[Résolu] PC infecté par ipexewin.exe

angelique · le 8 décembre 2008

tu as bien executer turlututu.reg ?? fait le

• tu va lancer HijackThis \open the misc tools section\clic open adsspy\ comme sur la capture là

http://www.bleepingcomputer.com/tutorials/...l42.html#adsspy

*clic scan \clic save log et enregistre le pour pouvoir poster le contenu stp , coche uniquement (que tu devrais voir!) :

C:\WINDOWS\system32:imwbi.exe

et clic remove selected.

• redemarre ton pc et reposte un nouveau rapport Gmer

-------------------

Voila ta bestiole coriace qui est pourtant bien détecté:

http://www.virustotal.com/fr/analisis/bc35...be3c6de1ceba83c

jaja33 · le 8 décembre 2008

un ptit soucis......

Quand je clique scan, puis save log, je n'ai aucune ligne qui apparait dans la fenêtre!!

Est-ce normal?

angelique · le 8 décembre 2008

faut decocher les 2 cases "quick scan" et "ignore safe..." , recommence

jaja33 · le 8 décembre 2008

J'ai enregistré le fichier log......je l'ai baptisé toto.txt

Ensuite quand je fais remove selected, voici le message que je reçois

The following ADS streams could not be deleted.

C:\WINDOWS\ystem32:imwbi.exe (130759 bytes)

Et j'ai 2 fois le fichier dans la liste après avoir scanné........est-ce normal?

Voilà toto.txt

C:\catchme.exe : Zone.Identifier (26 bytes)

C:\Documents and Settings\All Users\Documents\Ma musique\Échantillons de musique\Thumbs.db : encryptable (0 bytes)

C:\Documents and Settings\All Users\Documents\Mes images\Échantillons d'images\Thumbs.db : encryptable (0 bytes)

C:\Documents and Settings\LAMBERT\Bureau\Antivir\antivir_workstation_winu_fr_h.zip : Zone.Identifier (26 bytes)

C:\Documents and Settings\LAMBERT\Bureau\Antivir\hbedv.key : Zone.Identifier (26 bytes)

C:\Documents and Settings\LAMBERT\Bureau\ComboFix.exe : Zone.Identifier (26 bytes)

C:\Documents and Settings\LAMBERT\Bureau\dIAGhELP\DiagHelp.zip : Zone.Identifier (26 bytes)

C:\Documents and Settings\LAMBERT\Bureau\gmer\gmer.zip : Zone.Identifier (26 bytes)

C:\Documents and Settings\LAMBERT\Bureau\Google.url : favicon (1150 bytes)

C:\Documents and Settings\LAMBERT\Bureau\restoreregedit.vbs : Zone.Identifier (26 bytes)

C:\Documents and Settings\LAMBERT\Bureau\SDFix.exe : Zone.Identifier (26 bytes)

C:\Documents and Settings\LAMBERT\Bureau\tarlatata.bat : Zone.Identifier (26 bytes)

C:\Documents and Settings\LAMBERT\Bureau\tirlititi.bat : Zone.Identifier (26 bytes)

C:\Documents and Settings\LAMBERT\Bureau\toto.bat : Zone.Identifier (26 bytes)

C:\Documents and Settings\LAMBERT\Bureau\turlututu.reg : Zone.Identifier (26 bytes)

C:\Documents and Settings\LAMBERT\Bureau\WinsockxpFix.exe : Zone.Identifier (26 bytes)

C:\Documents and Settings\LAMBERT\Favoris\cinéma.url : favicon (1406 bytes)

C:\Documents and Settings\LAMBERT\Favoris\eBay.fr.url : favicon (1406 bytes)

C:\Documents and Settings\LAMBERT\Favoris\Echanges d'images Panini.url : favicon (18718 bytes)

C:\Documents and Settings\LAMBERT\Favoris\Google.url : favicon (1406 bytes)

C:\Documents and Settings\LAMBERT\Favoris\Lycos.url : favicon (318 bytes)

C:\Documents and Settings\LAMBERT\Favoris\mail_laposte.url : favicon (2550 bytes)

C:\Documents and Settings\LAMBERT\Favoris\Mappy.url : favicon (3638 bytes)

C:\Documents and Settings\LAMBERT\Favoris\météo.url : favicon (1406 bytes)

C:\Documents and Settings\LAMBERT\Favoris\Pages jaunes.url : favicon (318 bytes)

C:\Documents and Settings\LAMBERT\Favoris\Poisson Rouge.url : favicon (3774 bytes)

C:\Documents and Settings\LAMBERT\Favoris\Programme TV .url : favicon (894 bytes)

C:\Documents and Settings\LAMBERT\Favoris\sandra.url : favicon (1150 bytes)

C:\Documents and Settings\LAMBERT\Favoris\seb\Allopros.url : favicon (1150 bytes)

C:\Documents and Settings\LAMBERT\Favoris\seb\coteur.url : favicon (3638 bytes)

C:\Documents and Settings\LAMBERT\Favoris\seb\Coupe de France des Régions.url : favicon (15086 bytes)

C:\Documents and Settings\LAMBERT\Favoris\seb\créer un forum First Footstar Team of Luxembourg.url : favicon (15086 bytes)

C:\Documents and Settings\LAMBERT\Favoris\seb\Footstar.url : favicon (1080 bytes)

C:\Documents and Settings\LAMBERT\Favoris\seb\Forums Zebulon.fr.url : favicon (796 bytes)

C:\Documents and Settings\LAMBERT\Favoris\seb\France Football .url : favicon (1334 bytes)

C:\Documents and Settings\LAMBERT\Favoris\seb\FranceStats-HT.url : favicon (894 bytes)

C:\Documents and Settings\LAMBERT\Favoris\seb\Française des Jeux .url : favicon (318 bytes)

C:\Documents and Settings\LAMBERT\Favoris\seb\Fvl.url : favicon (1150 bytes)

C:\Documents and Settings\LAMBERT\Favoris\seb\GanEden.url : favicon (15086 bytes)

C:\Documents and Settings\LAMBERT\Favoris\seb\Hattrick.url : favicon (3126 bytes)

C:\Documents and Settings\LAMBERT\Favoris\seb\L'EQUIPE.url : favicon (1334 bytes)

C:\Documents and Settings\LAMBERT\Favoris\seb\MadWin.url : favicon (822 bytes)

C:\Documents and Settings\LAMBERT\Favoris\seb\MyP2P.url : favicon (1150 bytes)

C:\Documents and Settings\LAMBERT\Favoris\seb\Note du match Hattrick.url : favicon (5174 bytes)

C:\Documents and Settings\LAMBERT\Favoris\seb\Paypal 3dsl@orange.fr.url : favicon (1406 bytes)

C:\Documents and Settings\LAMBERT\Favoris\seb\Prizee.url : favicon (2238 bytes)

C:\Documents and Settings\LAMBERT\Favoris\seb\Pronosoft.url : favicon (1078 bytes)

C:\Documents and Settings\LAMBERT\Favoris\seb\PuissanceFoot.url : favicon (3638 bytes)

C:\Documents and Settings\LAMBERT\Favoris\seb\stats foot.url : favicon (25214 bytes)

C:\Documents and Settings\LAMBERT\Favoris\UpToTen Enfants.url : favicon (1406 bytes)

