5FB-E2B08591417C}\23\23-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v23-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v23-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 5664 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\poline-m@hotmail.fr\DFSR\Staging\CS{6350F2D6-CC48-E1F9-F5FB-E2B08591417C}\24\24-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v24-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v24-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 30306 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\poline-m@hotmail.fr\DFSR\Staging\CS{6350F2D6-CC48-E1F9-F5FB-E2B08591417C}\24\24-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v24-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v24-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2 2208 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\poline-m@hotmail.fr\DFSR\Staging\CS{6350F2D6-CC48-E1F9-F5FB-E2B08591417C}\24\24-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v24-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v24-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3400 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\poline-m@hotmail.fr\DFSR\Staging\CS{6350F2D6-CC48-E1F9-F5FB-E2B08591417C}\25\25-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v25-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v25-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 56658 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\poline-m@hotmail.fr\DFSR\Staging\CS{6350F2D6-CC48-E1F9-F5FB-E2B08591417C}\25\25-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v25-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v25-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2 3990 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\poline-m@hotmail.fr\DFSR\Staging\CS{6350F2D6-CC48-E1F9-F5FB-E2B08591417C}\25\25-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v25-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v25-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 6256 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\poline-m@hotmail.fr\DFSR\Staging\CS{6350F2D6-CC48-E1F9-F5FB-E2B08591417C}\31\31-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v31-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v31-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 31098 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\poline-m@hotmail.fr\DFSR\Staging\CS{6350F2D6-CC48-E1F9-F5FB-E2B08591417C}\31\31-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v31-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v31-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2 2226 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\poline-m@hotmail.fr\DFSR\Staging\CS{6350F2D6-CC48-E1F9-F5FB-E2B08591417C}\31\31-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v31-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v31-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3464 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\poline-m@hotmail.fr\DFSR\Staging\CS{6350F2D6-CC48-E1F9-F5FB-E2B08591417C}\32\32-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v32-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v32-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 45840 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\poline-m@hotmail.fr\DFSR\Staging\CS{6350F2D6-CC48-E1F9-F5FB-E2B08591417C}\32\32-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v32-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v32-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2 3378 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\poline-m@hotmail.fr\DFSR\Staging\CS{6350F2D6-CC48-E1F9-F5FB-E2B08591417C}\32\32-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v32-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v32-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 5160 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\poline-m@hotmail.fr\DFSR\Staging\CS{6350F2D6-CC48-E1F9-F5FB-E2B08591417C}\33\33-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v33-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v33-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 33222 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\poline-m@hotmail.fr\DFSR\Staging\CS{6350F2D6-CC48-E1F9-F5FB-E2B08591417C}\33\33-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v33-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v33-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2 2334 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\poline-m@hotmail.fr\DFSR\Staging\CS{6350F2D6-CC48-E1F9-F5FB-E2B08591417C}\33\33-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v33-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v33-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3736 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\poline-m@hotmail.fr\DFSR\Staging\CS{6350F2D6-CC48-E1F9-F5FB-E2B08591417C}\34\35-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v34-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v35-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 18804 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\poline-m@hotmail.fr\DFSR\Staging\CS{6350F2D6-CC48-E1F9-F5FB-E2B08591417C}\34\35-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v34-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v35-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2 1398 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\poline-m@hotmail.fr\DFSR\Staging\CS{6350F2D6-CC48-E1F9-F5FB-E2B08591417C}\34\35-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v34-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v35-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 2128 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\poline-m@hotmail.fr\DFSR\Staging\CS{6350F2D6-CC48-E1F9-F5FB-E2B08591417C}\36\36-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v36-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v36-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 43356 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\poline-m@hotmail.fr\DFSR\Staging\CS{6350F2D6-CC48-E1F9-F5FB-E2B08591417C}\36\36-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v36-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v36-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2 3180 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\poline-m@hotmail.fr\DFSR\Staging\CS{6350F2D6-CC48-E1F9-F5FB-E2B08591417C}\36\36-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v36-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v36-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 4896 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\poline-m@hotmail.fr\DFSR\Staging\CS{6350F2D6-CC48-E1F9-F5FB-E2B08591417C}\38\38-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v38-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v38-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 78708 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\poline-m@hotmail.fr\DFSR\Staging\CS{6350F2D6-CC48-E1F9-F5FB-E2B08591417C}\38\38-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v38-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v38-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2 5520 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\poline-m@hotmail.fr\DFSR\Staging\CS{6350F2D6-CC48-E1F9-F5FB-E2B08591417C}\38\38-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v38-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v38-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 8736 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\poline-m@hotmail.fr\DFSR\Staging\CS{6350F2D6-CC48-E1F9-F5FB-E2B08591417C}\39\39-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v39-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v39-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 30450 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\poline-m@hotmail.fr\DFSR\Staging\CS{6350F2D6-CC48-E1F9-F5FB-E2B08591417C}\39\39-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v39-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v39-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2 2226 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\poline-m@hotmail.fr\DFSR\Staging\CS{6350F2D6-CC48-E1F9-F5FB-E2B08591417C}\39\39-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v39-{038FD026-AE29-4AE2-9604-64E2E9E6DAD7}-v39-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3368 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\35\135-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v135-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v135-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 2720 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\58\158-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v158-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v158-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3048 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\200-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v200-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v200-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 2672 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}1\201-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v201-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v201-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 2264 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}2\202-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v202-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v202-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 2512 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}3\203-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v203-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v203-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3024 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}4\204-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v204-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v204-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 2960 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}5\205-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v205-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v205-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 2744 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}6\206-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v206-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v206-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3192 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}7\207-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v207-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v207-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3336 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}8\208-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v208-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v208-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3248 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}9\209-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v209-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v209-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 2896 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\10\210-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v210-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v210-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3032 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\11\211-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v211-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v211-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 2784 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\12\212-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v212-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v212-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1352 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\13\213-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v213-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v213-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1416 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\22\122-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v122-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v122-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 32430 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\22\122-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v122-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v122-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3632 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\23\123-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v123-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v123-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3064 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\24\124-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v124-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v124-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3072 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\25\125-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v125-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v125-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3120 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\26\126-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v126-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v126-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 2960 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\27\127-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v127-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v127-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3280 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\28\128-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v128-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v128-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 2856 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\29\129-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v129-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v129-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 2696 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\30\130-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v130-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v130-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 2816 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\31\131-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v131-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v131-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3352 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\32\132-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v132-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v132-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 2272 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\33\133-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v133-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v133-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 2960 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\34\134-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v134-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v134-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 2792 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\36\136-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v136-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v136-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 2704 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\37\137-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v137-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v137-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3392 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\38\138-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v138-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v138-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3192 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\39\139-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v139-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v139-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3048 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\40\140-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v140-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v140-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 29982 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\40\140-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v140-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v140-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3296 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\41\141-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v141-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v141-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 2408 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\42\142-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v142-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v142-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 2600 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\43\143-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v143-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v143-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 2744 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\44\144-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v144-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v144-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3584 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\45\145-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v145-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v145-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 2432 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\46\146-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v146-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v146-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1592 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\47\147-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v147-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v147-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3008 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\48\148-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v148-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v148-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3032 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\49\149-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v149-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v149-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3072 