[RESOLU]Infection tenace...Aidez-moi !!!!!!

Zonk · le 31 décembre 2007

Je pense que je l'ai trouvé

ComboFix 07-12-31.4 - Dany 2007-12-31 9:42:05.2 - NTFSx86

Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.109 [GMT -5:00]

Running from: C:\Documents and Settings\Dany.NOM-0C9D00AA293\Bureau\ComboFix.exe

Comme discuté avec cosby112,selon moi ceci n'est pas le rapport....je l'ai guider vers la recherche à la racine du C

à chercher:

ComboFix-quarantined-files.txt et C:\ComboFix.txt

alors à la fin de son scan il devrait revenir poster le bon....

@+

édit: selon les infos de cosby112 ,même à la racine,pas de ComboFix.txt ...

Modifié le 31 décembre 2007 par Zonk

Zonk · le 31 décembre 2007

Voic le seul .txt que cosby112 à trouver au sujet de Combofix....le ComboFix-quarantined-files.txt

.Page de codes activeÿ: 1252

1 fichier(s) copié(s).

SteelWerX Registry Console Tool 2.0

Written by Bobbi Flekman 2006 ©

HKEY_CURRENT_USER\control panel\international_combofixbackup

iCountry REG_SZ 2

iCurrDigits REG_SZ 2

iCurrency REG_SZ 3

iDate REG_SZ 2

iDigits REG_SZ 2

iLZero REG_SZ 1

iMeasure REG_SZ 0

iNegCurr REG_SZ 15

iTime REG_SZ 1

iTLZero REG_SZ 1

Locale REG_SZ 00000C0C

s1159 REG_SZ

s2359 REG_SZ

sCountry REG_SZ Canada

sCurrency REG_SZ $

sDate REG_SZ -

sDecimal REG_SZ ,

sLanguage REG_SZ FRC

sList REG_SZ ;

sLongDate REG_SZ d MMMM yyyy

sShortDate REG_SZ yyyy-MM-dd

sThousand REG_SZ

sTime REG_SZ :

sTimeFormat REG_SZ HH:mm:ss

iTimePrefix REG_SZ 0

sMonDecimalSep REG_SZ ,

sMonThousandSep REG_SZ

iNegNumber REG_SZ 1

sNativeDigits REG_SZ 0123456789

NumShape REG_SZ 1

iCalendarType REG_SZ 1

iFirstDayOfWeek REG_SZ 6

iFirstWeekOfYear REG_SZ 0

sGrouping REG_SZ 3;0

sMonGrouping REG_SZ 3;0

sPositiveSign REG_SZ

sNegativeSign REG_SZ -

HKEY_CURRENT_USER\control panel\international_combofixbackup\Geo

C:\ComboFix\errdbg.dat will be moved to \QooBox\Quarantine\C\ComboFix\errdbg.dat.vir at next reboot.

To undo this, start regedt32.exe and delete value PendingFileRenameOperations

in key HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SessionManager.

1 fichier(s) copié(s).

SteelWerX Registry Console Tool 2.0

Written by Bobbi Flekman 2006 ©

HKEY_CURRENT_USER\control panel\international_combofixbackup

iCountry REG_SZ 2

iCurrDigits REG_SZ 2

iCurrency REG_SZ 3

iDate REG_SZ 2

iDigits REG_SZ 2

iLZero REG_SZ 1

iMeasure REG_SZ 0

iNegCurr REG_SZ 15

iTime REG_SZ 1

iTLZero REG_SZ 1

Locale REG_SZ 00000C0C

s1159 REG_SZ

s2359 REG_SZ

sCountry REG_SZ Canada

sCurrency REG_SZ $

sDate REG_SZ -

sDecimal REG_SZ ,

sLanguage REG_SZ FRC

sList REG_SZ ;

sLongDate REG_SZ d MMMM yyyy

sShortDate REG_SZ yyyy-MM-dd

sThousand REG_SZ

sTime REG_SZ :

sTimeFormat REG_SZ HH:mm:ss

iTimePrefix REG_SZ 0

sMonDecimalSep REG_SZ ,

sMonThousandSep REG_SZ

iNegNumber REG_SZ 1

sNativeDigits REG_SZ 0123456789

NumShape REG_SZ 1

iCalendarType REG_SZ 1

iFirstDayOfWeek REG_SZ 6

iFirstWeekOfYear REG_SZ 0

sGrouping REG_SZ 3;0

sMonGrouping REG_SZ 3;0

sPositiveSign REG_SZ

sNegativeSign REG_SZ -

HKEY_CURRENT_USER\control panel\international_combofixbackup\Geo

C:\ComboFix\errdbg.dat will be moved to \QooBox\Quarantine\C\ComboFix\errdbg.dat.vir at next reboot.

To undo this, start regedt32.exe and delete value PendingFileRenameOperations

in key HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SessionManager.

Y a t'il quelque chose à tirer de ce rapport ??

@+

édit:cosby112 est en train de scanner en mode sans échec tout les comptes (il y avait encore des menaces) ....alors un nouveau HJT devrait apparaitre d'ici quelques heures.......