C:\Documents and Settings\LAMBERT\Favoris\Wikipédia.url : favicon (318 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Courrier de c3a\Inbox\00294823-00000001.eml : OEStandardProperty (1542 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Deleted Items\0F9F4E96-00000001.eml : OEStandardProperty (1504 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\004E1893-00000068.eml : OEStandardProperty (1448 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\00C570E7-0000003F.eml : OEStandardProperty (1934 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\00FD70F9-00000095.eml : OEStandardProperty (1402 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\01385ABF-00000001.eml : OEStandardProperty (1390 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\01F23AC0-000000AD.eml : OEStandardProperty (1510 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\02EC6C59-00000069.eml : OEStandardProperty (1556 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\0353068F-00000038.eml : OEStandardProperty (1322 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\035F2CEF-00000033.eml : OEStandardProperty (1426 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\03786FDB-000000B5.eml : OEStandardProperty (1954 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\037D1C1D-0000008E.eml : OEStandardProperty (1324 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\03C457E2-0000006C.eml : OEStandardProperty (2466 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\05A469EF-0000008C.eml : OEStandardProperty (1382 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\06B8663C-00000042.eml : OEStandardProperty (2034 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\06C3200A-00000024.eml : OEStandardProperty (1378 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\073F1D7E-00000081.eml : OEStandardProperty (1344 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\07A7552C-00000011.eml : OEStandardProperty (1492 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\07EE278B-00000037.eml : OEStandardProperty (1322 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\083C49A3-000000A7.eml : OEStandardProperty (1472 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\08C12469-00000002.eml : OEStandardProperty (1420 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\0BE6419A-0000006B.eml : OEStandardProperty (1386 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\0C0F0E3D-000000BA.eml : OEStandardProperty (1376 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\0C2E548E-000000AF.eml : OEStandardProperty (1474 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\0CF44016-00000035.eml : OEStandardProperty (1280 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\0DD90746-0000009E.eml : OEStandardProperty (1250 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\0F0D5331-00000031.eml : OEStandardProperty (1370 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\0F741D71-00000043.eml : OEStandardProperty (2032 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\11EE6563-000000B1.eml : OEStandardProperty (1336 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\12092404-00000082.eml : OEStandardProperty (1462 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\12E9449D-000000AB.eml : OEStandardProperty (1614 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\1460072F-00000065.eml : OEStandardProperty (1422 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\151E7C01-00000093.eml : OEStandardProperty (1544 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\15C65C46-00000084.eml : OEStandardProperty (1400 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\16BD1122-0000005E.eml : OEStandardProperty (1368 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\18136F2B-0000004A.eml : OEStandardProperty (1528 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\18FA3E38-00000085.eml : OEStandardProperty (1318 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\1A071982-000000A8.eml : OEStandardProperty (1418 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\1A6D118F-00000026.eml : OEStandardProperty (1834 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\1C5E2D43-00000007.eml : OEStandardProperty (1732 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\1D5945D3-0000001E.eml : OEStandardProperty (1368 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\1D721A1A-00000017.eml : OEStandardProperty (1846 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\1EEE5C8E-00000083.eml : OEStandardProperty (1392 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\1F001DBC-000000B8.eml : OEStandardProperty (1360 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\1F52200C-00000059.eml : OEStandardProperty (1486 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\201B41F2-00000003.eml : OEStandardProperty (1744 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\208C6BE7-000000B2.eml : OEStandardProperty (1322 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\209B03A3-00000040.eml : OEStandardProperty (1936 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\20DF0910-00000092.eml : OEStandardProperty (1544 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\217D2C5F-00000054.eml : OEStandardProperty (1438 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\22CC59BA-00000021.eml : OEStandardProperty (4198 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\242A3CC3-000000BC.eml : OEStandardProperty (1736 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\24AA38C5-00000027.eml : OEStandardProperty (1304 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\25D1471A-00000039.eml : OEStandardProperty (1314 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\25D31604-000000A2.eml : OEStandardProperty (1476 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\29F32386-0000001C.eml : OEStandardProperty (1544 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\2B3A2742-0000007B.eml : OEStandardProperty (1472 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\2B596BE0-0000005B.eml : OEStandardProperty (1492 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\2CF42D51-0000000D.eml : OEStandardProperty (1732 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\2D344C7B-00000019.eml : OEStandardProperty (1654 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\2D5C7FF2-000000A4.eml : OEStandardProperty (1470 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\2D83751E-00000025.eml : OEStandardProperty (2134 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\2E4430AB-00000016.eml : OEStandardProperty (1660 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\2EB776D1-00000091.eml : OEStandardProperty (1534 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\2F5E2148-00000028.eml : OEStandardProperty (1616 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\2F832D16-0000008A.eml : OEStandardProperty (1408 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\2F8D3B6C-00000063.eml : OEStandardProperty (1380 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\30D8327A-0000006A.eml : OEStandardProperty (2120 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\31394703-00000098.eml : OEStandardProperty (1554 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\31E53237-0000007C.eml : OEStandardProperty (1506 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\323B52A6-0000004D.eml : OEStandardProperty (1494 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\33B57D3F-0000002E.eml : OEStandardProperty (1420 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\345341DC-0000002C.eml : OEStandardProperty (1370 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\368D0100-0000009F.eml : OEStandardProperty (1422 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\3825133E-0000003D.eml : OEStandardProperty (1912 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\383C441D-00000066.eml : OEStandardProperty (1350 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\38432F2D-0000003A.eml : OEStandardProperty (1480 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\3AEA67C3-0000007F.eml : OEStandardProperty (1440 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\3B410214-0000007D.eml : OEStandardProperty (1376 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\3BE50AC3-00000056.eml : OEStandardProperty (1488 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\3C5B70B1-00000074.eml : OEStandardProperty (1466 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\3CA32FAC-00000058.eml : OEStandardProperty (1432 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\3E246086-000000A1.eml : OEStandardProperty (1470 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\3E55197B-00000018.eml : OEStandardProperty (6052 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\3F1A6CE4-00000029.eml : OEStandardProperty (1616 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\3F3967F4-0000000E.eml : OEStandardProperty (2558 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\3FFD4BCF-00000070.eml : OEStandardProperty (1550 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\4001052C-00000030.eml : OEStandardProperty (1610 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\40815B68-000000B7.eml : OEStandardProperty (1580 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\408773F8-00000051.eml : OEStandardProperty (1416 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\411A696A-0000005C.eml : OEStandardProperty (1510 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\412618B6-00000047.eml : OEStandardProperty (1528 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\41454D75-0000002B.eml : OEStandardProperty (1316 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\4180035A-0000001A.eml : OEStandardProperty (1338 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\41B85116-00000009.eml : OEStandardProperty (1484 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\435D4DD9-00000048.eml : OEStandardProperty (1344 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\43681326-0000005F.eml : OEStandardProperty (1416 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\47A50184-00000036.eml : OEStandardProperty (1280 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\47F426BA-0000007E.eml : OEStandardProperty (1294 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\48785755-0000000B.eml : OEStandardProperty (1890 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\491C57DA-0000007A.eml : OEStandardProperty (1454 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\493D52E2-00000075.eml : OEStandardProperty (1466 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\49FE0771-00000096.eml : OEStandardProperty (1524 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\4A035857-000000B0.eml : OEStandardProperty (1540 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\4A956293-00000046.eml : OEStandardProperty (1470 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\4AA942CC-0000004B.eml : OEStandardProperty (1392 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\4C1A5791-0000000F.eml : OEStandardProperty (1500 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\4E583B5F-000000B6.eml : OEStandardProperty (1504 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\4EBF1EA2-0000001B.eml : OEStandardProperty (1368 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\4EF07715-0000003B.eml : OEStandardProperty (1640 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\4F551DC3-00000071.eml : OEStandardProperty (1442 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\4F713A6D-00000060.eml : OEStandardProperty (1704 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\4F971D5B-00000077.eml : OEStandardProperty (1466 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\4FDB3C80-00000089.eml : OEStandardProperty (1650 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\51132F56-00000067.eml : OEStandardProperty (1566 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\5154273F-000000AA.eml : OEStandardProperty (1422 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\51E96EE0-00000015.eml : OEStandardProperty (1916 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\54A56970-00000010.eml : OEStandardProperty (10424 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\54BE7D96-00000005.eml : OEStandardProperty (1926 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\54F43640-0000003E.eml : OEStandardProperty (1936 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\55B13C3D-000000AE.eml : OEStandardProperty (1672 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\55D3137B-0000009B.eml : OEStandardProperty (1356 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\579E353C-00000032.eml : OEStandardProperty (1424 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\57BE0CDE-0000004E.eml : OEStandardProperty (1554 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\5805324C-000000A0.eml : OEStandardProperty (1446 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\58A0566B-00000086.eml : OEStandardProperty (1538 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\5989684E-00000034.eml : OEStandardProperty (1292 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\5A9F3BAD-000000AC.eml : OEStandardProperty (1422 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\5AD61D63-00000004.eml : OEStandardProperty (1908 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\5B642184-00000094.eml : OEStandardProperty (1408 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\5BA15E88-0000009D.eml : OEStandardProperty (1480 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\5CF70D92-00000079.eml : OEStandardProperty (1420 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\5DB36535-0000009A.eml : OEStandardProperty (1458 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\5E675FF3-00000020.eml : OEStandardProperty (1784 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\60424CA7-00000076.eml : OEStandardProperty (1466 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\60FA0756-00000055.eml : OEStandardProperty (1462 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\610379BF-000000A6.eml : OEStandardProperty (1592 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\620005EB-00000099.eml : OEStandardProperty (1406 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\62AF66ED-000000A5.eml : OEStandardProperty (1364 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\633C2D75-0000000A.eml : OEStandardProperty (1732 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\63852913-00000078.eml : OEStandardProperty (1462 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\63C32EC9-0000001F.eml : OEStandardProperty (1316 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\64424563-0000000C.eml : OEStandardProperty (1590 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\65821DBE-0000002D.eml : OEStandardProperty (1372 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\671F3F37-00000090.eml : OEStandardProperty (1498 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\6764085E-00000023.eml : OEStandardProperty (1592 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\67F45AEA-0000002A.eml : OEStandardProperty (9092 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\68045478-0000002F.eml : OEStandardProperty (1552 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\698A0DEF-0000003C.eml : OEStandardProperty (1912 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\69A865FB-00000052.eml : OEStandardProperty (1548 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\6B121EA0-00000008.eml : OEStandardProperty (1306 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\6B444A3A-00000097.eml : OEStandardProperty (1320 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\6B5E39E1-00000050.eml : OEStandardProperty (1422 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\6C151181-00000062.eml : OEStandardProperty (2630 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\6C3B1420-0000008B.eml : OEStandardProperty (1498 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\6CD30058-00000041.eml : OEStandardProperty (1934 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\6E3A528C-00000057.eml : OEStandardProperty (1344 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\6FD76B18-000000B4.eml : OEStandardProperty (1488 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\708C4B2E-00000053.eml : OEStandardProperty (1594 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\70964713-0000006E.eml : OEStandardProperty (1878 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\710D7DED-0000005A.eml : OEStandardProperty (1478 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\71194D84-0000006F.eml : OEStandardProperty (1544 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\71AE3F57-000000B9.eml : OEStandardProperty (1266 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\72645ACC-000000BB.eml : OEStandardProperty (1414 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\728370D0-00000006.eml : OEStandardProperty (2118 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\728F14D9-00000061.eml : OEStandardProperty (1974 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\72FB533B-00000064.eml : OEStandardProperty (1458 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\732D1DBC-0000005D.eml : OEStandardProperty (2898 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\733F783E-00000014.eml : OEStandardProperty (1454 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\73AF1EE5-00000087.eml : OEStandardProperty (1274 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\73BA5892-00000044.eml : OEStandardProperty (1468 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\73BF2947-0000004C.eml : OEStandardProperty (1712 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\73C143E5-00000049.eml : OEStandardProperty (1374 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\742A6890-00000080.eml : OEStandardProperty (1474 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\74B169F4-00000022.eml : OEStandardProperty (4232 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\74D73B17-000000A3.eml : OEStandardProperty (1470 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\753442E7-0000008D.eml : OEStandardProperty (1320 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\79610774-00000073.eml : OEStandardProperty (1444 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\79A35391-00000045.eml : OEStandardProperty (1476 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\79EE405F-0000004F.eml : OEStandardProperty (1686 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\7A4A0F5B-00000012.eml : OEStandardProperty (1576 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\7A9B5277-00000013.eml : OEStandardProperty (1576 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\7B030316-000000B3.eml : OEStandardProperty (1428 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\7CC36E2A-0000008F.eml : OEStandardProperty (1320 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\7D2A2494-0000009C.eml : OEStandardProperty (1358 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\7DA839D7-00000072.eml : OEStandardProperty (1464 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\7DCF4A9B-000000A9.eml : OEStandardProperty (1420 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\7E610A49-0000006D.eml : OEStandardProperty (1518 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\7EE9045C-0000001D.eml : OEStandardProperty (1516 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Inbox\7F7135B6-00000088.eml : OEStandardProperty (1416 bytes)