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\50\150-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v150-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v150-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 2512 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\51\151-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v151-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v151-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 2984 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\52\152-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v152-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v152-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 25320 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\52\152-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v152-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v152-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 2840 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\53\153-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v153-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v153-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 2864 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\54\154-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v154-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v154-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3176 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\55\155-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v155-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v155-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3072 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\56\156-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v156-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v156-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3088 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\57\157-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v157-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v157-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3536 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\59\159-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v159-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v159-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 26562 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\59\159-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v159-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v159-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 2944 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\60\160-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v160-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v160-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3216 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\61\161-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v161-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v161-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1360 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\62\162-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v162-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v162-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1304 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\63\163-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v163-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v163-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1224 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\64\164-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v164-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v164-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1304 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\65\165-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v165-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v165-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1320 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\66\166-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v166-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v166-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1248 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\67\167-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v167-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v167-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1360 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\68\168-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v168-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v168-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3240 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\69\169-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v169-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v169-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 2768 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\70\170-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v170-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v170-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3112 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\71\171-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v171-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v171-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 27804 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\71\171-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v171-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v171-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3088 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\72\172-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v172-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v172-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3368 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\73\173-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v173-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v173-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3656 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\74\174-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v174-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v174-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 2472 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\75\175-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v175-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v175-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 2560 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\76\176-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v176-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v176-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 2936 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\76\76-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v76-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v76-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 30846 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\76\76-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v76-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v76-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3488 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\77\177-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v177-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v177-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3048 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\77\77-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v77-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v77-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3440 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\78\178-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v178-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v178-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 29244 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\78\178-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v178-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v178-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3248 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\78\78-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v78-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v78-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3248 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\79\179-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v179-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v179-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3056 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\79\79-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v79-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v79-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 2800 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\80\180-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v180-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v180-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3064 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\80\80-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v80-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v80-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 2560 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\81\181-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v181-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v181-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3368 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\81\81-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v81-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v81-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3336 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\82\182-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v182-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v182-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 2576 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\82\82-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v82-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v82-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3424 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\83\183-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v183-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v183-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3312 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\83\83-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v83-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v83-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 30594 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\83\83-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v83-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v83-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3384 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\84\184-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v184-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v184-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 2440 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\84\84-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v84-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v84-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3496 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\85\185-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v185-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v185-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 2856 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\85\85-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v85-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v85-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3448 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\86\186-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v186-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v186-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 25626 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\86\186-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v186-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v186-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 2816 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\86\86-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v86-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v86-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3024 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\87\187-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v187-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v187-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1592 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\87\87-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v87-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v87-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3552 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\88\188-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v188-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v188-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1592 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\88\88-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v88-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v88-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3160 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\89\189-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v189-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v189-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 2184 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\89\89-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v89-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v89-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3248 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\90\190-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v190-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v190-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 2120 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\90\90-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v90-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v90-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3096 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\91\191-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v191-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v191-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1760 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\91\91-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v91-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v91-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 27858 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\91\91-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v91-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v91-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3064 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\92\192-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v192-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v192-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1488 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\92\92-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v92-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v92-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3096 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\93\193-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v193-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v193-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1408 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\93\93-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v93-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v93-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3304 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\94\194-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v194-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v194-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1520 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\94\94-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v94-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v94-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3080 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\95\195-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v195-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v195-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1864 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\95\95-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v95-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v95-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3088 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\96\196-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v196-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v196-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1864 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\96\96-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v96-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v96-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3312 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\97\197-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v197-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v197-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1536 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\97\97-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v97-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v97-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3208 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\98\198-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v198-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v198-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1864 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\98\98-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v98-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v98-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3088 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\99\199-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v199-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v199-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 8544 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\99\199-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v199-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v199-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 936 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\99\99-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v99-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v99-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 29010 bytes hidden from API

