bagle & winupgro

Jibione · le 10 janvier 2009

Bonjour à tous,

Je me suis un peu promené sur les différents forums traitant de ce nouveau type d'infection, mais j'ai l'impression que chaque type de réparation/supression de ces infections sont à chaque fois bien propres a chaque PC.

J'ai donc sorti sur les conseils de noppp un rapport SD Toolbar que je colle ci-dessous.

Si l'un d'entre vous aurait le courage et la patience d'y jeter un oeil, ce serait vraiment cool.

Merci d'avance.

-----------\\ ToolBar S&D 1.2.8 XP/Vista

Microsoft Windows XP Professional ( v5.1.2600 ) Service Pack 2

X86-based PC ( Multiprocessor Free : Genuine Intel® CPU 2140 @ 1.60GHz )

BIOS : Phoenix - AwardBIOS v6.00PG

USER : Jibione ( Administrator )

BOOT : Normal boot

Antivirus : avast! antivirus 4.8.1296 [VPS 090108-0] 4.8.1296 (Not Activated)

C:\ (Local Disk) - NTFS - Total:111 Go (Free:12 Go)

D:\ (Local Disk) - FAT32 - Total:232 Go (Free:160 Go)

E:\ (USB)

F:\ (USB)

G:\ (USB)

H:\ (USB)

I:\ (Local Disk) - NTFS - Total:111 Go (Free:13 Go)

J:\ (CD or DVD) - UDF - Total:7 Go (Free:0 Go)

L:\ (CD or DVD)

"C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )

Option : [1] ( 10/01/2009|12:30 )

-----------\\ Recherche de Fichiers / Dossiers ...

C:\Program Files\AskBarDis

C:\Program Files\AskBarDis\bar

C:\Program Files\AskBarDis\PopSwatter

C:\Program Files\AskBarDis\unins000.dat

C:\Program Files\AskBarDis\unins000.exe

C:\Program Files\AskBarDis\bar\bin

C:\Program Files\AskBarDis\bar\Cache

C:\Program Files\AskBarDis\bar\History

C:\Program Files\AskBarDis\bar\Settings

C:\Program Files\AskBarDis\bar\bin\askPopStp.dll

C:\Program Files\AskBarDis\bar\bin\psvince.dll

C:\Program Files\AskBarDis\bar\Cache\0077F6F0

C:\Program Files\AskBarDis\bar\Cache\0077FAB8.bin

C:\Program Files\AskBarDis\bar\Cache\0077FC8D.bin

C:\Program Files\AskBarDis\bar\Cache\0077FE43.bin

C:\Program Files\AskBarDis\bar\Cache\0077FFE8.bin

C:\Program Files\AskBarDis\bar\Cache\00780121.bin

C:\Program Files\AskBarDis\bar\Cache\files.ini

C:\Program Files\AskBarDis\bar\History\search

C:\Program Files\AskBarDis\bar\Settings\config.dat

C:\Program Files\AskBarDis\bar\Settings\config.dat.bak

C:\Program Files\AskBarDis\bar\Settings\prevcfg.htm

C:\Program Files\AskBarDis\PopSwatter\History

C:\Program Files\AskBarDis\PopSwatter\History\allowed

C:\Program Files\AskBarDis\PopSwatter\History\notallow

C:\DOCUME~1\Jibione\APPLIC~1\Dealio

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\res

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\temp

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\res\alerts.gif

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\res\alerts_over.gif

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\res\alerts_rec.gif

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\res\alerts_rec_over.gif

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\res\chevron-small.gif

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\res\DealioSearch.html

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\res\deals-leftcap.gif

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\res\deal_report.jpg

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\res\ebay_login.jpg

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\res\err_mainwindow.html

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\res\err_toolbar.html

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\res\global_scripts.js

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\res\headerbgthin.jpg

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\res\highlight-bg.png

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\res\logo.gif

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\res\logo_over.gif

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\res\man_toolbar.css

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\res\man_toolbar.html

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\res\man_toolbar.js

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\res\man_toolbarl.js

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\res\post-this-deal.gif

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\res\post-this-deal_over.gif

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\res\scripts.js

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\res\scroller.js

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\res\search-chevron.gif

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\res\search-chevron_over.gif