C:\Documents and Settings\LAMBERT\Local Settings\Application Data\Microsoft\Windows Live Mail\Travail\Junk E-mail\12DB153C-00000001.eml : OEStandardProperty (1440 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\loisirs\blagues\AMITIE1.pps : Zone.Identifier (26 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\loisirs\blagues\ARBRENOEL.pps : Zone.Identifier (26 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\loisirs\blagues\Créationdelafemme..pps : Zone.Identifier (26 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\loisirs\blagues\Eurovision.pps : Zone.Identifier (26 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\loisirs\blagues\que c'était bien avant!!.pps : Zone.Identifier (26 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\loisirs\blagues\renélepoisson_1.pps : Zone.Identifier (26 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\loisirs\blagues\RetraireChirac.pps : Zone.Identifier (26 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\loisirs\blagues\Thumbs.db : encryptable (0 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\loisirs\Mariage Laetitia\Thumbs.db : encryptable (0 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\loisirs\Oziers 2006\Thumbs.db : encryptable (0 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\loisirs\Thumbs.db : encryptable (0 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\loisirs\tour avion A89\Thumbs.db : encryptable (0 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\Mes fichiers reçus\113.JPG : Zone.Identifier (26 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\Mes fichiers reçus\P1000401.JPG : Zone.Identifier (26 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\Mes fichiers reçus\Photos-0049.jpg : Zone.Identifier (26 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\Mes fichiers reçus\Thumbs.db : encryptable (0 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\Mes images\chateauneuf\Thumbs.db : encryptable (0 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\Mes images\colette\Noel 2007\Thumbs.db : encryptable (0 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\Mes images\colette\Thumbs.db : encryptable (0 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\Mes images\jonas\Thumbs.db : encryptable (0 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\Mes images\photos Sandra\100_1194.jpg : Zone.Identifier (26 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\Mes images\photos Sandra\100_1195.jpg : Zone.Identifier (26 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\Mes images\photos Sandra\100_1196.jpg : Zone.Identifier (26 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\Mes images\photos Sandra\100_1197.jpg : Zone.Identifier (26 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\Mes images\photos Sandra\Thumbs.db : encryptable (0 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\Mes images\piquette\Thumbs.db : encryptable (0 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\Mes images\pontcharal\Thumbs.db : encryptable (0 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\Mes images\Saint Ybard 2007\Thumbs.db : encryptable (0 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\Mes images\Thumbs.db : encryptable (0 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\msn messenger\INSTALL_MSN_MESSENGER_NT.EXE : Zone.Identifier (26 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\msn messenger\WLinstaller.exe : Zone.Identifier (26 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\My Stationery\Thumbs.db : encryptable (0 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\SANDRA\Beaulieu sur dordogne\Thumbs.db : encryptable (0 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\SANDRA\féérie\Thumbs.db : encryptable (0 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\SANDRA\jaguet\Thumbs.db : encryptable (0 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\SANDRA\Océane\Thumbs.db : encryptable (0 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\SANDRA\photo appareil Mael&Matteo\Thumbs.db : encryptable (0 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\SANDRA\photo matteo\Thumbs.db : encryptable (0 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\SANDRA\photo Sandra\collègues\P1070464.JPG : Zone.Identifier (26 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\SANDRA\photo Sandra\collègues\P1070465.JPG : Zone.Identifier (26 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\SANDRA\photo Sandra\collègues\P1070467.JPG : Zone.Identifier (26 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\SANDRA\photo Sandra\collègues\P1070470.JPG : Zone.Identifier (26 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\SANDRA\photo Sandra\collègues\P1070472.JPG : Zone.Identifier (26 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\SANDRA\photo Sandra\collègues\Thumbs.db : encryptable (0 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\SANDRA\photo Sandra\Noel 2007\Thumbs.db : encryptable (0 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\SANDRA\photo Sandra\petit paradis de jacqueline\IMG_4189.jpg : Zone.Identifier (26 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\SANDRA\photo Sandra\petit paradis de jacqueline\IMG_4221.jpg : Zone.Identifier (26 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\SANDRA\photo Sandra\petit paradis de jacqueline\IMG_4223.jpg : Zone.Identifier (26 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\SANDRA\photo Sandra\petit paradis de jacqueline\Thumbs.db : encryptable (0 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\SANDRA\photo Sandra\Thumbs.db : encryptable (0 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\SANDRA\photos mael\Thumbs.db : encryptable (0 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\SANDRA\Photos St Pardoux\Thumbs.db : encryptable (0 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\SANDRA\photos vac. Guy et Colette TURQUIE\Thumbs.db : encryptable (0 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\SANDRA\phtos pêche\Thumbs.db : encryptable (0 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\SANDRA\powerpoint sandra\JourJeTaime.pps : Zone.Identifier (26 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\SANDRA\Thumbs.db : encryptable (0 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\SANDRA\vacances\Thumbs.db : encryptable (0 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\SANDRA\vassivière\Thumbs.db : encryptable (0 bytes)

