rapport HiJackThis

shell · le 5 janvier 2009

bonjour a tous... bonne année aussi ^^... je voulais vous demander de depanner mon PC (deja dans le passé vous l'avez fait, et c'etais du boulot de pro...magnifique merci encore) grace au rapport HighJackThis ci-dessous. Je vous remercie par avance et je vous souhaite bon courage et bonne continuation.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 08:05:30, on 05/01/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16762)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe

C:\WINDOWS\arservice.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\eHome\ehRecvr.exe

C:\WINDOWS\eHome\ehSched.exe

C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

C:\Program Files\Fichiers communs\BinarySense\hldasvc.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe

C:\WINDOWS\system32\PnkBstrA.exe

C:\WINDOWS\system32\CAPRPCSK.EXE

C:\WINDOWS\system32\spool\drivers\w32x86\3\CAPPSWK.EXE

C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\wanmpsvc.exe

C:\Program Files\RealVNC\VNC4\WinVNC4.exe

C:\WINDOWS\system32\dllhost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Vidalia Bundle\Vidalia\vidalia.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\HP\Digital Imaging\bin\hpobnz08.exe

C:\Program Files\HP\Digital Imaging\bin\hpotdd01.exe

C:\Program Files\BinarySense\HDDlife 3\HDDlifePro.exe

C:\Program Files\Vidalia Bundle\Tor\tor.exe

C:\Documents and Settings\HP_Administrateur\Bureau\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.crawler.com/search/dispatcher.a...&tbid=66005

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.iesearch.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=66005

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=66005

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=66005

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=66005

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll

O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll

O2 - BHO: (no name) - {7e235d19-c2bf-404f-9448-036719e47191} - C:\WINDOWS\system32\wotologa.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [CAPON] C:\WINDOWS\system32\Spool\Drivers\w32x86\3\CAPONN.EXE

O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"

O4 - HKLM\..\Run: [CPM53600f2e] Rundll32.exe "c:\windows\system32\pamepusu.dll",a

O4 - HKLM\..\Run: [revihonole] Rundll32.exe "C:\WINDOWS\system32\tawagifi.dll",s

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Vidalia] "C:\Program Files\Vidalia Bundle\Vidalia\vidalia.exe"

O4 - HKCU\..\Run: [soap Title] C:\DOCUME~1\HP_ADM~1\APPLIC~1\WAYMULTITYPE\ByteThe4.exe

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKUS\S-1-5-21-427002223-2362907279-2251899480-1008\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime (User 'Joy et Mam')

O4 - HKUS\S-1-5-21-427002223-2362907279-2251899480-1008\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'Joy et Mam')

O4 - HKUS\S-1-5-21-427002223-2362907279-2251899480-1008\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Joy et Mam')

O4 - HKUS\S-1-5-21-427002223-2362907279-2251899480-1008\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Joy et Mam')

O4 - HKUS\S-1-5-21-427002223-2362907279-2251899480-1008\..\Run: [ManyCam] "C:\Program Files\ManyCam 2.2\ManyCam.exe" (User 'Joy et Mam')

O4 - HKUS\S-1-5-21-427002223-2362907279-2251899480-1008\..\Run: [MSServer] rundll32.exe C:\DOCUME~1\JOYETM~1\LOCALS~1\Temp\ddcYpnol.dll,#1 (User 'Joy et Mam')

O4 - HKUS\S-1-5-21-427002223-2362907279-2251899480-1008\..\Run: [cmds] rundll32.exe C:\DOCUME~1\JOYETM~1\LOCALS~1\Temp\hgGyVNDS.dll,c (User 'Joy et Mam')

O4 - HKUS\S-1-5-21-427002223-2362907279-2251899480-1008\..\Run: [50533cb2] rundll32.exe "C:\WINDOWS\system32\owharagk.dll",b (User 'Joy et Mam')

O4 - HKUS\S-1-5-21-427002223-2362907279-2251899480-1008\..\Run: [MS Juan] rundll32 "C:\WINDOWS\system32\cdfcli.dll",run (User 'Joy et Mam')

O4 - HKUS\S-1-5-21-427002223-2362907279-2251899480-1008\..\Run: [QUAD Scheduler] C:\Program Files\QUAD Utilities\QUAD Registry Cleaner\QUAD Scheduler.exe (User 'Joy et Mam')

O4 - HKUS\S-1-5-21-427002223-2362907279-2251899480-1008\..\Run: [QUAD Windows service] C:\Program Files\QUAD Utilities\QUAD Registry Cleaner\QUAD Registry Cleaner.exe -h (User 'Joy et Mam')

O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')

O4 - S-1-5-21-427002223-2362907279-2251899480-1008 Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe (User 'Joy et Mam')

O4 - S-1-5-21-427002223-2362907279-2251899480-1008 Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Joy et Mam')

O4 - S-1-5-21-427002223-2362907279-2251899480-1008 Startup: PinMcLnk.lnk = C:\hp\bin\cloaker.exe (User 'Joy et Mam')