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\res\search_bg_blink.gif

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\res\separator.gif

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\res\settings.gif

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\res\settings_over.gif

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\res\yahoo-search.png

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\index.76.35

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.10.76

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.109.43

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.110.43

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.12.52

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.13.58

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.130.58

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.135.50

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.153.44

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.155.43

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.156.49

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.16.60

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.161.52

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.178.66

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.184.55

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.188.52

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.189.45

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.196.43

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.198.56

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.199.43

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.200.53

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.201.43

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.202.43

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.203.71

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.205.62

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.213.71

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.214.49

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.215.43

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.216.67

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.217.67

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.218.52

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.219.43

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.220.43

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.221.57

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.222.43

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.223.68

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.226.68

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.227.43

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.228.62

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.229.76

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.23.63

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.239.43

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.24.43

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.240.43

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.241.43

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.242.43

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.243.43

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.244.63

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.245.43

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.247.43

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.248.43

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.249.43

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.250.43

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.251.43

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.252.43

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.253.43

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.254.43

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.255.43

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.256.43

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.257.43

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.279.43

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.28.58

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.282.75

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.283.43

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.284.43

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.289.67

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.290.62

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.291.61

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.296.43

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.297.43

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.304.43

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.307.43

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.308.75

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.31.47

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.310.46

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.311.43

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.315.43

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.316.43

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.317.43

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.318.43

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.319.49

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.32.48

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.334.44

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.335.60

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.336.44

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.337.44

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.338.75

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.339.47

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.34.43

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.340.47

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.341.47

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.349.50

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.35.48

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.350.50

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.351.51

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.352.54

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.353.51

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.354.51

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.357.62

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.358.52

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.359.52

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.360.53

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.361.54

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.362.68

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.363.58

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.364.54

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.365.53

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.367.56

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.368.58