C:\Documents and Settings\LAMBERT\Mes documents\Thumbs.db : encryptable (0 bytes)

C:\HJT\sghreu.exe : Zone.Identifier (26 bytes)

C:\Program Files\ADOBE\photoshop 7.0\Help\images\Thumbs.db : encryptable (0 bytes)

C:\Program Files\ADOBE\photoshop 7.0\Paramètres prédéfinis\Galerie Web Photo\Diaporama vertical 2\images\Thumbs.db : encryptable (0 bytes)

C:\Program Files\ADOBE\photoshop 7.0\Paramètres prédéfinis\Galerie Web Photo\Horizontale bleu et gris\images\Thumbs.db : encryptable (0 bytes)

C:\Program Files\ADOBE\photoshop 7.0\Paramètres prédéfinis\Galerie Web Photo\Horizontale foncée\images\Thumbs.db : encryptable (0 bytes)

C:\Program Files\ADOBE\photoshop 7.0\Paramètres prédéfinis\Galerie Web Photo\Horizontale à dessins\images\Thumbs.db : encryptable (0 bytes)

C:\Program Files\ADOBE\photoshop 7.0\Paramètres prédéfinis\Galerie Web Photo\Tableau\images\Thumbs.db : encryptable (0 bytes)

C:\Program Files\ADOBE\photoshop 7.0\Paramètres prédéfinis\Galerie Web Photo\Tableau - Bleu\images\Thumbs.db : encryptable (0 bytes)

C:\Program Files\ADOBE\photoshop 7.0\Paramètres prédéfinis\Textures\Thumbs.db : encryptable (0 bytes)

C:\Program Files\eMule\Incoming\Thumbs.db : encryptable (0 bytes)

C:\Program Files\Fichier de personnalisation COVADIS\Cov2007Base.arx : Zone.Identifier (26 bytes)

C:\Program Files\Geomedia SA\Covadis\Patch\Programmes\Cov2007Base.arx : Zone.Identifier (26 bytes)

C:\Program Files\Geomedia SA\Covadis\Programmes\Cov2007Base.arx : Zone.Identifier (26 bytes)

C:\Program Files\Geomedia SA\Covadis\Thumbs.db : encryptable (0 bytes)

C:\Program Files\Leica Geosystems\Cyclone\CloudWorx\AutoCAD 2000\bitmaps\Thumbs.db : encryptable (0 bytes)

C:\Program Files\Microsoft Office\Clipart\Popular\Thumbs.db : encryptable (0 bytes)

C:\Program Files\Microsoft Office\Clipart\PUB60COR\Thumbs.db : encryptable (0 bytes)

C:\Program Files\Microsoft Office\Clipart\Publisher\Backgrounds\Thumbs.db : encryptable (0 bytes)

C:\Program Files\Microsoft Office\Clipart\Puces\Thumbs.db : encryptable (0 bytes)

C:\Program Files\Microsoft Office\Clipart\Traits\Thumbs.db : encryptable (0 bytes)

C:\Qoobox\CFScript_used_2008-12-06@19.49.txt : Zone.Identifier (26 bytes)

C:\Qoobox\Quarantine\C\Program Files\Eurobarre\eb.exe.vir : SummaryInformation (88 bytes)

C:\Qoobox\Quarantine\C\Program Files\Eurobarre\eb.exe.vir : {4c8cc155-6c1e-11d1-8e41-00c04fb9386d} (0 bytes)

C:\Qoobox\Quarantine\C\Program Files\Eurobarre\Eurofake.exe.vir : SummaryInformation (88 bytes)

C:\Qoobox\Quarantine\C\Program Files\Eurobarre\Eurofake.exe.vir : {4c8cc155-6c1e-11d1-8e41-00c04fb9386d} (0 bytes)

C:\Qoobox\Quarantine\C\Program Files\Eurobarre\setup214.exe.vir : Zone.Identifier (26 bytes)

C:\Qoobox\Quarantine\C\Program Files\Eurobarre\Thumbs.db.vir : encryptable (0 bytes)

C:\Qoobox\Quarantine\C\Program Files\Eurobarre\Uninstall\Thumbs.db.vir : encryptable (0 bytes)

C:\SEB\100.doc : Zone.Identifier (26 bytes)

C:\SEB\astroraidinstall.exe : Zone.Identifier (26 bytes)

C:\SEB\Childsplay-0.85.1_win32.exe : Zone.Identifier (26 bytes)

C:\SEB\flechette_calcul_points.zip : Zone.Identifier (26 bytes)

C:\SEB\fléchettes_prog.exe : Zone.Identifier (26 bytes)

C:\SEB\HO_1421\HO_1421.zip : Zone.Identifier (26 bytes)

C:\SEB\imagemo_fr_install.exe : Zone.Identifier (26 bytes)

C:\SEB\kfk.exe : Zone.Identifier (26 bytes)

C:\SEB\scynse_man.exe : Zone.Identifier (26 bytes)

C:\SEB\Thumbs.db : encryptable (0 bytes)

C:\Thumbs.db : encryptable (0 bytes)

C:\WINDOWS\system32 : imwbi.exe (130759 bytes)

C:\WINDOWS\Thumbs.db : encryptable (0 bytes)

E:\3DSL\CREATION\Carte de visite\Thumbs.db : encryptable (0 bytes)

E:\3DSL\CREATION\Courrier\Thumbs.db : encryptable (0 bytes)

E:\3DSL\CREATION\devis\Thumbs.db : encryptable (0 bytes)

E:\3DSL\CREATION\Formation Leica\Formation HDS 3000\Jean-Pierre\Thumbs.db : encryptable (0 bytes)

E:\3DSL\CREATION\Formation Leica\Formation HDS 3000\photos\Thumbs.db : encryptable (0 bytes)

E:\3DSL\CREATION\Formation Leica\Formation HDS 3000\SAINT YBARD\Eglise\Thumbs.db : encryptable (0 bytes)

E:\3DSL\CREATION\illustrations\Thumbs.db : encryptable (0 bytes)

E:\3DSL\CREATION\Logo\Thumbs.db : encryptable (0 bytes)

E:\3DSL\CREATION\Matériel\Leica\CycloneSetup55.exe : Zone.Identifier (26 bytes)