O4 - S-1-5-21-427002223-2362907279-2251899480-1008 User Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe (User 'Joy et Mam')

O4 - S-1-5-21-427002223-2362907279-2251899480-1008 User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Joy et Mam')

O4 - S-1-5-21-427002223-2362907279-2251899480-1008 User Startup: PinMcLnk.lnk = C:\hp\bin\cloaker.exe (User 'Joy et Mam')

O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')

O4 - .DEFAULT User Startup: PinMcLnk.lnk = C:\hp\bin\cloaker.exe (User 'Default user')

O4 - Startup: HDDlife.lnk = C:\Program Files\BinarySense\HDDlife 3\HDDlifePro.exe

O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\HP\Digital Imaging\bin\hpobnz08.exe

O4 - Global Startup: hpoddt01.exe.lnk = ?

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm

O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm

O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm

O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx

O8 - Extra context menu item: Ajouter à Kaspersky Anti-Bannière - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000

O9 - Extra button: Statistiques de la protection du trafic Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll

O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll

O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm

O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab

O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab

O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab56986.cab

O20 - AppInit_DLLs: c:\windows\system32\lelutayo.dll c:\progra~1\kaspersky lab\kaspersky internet security 2009\mzvkbd.dll,c:\progra~1\kaspersky lab\kaspersky internet security 2009\mzvkbd3.dll,c:\progra~1\kaspersky lab\kaspersky internet security 2009\adialhk.dll,c:\progra~1\kaspersky lab\kaspersky internet security 2009\kloehk.dll c:\windows\system32\pamepusu.dll

O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\pamepusu.dll (file missing)

O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\pamepusu.dll (file missing)

O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe

O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: HDDlife HDD Access service - BinarySense, Inc. - C:\Program Files\Fichiers communs\BinarySense\hldasvc.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe

O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe

--

End of file - 15366 bytes

Thanos · le 5 janvier 2009

salut

Le pc est bien infecté par au moins trois malwares! Je ne vois pas Kaspersky dans les processus actifs: est ce qu'il fonctionne correctement ?

On commence comme ceci >>

Télécharge ComboFix

Assure toi que tous les programmes sont fermés avant de lancer le fix!
Fait un double clique sur combofix.exe.
Note: Ne ferme pas la fenêtre qui vient de s'ouvrir , tu te retrouverais avec un bureau vide !
Tape sur la touche Y (Yes) pour démarrer le scan.
Lorsque le scan est terminé, un rapport sera généré : poste en le contenu dans ton prochain message.
Si le rapport est trop long, poste le en deux fois.
Si tu ne vois pas le rapport, tu le trouveras ici > C:\ComboFix.txt

shell · le 5 janvier 2009

donc voila, j'ai fait ce qu'il y avait a faire et voici le rapport

ComboFix 09-01-05.02 - HP_Administrateur 2009-01-05 18:06:18.1 - NTFSx86

Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.959.316 [GMT 1:00]

Lancé depuis: c:\documents and settings\HP_Administrateur\Bureau\ComboFix.exe

* Un nouveau point de restauration a été créé

.

Les fichiers ci-dessous ont été désactivés pendant l'exécution:

c:\windows\system32\pamepusu.dll

ADS - system32: deleted 1117148 bytes in 1 streams.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat

c:\documents and settings\Joy\Application Data\HbTools

c:\documents and settings\Joy\Application Data\HbTools\HbTools.log

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\dynamic\1.sdf

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\dynamic\1383771.sdf

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\dynamic\3783087.sdf

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\dynamic\domains.txt

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\dynamic\TooltipXML\1000052701

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\dynamic\TooltipXML\1000081378