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.369.55

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.370.56

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.371.56

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.372.57

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.373.55

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.375.56

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.376.57

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.377.55

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.378.65

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.384.58

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.386.71

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.387.59

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.388.59

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.389.59

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.390.60

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.391.60

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.392.60

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.393.60

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.394.60

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.396.61

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.397.61

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.398.60

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.399.60

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.403.61

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.404.63

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.405.61

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.406.61

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.407.76

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.408.63

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.409.61

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.412.62

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.413.62

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.414.62

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.415.62

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.416.62

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.417.62

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.418.62

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.419.62

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.420.62

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.421.62

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.423.63

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.424.63

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.425.63

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.426.63

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.427.63

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.428.65

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.429.63

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.430.63

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.432.65

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.433.64

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.434.65

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.435.64

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.436.76

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.437.64

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.438.71

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.439.71

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.440.75

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.442.73

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.443.73

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.444.73

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.445.68

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.446.69

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.450.67

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.451.67

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.452.68

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.453.68

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.454.69

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.456.69

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.457.75

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.458.70

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.459.70

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.460.69

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.462.74

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.463.69

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.464.70

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.465.68

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.468.70

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.469.70

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.470.70

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.471.73

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.472.70

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.478.74

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.479.73

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.480.68

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.481.71

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.482.74

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.49.67

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.50.43

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.500.71

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.501.74

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.502.71

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.51.69

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.52.72

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.520.76

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.521.76

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.522.76

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.53.51

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.531.76

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.532.75

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.534.75

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.54.47

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.55.45

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.56.69

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.57.43

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.58.47

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.593.76

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.595.76

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.63.57

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.66.47

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.70.75

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\rules\rules.1.71.43

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\temp\dealio-14251.log

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\temp\dealio-14254.log

C:\DOCUME~1\Jibione\APPLIC~1\Dealio\kb127\temp\dod_cache.xml