C:\Documents and Settings\julien\Local Settings\Application Data\Microsoft\Messenger\yoshienforce@hotmail.com\SharingMetadata\titdez@msn.com\DFSR\Staging\CS{2F080E07-01D2-4DBC-F467-B6E14D5C4C01}\99\99-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v99-{E4059708-C4CA-49CF-958C-34E2EF65FD86}-v99-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3216 bytes hidden from API

 

scan completed successfully

hidden processes: 0

hidden services: 0

hidden files: 166

 

 

Remaining Services:

------------------

 

 

 

Authorized Application Key Export:

 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"

"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"

"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

 

Remaining Files:

---------------

 

File Backups: - C:\SDFix\backups\backups.zip

 

Files with Hidden Attributes:

 

Wed 12 Dec 2007 62,784 ..SH. --- "C:\WINDOWS\system32\knnmp.bak1"

Sat 28 Oct 2006 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"

 

Finished!

 

La suite arrive

yoshienforce Junior Member

yoshienforce

Posté(e)
  • Auteur
Posté(e)

ComboFix 07-12-12.3 - julien 2007-12-12 21:02:41.1 - NTFSx86

Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.608 [GMT 1:00]

Running from: F:\Install_prog\ComboFix.exe

* Created a new restore point

.

 

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

 

C:\Documents and Settings\All Users\Application Data.\salesmonitor

C:\Documents and Settings\julien\Application Data.\AVSystemCare

C:\Documents and Settings\julien\Application Data.\AVSystemCare\avtasks.dat

C:\Documents and Settings\julien\Application Data.\AVSystemCare\Logs\av.log

C:\Documents and Settings\julien\Application Data.\AVSystemCare\Logs\ga6Support.log