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\dynamic\TooltipXML\162760

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\dynamic\TooltipXML\20570

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\dynamic\TooltipXML\25469

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\dynamic\TooltipXML\26664

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\dynamic\TooltipXML\30854

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\dynamic\TooltipXML\34237

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\dynamic\TooltipXML\403305

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\dynamic\TooltipXML\41499

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\dynamic\TooltipXML\44228

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\dynamic\TooltipXML\56815

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\dynamic\TooltipXML\64737

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\dynamic\TooltipXML\66836

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\dynamic\TooltipXML\745086

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\dynamic\TooltipXML\82292

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\dynamic\TooltipXML\9974

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\dynamic\ustat\350a.dat

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\ads.cdf

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\btntrans.idx

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\btntrans1.dat

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\business_promo.htm

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\buttondir.txt

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\components.cdf

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\d_icons_buttons_1000.res

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\d_icons_buttons_2000.res

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\d_icons_buttons_3000.res

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\d_icons_buttons_bar.res

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\d_icons_buttons_bbar1.res

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\d_icons_buttons_logos.res

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\d_icons_buttons_other.res

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\d_icons_weather.res

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\default.cdf

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\Default_511745-514279.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\Default_bidz.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\Default_bidz1.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\Default_bidz10.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\Default_bidz11.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\Default_bidz12.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\Default_bidz13.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\Default_bidz14.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\Default_bidz15.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\Default_bidz16.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\Default_bidz17.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\Default_bidz18.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\Default_bidz19.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\Default_bidz2.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\Default_bidz20.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\Default_bidz3.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\Default_bidz4.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\Default_bidz5.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\Default_bidz6.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\Default_bidz7.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\Default_bidz8.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\Default_bidz9.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\Default_categorize.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\Default_comparison.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\Default_em_PROFL_CA_flow_b_IEB.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\Default_explorer-Mails.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\Default_explorer-people.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\Default_favorites.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\Default_Games.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\Default_Hide.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\Default_hotbarcom.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\Default_Hotmail.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\Default_hsskin.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\Default_jemster.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\Default_jemsterie.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\Default_jemsteruk.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\Default_jobsearch.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\Default_Mails.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\Default_new.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\Default_premium.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\Default_reun.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\Default_ringtones.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\Default_SearchBoxTrapper.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\Default_searchfor.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\Default_searchgo.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\Default_weather.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\Default_yellowpages.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\email-def-511724-548964.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\email-def-511724-9595.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\email-t1-bg.res

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\hotbar-premium-hotbar-premium.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\hotbar-premium.cdf

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\hotbar_promo.htm

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\icons2.res

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\keywords.idx

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\keywords1.dat

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\layout.cdf

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\linkpathlegal.txt

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\progress.res

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\s_icons_buttons.res

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\sales_buttons.res

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\t2_bg.res

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\theweb.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\top7.cdf

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\Top7_theweb.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\1\tsd_bg.res

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\ads.cdf

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\btntrans.idx

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\btntrans1.dat

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\business_promo.htm

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\buttondir.txt

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\components.cdf

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\d_icons_buttons_1000.res

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\d_icons_buttons_2000.res

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\d_icons_buttons_3000.res

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\d_icons_buttons_bar.res

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\d_icons_buttons_bbar1.res

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\d_icons_buttons_logos.res

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\d_icons_buttons_other.res

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\d_icons_weather.res

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\default.cdf

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\Default_511745-514279.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\Default_bidz.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\Default_bidz1.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\Default_bidz10.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\Default_bidz11.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\Default_bidz12.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\Default_bidz13.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\Default_bidz14.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\Default_bidz15.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\Default_bidz16.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\Default_bidz17.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\Default_bidz18.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\Default_bidz19.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\Default_bidz2.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\Default_bidz20.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\Default_bidz3.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\Default_bidz4.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\Default_bidz5.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\Default_bidz6.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\Default_bidz7.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\Default_bidz8.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\Default_bidz9.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\Default_categorize.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\Default_comparison.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\Default_em_PROFL_CA_flow_b_IEB.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\Default_explorer-Mails.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\Default_explorer-people.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\Default_favorites.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\Default_Games.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\Default_Hide.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\Default_hotbarcom.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\Default_Hotmail.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\Default_hsskin.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\Default_jemster.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\Default_jemsterie.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\Default_jemsteruk.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\Default_jobsearch.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\Default_Mails.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\Default_new.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\Default_premium.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\Default_reun.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\Default_ringtones.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\Default_SearchBoxTrapper.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\Default_searchfor.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\Default_searchgo.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\Default_weather.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\Default_yellowpages.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\email-def-511724-548964.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\email-def-511724-9595.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\email-t1-bg.res

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\hotbar-premium-hotbar-premium.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\hotbar-premium.cdf

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\hotbar_promo.htm

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\icons2.res

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\keywords.idx

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\keywords1.dat

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\layout.cdf

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\linkpathlegal.txt

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\progress.res

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\s_icons_buttons.res

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\sales_buttons.res

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\t2_bg.res

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\theweb.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\top7.cdf

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\Top7_theweb.mnu

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\2\tsd_bg.res

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\DownLoad\ads.xip

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\DownLoad\BtnTrans.xip

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\DownLoad\BtnTrans1.xip

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\DownLoad\business_promo.xip

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\DownLoad\buttondir.xip

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\DownLoad\d_icons_buttons_1000.xip

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\DownLoad\d_icons_buttons_2000.xip

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\DownLoad\d_icons_buttons_3000.xip

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\DownLoad\d_icons_buttons_bar.xip

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\DownLoad\d_icons_buttons_bbar1.xip

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\DownLoad\d_icons_buttons_logos.xip

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\DownLoad\d_icons_buttons_other.xip

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\DownLoad\d_icons_weather.xip

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\DownLoad\default.xip

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\DownLoad\email-t1-bg.xip

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\DownLoad\hotbar-premium.xip

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\DownLoad\hotbar_promo.xip

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\DownLoad\icons2.xip

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\DownLoad\keywords.xip

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\DownLoad\keywords1.xip

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\DownLoad\layout.xip

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\DownLoad\linkpathlegal.xip

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\DownLoad\progress.xip

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\DownLoad\s_icons_buttons.xip