E:\3DSL\CREATION\Matériel\Leica\Doc Scanstation\Thumbs.db : encryptable (0 bytes)

E:\3DSL\CREATION\Matériel\Leica\HDS 3000\Thumbs.db : encryptable (0 bytes)

E:\3DSL\CREATION\Matériel\Leica\panne HDS 3000\Telnet HDS 3000_ScanStation pour Diags fr.doc : Zone.Identifier (26 bytes)

E:\3DSL\CREATION\Matériel\Leica\patrice gaubert\diag.zip : Zone.Identifier (26 bytes)

E:\3DSL\CREATION\Matériel\Leica\patrice gaubert\Telnet HDS 3000_ScanStation pour Diags fr.doc : Zone.Identifier (26 bytes)

E:\3DSL\CREATION\Matériel\Leica\scanstation\Thumbs.db : encryptable (0 bytes)

E:\3DSL\CREATION\Plaquette\Thumbs.db : encryptable (0 bytes)

E:\3DSL\CREATION\tampon\Thumbs.db : encryptable (0 bytes)

E:\3DSL\INTERVENTIONS\bessines\Batiment 1\Plans\Thumbs.db : encryptable (0 bytes)

E:\3DSL\INTERVENTIONS\BLOCFER\Levé bâtiment\photos\Thumbs.db : encryptable (0 bytes)

E:\3DSL\INTERVENTIONS\DUBROCA LETRANGE\Charpente Ussel\Dessins\Thumbs.db : encryptable (0 bytes)

E:\3DSL\INTERVENTIONS\DUBROCA LETRANGE\Charpente Ussel\photos\Thumbs.db : encryptable (0 bytes)

E:\3DSL\INTERVENTIONS\DUBROCA LETRANGE\Charpente Ussel\Thumbs.db : encryptable (0 bytes)

E:\3DSL\INTERVENTIONS\Maison Terrasson\photos\Thumbs.db : encryptable (0 bytes)

E:\3DSL\INTERVENTIONS\Maisons Agoreha\12 malpas\façades.dwg : Zone.Identifier (26 bytes)

E:\3DSL\INTERVENTIONS\Maisons Agoreha\12 malpas\plans_niveau.dwg : Zone.Identifier (26 bytes)

E:\3DSL\INTERVENTIONS\Maisons Agoreha\32 Hugo\façades.dwg : Zone.Identifier (26 bytes)

E:\3DSL\INTERVENTIONS\Maisons Agoreha\32 Hugo\plans_niveau.dwg : Zone.Identifier (26 bytes)

E:\3DSL\INTERVENTIONS\Maisons Agoreha\poisiat\façades.dwg : Zone.Identifier (26 bytes)

E:\3DSL\INTERVENTIONS\Maisons Agoreha\poisiat\plans_niveau.dwg : Zone.Identifier (26 bytes)

E:\3DSL\INTERVENTIONS\Montauran\Fichiers\façades\Thumbs.db : encryptable (0 bytes)

E:\3DSL\INTERVENTIONS\Montauran\Fichiers\Thumbs.db : encryptable (0 bytes)

E:\3DSL\INTERVENTIONS\Montauran\Photos\photos pour plaquage\Thumbs.db : encryptable (0 bytes)

E:\3DSL\INTERVENTIONS\Montauran\Photos\Thumbs.db : encryptable (0 bytes)

E:\3DSL\INTERVENTIONS\Pascual\Lille\Centre Commercial des Tanneurs\Molinel\Photos\Thumbs.db : encryptable (0 bytes)

E:\3DSL\INTERVENTIONS\Pascual\Lille\Centre Commercial des Tanneurs\Molinel\Thumbs.db : encryptable (0 bytes)

E:\3DSL\INTERVENTIONS\Pascual\Lille\Centre Commercial des Tanneurs\Paris\Photos\Thumbs.db : encryptable (0 bytes)

E:\3DSL\INTERVENTIONS\Pascual\Lille\Centre Commercial des Tanneurs\Paris\Thumbs.db : encryptable (0 bytes)

E:\3DSL\INTERVENTIONS\Pascual\Lille\Centre Commercial des Tanneurs\Sec Arembault\Centre commercial\Photos\Thumbs.db : encryptable (0 bytes)

E:\3DSL\INTERVENTIONS\Pascual\Lille\Centre Commercial des Tanneurs\Sec Arembault\Centre commercial\Thumbs.db : encryptable (0 bytes)

E:\3DSL\INTERVENTIONS\Pascual\Lille\Centre Commercial des Tanneurs\Sec Arembault\Façade FNAC\Photos\Thumbs.db : encryptable (0 bytes)

E:\3DSL\INTERVENTIONS\Pascual\Lille\Centre Commercial des Tanneurs\Sec Arembault\Façade FNAC\Thumbs.db : encryptable (0 bytes)

E:\3DSL\INTERVENTIONS\Pascual\Lille\Centre Commercial des Tanneurs\Tanneurs\Photos\Thumbs.db : encryptable (0 bytes)

E:\3DSL\INTERVENTIONS\Pascual\Lille\Centre Commercial des Tanneurs\Tanneurs\Thumbs.db : encryptable (0 bytes)

E:\3DSL\INTERVENTIONS\Pascual\Lille\doc_jointe\Grandplace-Fac-2007-05.dwg : Zone.Identifier (26 bytes)

E:\3DSL\INTERVENTIONS\Pascual\Lille\doc_jointe\Reperage Stations.dwg : Zone.Identifier (26 bytes)

E:\3DSL\INTERVENTIONS\Pascual\Lille\doc_jointe\Reperage stations.pdf : Zone.Identifier (26 bytes)

E:\3DSL\INTERVENTIONS\Pascual\Lille\Photos\Photos pour plaquage\Rue de Molinel\Thumbs.db : encryptable (0 bytes)

E:\3DSL\INTERVENTIONS\Pascual\Lille\Photos\Photos pour plaquage\Rue de Paris\Thumbs.db : encryptable (0 bytes)

E:\3DSL\INTERVENTIONS\Pascual\Lille\Photos\Photos pour plaquage\Rue des Tanneurs\Thumbs.db : encryptable (0 bytes)

E:\3DSL\INTERVENTIONS\Pascual\Lille\Photos\Photos pour plaquage\Rue du Sec Arembault\Thumbs.db : encryptable (0 bytes)

E:\3DSL\INTERVENTIONS\Pascual\Lille\Photos\Rue de Molinel\Thumbs.db : encryptable (0 bytes)

E:\3DSL\INTERVENTIONS\Pascual\Lille\Photos\Rue de Paris\Thumbs.db : encryptable (0 bytes)

E:\3DSL\INTERVENTIONS\Pascual\Lille\Photos\Rue des Tanneurs\Thumbs.db : encryptable (0 bytes)

E:\3DSL\INTERVENTIONS\Pascual\Lille\Photos\Rue du Secrétaire Arembault\Thumbs.db : encryptable (0 bytes)

E:\3DSL\INTERVENTIONS\Pascual\Lille\Photos\Thumbs.db : encryptable (0 bytes)

E:\3DSL\INTERVENTIONS\Poujade_Villefranche\Levés\Photos\Thumbs.db : encryptable (0 bytes)

E:\3DSL\INTERVENTIONS\SCETAUROUTE\Plateformes stockage A39_A40\Aire de Poisiat\Cubatures\Thumbs.db : encryptable (0 bytes)

E:\3DSL\INTERVENTIONS\SCETAUROUTE\Plateformes stockage A39_A40\Aire de Poisiat\dessins\Thumbs.db : encryptable (0 bytes)

E:\3DSL\INTERVENTIONS\SCETAUROUTE\Plateformes stockage A39_A40\Aire de Poisiat\photos\Thumbs.db : encryptable (0 bytes)

E:\3DSL\INTERVENTIONS\SCETAUROUTE\Plateformes stockage A39_A40\Aire de Poisiat\Thumbs.db : encryptable (0 bytes)