Modifié le 31 décembre 2007 par Zonk

cosby112 · le 1 janvier 2008

Salut

J'ai fais un scan de tout mes sessions comme prévu...voci le rapport et en passant bonne année à tous

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 12:22, on 2008-01-01

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe

C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\hphmon06.exe

C:\WINDOWS\system32\ps2.exe

C:\hp\drivers\hplsbwatcher\lsburnwatcher.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe

C:\Program Files\QuickTime\QTTask.exe

C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIALA.EXE

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\internet explorer\iexplore.exe

C:\Documents and Settings\Dany.NOM-0C9D00AA293\Bureau\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sympatico.msn.ca/defaultf.aspx?lang=fr-ca

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: {eacfaaa8-2517-047b-06a4-6b0ac868b3e0} - {0e3b868c-a0b6-4a60-b740-71528aaafcae} - C:\WINDOWS\system32\fqlkhjna.dll (file missing)

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O2 - BHO: (no name) - {A5578F41-70E1-4B13-86D5-D46A13B2621D} - C:\WINDOWS\system32\pmnlj.dll (file missing)

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll

O3 - Toolbar: Vue HP - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll

O4 - HKLM\..\Run: [HPHUPD06] c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe

O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe

O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe

O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe

O4 - HKLM\..\Run: [bm] "C:\Program Files\Fichiers communs\AntiVer2008\bm.exe" dm=http://antiver2008.com ad=http://antiver2008.com sd=http://gregistre.antiver2008.com

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [EPSON Stylus CX5800F Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIALA.EXE /P27 "EPSON Stylus CX5800F Series" /M "Stylus CX5800F" /EF "HKCU"

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Policies\Explorer\Run: [{24A95918-08A2-3084-0420-050624040002}] "C:\Program Files\Fichiers communs\{24A95918-08A2-3084-0420-050624040002}\Update.exe" mc-110-12-0000904

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')

O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user')

O4 - Global Startup: Microsoft Office.lnk.disabled

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL

O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe

O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe

O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing)

O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll

O16 - DPF: {00330010-0000-0000-0000-000020160010} - http://207.234.185.217/ABoxInst_int25.exe

O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} (DjVuCtl Class) - http://www.lizardtech.com/download/files/w...ntrol_en_US.cab

O16 - DPF: {1A26F07F-0D60-4835-91CF-1E1766A0EC56} (WebInstall Class) - http://scanner2.malware-scan.com/setup/webinst.cab

O16 - DPF: {2D2BEE6E-3C9A-4D58-B9EC-458EDB28D0F6} - http://cdn.drivecleaner.com/installdrivecleanerstart_fr.cab

O16 - DPF: {A1426AC5-8CE5-4A00-B71E-011D35709AC6} - http://advnt01.com/dialer/int_ver34.CAB

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.com/games/popcaploader_v10_fr.cab

O20 - Winlogon Notify: cxkopqqb - cxkopqqb.dll (file missing)

O20 - Winlogon Notify: mdytwdzo - mdytwdzo.dll (file missing)

O20 - Winlogon Notify: rqrqoon - rqrqoon.dll (file missing)

O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe

O24 - Desktop Component 0: (no name) - http://sd579.sivit.org/lesgrandscasinos/fo.../cascades05.jpg

--

End of file - 8594 bytes

Zonk · le 1 janvier 2008

Salut cosby112

Je vois encore des menaces.

Entre autres:

O4 - HKLM\..\Run: [bm] "C:\Program Files\Fichiers communs\AntiVer2008\bm.exe" dm=http://antiver2008.com ad=http://antiver2008.com sd=http://gregistre.antiver2008.com

O16 - DPF: {A1426AC5-8CE5-4A00-B71E-011D35709AC6} - http://advnt01.com/dialer/int_ver34.CAB

.......restera à attendre Charles I. et ses directives.....

édit:

est ce que ton Antivir s'affole encore?? ...as tu encore des fenêtres sur des comptes???

@+

Modifié le 1 janvier 2008 par Zonk

Thanos · le 2 janvier 2008

salut @ vous deux

Mes excuses pour avoir zappé et..bonne année

Après avoir passé ComboFix, vous devez trouver ce rapport à la racine du disque dur normalement > ComboFix.txt

Je pense que je l'ai trouvé

ComboFix 07-12-31.4 - Dany 2007-12-31 9:42:05.2 - NTFSx86

Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.109 [GMT -5:00]

Running from: C:\Documents and Settings\Dany.NOM-0C9D00AA293\Bureau\ComboFix.exe

Il s'agit bien de ce rapport, mais tu n'as posté l'intégralité cosby112 !

On peux voir d'après ton dernier rapport hijackthis que ComboFix a fait du nettoyage.