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\DownLoad\sales_buttons.xip

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\DownLoad\samplegroups2.txt

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\DownLoad\samplegroups2.xip

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\DownLoad\t2_bg.xip

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\DownLoad\top7.xip

c:\documents and settings\Joy\Application Data\HbTools\v3.0\HbTools\static\DownLoad\tsd_bg.xip

c:\documents and settings\Joy\Application Data\HbTools_Icons

c:\documents and settings\Joy\Application Data\HbTools_Icons\games2.ico

c:\documents and settings\Joy\Application Data\HbTools_Icons\wallpapere1.ico

c:\documents and settings\Joy\Bureau\Free PC Wallpapers.lnk

c:\documents and settings\Veronique\Application Data\MessengerSkinner

c:\documents and settings\Veronique\Menu D‚marrer\Programmes\MessengerSkinner

c:\documents and settings\Veronique\Menu Démarrer\Programmes\MessengerSkinner\MessengerSkinner.lnk

c:\documents and settings\Veronique\Menu Démarrer\Programmes\MessengerSkinner\Website.lnk

c:\windows\system32\jogopamo.dll

c:\windows\system32\lelutayo.dll

c:\windows\system32\Microsoft\backup.ftp

c:\windows\system32\Microsoft\backup.tftp

c:\windows\system32\pamepusu.dll.vir

c:\windows\system32\satukivu.dll

c:\windows\system32\tawagifi.dll

c:\windows\system32\wotologa.dll

c:\windows\system32\yigejiyu.dll

D:\Autorun.inf

----- BITS: Il y a peut-être des sites infectés -----

hxxp://77.74.48.105

.

((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_BOONTY_GAMES

-------\Service_Boonty Games

((((((((((((((((((((((((((((( Fichiers créés du 2008-12-05 au 2009-01-05 ))))))))))))))))))))))))))))))))))))

.

2009-01-05 07:52 . 2009-01-05 07:52 2,652 --ahs---- c:\windows\system32\devoresi.dll

2009-01-05 07:52 . 2009-01-05 07:52 2,649 --ahs---- c:\windows\system32\kegovahe.dll

2009-01-05 07:52 . 2009-01-05 07:52 0 --ah----- c:\windows\system32\BIT8.tmp

2009-01-05 07:52 . 2009-01-05 07:52 0 --ah----- c:\windows\system32\BIT6.tmp

2009-01-04 19:33 . 2009-01-04 19:33 96,976 --a------ c:\windows\system32\drivers\klin.dat

2009-01-04 19:33 . 2009-01-04 19:33 87,855 --a------ c:\windows\system32\drivers\klick.dat

2009-01-04 19:32 . 2009-01-04 19:32 <REP> d-------- c:\program files\Kaspersky Lab

2009-01-04 19:32 . 2009-01-05 18:26 <REP> d-------- c:\documents and settings\All Users\Application Data\Kaspersky Lab

2009-01-04 19:32 . 2009-01-05 18:24 8,580,128 --ahs---- c:\windows\system32\drivers\fidbox.dat

2009-01-04 19:32 . 2009-01-05 18:24 860,192 --ahs---- c:\windows\system32\drivers\fidbox2.dat

2009-01-04 19:32 . 2009-01-05 18:24 68,112 --ahs---- c:\windows\system32\drivers\fidbox.idx

2009-01-04 19:32 . 2009-01-05 18:24 4,020 --ahs---- c:\windows\system32\drivers\fidbox2.idx

2009-01-04 19:18 . 2009-01-04 19:18 <REP> d-------- c:\documents and settings\Joy et Mam\Application Data\QUAD Backups

2009-01-04 19:17 . 2009-01-04 19:17 <REP> d-------- c:\program files\QUAD Utilities

2009-01-04 11:05 . 2009-01-04 11:05 1,294,028 --ahs---- c:\windows\system32\uvikutas.ini

2009-01-03 22:28 . 2009-01-03 22:28 1,294,028 --ahs---- c:\windows\system32\ojeninal.ini

2009-01-03 10:28 . 2009-01-03 13:22 1,294,046 --ahs---- c:\windows\system32\efahiweb.ini

2009-01-02 18:30 . 2009-01-03 02:32 1,294,109 --ahs---- c:\windows\system32\efelagiv.ini

2008-12-31 00:07 . 2008-12-31 00:07 <REP> d-------- c:\documents and settings\All Users\Application Data\Skype

2008-12-30 23:31 . 2008-12-30 23:31 <REP> d-------- c:\windows\system32\fr

2008-12-30 23:31 . 2008-12-30 23:31 <REP> d-------- c:\windows\system32\bits

2008-12-30 23:31 . 2008-12-30 23:31 <REP> d-------- c:\windows\l2schemas

2008-12-30 23:27 . 2008-12-30 23:31 <REP> d-------- c:\windows\ServicePackFiles

2008-12-30 23:04 . 2008-12-30 23:03 410,984 --a------ c:\windows\system32\deploytk.dll

2008-12-29 10:52 . 2008-12-29 10:52 <REP> d-------- c:\documents and settings\HP_Administrateur\Application Data\dvdcss