E:\3DSL\INTERVENTIONS\SCETAUROUTE\Plateformes stockage A39_A40\Aire de St Just\cubatures\Thumbs.db : encryptable (0 bytes)

E:\3DSL\INTERVENTIONS\SCETAUROUTE\Plateformes stockage A39_A40\Aire de St Just\dessins\Thumbs.db : encryptable (0 bytes)

E:\3DSL\INTERVENTIONS\SCETAUROUTE\Plateformes stockage A39_A40\Aire de St Just\photos\Thumbs.db : encryptable (0 bytes)

E:\3DSL\INTERVENTIONS\SCETAUROUTE\Plateformes stockage A39_A40\Aire de St Just\Thumbs.db : encryptable (0 bytes)

E:\3DSL\INTERVENTIONS\SCETAUROUTE\Plateformes stockage A39_A40\Thumbs.db : encryptable (0 bytes)

E:\3DSL\INTERVENTIONS\SESO\Fichiers\Thumbs.db : encryptable (0 bytes)

E:\3DSL\INTERVENTIONS\SESO\Levé\Thumbs.db : encryptable (0 bytes)

E:\3DSL\INTERVENTIONS\SESO\Thumbs.db : encryptable (0 bytes)

E:\3DSL\INTERVENTIONS\SOTEC PLANS\Levé Bâtiment production _ préparation pâte\Photos\Thumbs.db : encryptable (0 bytes)

E:\A89\OH 393\PL_OH393 et OH 466.dwg : Zone.Identifier (26 bytes)

E:\A89\OH 393\Rep393_liv04_10_05.xls : Zone.Identifier (26 bytes)

E:\A89\OH 393\Thumbs.db : encryptable (0 bytes)

E:\A89\Recolement Lot1\Thumbs.db : encryptable (0 bytes)

E:\A89\Recolement Lot2\Thumbs.db : encryptable (0 bytes)

E:\A89\Thumbs.db : encryptable (0 bytes)

E:\CHAMPIONNAT DES ETOILES\Thumbs.db : encryptable (0 bytes)

E:\COUPE DES REGIONS HATTRICK\5e journée\Thumbs.db : encryptable (0 bytes)

E:\COUPE DES REGIONS HATTRICK\Avatar\Thumbs.db : encryptable (0 bytes)

E:\COUPE DES REGIONS HATTRICK\images\Thumbs.db : encryptable (0 bytes)

E:\COUPE DES REGIONS HATTRICK\Inscriptions\Thumbs.db : encryptable (0 bytes)

E:\COUPE DES REGIONS HATTRICK\Joueurs\Thumbs.db : encryptable (0 bytes)

E:\COUPE DES REGIONS HATTRICK\Recrutement équipes\Thumbs.db : encryptable (0 bytes)

E:\COUPE DES REGIONS HATTRICK\Thumbs.db : encryptable (0 bytes)

E:\COUPE DES REGIONS HATTRICK\Tour 1 Lorraine\Thumbs.db : encryptable (0 bytes)

E:\COUPE DES REGIONS HATTRICK\Tour 2 Picardie\Thumbs.db : encryptable (0 bytes)

E:\COUPE DES REGIONS HATTRICK\Tour 3 Bourgogne\Thumbs.db : encryptable (0 bytes)

E:\Fanfare\carte_visite fanfare\Thumbs.db : encryptable (0 bytes)

E:\Fanfare\déco hélicon\Thumbs.db : encryptable (0 bytes)

E:\Fanfare\partitions\Mozart\Thumbs.db : encryptable (0 bytes)

E:\Fanfare\photos\12_03_2005\Thumbs.db : encryptable (0 bytes)

E:\Fanfare\photos\Condom 2006\Thumbs.db : encryptable (0 bytes)

E:\Fanfare\photos\Mai 2005\Thumbs.db : encryptable (0 bytes)

E:\Fanfare\photos\malemort 2007\DIMANCHE 25\Thumbs.db : encryptable (0 bytes)

E:\Fanfare\photos\malemort 2007\MERCREDI 21\Thumbs.db : encryptable (0 bytes)

E:\Fanfare\photos\malemort 2007\Thumbs.db : encryptable (0 bytes)

E:\Fanfare\photos\Mazère 2006\Thumbs.db : encryptable (0 bytes)

E:\Fanfare\photos\Mazères 2007\Thumbs.db : encryptable (0 bytes)

E:\Fanfare\photos\Royère 2006\Thumbs.db : encryptable (0 bytes)

E:\Fanfare\photos\Thumbs.db : encryptable (0 bytes)

E:\Fanfare\photos\Vigeois 2007\Thumbs.db : encryptable (0 bytes)

E:\Fanfare\planning02032007.doc : Zone.Identifier (26 bytes)

E:\Fanfare\tampon\Thumbs.db : encryptable (0 bytes)

E:\Fanfare\Thumbs.db : encryptable (0 bytes)

E:\FootFrL1_0708A.rar : Zone.Identifier (26 bytes)

E:\footstar\Thumbs.db : encryptable (0 bytes)

E:\HATTRICK\Thumbs.db : encryptable (0 bytes)

E:\L'envie _ stavelot.mp3 : Zone.Identifier (26 bytes)

E:\LF 7&15\Thumbs.db : encryptable (0 bytes)

E:\MP3\Ace Of Base - all that she wants.mp3 : Zone.Identifier (26 bytes)

E:\MP3\Alias\saison 5\Thumbs.db : encryptable (0 bytes)

E:\MP3\Alias\Thumbs.db : encryptable (0 bytes)

E:\MP3\chanteurs&groupes\Patrick Sébastien\Jaquette-livret\Thumbs.db : encryptable (0 bytes)

E:\MP3\Desperate Housewives\Thumbs.db : encryptable (0 bytes)

E:\MP3\ELMANDER\Thumbs.db : encryptable (0 bytes)

E:\MP3\FCGB\Thumbs.db : encryptable (0 bytes)

E:\MP3\films\Thumbs.db : encryptable (0 bytes)

E:\MP3\génériques émissions&Films\fox.mp3 : Zone.Identifier (26 bytes)

E:\MP3\génériques émissions&Films\fr3.mp3 : Zone.Identifier (26 bytes)

E:\MP3\génériques émissions&Films\hsparole.mp3 : Zone.Identifier (26 bytes)

E:\MP3\génériques émissions&Films\intervilles.mp3 : Zone.Identifier (26 bytes)

E:\MP3\génériques émissions&Films\jeux_20h.mp3 : Zone.Identifier (26 bytes)

E:\MP3\génériques émissions&Films\L'eurovision.mp3 : Zone.Identifier (26 bytes)

E:\MP3\génériques émissions&Films\Les_animaux_du_monde.mp3 : Zone.Identifier (26 bytes)

E:\MP3\génériques émissions&Films\sequence telespectateur.mp3 : Zone.Identifier (26 bytes)

E:\MP3\génériques émissions&Films\Top50.mp3 : Zone.Identifier (26 bytes)

E:\MP3\heroes\Thumbs.db : encryptable (0 bytes)

E:\MP3\livres internet\gagnez argent.pdf : Zone.Identifier (26 bytes)

E:\MP3\livres internet\site attractif.pdf : Zone.Identifier (26 bytes)

E:\MP3\livres internet\Thumbs.db : encryptable (0 bytes)

E:\MP3\LOGICIELS\adobe\photoshop\xeroset2.zip : Zone.Identifier (26 bytes)

E:\MP3\LOGICIELS\all to mp3 converter\all2mp3.exe : Zone.Identifier (26 bytes)

E:\MP3\LOGICIELS\AUTODESK\inventor\famille_de_pieces_pile_baton_P.zip : Zone.Identifier (26 bytes)

E:\MP3\LOGICIELS\AUTODESK\inventor\tut_doigt_P.zip : Zone.Identifier (26 bytes)