Tu as bien vu les entrées néfastes zonk

Démarre Hijackthis,clique sur "Do a system scan only", et coche les lignes suivantes :

O2 - BHO: {eacfaaa8-2517-047b-06a4-6b0ac868b3e0} - {0e3b868c-a0b6-4a60-b740-71528aaafcae} - C:\WINDOWS\system32\fqlkhjna.dll (file missing)

O2 - BHO: (no name) - {A5578F41-70E1-4B13-86D5-D46A13B2621D} - C:\WINDOWS\system32\pmnlj.dll (file missing)

O4 - HKLM\..\Run: [bm] "C:\Program Files\Fichiers communs\AntiVer2008\bm.exe" dm=http://antiver2008.com ad=http://antiver2008.com sd=http://gregistre.antiver2008.com

O4 - HKCU\..\Policies\Explorer\Run: [{24A95918-08A2-3084-0420-050624040002}] "C:\Program Files\Fichiers communs\{24A95918-08A2-3084-0420-050624040002}\Update.exe" mc-110-12-0000904

O16 - DPF: {00330010-0000-0000-0000-000020160010} - http://207.234.185.217/ABoxInst_int25.exe

O16 - DPF: {1A26F07F-0D60-4835-91CF-1E1766A0EC56} (WebInstall Class) - http://scanner2.malware-scan.com/setup/webinst.cab

O16 - DPF: {2D2BEE6E-3C9A-4D58-B9EC-458EDB28D0F6} - http://cdn.drivecleaner.com/installdrivecleanerstart_fr.cab

O16 - DPF: {A1426AC5-8CE5-4A00-B71E-011D35709AC6} - http://advnt01.com/dialer/int_ver34.CAB

O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.com/games/popcaploader_v10_fr.cab

O20 - Winlogon Notify: cxkopqqb - cxkopqqb.dll (file missing)

O20 - Winlogon Notify: mdytwdzo - mdytwdzo.dll (file missing)

O20 - Winlogon Notify: rqrqoon - rqrqoon.dll (file missing)

-Ferme tous les programmes et clique sur "Fix Checked"

Poste stp le rapport de ComboFix

Zonk · le 2 janvier 2008

Allô Charles et encore merci!!

cosby112 dit ne pas voir autre chose que ce qu'il a donner comme rapport du combofix.........je lui laisse le soin de parfaire la recherche selon ta recommandation ,mais si parfois il ne trouve pas, serais-ce une bonne idée de refaire le combofix une deuxième fois pour pouvoir enfin mettre la main sur un rapport quelconque??

@+ et bonne année grand chef!

Thanos · le 2 janvier 2008

salut zonk

Ok s'il ne trouve pas le rapport, cosby112 peux relancer ComboFix et poster le nouveau rapport

@+ tard!

Zonk · le 2 janvier 2008

salut zonk

Ok s'il ne trouve pas le rapport, cosby112 peux relancer ComboFix et poster le nouveau rapport

@+ tard!

Cool!!!

..cosby112 est en train de festoyer allègrement .. ..il sera de retour sous peu.......en forme j'espère ...

Modifié le 2 janvier 2008 par Zonk

cosby112 · le 2 janvier 2008

Allo Charles I. et merci!!!!!

Voici le rapport:

ComboFix 08-01-03.3 - Dany 2008-01-02 14:39:09.3 - NTFSx86

Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.143 [GMT -5:00]

Running from: C:\Documents and Settings\Dany.NOM-0C9D00AA293\Bureau\ComboFix.exe

* Created a new restore point

.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

D:\Autorun.inf

.

((((((((((((((((((((((((((((( Fichiers créés 2007-12-03 to 2008-01-03 ))))))))))))))))))))))))))))))))))))

.

2008-01-02 14:38 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe

2007-12-30 08:17 . 2007-12-30 08:17 <REP> d-------- C:\Documents and Settings\Sonia.NOM-0C9D00AA293\Application Data\Grisoft

2007-12-30 08:15 . 2007-12-30 08:15 <REP> d-------- C:\Documents and Settings\KelLie.NOM-0C9D00AA293\Application Data\Grisoft

2007-12-30 08:12 . 2007-12-30 08:12 <REP> d-------- C:\Documents and Settings\Nick.NOM-0C9D00AA293\Application Data\Grisoft

2007-12-29 23:09 . 2007-12-29 23:09 <REP> d-------- C:\Documents and Settings\Dany.NOM-0C9D00AA293\Application Data\Grisoft

2007-12-29 20:35 . 2005-05-31 02:56 <REP> d-------- C:\Documents and Settings\Administrateur\WINDOWS

2007-12-29 20:35 . 2004-11-23 19:24 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage réseau

2007-12-29 20:35 . 2004-11-23 19:24 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression

2007-12-29 20:35 . 2006-08-06 12:08 <REP> d--h----- C:\Documents and Settings\Administrateur\Modèles

2007-12-29 20:35 . 2006-08-06 12:07 <REP> dr------- C:\Documents and Settings\Administrateur\Mes documents

2007-12-29 20:35 . 2006-08-06 12:07 <REP> dr------- C:\Documents and Settings\Administrateur\Menu Démarrer

2007-12-29 20:35 . 2006-08-06 12:07 <REP> dr------- C:\Documents and Settings\Administrateur\Favoris

2007-12-29 20:35 . 2005-05-31 03:01 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau

2007-12-29 20:35 . 2005-05-31 03:14 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Symantec

2007-12-29 20:35 . 2005-05-31 03:06 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\SampleView

2007-12-29 20:35 . 2005-05-31 02:55 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Apple Computer

2007-12-29 19:35 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl

2007-12-29 18:19 . 2007-12-29 18:19 15 --a------ C:\WINDOWS\system32\24a94b39

2007-12-29 15:07 . 2007-12-29 15:07 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\Contacts

2007-12-29 13:49 . 2007-12-29 13:49 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\Application Data\Grisoft

2007-12-29 13:49 . 2007-12-29 13:49 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft

2007-12-29 13:49 . 2007-05-30 07:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys

2007-12-29 13:47 . 2007-12-29 13:47 <REP> d---s---- C:\Documents and Settings\HP_Propriétaire\UserData

2007-12-29 13:33 . 2007-12-29 13:33 <REP> d-------- C:\Program Files\Avira

2007-12-29 13:33 . 2007-12-29 13:33 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira

2007-12-29 13:11 . 2007-12-29 13:29 1,031,448 ---hs---- C:\WINDOWS\system32\gnmvujwi.ini

2007-12-29 09:24 . 2007-12-29 13:10 1,031,268 ---hs---- C:\WINDOWS\system32\oqviiogp.ini

2007-12-27 21:53 . 2007-12-29 09:23 1,031,499 ---hs---- C:\WINDOWS\system32\bgcoisda.ini

2007-12-27 14:46 . 2007-12-27 14:46 <REP> d-------- C:\Documents and Settings\Kellie\Application Data\LANCITE

2007-12-26 20:59 . 2007-12-27 21:53 1,031,679 ---hs---- C:\WINDOWS\system32\rknxpxjx.ini

2007-12-26 16:52 . 2007-12-26 16:52 88,936 --a------ C:\Documents and Settings\Dany.NOM-0C9D00AA293\Application Data\GDIPFONTCACHEV1.DAT

2007-12-25 23:25 . 2007-12-26 09:32 <REP> d-------- C:\Program Files\MalwareAlarm

2007-12-25 23:25 . 2007-12-25 23:25 1,283,174 --a------ C:\Install

2007-12-24 20:30 . 2007-12-25 20:31 1,019,762 ---hs---- C:\WINDOWS\system32\xfibslre.ini

2007-12-23 19:39 . 2007-12-24 20:30 1,014,665 ---hs---- C:\WINDOWS\system32\itvlhnax.ini

2007-12-23 14:32 . 2007-12-23 14:32 <REP> d-------- C:\Documents and Settings\Nick.NOM-0C9D00AA293\Application Data\AntiVer2008

2007-12-23 14:32 . 2007-12-23 14:32 <REP> dr------- C:\Documents and Settings\All Users\Application Data\SalesMon

2007-12-23 14:31 . 2007-12-23 14:37 <REP> d-------- C:\Program Files\AntiVer2008

2007-12-16 12:12 . 1991-11-11 13:01 970,686 ---hs---- C:\WINDOWS\system32\cxnjkrpy.ini

2007-12-11 17:34 . 2007-12-13 16:17 1,123,654 ---hs---- C:\WINDOWS\system32\iliwprmm.ini

2007-12-11 10:57 . 2007-12-11 10:57 65,536 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx

2007-12-11 10:57 . 2007-12-11 10:57 49,152 --a------ C:\WINDOWS\system32\QuickTime.qts

2007-12-10 17:48 . 2007-12-11 12:53 1,532,882 ---hs---- C:\WINDOWS\system32\wcbirmyp.ini

2007-12-09 17:26 . 2007-12-10 17:49 1,565,077 ---hs---- C:\WINDOWS\system32\wqbkbcac.ini

2007-12-09 17:19 . 2007-12-29 13:09 20,480 --a------ C:\WINDOWS\quit.exe

2007-12-06 16:42 . 2001-03-08 18:30 24,064 --a------ C:\WINDOWS\system32\msxml3a.dll

2007-12-04 14:47 . 2007-12-05 13:43 1,471,289 ---hs---- C:\WINDOWS\system32\ickautoa.ini

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2007-12-30 01:43 --------- d-----w C:\Program Files\Java

2007-12-30 00:38 --------- d-----w C:\Program Files\Ares

2007-12-30 00:37 --------- d--h--w C:\Program Files\InstallShield Installation Information

2007-12-30 00:37 --------- d-----w C:\Program Files\Fichiers communs\ArcSoft

2007-12-30 00:27 --------- d-----w C:\Program Files\QuickTime

2007-12-29 23:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy

2007-12-29 23:24 --------- d-----w C:\Documents and Settings\HP_Propriétaire\Application Data\Apple Computer

2007-12-29 23:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer

2007-12-22 11:03 --------- d-----w C:\Documents and Settings\Dany.NOM-0C9D00AA293\Application Data\LimeWire