C:\Documents and Settings\julien\Application Data.\AVSystemCare\Logs\update.log

C:\Documents and Settings\LocalService\Application Data\NetMon

C:\Documents and Settings\LocalService\Application Data\NetMon\domains.txt

C:\Documents and Settings\LocalService\Application Data\NetMon\log.txt

C:\Documents and Settings\NetworkService\Application Data\NetMon

C:\Documents and Settings\NetworkService\Application Data\NetMon\domains.txt

C:\Documents and Settings\NetworkService\Application Data\NetMon\log.txt

C:\Program Files\Services en ligne\hopezego4444.dll

C:\Program Files\Services en ligne\hopezego83122.dll

C:\WINDOWS\cookies.ini

C:\WINDOWS\system32\gebbcay.dll

C:\WINDOWS\system32\karswvkn.dll

C:\WINDOWS\system32\knnmp.bak1

C:\WINDOWS\system32\knnmp.ini

C:\WINDOWS\system32\nkvwsrak.ini

C:\WINDOWS\system32\opnlifg.dll

C:\WINDOWS\system32\oxfggqes.exe

C:\WINDOWS\system32\pmnnk.dll

C:\WINDOWS\system32\tuvwtss.dll

C:\WINDOWS\system32\wrcsfwmr.dll

C:\WINDOWS\system32\xxyxvuu.dll

C:\WINDOWS\system32\yayxwtt.dll

C:\WINDOWS\system32\yqbqlksl.dll

G:\RECYCLER

 

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

 

.

-------\LEGACY_DOMAINSERVICE

-------\DomainService

 

 

((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-11-12 to 2007-12-12 ))))))))))))))))))))))))))))))))))))

.

 

2007-12-12 20:49 . 2007-12-12 20:49 <REP> d-------- C:\WINDOWS\ERUNT

2007-12-11 19:44 . 2007-12-11 19:44 <REP> d-------- C:\VundoFix Backups

2007-12-11 19:27 . 2007-12-12 13:26 913,044 ---hs---- C:\WINDOWS\system32\ysamujhr.ini

2007-12-10 20:34 . 2007-12-10 20:34 143 --a------ C:\WINDOWS\system32\mcrh.tmp

2007-12-09 23:51 . 2007-12-10 19:01 834,133 ---hs---- C:\WINDOWS\system32\hwvkmqvq.ini

2007-12-09 10:49 . 2007-12-09 10:49 244 --ah----- C:\sqmnoopt19.sqm

2007-12-09 10:49 . 2007-12-09 10:49 232 --ah----- C:\sqmdata17.sqm

2007-12-09 10:39 . 2007-12-09 10:39 244 --ah----- C:\sqmnoopt16.sqm

2007-12-09 10:39 . 2007-12-09 10:39 232 --ah----- C:\sqmdata16.sqm

2007-12-09 10:32 . 2007-12-09 10:32 244 --ah----- C:\sqmnoopt15.sqm

2007-12-09 10:32 . 2007-12-09 10:32 232 --ah----- C:\sqmdata15.sqm

2007-12-09 10:15 . 2007-12-09 10:26 <REP> d-------- C:\Program Files\Fichiers communs\AVSystemCare

2007-12-09 10:15 . 2001-03-08 18:30 24,064 --a------ C:\WINDOWS\system32\msxml3a.dll

2007-12-09 10:13 . 2007-12-09 19:13 <REP> d-------- C:\WINDOWS\system32\daSgo01

2007-12-09 10:13 . 2007-12-12 18:59 <REP> d-------- C:\Temp

2007-11-29 09:37 . 2007-11-29 09:37 54,156 --ah----- C:\WINDOWS\QTFont.qfn

2007-11-29 09:37 . 2007-11-29 09:37 1,409 --a------ C:\WINDOWS\QTFont.for

 

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2007-12-12 20:06 --------- d-----w C:\Program Files\Services en ligne

2007-12-12 17:59 --------- d-----w C:\Program Files\PokerStars.NET

2007-11-18 16:43 --------- d-----w C:\Program Files\Everest Poker

2007-10-28 07:32 --------- d--h--w C:\Program Files\InstallShield Installation Information

2007-10-28 07:32 --------- d-----w C:\Program Files\NVIDIA Corporation

2007-10-28 07:32 --------- d-----w C:\Program Files\Fichiers communs\NVIDIA Shared

2007-10-28 07:23 --------- d-----w C:\Program Files\TomTom HOME

2007-10-19 16:46 --------- d-----w C:\Documents and Settings\All Users\Application Data\TomTom