2008-12-21 11:23 . 2008-12-21 13:45 <REP> d-------- c:\documents and settings\Joy et Mam\Application Data\Zylom

2008-12-20 20:46 . 2008-12-20 22:59 <REP> d-------- c:\documents and settings\HP_Administrateur\Application Data\Zylom

2008-12-09 07:26 . 2008-12-30 23:57 <REP> d-------- c:\program files\WowCartographe

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-01-05 17:27 --------- d-----w c:\documents and settings\HP_Administrateur\Application Data\Vidalia

2009-01-05 17:27 --------- d-----w c:\documents and settings\HP_Administrateur\Application Data\tor

2009-01-05 17:25 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP

2009-01-05 07:03 --------- d-----w c:\documents and settings\Joy et Mam\Application Data\OpenOffice.org2

2009-01-04 22:23 --------- d-----w c:\program files\Circle Developement

2009-01-04 19:14 --------- d-----w c:\documents and settings\All Users\Application Data\third lies itch ford

2009-01-04 18:31 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files

2009-01-04 18:20 --------- d-----w c:\documents and settings\All Users\Application Data\Google Updater

2009-01-03 15:09 --------- d-----w c:\program files\Windows Live Safety Center

2009-01-02 16:15 --------- d-----w c:\program files\Dofus

2008-12-31 12:57 1,835,008 ---ha-w c:\documents and settings\Invité\NTUSER.DAT

2008-12-30 22:03 --------- d-----w c:\program files\Java

2008-12-21 12:45 --------- d-----w c:\program files\Zylom Games

2008-12-17 19:51 --------- d-----w c:\documents and settings\HP_Administrateur\Application Data\LimeWire

2008-12-12 21:33 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help

2008-12-04 17:57 --------- d-----w c:\program files\Fichiers communs\Blizzard Entertainment

2008-11-18 19:06 --------- d-----w c:\documents and settings\Joy et Mam\Application Data\Sierra

2008-11-18 11:57 --------- d-----w c:\program files\GameSpy Arcade

2008-11-18 11:54 --------- d-----w c:\documents and settings\HP_Administrateur\Application Data\Sierra

2008-11-18 11:27 --------- d--h--w c:\program files\InstallShield Installation Information

2008-11-11 18:58 25,601 ----a-w c:\windows\system32\drivers\klopp.dat

2007-06-04 14:37 0 ----a-w c:\documents and settings\HP_Administrateur\Application Data\wklnhst.dat

2007-06-04 10:11 0 ----a-w c:\documents and settings\Joy et Mam\Application Data\wklnhst.dat

2007-05-18 11:10 278,528 ----a-w c:\program files\Fichiers communs\FDEUnInstaller.exe

2007-05-14 11:08 4,090 ----a-w c:\documents and settings\Veronique\Application Data\wklnhst.dat

2007-03-31 17:30 22 --sha-w c:\windows\SMINST\HPCD.sys

.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

"Vidalia"="c:\program files\Vidalia Bundle\Vidalia\vidalia.exe" [2007-11-22 12889088]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-04-04 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2006-02-15 249856]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-30 136600]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-03-28 413696]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-03-30 267048]

"CAPON"="c:\windows\system32\Spool\Drivers\w32x86\3\CAPONN.EXE" [2001-02-14 22528]

"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2008-11-11 206088]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 1241088]

c:\documents and settings\Yumiii\Menu D‚marrer\Programmes\D‚marrage\

Pin.lnk - c:\hp\bin\CLOAKER.EXE [2006-10-26 27136]

PinMcLnk.lnk - c:\hp\bin\cloaker.exe [2006-10-26 27136]

c:\documents and settings\Invit‚\Menu D‚marrer\Programmes\D‚marrage\

Pin.lnk - c:\hp\bin\CLOAKER.EXE [2006-10-26 27136]

PinMcLnk.lnk - c:\hp\bin\cloaker.exe [2006-10-26 27136]

c:\documents and settings\Joy\Menu D‚marrer\Programmes\D‚marrage\

Pin.lnk - c:\hp\bin\CLOAKER.EXE [2006-10-26 27136]

PinMcLnk.lnk - c:\hp\bin\cloaker.exe [2006-10-26 27136]

c:\documents and settings\HP_Administrateur\Menu D‚marrer\Programmes\D‚marrage\

HDDlife.lnk - c:\program files\BinarySense\HDDlife 3\HDDlifePro.exe [2007-08-09 2422008]

c:\documents and settings\Joy et Mam\Menu D‚marrer\Programmes\D‚marrage\

OpenOffice.org 2.0.lnk - c:\program files\OpenOffice.org 2.0\program\quickstart.exe [2006-01-25 61440]

Pin.lnk - c:\hp\bin\CLOAKER.EXE [2006-10-26 27136]

PinMcLnk.lnk - c:\hp\bin\cloaker.exe [2006-10-26 27136]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"MaxRecentDocs"= 0

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]