E:\MP3\LOGICIELS\AUTODESK\inventor\tut_piston_P.zip : Zone.Identifier (26 bytes)

E:\MP3\LOGICIELS\avast antivirus\setupfre.exe : Zone.Identifier (26 bytes)

E:\MP3\LOGICIELS\carpe manager\CarpeManager.exe : Zone.Identifier (26 bytes)

E:\MP3\LOGICIELS\carpe manager\CarpeManager.exe : {4c8cc155-6c1e-11d1-8e41-00c04fb9386d} (0 bytes)

E:\MP3\LOGICIELS\carpe manager\Thumbs.db : encryptable (0 bytes)

E:\MP3\LOGICIELS\ComboFix.exe : Zone.Identifier (26 bytes)

E:\MP3\LOGICIELS\cutkiller\cutkiller.exe : Zone.Identifier (26 bytes)

E:\MP3\LOGICIELS\emule\eMule0.48a-Installer.exe : Zone.Identifier (26 bytes)

E:\MP3\LOGICIELS\emule\eMulePlus-1.2.Installer.exe : Zone.Identifier (26 bytes)

E:\MP3\LOGICIELS\emule\emule_speed_booster_21.exe : Zone.Identifier (26 bytes)

E:\MP3\LOGICIELS\emule\server.met : Zone.Identifier (26 bytes)

E:\MP3\LOGICIELS\Eq.29.11.rar : Zone.Identifier (26 bytes)

E:\MP3\LOGICIELS\expert pdf pro\expertpdf_v4_avanquest_trial_fra.exe : Zone.Identifier (26 bytes)

E:\MP3\LOGICIELS\Free mp3WMA\Setup_FreeConverter.exe : Zone.Identifier (26 bytes)

E:\MP3\LOGICIELS\Free-SpyHunter-Scanner-Install.exe : Zone.Identifier (26 bytes)

E:\MP3\LOGICIELS\google earth\GoogleEarthWin.exe : Zone.Identifier (26 bytes)

E:\MP3\LOGICIELS\google earth\Thumbs.db : encryptable (0 bytes)

E:\MP3\LOGICIELS\msn messenger\INSTALL_MSN_MESSENGER_NT.EXE : Zone.Identifier (26 bytes)

E:\MP3\LOGICIELS\msn messenger\messengerskinner.exe : Zone.Identifier (26 bytes)

E:\MP3\LOGICIELS\msn messenger\smileys\smileys_all.tar.tar : Zone.Identifier (26 bytes)

E:\MP3\LOGICIELS\msn messenger\smileys\smileys_all.zip : Zone.Identifier (26 bytes)

E:\MP3\LOGICIELS\post-it\pn31lous.exe : Zone.Identifier (26 bytes)

E:\MP3\LOGICIELS\SaveAsPDFandXPS.exe : Zone.Identifier (26 bytes)

E:\MP3\LOGICIELS\SmitfraudFix.exe : Zone.Identifier (26 bytes)

E:\MP3\LOGICIELS\SopCast.zip : Zone.Identifier (26 bytes)

E:\MP3\LOGICIELS\super 2006\SUPERsetup.exe : Zone.Identifier (26 bytes)

E:\MP3\LOGICIELS\trsetup.exe : Zone.Identifier (26 bytes)

E:\MP3\LOGICIELS\UNKNOWN_PARAMETER_VALUE : Zone.Identifier (26 bytes)

E:\MP3\LOGICIELS\zipgenius\frapak220.exe : Zone.Identifier (26 bytes)

E:\MP3\LOGICIELS\zipgenius\zg602std.exe : Zone.Identifier (26 bytes)

E:\MP3\lost\Thumbs.db : encryptable (0 bytes)

E:\MP3\messi\Thumbs.db : encryptable (0 bytes)

E:\MP3\pixar\Thumbs.db : encryptable (0 bytes)

E:\MP3\pêche\mouche\Thumbs.db : encryptable (0 bytes)

E:\MP3\smallville\Thumbs.db : encryptable (0 bytes)

E:\MP3\Stickers\Thumbs.db : encryptable (0 bytes)

E:\MP3\Thumbs.db : encryptable (0 bytes)

E:\MP3\X Files\Thumbs.db : encryptable (0 bytes)

E:\Thumbs.db : encryptable (0 bytes)

E:\Vente Directe\Thumbs.db : encryptable (0 bytes)

angelique · le 8 décembre 2008

pfff

» ouvre ton bloc note[executer--notepad] et copies/colles le contenu du cadre ci dessous:

ADS::
C:\WINDOWS\system32:imwbi.exe
Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=-
"AppInit_DLLs"=""

[*]Va en haut de la page et clique sur le menu"Fichier" , une liste apparait=>

[*]Choisis "Enregistrer sous" et choisis "Bureau"

[*]Dans le champs "Nom du fichier" en bas de page donne le nom suivant:CFScript

[*]Clique sur le bouton "Enregistrer" à droite du champs "nom du fichier"

[*]Quitte le Bloc Notes.

[*]Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture

* suis les instructions

* Patiente le temps du scan.Le bureau va disparaitre à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

* Une fois le scan achevé, un rapport va s'afficher: poste son contenu.

* Si le fichier n'apparait pas, il se trouve ici > C:\ComboFix.txt

angelique · le 8 décembre 2008

pff!! j'ai oublié le s de system32 , j'ai rectifié

jaja33 · le 8 décembre 2008

Voilà le fichier.......et pour la 1e fois il a fallu que j'aille le chercher à la racine!

ComboFix 08-12-05.06 - LAMBERT 2008-12-08 18:16:28.8 - NTFSx86

Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.553 [GMT 1:00]

Lancé depuis: c:\documents and settings\LAMBERT\Bureau\ComboFix.exe

Commutateurs utilisés :: c:\documents and settings\LAMBERT\Bureau\CFScript.txt

* Un nouveau point de restauration a été créé

.

((((((((((((((((((((((((((((( Fichiers créés du 2008-11-08 au 2008-12-08 ))))))))))))))))))))))))))))))))))))

.

2008-12-08 14:55 . 2008-12-08 14:55 <REP> d-------- c:\program files\MSECache

2008-12-07 19:10 . 2008-12-07 19:10 29,902,669 --a------ C:\Qoobox.zip

2008-12-07 19:05 . 2008-12-07 19:05 28,672 --a------ C:\catchme.exe

2008-12-07 12:52 . 2008-12-08 17:08 250 --a------ c:\windows\gmer.ini

2008-12-07 10:20 . 2008-12-07 10:20 <REP> d-------- c:\windows\ERUNT

2008-12-07 10:13 . 2008-12-07 11:43 <REP> d-------- C:\SDFix

2008-12-07 08:54 . 2008-12-07 08:54 <REP> d-------- c:\program files\Avira

2008-12-07 08:54 . 2008-12-07 08:54 <REP> d-------- c:\documents and settings\All Users\Application Data\Avira

2008-12-07 00:06 . 2008-12-07 00:06 410,984 --a------ c:\windows\system32\deploytk.dll

2008-12-06 17:16 . 2008-12-08 17:47 <REP> d-------- C:\HJT

2008-12-06 17:09 . 2008-12-06 18:40 1,864 --a------ c:\windows\system32\tmp.reg

2008-12-06 15:49 . 2008-12-06 17:55 <REP> d-------- c:\program files\Enigma Software Group

2008-12-06 10:58 . 2008-12-06 10:58 <REP> d-------- c:\documents and settings\All Users\Application Data\Fighters

2008-12-05 18:28 . 2008-12-05 18:28 <REP> d-------- c:\documents and settings\LAMBERT\Application Data\Windows Live Writer

2008-11-28 14:39 . 2008-12-06 11:05 54,156 --ah----- c:\windows\QTFont.qfn

2008-11-28 14:39 . 2008-11-28 14:39 1,409 --a------ c:\windows\QTFont.for

2008-11-18 11:01 . 2008-11-18 11:01 15,496 --a------ c:\windows\system32\drivers\vffilter.sys