2007-10-19 16:45 --------- d-----w C:\Documents and Settings\julien\Application Data\InstallShield

2007-10-19 16:40 --------- d-----w C:\Program Files\TomTom DesktopSuite

2007-08-02 13:43 282,624 ----a-w C:\Program Files\TTC.dll

2006-11-25 07:57 482 ----a-w C:\Program Files\Del.js

2004-12-14 16:47 400,096 ----a-w C:\WINDOWS\inf\WG311T\WG311T13.sys

2004-10-19 18:58 35,232 ----a-w C:\WINDOWS\inf\WG311T\ME_INST.EXE

2004-10-19 18:58 26,112 ----a-w C:\WINDOWS\inf\WG311T\install.exe

.

 

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

REGEDIT4

*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{51A39CD7-5980-4441-3582-8B3C16312673}]

C:\Program Files\Messenger\labu.dll

 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{75ED9748-1E4B-4184-8E42-10DEAB36FF76}]

C:\WINDOWS\system32\jkhhi.dll

 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{789DE549-80DF-4056-8269-0319E7F8B89F}]

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 11:55]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2006-07-19 11:03 C:\WINDOWS\KHALMNPR.Exe]

"PinnacleDriverCheck"="C:\WINDOWS\system32\PSDrvCheck.exe" [2004-03-11 01:26]

"NvCplDaemon"="RUNDLL32.exe" [2004-08-19 15:10 C:\WINDOWS\system32\rundll32.exe]

"nwiz"="nwiz.exe" [2007-04-19 12:26 C:\WINDOWS\system32\nwiz.exe]

"NvMediaCenter"="RUNDLL32.exe" [2004-08-19 15:10 C:\WINDOWS\system32\rundll32.exe]

"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-01-10 00:49]

"NVMixerTray"="C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [2004-06-03 20:51]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-19 15:09]

 

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]

Source= C:\Program Files\Messenger\proky.html

FriendlyName=

 

R0 si3112r;Silicon Image SiI 3112 SATARaid Controller;C:\WINDOWS\system32\drivers\si3112r.sys

R0 SiWinAcc;SiWinAcc;C:\WINDOWS\system32\drivers\SiWinAcc.sys

R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys

R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys

R2 LBeepKE;LBeepKE;C:\WINDOWS\system32\Drivers\LBeepKE.sys

R2 vnccom;vnccom;C:\WINDOWS\system32\Drivers\vnccom.SYS

R2 WebDriveFSD;WebDrive File System Driver;\??\C:\Program Files\NetDrive\rffsd.sys

R3 ovt530;Webcam Deluxe;C:\WINDOWS\system32\Drivers\ov530vid.sys

R3 vncdrv;vncdrv;C:\WINDOWS\system32\DRIVERS\vncdrv.sys

S3 AVCSTRM;AVC Streaming Filter Driver;C:\WINDOWS\system32\DRIVERS\avcstrm.sys

S3 MSTAPE;Microsoft AV/C Tape Subunit Device;C:\WINDOWS\system32\DRIVERS\mstape.sys

S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys

S3 PTV339;Mini DualTV USB;C:\WINDOWS\system32\DRIVERS\PTV339.SYS

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f41ca91e-7e61-11dc-a6d1-000fb587d7b9}]

\Shell\AutoRun\command - J:\InstallTomTomHOME.exe

 

.

**************************************************************************

 

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2007-12-12 23:04:06

Windows 5.1.2600 Service Pack 2 NTFS

 

scanning hidden processes ...

 

scanning hidden autostart entries ...

 

scanning hidden files ...

 

scan completed successfully

hidden files: 0

 

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

 

PROCESS: C:\WINDOWS\system32\winlogon.exe

-> C:\WINDOWS\system32\RFHelper.dll

 

PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2900.2180]

-> C:\WINDOWS\system32\RFHelper.dll

.