"UIHost"=hex(2):58,50,69,7a,65,5f,4c,6f,67,6f,6e,2e,65,78,65,00

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^AOL 9.0 Icône AOL.lnk]

path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\AOL 9.0 Icône AOL.lnk

backup=c:\windows\pss\AOL 9.0 Icône AOL.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Canon LBP-810 Status Window.LNK]

path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Canon LBP-810 Status Window.LNK

backup=c:\windows\pss\Canon LBP-810 Status Window.LNKCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Fenêtre d'état Canon LBP-810.LNK]

path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Fenêtre d'état Canon LBP-810.LNK

backup=c:\windows\pss\Fenêtre d'état Canon LBP-810.LNKCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^KODAK Software Updater.lnk]

path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\KODAK Software Updater.lnk

backup=c:\windows\pss\KODAK Software Updater.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk]

path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Reader.lnk

backup=c:\windows\pss\Lancement rapide d'Adobe Reader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Logiciel Kodak EasyShare.lnk]

path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Logiciel Kodak EasyShare.lnk

backup=c:\windows\pss\Logiciel Kodak EasyShare.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Outil de mise à jour Google.lnk]

path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Outil de mise à jour Google.lnk

backup=c:\windows\pss\Outil de mise à jour Google.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Privoxy.lnk]

path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Privoxy.lnk

backup=c:\windows\pss\Privoxy.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^HP_Administrateur^Menu Démarrer^Programmes^Démarrage^hamachi.lnk]

path=c:\documents and settings\HP_Administrateur\Menu Démarrer\Programmes\Démarrage\hamachi.lnk

backup=c:\windows\pss\hamachi.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^HP_Administrateur^Menu Démarrer^Programmes^Démarrage^OpenOffice.org 2.0.lnk]

path=c:\documents and settings\HP_Administrateur\Menu Démarrer\Programmes\Démarrage\OpenOffice.org 2.0.lnk

backup=c:\windows\pss\OpenOffice.org 2.0.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitComet]

--a------ 2007-11-07 16:06 1881400 c:\program files\BitComet\BitComet.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]

--a------ 2007-06-18 15:10 271360 c:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]

--a------ 2007-11-19 20:37 26112 c:\program files\Real\RealPlayer\realplay.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]

--a------ 2007-04-04 15:40 68856 c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"Apple Mobile Device"=2 (0x2)

"AOL ACS"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"UpdatesDisableNotify"=dword:00000001

"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\AOL 9.0\\waol.exe"=

"c:\\Program Files\\Fichiers communs\\AOL\\ACS\\AOLAcsd.exe"=

"c:\\Program Files\\Fichiers communs\\AOL\\ACS\\AOLDial.exe"=

"c:\\Program Files\\LimeWire\\LimeWire.exe"=

"c:\\StubInstaller.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\Sierra\\Empire Earth\\Empire Earth.exe"=

"c:\\Sierra\\Empire Earth - The Art of Conquest\\EE-AOC.exe"=

"c:\\Program Files\\AOL 9.0e\\waol.exe"=

"c:\\Program Files\\Fichiers communs\\AOL\\1179916063\\ee\\aolsoftware.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe"=

"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=

"c:\\Program Files\\BitComet\\BitComet.exe"=

"c:\\WINDOWS\\system32\\dpvsetup.exe"=

"c:\\Program Files\\SopCast\\SopCast.exe"=

"c:\\Program Files\\SopCast\\adv\\SopAdver.exe"=

"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

"c:\\Program Files\\Vidalia Bundle\\Tor\\tor.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\SEGA\\Iron Man\\IronMan.exe"=

"c:\\Program Files\\Electronic Arts\\Battlefield 2142\\BF2142.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\helpctr.exe"=

"c:\\UT2004\\System\\UT2004.exe"=

"c:\\Program Files\\LucasArts\\Star Wars Empire at War\\GameData\\fpupdate.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Program Files\\GameSpy Arcade\\Aphex.exe"=

"c:\\Documents and Settings\\HP_Administrateur\\Bureau\\Empire Earth II\\EE2.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

"13432:TCP"= 13432:TCP:BitComet 13432 TCP

"13432:UDP"= 13432:UDP:BitComet 13432 UDP

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 32784]

R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [2008-03-13 26640]

R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2008-04-30 24592]

R3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\drivers\ManyCam.sys [2008-01-14 21632]

R4 HDDlife HDD Access service;HDDlife HDD Access service;c:\program files\Fichiers communs\BinarySense\hldasvc.exe [2007-08-09 816376]

R4 RapidPort;RapidPort;c:\windows\system32\drivers\CAPLPTN.SYS [2007-06-14 22912]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]

\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{21DB17A7-9EB9-0768-D9C5-22A71AD280F1}]

c:\windows\system32:svchost.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6778F1EE-80BB-4F27-BC69-F91B843782CD}]

c:\documents and settings\HP_Administrateur\Application Data\Microsoft\cfgmgr.vbs

.