2007-12-15 13:12 --------- d-----w C:\Program Files\MSN Messenger

2007-12-04 23:47 --------- d-----w C:\Program Files\Common Files

2007-12-04 22:13 --------- d-----w C:\Program Files\PlayMP3z

2007-12-02 21:22 --------- d-----w C:\Program Files\microsoft frontpage

2007-12-02 19:34 --------- d-----w C:\Program Files\PopCap Games

2007-12-02 19:32 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP

2007-11-26 21:45 --------- d-----w C:\Documents and Settings\Nick.NOM-0C9D00AA293\Application Data\LimeWire

2007-11-19 02:08 --------- d-----w C:\Program Files\Microsoft Games

2007-11-16 02:29 --------- d-----w C:\Documents and Settings\KelLie.NOM-0C9D00AA293\Application Data\LimeWire

2007-11-14 07:28 450,560 ----a-w C:\WINDOWS\system32\dllcache\jscript.dll

2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys

2007-11-10 19:30 --------- d-----w C:\Program Files\iTunes

2007-11-10 19:29 --------- d-----w C:\Program Files\iPod

2007-11-03 18:31 --------- d-----w C:\Program Files\PartyGaming

2007-10-30 10:18 3,079,680 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll

2007-10-29 22:43 1,293,824 ----a-w C:\WINDOWS\system32\quartz.dll

2007-10-29 22:43 1,293,824 ----a-w C:\WINDOWS\system32\dllcache\quartz.dll

2007-10-25 16:56 8,510,976 ----a-w C:\WINDOWS\system32\dllcache\shell32.dll

2007-10-20 11:01 227,328 ----a-w C:\WINDOWS\system32\wmasf.dll

2007-10-20 11:01 227,328 ----a-w C:\WINDOWS\system32\dllcache\wmasf.dll

2007-10-11 06:13 96,768 ----a-w C:\WINDOWS\system32\dllcache\inseng.dll

2007-10-11 06:13 663,552 ----a-w C:\WINDOWS\system32\dllcache\wininet.dll

2007-10-11 06:13 617,472 ----a-w C:\WINDOWS\system32\dllcache\urlmon.dll

2007-10-11 06:13 55,808 ----a-w C:\WINDOWS\system32\dllcache\extmgr.dll

2007-10-11 06:13 532,480 ----a-w C:\WINDOWS\system32\dllcache\mstime.dll

2007-10-11 06:13 474,624 ----a-w C:\WINDOWS\system32\dllcache\shlwapi.dll

2007-10-11 06:13 449,024 ----a-w C:\WINDOWS\system32\dllcache\mshtmled.dll

2007-10-11 06:13 39,424 ----a-w C:\WINDOWS\system32\dllcache\pngfilt.dll

2007-10-11 06:13 357,888 ----a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll

2007-10-11 06:13 251,392 ----a-w C:\WINDOWS\system32\dllcache\iepeers.dll

2007-10-11 06:13 205,312 ----a-w C:\WINDOWS\system32\dllcache\dxtrans.dll

2007-10-11 06:13 16,384 ----a-w C:\WINDOWS\system32\dllcache\jsproxy.dll

2007-10-11 06:13 152,064 ----a-w C:\WINDOWS\system32\dllcache\cdfview.dll

2007-10-11 06:13 146,432 ----a-w C:\WINDOWS\system32\dllcache\msrating.dll

2007-10-11 06:13 1,495,040 ----a-w C:\WINDOWS\system32\dllcache\shdocvw.dll

2007-10-11 06:13 1,056,768 ----a-w C:\WINDOWS\system32\dllcache\danim.dll

2007-10-11 06:13 1,024,000 ----a-w C:\WINDOWS\system32\dllcache\browseui.dll

2007-10-10 11:16 18,432 ----a-w C:\WINDOWS\system32\dllcache\iedw.exe

2007-08-25 16:31 88,936 ----a-w C:\Documents and Settings\KelLie.NOM-0C9D00AA293\Application Data\GDIPFONTCACHEV1.DAT

2007-05-22 01:36 88,936 ----a-w C:\Documents and Settings\Nick.NOM-0C9D00AA293\Application Data\GDIPFONTCACHEV1.DAT

2006-03-19 19:30 62,352 ----a-w C:\Documents and Settings\Dany\Application Data\GDIPFONTCACHEV1.DAT

2006-02-01 16:19 62,352 ----a-w C:\Documents and Settings\Sonia\Application Data\GDIPFONTCACHEV1.DAT

2006-01-31 22:34 62,352 ----a-w C:\Documents and Settings\Kellie\Application Data\GDIPFONTCACHEV1.DAT

2006-01-19 21:32 774,144 ----a-w C:\Program Files\RngInterstitial.dll

2005-12-25 22:35 8 ----a-w C:\Documents and Settings\Dany\Application Data\usb.dat.bin

2005-07-17 21:00 0 ----a-w C:\Documents and Settings\Dany\Application Data\wklnhst.dat

2004-03-11 18:27 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe

.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))

.