Completion time: 2007-12-12 23:05:24 - machine was rebooted

Zonk Godlike Member

Zonk

Posté(e)
Posté(e) (modifié)

Allo

Tu es entre bonne mains avec Bruce Lee.......je mets ceci en complément:

Idéalement passe à la nouvelle version de HJT

désinstalle la vieille....

http://telechargement.zebulon.fr/hijackthis.html

 

je ne vois pas d'antivirus !! à moins que quelque chose m'échappe

en voici un bon et gratuit :P

 

 

http://www.free-av.com/

Antivir Classic

Tuto ....à toi de choisir mais assure toi de bien suivre les conseils .....surveille à bien activer la recherche de " rootkits" (cette fonction est souvent oublier par les gens)

http://www.libellules.ch/tuto_antivir.php

http://tutopat.hostonet.org/viewtopic.php?t=2417

 

 

Télécharge ATF Cleaner par Atribune.....(petit programme sans danger qui ne s'installe pas.... :P il ne fait que s'exécuter

....parfois avec des ordis moins performants, le nettoyage est lourd....alors si tu veux alléger la tache, va y deux cases à la fois et fait "Empty selected"......

Nettoyeur ATF

 

Installe-le sur le bureau.

 

Double-clique ATF-Cleaner.exe afin de lancer le programme.

Sous l'onglet Main, choisis : Select All (ou deux cases à la fois....mais fait toutes les cases )

Cliquer sur le bouton Empty Selected

 

... as tu un antipsyware en temps réel ?...sinon: AVG Antipsyware (choix de langues)

http://free.grisoft.com/doc/5390/us/frt/0?prd=asf

http://www.kachouri.com/tuto/imprimer161.html

il est en version complète durant 30 jours (protection résidente)...suite a cela,tu perdras la protection en temps réel.....

je te conseille d'acheter la licence.....

mais si parfois tu ne veux pas.,alors une fois la période d'essai terminée (IMPORTANT de ne pas mettre deux protections en temps réel de la même famille ),il y a celui-ci:

Windows Defender

ce n'est pas le ténor du genre...mais selon mon expérience,il fait un travail honnête...et gratuit !

 

applique ceci:

http://forum.zebulon.fr/index.php?showtopic=83986

Tu auras les indications pour aller en mode sans échec dans le lien ci-haut....le mode sans échec est parfois lent à démarrer/fermer...soit très patient......ayant Antivir maintenant comme antivirus,tu oublies la désinstallation suggérée dans le la procédure de pré-nettoyage....ceci s'applique si tu as déjà un antivirus autre que Antivir

Profite en pour passer tout tes antipestes en sans échec......

les rapports d'Antivir,de AVG,Hijackthis,etc.......tu nous les donnes ...ça va nous guider....

le pré-nettoyage ne parvient pas toujours à tout nettoyer....l'Equipe Sécurité passera parfaire le travail :P

@+

Modifié par Zonk
bruce lee Devil Member !

bruce lee

Posté(e)
Posté(e)

Bonjour a vous deux,

 

1/ Ouvre le Bloc-notes ( Menu Démarrer\Tous les programmes\Accessoires\Bloc-notes)

 

2/ Copie ce qui est en citation ci-dessous (sans le mot citation) par sélection puis Ctrl-C :

 

File::

C:\WINDOWS\system32\ysamujhr.ini

C:\WINDOWS\system32\mcrh.tmp

C:\WINDOWS\system32\hwvkmqvq.ini

C:\WINDOWS\QTFont.qfn

C:\WINDOWS\QTFont.for

C:\Program Files\Messenger\labu.dll

C:\WINDOWS\system32\jkhhi.dll

C:\Program Files\Messenger\proky.html

 

Folder::

C:\WINDOWS\system32\daSgo01

 

Registry::

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{51A39CD7-5980-4441-3582-8B3C16312673}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{75ED9748-1E4B-4184-8E42-10DEAB36FF76}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{789DE549-80DF-4056-8269-0319E7F8B89F}]

 

-Enregistre ce fichier dans: Bureau

-Nom du fichier : CFScript

-Type du fichier : tous les fichiers

-clique sur Enregistrer

-quitte le Bloc Notes

 

 

[*]Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture

 

CFScript.gif

  • Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort), tape 1 puis valide.
  • Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!
    Ne touche à rien tant que le scan n'est pas terminé.
  • Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
  • Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

yoshienforce Junior Member

yoshienforce

Posté(e)
  • Auteur
Posté(e)

ComboFix 07-12-12.3 - julien 2007-12-13 19:42:46.2 - NTFSx86

Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.591 [GMT 1:00]

Running from: C:\Documents and Settings\julien\Bureau\ComboFix.exe

Command switches used :: C:\Documents and Settings\julien\Bureau\CFScript.txt

* Created a new restore point

 

FILE

C:\Program Files\Messenger\labu.dll

C:\Program Files\Messenger\proky.html

C:\WINDOWS\QTFont.for

C:\WINDOWS\QTFont.qfn

C:\WINDOWS\system32\hwvkmqvq.ini

C:\WINDOWS\system32\jkhhi.dll

C:\WINDOWS\system32\mcrh.tmp

C:\WINDOWS\system32\ysamujhr.ini

.