Contenu du dossier 'Tâches planifiées'

2008-12-20 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:57]

2009-01-03 c:\windows\Tasks\EasyShare Registration Task.job

- c:\windows\system32\rundll32.exe [2008-04-14 03:34]

2008-12-20 c:\windows\Tasks\FRU Task #Hewlett-Packard#hp psc 2100 series#1222252533.job

- c:\program files\HP\Digital Imaging\Bin\hpqfrucl.exe [2003-04-09 16:56]

2008-12-29 c:\windows\Tasks\FRU Task $ContextID$.job

- c:\program files\HP\Digital Imaging\Bin\hpqfrucl.exe [2003-04-09 16:56]

.

- - - - ORPHELINS SUPPRIMES - - - -

BHO-{7e235d19-c2bf-404f-9448-036719e47191} - c:\windows\system32\wotologa.dll

HKCU-Run-Soap Title - c:\docume~1\HP_ADM~1\APPLIC~1\WAYMULTITYPE\ByteThe4.exe

HKLM-Run-CPM53600f2e - c:\windows\system32\pamepusu.dll

MSConfigStartUp-ManyCam - c:\program files\ManyCam 2.1\ManyCam.exe

.

------- Examen supplémentaire -------

.

uStart Page = hxxp://www.iesearch.com/

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=64&bd=PAVILION&pf=desktop

uInternet Settings,ProxyOverride = *.local

IE: &D&ownload &with BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm

IE: &D&ownload all video with BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm

IE: &D&ownload all with BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm

IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx

IE: Ajouter à Kaspersky Anti-Bannière - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm

IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000

FF - ProfilePath - c:\documents and settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\gopqn62o.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1460988&SearchSource=3&q=

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/

FF - prefs.js: keyword.URL - hxxp://www.crawler.com/search/dispatcher.aspx?tp=aus&tbid=66005&qkw=

FF - component: c:\documents and settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\gopqn62o.default\extensions\{34ea1c70-42cc-42c5-aa29-ec58b95a343e}\components\FFAlert.dll

FF - plugin: c:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll

FF - plugin: c:\program files\Google\Google Updater\2.4.1368.5602\npCIDetect13.dll

FF - plugin: c:\program files\Microsoft Silverlight\2.0.31005.0\npctrl.1.0.30716.0.dll

FF - plugin: c:\program files\Microsoft Silverlight\2.0.31005.0\npctrl.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npzylomgamesplayer.dll

FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll

FF - plugin: c:\program files\Yahoo!\Common\npyaxmpb.dll

ATTENTION: FIREFOX POLICES IS IN FORCE

FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-01-05 18:26:09

Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès

Fichiers cachés: 0

**************************************************************************

.

--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(1100)

c:\windows\system32\Ati2evxx.dll

.

------------------------ Autres processus actifs ------------------------

.

c:\windows\system32\ati2evxx.exe

c:\program files\Fichiers communs\AOL\ACS\AOLacsd.exe

c:\windows\arservice.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\windows\ehome\ehrecvr.exe

c:\windows\ehome\ehSched.exe

c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\Fichiers communs\LightScribe\LSSrvc.exe

c:\windows\system32\PnkBstrA.exe

c:\windows\system32\CAPRPCSK.EXE

c:\program files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe

c:\windows\system32\spool\drivers\w32x86\3\CAPPSWK.EXE

c:\windows\wanmpsvc.exe

c:\windows\system32\ati2evxx.exe

c:\program files\RealVNC\VNC4\winvnc4.exe

c:\windows\ehome\mcrdsvc.exe

c:\windows\system32\dllhost.exe

c:\program files\HP\Digital Imaging\bin\hpobnz08.exe

c:\program files\HP\Digital Imaging\bin\hpotdd01.exe

c:\program files\iPod\bin\iPodService.exe

.

**************************************************************************

.

Heure de fin: 2009-01-05 18:30:25 - La machine a redémarré

ComboFix-quarantined-files.txt 2009-01-05 17:30:20

Avant-CF: 226ÿ015ÿ895ÿ552 octets libres

AprÞs-CF: 228,160,110,592 octets libres

538 --- E O F --- 2008-12-31 16:09:59

Modifié le 5 janvier 2009 par shell

Thanos · le 5 janvier 2009

re!

La suite des opérations >>

Branche tous les supports amovibles que tu possèdes avant de faire les scans suivants (clé usb/disque dur externe etc).

1°) Rend toi sur cette page afin de télécharger le fichier CFScript > http://senduit.com/b0c683

Patiente une seconde: le téléchargement va se lancer automatiquement.

Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture
Patiente le temps du scan.Le bureau va disparaitre à plusieurs reprises: c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.
Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
Si le fichier n'apparait pas, il se trouve ici > C:\ComboFix.txt

Note: Le script proposé est adapté au cas de shell : Vous ne devez en aucun cas l'utiliser sur votre pc!