REGEDIT4

*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 20:00 15360]

"EPSON Stylus CX5800F Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIALA.exe" [2005-05-09 23:00 98304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"HPHUPD06"="c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe" [2004-06-07 20:53 49152]

"HPHmon06"="C:\WINDOWS\system32\hphmon06.exe" [2004-06-07 20:43 659456]

"PS2"="C:\WINDOWS\system32\ps2.exe" [2004-10-25 23:17 90112]

"LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 23:54 253952]

"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2007-12-29 13:35 249896]

"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 04:25 6731312]

"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2005-05-31 02:51 180269]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\

Microsoft Office.lnk.disabled [2006-08-08 19:56:03]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]

"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe"

"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" -atboottime

"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot

"AlcxMonitor"=ALCXMNTR.EXE

"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"

R3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 21:58]

R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 12:08]

S3 PTV371;Mini TV USB;C:\WINDOWS\system32\DRIVERS\PTV371.SYS [2006-04-14 15:56]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b7e52e1c-0005-11da-ba3d-806d6172696f}]

\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480

.

Contenu du dossier 'Scheduled Tasks/Tâches planifiées'

"2008-01-02 19:00:00 C:\WINDOWS\Tasks\A6E910479052837B.job"

- c:\docume~1\sonia~1.nom\applic~1\option~1\2purewipe.exe

"2007-12-29 19:23:34 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"

- C:\Program Files\Apple Software Update\SoftwareUpdate.exe

"2007-11-29 00:17:33 C:\WINDOWS\Tasks\At100.job"

- C:\WINDOWS\system32\nMP4fOMN.exe

"2007-11-29 00:17:33 C:\WINDOWS\Tasks\At101.job"

- C:\WINDOWS\system32\nMP4fOMN.exe

"2007-11-29 00:17:33 C:\WINDOWS\Tasks\At102.job"

- C:\WINDOWS\system32\nMP4fOMN.exe

"2007-12-22 11:00:45 C:\WINDOWS\Tasks\At103.job"

- C:\WINDOWS\system32\nMP4fOMN.exe

"2008-01-01 12:00:00 C:\WINDOWS\Tasks\At104.job"

- C:\WINDOWS\system32\nMP4fOMN.exe

"2008-01-01 13:00:00 C:\WINDOWS\Tasks\At105.job"

- C:\WINDOWS\system32\nMP4fOMN.exe

"2008-01-01 14:00:01 C:\WINDOWS\Tasks\At106.job"

- C:\WINDOWS\system32\nMP4fOMN.exe

"2007-12-31 15:00:00 C:\WINDOWS\Tasks\At107.job"

- C:\WINDOWS\system32\nMP4fOMN.exe

"2008-01-02 16:00:00 C:\WINDOWS\Tasks\At108.job"

- C:\WINDOWS\system32\nMP4fOMN.exe

"2008-01-02 17:00:00 C:\WINDOWS\Tasks\At109.job"

- C:\WINDOWS\system32\nMP4fOMN.exe

"2008-01-02 18:00:00 C:\WINDOWS\Tasks\At110.job"

- C:\WINDOWS\system32\nMP4fOMN.exe

"2008-01-02 19:00:00 C:\WINDOWS\Tasks\At111.job"

- C:\WINDOWS\system32\nMP4fOMN.exe

"2008-01-01 20:00:00 C:\WINDOWS\Tasks\At112.job"

- C:\WINDOWS\system32\nMP4fOMN.exe

"2008-01-01 21:00:00 C:\WINDOWS\Tasks\At113.job"

- C:\WINDOWS\system32\nMP4fOMN.exe

"2008-01-01 22:00:00 C:\WINDOWS\Tasks\At114.job"

- C:\WINDOWS\system32\nMP4fOMN.exe

"2008-01-01 23:00:00 C:\WINDOWS\Tasks\At115.job"

- C:\WINDOWS\system32\nMP4fOMN.exe

"2008-01-02 00:00:00 C:\WINDOWS\Tasks\At116.job"

- C:\WINDOWS\system32\nMP4fOMN.exe

"2008-01-02 01:00:00 C:\WINDOWS\Tasks\At117.job"

- C:\WINDOWS\system32\nMP4fOMN.exe

"2008-01-02 02:00:00 C:\WINDOWS\Tasks\At118.job"

- C:\WINDOWS\system32\nMP4fOMN.exe

"2008-01-02 03:00:00 C:\WINDOWS\Tasks\At119.job"

- C:\WINDOWS\system32\nMP4fOMN.exe

"2008-01-02 04:00:00 C:\WINDOWS\Tasks\At120.job"

- C:\WINDOWS\system32\nMP4fOMN.exe

"2008-01-02 05:00:00 C:\WINDOWS\Tasks\At121.job"

- C:\WINDOWS\system32\QVblq07i.exe

"2008-01-02 06:00:00 C:\WINDOWS\Tasks\At122.job"

- C:\WINDOWS\system32\QVblq07i.exe

"2007-11-29 21:30:40 C:\WINDOWS\Tasks\At123.job"

- C:\WINDOWS\system32\QVblq07i.exe

"2007-11-29 21:30:40 C:\WINDOWS\Tasks\At124.job"