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-12-08 15:51 13,440 ----a-w c:\windows\GPCIDrv.sys

2008-12-08 15:50 23,524 ----a-w c:\windows\system32\drivers\GVTDrv.sys

2008-12-06 23:06 --------- d-----w c:\program files\Java

2008-11-22 16:44 --------- d-----w c:\program files\eMule

2006-06-15 12:40 278,528 ----a-w c:\program files\Fichiers communs\FDEUnInstaller.exe

2005-05-13 15:12 217,073 --sha-r c:\windows\meta4.exe

2005-10-24 09:13 66,560 --sha-r c:\windows\MOTA113.exe

2005-10-13 19:27 422,400 --sha-r c:\windows\x2.64.exe

2005-10-07 17:14 308,224 --sha-r c:\windows\system32\avisynth.dll

2005-07-14 10:31 27,648 --sha-r c:\windows\system32\AVSredirect.dll

2005-06-26 13:32 616,448 --sha-r c:\windows\system32\cygwin1.dll

2005-06-21 20:37 45,568 --sha-r c:\windows\system32\cygz.dll

2004-01-24 22:00 70,656 --sha-r c:\windows\system32\i420vfw.dll

2006-04-27 08:24 2,945,024 --sha-r c:\windows\system32\Smab.dll

2005-02-28 11:16 240,128 --sha-r c:\windows\system32\x.264.exe

2004-01-24 22:00 70,656 --sha-r c:\windows\system32\yv12vfw.dll

.

((((((((((((((((((((((((((((( snapshot_2008-12-08_10.05.03.51 )))))))))))))))))))))))))))))))))))))))))

.

+ 2008-12-08 13:55:09 35,088 ----a-r c:\windows\Installer\{90120000-00B2-040C-0000-0000000FF1CE}\expxic.exe

+ 2008-12-08 15:50:10 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_7e0.dat

.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-05 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-06-15 6803456]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-07 136600]

"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

"vspdfprsrv.exe"="c:\program files\Visagesoft\eXPert PDF\vspdfprsrv.exe" [2006-05-04 879616]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2005-06-15 86016]

"VGAUtil"="c:\program files\GigaByte\VGA Utility Manager\G-VGA.exe" [2005-08-16 544768]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-11-06 155648]

"fssui"="c:\program files\Windows Live\Contrôle parental\fssui.exe" [2007-10-17 243240]

"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]

"nwiz"="nwiz.exe" [2005-06-15 c:\windows\system32\nwiz.exe]

"RTHDCPL"="RTHDCPL.EXE" [2005-09-22 c:\windows\RTHDCPL.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-05 15360]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\

Acc‚l‚rateur de d‚marrage AutoCAD.lnk - c:\program files\Fichiers communs\Autodesk Shared\acstart17.exe [2006-03-05 11000]

Acrobat Assistant.lnk - c:\program files\ADOBE\Acrobat 6.0\Distillr\acrotray.exe [2003-05-15 217193]

Adobe Gamma Loader.lnk - c:\program files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2006-05-17 110592]

D‚marrage d'Office.lnk - c:\program files\Microsoft Office\Office\OSA.EXE [1997-08-28 51984]

EPSON Status Monitor 3 Environment Check 2.lnk - c:\windows\system32\spool\drivers\w32x86\3\E_SRCV02.EXE [2006-05-12 135680]

Gestionnaire Microsoft Office.lnk - c:\program files\Microsoft Office\Office\MSOFFICE.EXE [1997-08-28 340480]

Lancement rapide d'Adobe Reader.lnk - c:\program files\ADOBE\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696]

Microsoft Recherche acc‚l‚r‚e.lnk - c:\program files\Microsoft Office\Office\FINDFAST.EXE [1997-08-28 111376]

Phone Connection Monitor.lnk - c:\program files\Sony Ericsson\Mobile\audevicemgr.exe [2006-07-01 813056]

WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2006-05-15 118784]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"vidc.I420"= i420vfw.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"c:\\WINDOWS\\system32\\sessmgr.exe"=

"c:\\Program Files\\eMule\\eMule.exe"=

"c:\\Program Files\\Intuwave Ltd\\Shared\\mRouterRunTime\\mRouterRuntime.exe"=

"c:\\Program Files\\GIGABYTE\\VGA Utility Manager\\G-vga.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009

R0 iteraid;ITERAID_Service_Install;c:\windows\system32\DRIVERS\iteraid.sys [2006-05-11 25067]

R2 CycloneLicenseServer;Cyclone License Server;"c:\program files\Leica Geosystems\Cyclone\CyraLicense.exe" "c:\program files\Leica Geosystems\Cyclone\" [2006-05-15 643072]

R2 fssfltr;FssFltr;c:\windows\system32\DRIVERS\fssfltr.sys [2008-01-27 43816]

R2 fsssvc;Windows Live OneCare Contrôle parental;"c:\program files\Windows Live\Contrôle parental\fsssvc.exe" [2007-10-17 523816]

R2 Leica HDS Server;Leica HDS Server;"c:\program files\Leica Geosystems\Cyclone\ptserv32.exe" -config "c:\program files\Leica Geosystems\Cyclone\ptserver.cfg" [2006-05-15 577655]

R3 GPCIDrv;GPCIDrv;\??\c:\windows\GPCIDrv.sys [2007-12-01 13440]

R3 GVTDrv;GVTDrv;\??\c:\windows\system32\Drivers\GVTDrv.sys [2007-12-01 23524]

S3 FTLUND;Lundinova Filter Driver;c:\windows\system32\drivers\ftlund.sys [2006-07-03 6828]

S3 Vfscan;Vfscan;c:\windows\system32\DRIVERS\vffilter.sys [2008-11-18 15496]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]

\Shell\AutoRun\command - F:\laucher.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{40be8cc0-a2b4-11dd-90dc-001485ec525e}]

\Shell\AutoRun\command - F:\laucher.exe

*Newly Created Service* - CATCHME

.

Contenu du dossier 'Tâches planifiées'

2008-01-27 c:\windows\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job

- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 11:20]

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-12-08 18:17:25

Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

c:\windows\system32:imwbi.exe 130759 bytes damaged executable

Scan terminé avec succès

Fichiers cachés: 1

**************************************************************************

.

Heure de fin: 2008-12-08 18:18:28

ComboFix-quarantined-files.txt 2008-12-08 17:17:58

ComboFix2.txt 2008-12-08 17:14:19

ComboFix3.txt 2008-12-08 17:08:27

ComboFix4.txt 2008-12-08 09:05:33

ComboFix5.txt 2008-12-08 17:16:03

Avant-CF: 10 268 475 392 octets libres

Après-CF: 10,259,636,224 octets libres

135

angelique · le 8 décembre 2008

ok , faut que je demande un avis si on peut le files to delete, y'a une difference desormais il est damaged et ne se recharge pas RunOnce et AppInit_DLLs

le header de l'exe a été niqué , mais me faut confirmation si on peut le delete catchme, tu patientes

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

c:\windows\system32:imwbi.exe 130759 bytes damaged executable

Scan terminé avec succès

Fichiers cachés: 1

jaja33 · le 8 décembre 2008

Oui je patiente.....pas de soucis!!

Par contre j'ai antivir qui s'alerte régulièrement quand j'ouvre des programmes........juste à l'ouverture, après il n'y en a plus!!!!

angelique · le 8 décembre 2008

c'est à dire ? ouvre antivir \onglet "event" \double clic sur les detections et copie_colle le contenu , les 5 derniers

j'attend toujours la confirmation , t'inquiete pas ;o)

Connexion

Pas encore inscrit ?

[Résolu] PC infecté par ipexewin.exe

Messages recommandés

angelique

jaja33

angelique

jaja33

angelique

angelique

jaja33

angelique

jaja33

angelique

Rejoindre la conversation

En ligne récemment 0 membre est en ligne

Zebulon

Outils en ligne

Naviguer