2°) Un petit scan supplémentaire avec un programme que tu vas pouvoir conserver >>

Télécharge Malwarebytes' Anti-Malware (MBAM)

Double clique sur le fichier téléchargé pour lancer le processus d'installation.
Dans l'onglet "Mise à jour", clique sur le bouton "Recherche de mise à jour": si le pare-feu demande l'autorisation à MBAM de se connecter, accepte.
Une fois la mise à jour terminée, rends-toi dans l'onglet "Recherche".
Sélectionne "Exécuter un examen complêt"
Clique sur "Rechercher"
L'analyse démarre, le scan est relativement long, c'est normal.
A la fin de l'analyse, un message s'affiche :
L'examen s'est terminé normalement. Clique sur 'Afficher les résultats' pour afficher tous les objets trouvés.
Clique sur "Ok" pour poursuivre. Si MBAM n'a rien trouvé, il te le dira aussi.
Ferme tes navigateurs.
Si des malwares ont été détectés, clique sur Afficher les résultats.
Sélectionne tout (ou laisse coché) et clique sur Supprimer la sélection, MBAM va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.
MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Copie-colle ce rapport et poste-le dans ta prochaine réponse.

Poste les deux rapports stp

shell · le 6 janvier 2009

donc voila j'ai suivi les instructions et voici...

ComboFix 09-01-05.02 - HP_Administrateur 2009-01-06 7:17:19.2 - NTFSx86

Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.959.424 [GMT 1:00]

Lancé depuis: c:\documents and settings\HP_Administrateur\Bureau\ComboFix.exe

Commutateurs utilisés :: c:\documents and settings\HP_Administrateur\Bureau\CFScript.txt

* Un nouveau point de restauration a été créé

FILE ::

c:\autorun.inf

c:\docume~1\JOYETM~1\LOCALS~1\Temp\ddcYpnol.dll

c:\docume~1\JOYETM~1\LOCALS~1\Temp\hgGyVNDS.dll

c:\documents and settings\HP_Administrateur\Application Data\Microsoft\cfgmgr.vbs

c:\documents and settings\HP_Administrateur\Application Data\Microsoft\spoolsv.exe

C:\info.exe

c:\windows\system32\BIT6.tmp

c:\windows\system32\BIT8.tmp

c:\windows\system32\cdfcli.dll

c:\windows\system32\devoresi.dll

c:\windows\system32\efahiweb.ini

c:\windows\system32\efelagiv.ini

c:\windows\system32\kegovahe.dll

c:\windows\system32\ojeninal.ini

c:\windows\system32\owharagk.dll

c:\windows\system32\pamepusu.dll

c:\windows\system32\uvikutas.ini

D:\autorun.inf

D:\Info.exe

.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\All Users\Application Data\third lies itch ford

c:\documents and settings\HP_Administrateur\Application Data\Microsoft\cfgmgr.vbs

c:\documents and settings\HP_Administrateur\Application Data\WAYMULTITYPE

c:\documents and settings\HP_Administrateur\Application Data\WAYMULTITYPE\Anti bold does long.exe

c:\documents and settings\HP_Administrateur\Application Data\WAYMULTITYPE\krgpzgyu.exe

c:\documents and settings\HP_Administrateur\Application Data\WAYMULTITYPE\oxixuval.exe

c:\program files\Circle Developement

c:\windows\system32\BIT6.tmp

c:\windows\system32\BIT8.tmp

c:\windows\system32\devoresi.dll

c:\windows\system32\efahiweb.ini

c:\windows\system32\efelagiv.ini

c:\windows\system32\gprsvqeq.ini

c:\windows\system32\kegovahe.dll

c:\windows\system32\kgarahwo.ini

c:\windows\system32\kvtkgdva.ini

c:\windows\system32\kwcvlexw.ini

c:\windows\system32\ojeninal.ini

c:\windows\system32\pgbhxpnu.ini

c:\windows\system32\uvikutas.ini

D:\Info.exe

.

((((((((((((((((((((((((((((( Fichiers créés du 2008-12-06 au 2009-01-06 ))))))))))))))))))))))))))))))))))))

.

2009-01-04 19:33 . 2009-01-04 19:33 96,976 --a------ c:\windows\system32\drivers\klin.dat

2009-01-04 19:33 . 2009-01-04 19:33 87,855 --a------ c:\windows\system32\drivers\klick.dat

2009-01-04 19:32 . 2009-01-04 19:32 <REP> d-------- c:\program files\Kaspersky Lab

2009-01-04 19:32 . 2009-01-06 07:27 <REP> d-------- c:\documents and settings\All Users\Application Data\Kaspersky Lab

2009-01-04 19:32 . 2009-01-06 07:24 8,580,128 --ahs---- c:\windows\system32\drivers\fidbox.dat

2009-01-04 19:32 . 2009-01-06 07:24 925,728 --ahs---- c:\windows\system32\drivers\fidbox2.dat

2009-01-04 19:32 . 2009-01-06 07:24 68,112 --ahs---- c:\windows\system32\drivers\fidbox.idx

2009-01-04 19:32 . 2009-01-06 07:24 4,244 --ahs---- c:\windows\system32\drivers\fidbox2.idx