- C:\WINDOWS\system32\QVblq07i.exe

"2007-11-29 21:30:40 C:\WINDOWS\Tasks\At125.job"

- C:\WINDOWS\system32\QVblq07i.exe

"2007-11-29 21:30:40 C:\WINDOWS\Tasks\At126.job"

- C:\WINDOWS\system32\QVblq07i.exe

"2007-12-22 11:00:45 C:\WINDOWS\Tasks\At127.job"

- C:\WINDOWS\system32\QVblq07i.exe

"2008-01-01 12:00:00 C:\WINDOWS\Tasks\At128.job"

- C:\WINDOWS\system32\QVblq07i.exe

"2008-01-01 13:00:00 C:\WINDOWS\Tasks\At129.job"

- C:\WINDOWS\system32\QVblq07i.exe

"2008-01-01 14:00:01 C:\WINDOWS\Tasks\At130.job"

- C:\WINDOWS\system32\QVblq07i.exe

"2007-12-31 15:00:00 C:\WINDOWS\Tasks\At131.job"

- C:\WINDOWS\system32\QVblq07i.exe

"2008-01-02 16:00:00 C:\WINDOWS\Tasks\At132.job"

- C:\WINDOWS\system32\QVblq07i.exe

"2008-01-02 17:00:00 C:\WINDOWS\Tasks\At133.job"

- C:\WINDOWS\system32\QVblq07i.exe

"2008-01-02 18:00:00 C:\WINDOWS\Tasks\At134.job"

- C:\WINDOWS\system32\QVblq07i.exe

"2008-01-02 19:00:00 C:\WINDOWS\Tasks\At135.job"

- C:\WINDOWS\system32\QVblq07i.exe

"2008-01-01 20:00:00 C:\WINDOWS\Tasks\At136.job"

- C:\WINDOWS\system32\QVblq07i.exe

"2008-01-01 21:00:00 C:\WINDOWS\Tasks\At137.job"

- C:\WINDOWS\system32\QVblq07i.exe

"2008-01-01 22:00:00 C:\WINDOWS\Tasks\At138.job"

- C:\WINDOWS\system32\QVblq07i.exe

"2008-01-01 23:00:00 C:\WINDOWS\Tasks\At139.job"

- C:\WINDOWS\system32\QVblq07i.exe

"2008-01-02 00:00:00 C:\WINDOWS\Tasks\At140.job"

- C:\WINDOWS\system32\QVblq07i.exe

"2008-01-02 01:00:00 C:\WINDOWS\Tasks\At141.job"

- C:\WINDOWS\system32\QVblq07i.exe

"2008-01-02 02:00:00 C:\WINDOWS\Tasks\At142.job"

- C:\WINDOWS\system32\QVblq07i.exe

"2008-01-02 03:00:00 C:\WINDOWS\Tasks\At143.job"

- C:\WINDOWS\system32\QVblq07i.exe

"2008-01-02 04:00:00 C:\WINDOWS\Tasks\At144.job"

- C:\WINDOWS\system32\QVblq07i.exe

"2008-01-02 05:00:00 C:\WINDOWS\Tasks\At145.job"

- C:\WINDOWS\system32\RY305Ji6.exe

"2008-01-02 06:00:00 C:\WINDOWS\Tasks\At146.job"

- C:\WINDOWS\system32\RY305Ji6.exe

"2007-12-18 04:55:53 C:\WINDOWS\Tasks\At147.job"

- C:\WINDOWS\system32\RY305Ji6.exe

"2007-12-18 04:55:53 C:\WINDOWS\Tasks\At148.job"

- C:\WINDOWS\system32\RY305Ji6.exe

"2007-12-18 04:55:53 C:\WINDOWS\Tasks\At149.job"

- C:\WINDOWS\system32\RY305Ji6.exe

"2007-12-18 04:55:53 C:\WINDOWS\Tasks\At150.job"

- C:\WINDOWS\system32\RY305Ji6.exe

"2007-12-22 11:01:52 C:\WINDOWS\Tasks\At151.job"

- C:\WINDOWS\system32\RY305Ji6.exe

"2008-01-01 12:00:00 C:\WINDOWS\Tasks\At152.job"

- C:\WINDOWS\system32\RY305Ji6.exe

"2008-01-01 13:00:00 C:\WINDOWS\Tasks\At153.job"

- C:\WINDOWS\system32\RY305Ji6.exe

"2008-01-01 14:00:02 C:\WINDOWS\Tasks\At154.job"

- C:\WINDOWS\system32\RY305Ji6.exe

"2007-12-31 15:00:00 C:\WINDOWS\Tasks\At155.job"

- C:\WINDOWS\system32\RY305Ji6.exe

"2008-01-02 16:00:00 C:\WINDOWS\Tasks\At156.job"

- C:\WINDOWS\system32\RY305Ji6.exe

"2008-01-02 17:00:00 C:\WINDOWS\Tasks\At157.job"

- C:\WINDOWS\system32\RY305Ji6.exe

"2008-01-02 18:00:00 C:\WINDOWS\Tasks\At158.job"