 

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

 

C:\WINDOWS\QTFont.for

C:\WINDOWS\QTFont.qfn

C:\WINDOWS\system32\daSgo01

C:\WINDOWS\system32\hwvkmqvq.ini

C:\WINDOWS\system32\mcrh.tmp

C:\WINDOWS\system32\ysamujhr.ini

 

.

((((((((((((((((((((((((((((( Fichiers créés 2007-11-13 to 2007-12-13 ))))))))))))))))))))))))))))))))))))

.

 

2007-12-12 20:49 . 2007-12-12 20:49 <REP> d-------- C:\WINDOWS\ERUNT

2007-12-11 19:44 . 2007-12-11 19:44 <REP> d-------- C:\VundoFix Backups

2007-12-09 10:49 . 2007-12-09 10:49 244 --ah----- C:\sqmnoopt19.sqm

2007-12-09 10:49 . 2007-12-09 10:49 232 --ah----- C:\sqmdata17.sqm

2007-12-09 10:39 . 2007-12-09 10:39 244 --ah----- C:\sqmnoopt16.sqm

2007-12-09 10:39 . 2007-12-09 10:39 232 --ah----- C:\sqmdata16.sqm

2007-12-09 10:32 . 2007-12-09 10:32 244 --ah----- C:\sqmnoopt15.sqm

2007-12-09 10:32 . 2007-12-09 10:32 232 --ah----- C:\sqmdata15.sqm

2007-12-09 10:15 . 2007-12-09 10:26 <REP> d-------- C:\Program Files\Fichiers communs\AVSystemCare

2007-12-09 10:15 . 2001-03-08 18:30 24,064 --a------ C:\WINDOWS\system32\msxml3a.dll

2007-12-09 10:13 . 2007-12-12 18:59 <REP> d-------- C:\Temp

 

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2007-12-13 17:59 --------- d-----w C:\Program Files\PokerStars.NET

2007-12-12 20:06 --------- d-----w C:\Program Files\Services en ligne

2007-11-18 16:43 --------- d-----w C:\Program Files\Everest Poker

2007-10-28 07:32 --------- d--h--w C:\Program Files\InstallShield Installation Information

2007-10-28 07:32 --------- d-----w C:\Program Files\NVIDIA Corporation

2007-10-28 07:32 --------- d-----w C:\Program Files\Fichiers communs\NVIDIA Shared

2007-10-28 07:23 --------- d-----w C:\Program Files\TomTom HOME

2007-10-19 16:46 --------- d-----w C:\Documents and Settings\All Users\Application Data\TomTom

2007-10-19 16:45 --------- d-----w C:\Documents and Settings\julien\Application Data\InstallShield

2007-10-19 16:40 --------- d-----w C:\Program Files\TomTom DesktopSuite

2007-08-02 13:43 282,624 ----a-w C:\Program Files\TTC.dll

2006-11-25 07:57 482 ----a-w C:\Program Files\Del.js

2004-12-14 16:47 400,096 ----a-w C:\WINDOWS\inf\WG311T\WG311T13.sys

2004-10-19 18:58 35,232 ----a-w C:\WINDOWS\inf\WG311T\ME_INST.EXE

2004-10-19 18:58 26,112 ----a-w C:\WINDOWS\inf\WG311T\install.exe

.

 

((((((((((((((((((((((((((((( snapshot@2007-12-12_23.04.29.48 )))))))))))))))))))))))))))))))))))))))))

.