- C:\WINDOWS\system32\RY305Ji6.exe

"2008-01-02 19:00:00 C:\WINDOWS\Tasks\At159.job"

- C:\WINDOWS\system32\RY305Ji6.exe

"2008-01-01 20:00:00 C:\WINDOWS\Tasks\At160.job"

- C:\WINDOWS\system32\RY305Ji6.exe

"2008-01-01 21:00:00 C:\WINDOWS\Tasks\At161.job"

- C:\WINDOWS\system32\RY305Ji6.exe

"2008-01-01 22:00:00 C:\WINDOWS\Tasks\At162.job"

- C:\WINDOWS\system32\RY305Ji6.exe

"2008-01-01 23:00:00 C:\WINDOWS\Tasks\At163.job"

- C:\WINDOWS\system32\RY305Ji6.exe

"2008-01-02 00:00:00 C:\WINDOWS\Tasks\At164.job"

- C:\WINDOWS\system32\RY305Ji6.exe

"2008-01-02 01:00:00 C:\WINDOWS\Tasks\At165.job"

- C:\WINDOWS\system32\RY305Ji6.exe

"2008-01-02 02:00:00 C:\WINDOWS\Tasks\At166.job"

- C:\WINDOWS\system32\RY305Ji6.exe

"2008-01-02 03:00:00 C:\WINDOWS\Tasks\At167.job"

- C:\WINDOWS\system32\RY305Ji6.exe

"2008-01-02 04:00:00 C:\WINDOWS\Tasks\At168.job"

- C:\WINDOWS\system32\RY305Ji6.exe

"2008-01-02 06:00:00 C:\WINDOWS\Tasks\At26.job"

- C:\WINDOWS\system32\4ItJE164.exe

"2007-11-11 20:31:32 C:\WINDOWS\Tasks\At27.job"

- C:\WINDOWS\system32\4ItJE164.exe

"2007-11-11 20:31:32 C:\WINDOWS\Tasks\At28.job"

- C:\WINDOWS\system32\4ItJE164.exe

"2007-11-11 20:31:32 C:\WINDOWS\Tasks\At29.job"

- C:\WINDOWS\system32\4ItJE164.exe

"2007-11-11 20:31:32 C:\WINDOWS\Tasks\At30.job"

- C:\WINDOWS\system32\4ItJE164.exe

"2007-12-22 11:00:45 C:\WINDOWS\Tasks\At31.job"

- C:\WINDOWS\system32\4ItJE164.exe

"2008-01-01 12:00:00 C:\WINDOWS\Tasks\At32.job"

- C:\WINDOWS\system32\4ItJE164.exe

"2008-01-01 13:00:00 C:\WINDOWS\Tasks\At33.job"

- C:\WINDOWS\system32\4ItJE164.exe

"2008-01-01 14:00:02 C:\WINDOWS\Tasks\At34.job"

- C:\WINDOWS\system32\4ItJE164.exe

"2007-12-31 15:00:00 C:\WINDOWS\Tasks\At35.job"

- C:\WINDOWS\system32\4ItJE164.exe

"2008-01-02 16:00:00 C:\WINDOWS\Tasks\At36.job"

- C:\WINDOWS\system32\4ItJE164.exe

"2008-01-02 17:00:00 C:\WINDOWS\Tasks\At37.job"

- C:\WINDOWS\system32\4ItJE164.exe

"2008-01-02 18:00:00 C:\WINDOWS\Tasks\At38.job"

- C:\WINDOWS\system32\4ItJE164.exe

"2008-01-02 19:00:00 C:\WINDOWS\Tasks\At39.job"

- C:\WINDOWS\system32\4ItJE164.exe

"2008-01-01 20:00:00 C:\WINDOWS\Tasks\At40.job"

- C:\WINDOWS\system32\4ItJE164.exe

"2008-01-01 21:00:00 C:\WINDOWS\Tasks\At41.job"

- C:\WINDOWS\system32\4ItJE164.exe

"2008-01-01 22:00:00 C:\WINDOWS\Tasks\At42.job"

- C:\WINDOWS\system32\4ItJE164.exe

"2008-01-01 23:00:00 C:\WINDOWS\Tasks\At43.job"

- C:\WINDOWS\system32\4ItJE164.exe

"2008-01-02 00:00:00 C:\WINDOWS\Tasks\At44.job"

- C:\WINDOWS\system32\4ItJE164.exe

"2008-01-02 01:00:00 C:\WINDOWS\Tasks\At45.job"

- C:\WINDOWS\system32\4ItJE164.exe

"2008-01-02 02:00:00 C:\WINDOWS\Tasks\At46.job"

- C:\WINDOWS\system32\4ItJE164.exe

"2008-01-02 03:00:00 C:\WINDOWS\Tasks\At47.job"

- C:\WINDOWS\system32\4ItJE164.exe

"2008-01-02 04:00:00 C:\WINDOWS\Tasks\At48.job"

- C:\WINDOWS\system32\4ItJE164.exe

"2008-01-02 05:00:00 C:\WINDOWS\Tasks\At49.job"