- 2007-12-12 20:12:56 70,746 ----a-w C:\WINDOWS\system32\perfc009.dat

+ 2007-12-12 22:04:56 70,746 ----a-w C:\WINDOWS\system32\perfc009.dat

- 2007-12-12 20:12:56 84,190 ----a-w C:\WINDOWS\system32\perfc00C.dat

+ 2007-12-12 22:04:56 84,190 ----a-w C:\WINDOWS\system32\perfc00C.dat

- 2007-12-12 20:12:56 421,358 ----a-w C:\WINDOWS\system32\perfh009.dat

+ 2007-12-12 22:04:56 421,358 ----a-w C:\WINDOWS\system32\perfh009.dat

- 2007-12-12 20:12:56 488,206 ----a-w C:\WINDOWS\system32\perfh00C.dat

+ 2007-12-12 22:04:56 488,206 ----a-w C:\WINDOWS\system32\perfh00C.dat

.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

REGEDIT4

*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 11:55]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2006-07-19 11:03 C:\WINDOWS\KHALMNPR.Exe]

"PinnacleDriverCheck"="C:\WINDOWS\system32\PSDrvCheck.exe" [2004-03-11 01:26]

"NvCplDaemon"="RUNDLL32.exe" [2004-08-19 15:10 C:\WINDOWS\system32\rundll32.exe]

"nwiz"="nwiz.exe" [2007-04-19 12:26 C:\WINDOWS\system32\nwiz.exe]

"NvMediaCenter"="RUNDLL32.exe" [2004-08-19 15:10 C:\WINDOWS\system32\rundll32.exe]

"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-01-10 00:49]

"NVMixerTray"="C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [2004-06-03 20:51]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-19 15:09]

 

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\

Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2006-10-01 13:20:06]

NETGEAR WG311T Wireless Assistant.lnk - C:\Program Files\NETGEAR\WG311T\wlancfg5.exe [2004-12-17 10:55:26]

 

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]

Source= C:\Program Files\Messenger\proky.html

FriendlyName=

 

R0 si3112r;Silicon Image SiI 3112 SATARaid Controller;C:\WINDOWS\system32\drivers\si3112r.sys

R0 SiWinAcc;SiWinAcc;C:\WINDOWS\system32\drivers\SiWinAcc.sys

R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys

R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys

R2 LBeepKE;LBeepKE;C:\WINDOWS\system32\Drivers\LBeepKE.sys

R2 vnccom;vnccom;C:\WINDOWS\system32\Drivers\vnccom.SYS

R2 WebDriveFSD;WebDrive File System Driver;\??\C:\Program Files\NetDrive\rffsd.sys

R3 ovt530;Webcam Deluxe;C:\WINDOWS\system32\Drivers\ov530vid.sys

R3 vncdrv;vncdrv;C:\WINDOWS\system32\DRIVERS\vncdrv.sys

S3 AVCSTRM;AVC Streaming Filter Driver;C:\WINDOWS\system32\DRIVERS\avcstrm.sys

S3 MSTAPE;Microsoft AV/C Tape Subunit Device;C:\WINDOWS\system32\DRIVERS\mstape.sys

S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys

S3 PTV339;Mini DualTV USB;C:\WINDOWS\system32\DRIVERS\PTV339.SYS

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f41ca91e-7e61-11dc-a6d1-000fb587d7b9}]

\Shell\AutoRun\command - J:\InstallTomTomHOME.exe

 

.

**************************************************************************

 

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2007-12-13 19:46:23

Windows 5.1.2600 Service Pack 2 NTFS

 

scanning hidden processes ...

 

scanning hidden autostart entries ...

 

scanning hidden files ...

 

scan completed successfully

hidden files: 0

 

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

 

PROCESS: C:\WINDOWS\system32\winlogon.exe

-> C:\WINDOWS\system32\RFHelper.dll

.

Completion time: 2007-12-13 19:47:41

C:\ComboFix2.txt ... 2007-12-12 23:05

Rejoindre la conversation

Vous pouvez publier maintenant et vous inscrire plus tard. Si vous avez un compte, connectez-vous maintenant pour publier avec votre compte.
Remarque : votre message nécessitera l’approbation d’un modérateur avant de pouvoir être visible.

Invité
Répondre à ce sujet…

×   Collé en tant que texte enrichi.   Coller en tant que texte brut à la place

  Seulement 75 émoticônes maximum sont autorisées.

×   Votre lien a été automatiquement intégré.   Afficher plutôt comme un lien

×   Votre contenu précédent a été rétabli.   Vider l’éditeur

×   Vous ne pouvez pas directement coller des images. Envoyez-les depuis votre ordinateur ou insérez-les depuis une URL.

×
 Partager
Aller sur la liste des sujets

  • En ligne récemment   0 membre est en ligne

    • Aucun utilisateur enregistré regarde cette page.
×
×
  • Créer...