C:\Program Files\Dealio

C:\Program Files\Dealio\DealioAU.exe

C:\Program Files\Dealio\kb127

C:\Program Files\Dealio\SearchSettingsKit.exe

C:\Program Files\Dealio\kb127\Dealio Deskbar.exe

C:\Program Files\Dealio\kb127\Dealio.dll

C:\Program Files\Dealio\kb127\DealioRes409.dll

C:\Program Files\Dealio\kb127\res

C:\Program Files\Dealio\kb127\resDN

C:\Program Files\Dealio\kb127\rules

C:\Program Files\Dealio\kb127\temp

C:\Program Files\Dealio\kb127\res\alerts.gif

C:\Program Files\Dealio\kb127\res\alerts_over.gif

C:\Program Files\Dealio\kb127\res\alerts_rec.gif

C:\Program Files\Dealio\kb127\res\alerts_rec_over.gif

C:\Program Files\Dealio\kb127\res\chevron-small.gif

C:\Program Files\Dealio\kb127\res\DealioSearch.html

C:\Program Files\Dealio\kb127\res\deals-leftcap.gif

C:\Program Files\Dealio\kb127\res\deal_report.jpg

C:\Program Files\Dealio\kb127\res\ebay_login.jpg

C:\Program Files\Dealio\kb127\res\err_mainwindow.html

C:\Program Files\Dealio\kb127\res\err_toolbar.html

C:\Program Files\Dealio\kb127\res\global_scripts.js

C:\Program Files\Dealio\kb127\res\headerbgthin.jpg

C:\Program Files\Dealio\kb127\res\highlight-bg.png

C:\Program Files\Dealio\kb127\res\logo.gif

C:\Program Files\Dealio\kb127\res\logo_over.gif

C:\Program Files\Dealio\kb127\res\man_toolbar.css

C:\Program Files\Dealio\kb127\res\man_toolbar.html

C:\Program Files\Dealio\kb127\res\man_toolbar.js

C:\Program Files\Dealio\kb127\res\man_toolbarl.js

C:\Program Files\Dealio\kb127\res\post-this-deal.gif

C:\Program Files\Dealio\kb127\res\post-this-deal_over.gif

C:\Program Files\Dealio\kb127\res\scripts.js

C:\Program Files\Dealio\kb127\res\scroller.js

C:\Program Files\Dealio\kb127\res\search-chevron.gif

C:\Program Files\Dealio\kb127\res\search-chevron_over.gif

C:\Program Files\Dealio\kb127\res\search_bg_blink.gif

C:\Program Files\Dealio\kb127\res\separator.gif

C:\Program Files\Dealio\kb127\res\settings.gif

C:\Program Files\Dealio\kb127\res\settings_over.gif

C:\Program Files\Dealio\kb127\res\yahoo-search.png

C:\Program Files\Dealio\kb127\resDN\bottom.gif

C:\Program Files\Dealio\kb127\resDN\chevron_down.gif

C:\Program Files\Dealio\kb127\resDN\chevron_up.gif

C:\Program Files\Dealio\kb127\resDN\close.gif

C:\Program Files\Dealio\kb127\resDN\deskbar.css

C:\Program Files\Dealio\kb127\resDN\deskbar.js

C:\Program Files\Dealio\kb127\resDN\dispatch_helper.js

C:\Program Files\Dealio\kb127\resDN\ebay_compatible.jpg

C:\Program Files\Dealio\kb127\resDN\logo.gif

C:\Program Files\Dealio\kb127\resDN\logo_chevron_bkg.gif

C:\Program Files\Dealio\kb127\resDN\losing.gif

C:\Program Files\Dealio\kb127\resDN\lost.gif

C:\Program Files\Dealio\kb127\resDN\man_deskbar.html

C:\Program Files\Dealio\kb127\resDN\menu_arrow.gif

C:\Program Files\Dealio\kb127\resDN\menu_check.gif

C:\Program Files\Dealio\kb127\resDN\no_image.gif

C:\Program Files\Dealio\kb127\resDN\prod_img.gif

C:\Program Files\Dealio\kb127\resDN\search_chevron.gif

C:\Program Files\Dealio\kb127\resDN\spacer.gif

C:\Program Files\Dealio\kb127\resDN\textfield_bkg.gif

C:\Program Files\Dealio\kb127\resDN\top.gif

C:\Program Files\Dealio\kb127\resDN\unknown.gif

C:\Program Files\Dealio\kb127\resDN\winning.gif

C:\Program Files\Dealio\kb127\resDN\won.gif

C:\Program Files\Dealio\kb127\rules\index.76.35

C:\Program Files\Dealio\kb127\rules\rules.1.10.76

C:\Program Files\Dealio\kb127\rules\rules.1.109.43

C:\Program Files\Dealio\kb127\rules\rules.1.110.43

C:\Program Files\Dealio\kb127\rules\rules.1.12.52

C:\Program Files\Dealio\kb127\rules\rules.1.13.58

C:\Program Files\Dealio\kb127\rules\rules.1.130.58

C:\Program Files\Dealio\kb127\rules\rules.1.135.50

C:\Program Files\Dealio\kb127\rules\rules.1.153.44

C:\Program Files\Dealio\kb127\rules\rules.1.155.43

C:\Program Files\Dealio\kb127\rules\rules.1.156.49

C:\Program Files\Dealio\kb127\rules\rules.1.16.60

C:\Program Files\Dealio\kb127\rules\rules.1.161.52

C:\Program Files\Dealio\kb127\rules\rules.1.178.66

C:\Program Files\Dealio\kb127\rules\rules.1.184.55

C:\Program Files\Dealio\kb127\rules\rules.1.188.52

C:\Program Files\Dealio\kb127\rules\rules.1.189.45

C:\Program Files\Dealio\kb127\rules\rules.1.196.43

C:\Program Files\Dealio\kb127\rules\rules.1.198.56

C:\Program Files\Dealio\kb127\rules\rules.1.199.43

C:\Program Files\Dealio\kb127\rules\rules.1.200.53

C:\Program Files\Dealio\kb127\rules\rules.1.201.43

C:\Program Files\Dealio\kb127\rules\rules.1.202.43

C:\Program Files\Dealio\kb127\rules\rules.1.203.71

C:\Program Files\Dealio\kb127\rules\rules.1.205.62

C:\Program Files\Dealio\kb127\rules\rules.1.213.71

C:\Program Files\Dealio\kb127\rules\rules.1.214.49

C:\Program Files\Dealio\kb127\rules\rules.1.215.43

C:\Program Files\Dealio\kb127\rules\rules.1.216.67

C:\Program Files\Dealio\kb127\rules\rules.1.217.67

C:\Program Files\Dealio\kb127\rules\rules.1.218.52

C:\Program Files\Dealio\kb127\rules\rules.1.219.43

C:\Program Files\Dealio\kb127\rules\rules.1.220.43

C:\Program Files\Dealio\kb127\rules\rules.1.221.57

C:\Program Files\Dealio\kb127\rules\rules.1.222.43

C:\Program Files\Dealio\kb127\rules\rules.1.223.68

C:\Program Files\Dealio\kb127\rules\rules.1.226.68

C:\Program Files\Dealio\kb127\rules\rules.1.227.43

C:\Program Files\Dealio\kb127\rules\rules.1.228.62

C:\Program Files\Dealio\kb127\rules\rules.1.229.76

C:\Program Files\Dealio\kb127\rules\rules.1.23.63

C:\Program Files\Dealio\kb127\rules\rules.1.239.43

C:\Program Files\Dealio\kb127\rules\rules.1.24.43

C:\Program Files\Dealio\kb127\rules\rules.1.240.43

C:\Program Files\Dealio\kb127\rules\rules.1.241.43

C:\Program Files\Dealio\kb127\rules\rules.1.242.43

C:\Program Files\Dealio\kb127\rules\rules.1.243.43

C:\Program Files\Dealio\kb127\rules\rules.1.244.63

C:\Program Files\Dealio\kb127\rules\rules.1.245.43

C:\Program Files\Dealio\kb127\rules\rules.1.247.43

C:\Program Files\Dealio\kb127\rules\rules.1.248.43

C:\Program Files\Dealio\kb127\rules\rules.1.249.43

C:\Program Files\Dealio\kb127\rules\rules.1.250.43

C:\Program Files\Dealio\kb127\rules\rules.1.251.43

C:\Program Files\Dealio\kb127\rules\rules.1.252.43

C:\Program Files\Dealio\kb127\rules\rules.1.253.43

C:\Program Files\Dealio\kb127\rules\rules.1.254.43

C:\Program Files\Dealio\kb127\rules\rules.1.255.43

C:\Program Files\Dealio\kb127\rules\rules.1.256.43

C:\Program Files\Dealio\kb127\rules\rules.1.257.43

C:\Program Files\Dealio\kb127\rules\rules.1.279.43

C:\Program Files\Dealio\kb127\rules\rules.1.28.58

C:\Program Files\Dealio\kb127\rules\rules.1.282.75

C:\Program Files\Dealio\kb127\rules\rules.1.283.43

C:\Program Files\Dealio\kb127\rules\rules.1.284.43

C:\Program Files\Dealio\kb127\rules\rules.1.289.67

C:\Program Files\Dealio\kb127\rules\rules.1.290.62

C:\Program Files\Dealio\kb127\rules\rules.1.291.61

C:\Program Files\Dealio\kb127\rules\rules.1.296.43

C:\Program Files\Dealio\kb127\rules\rules.1.297.43

C:\Program Files\Dealio\kb127\rules\rules.1.304.43

C:\Program Files\Dealio\kb127\rules\rules.1.307.43

C:\Program Files\Dealio\kb127\rules\rules.1.308.75

C:\Program Files\Dealio\kb127\rules\rules.1.31.47

C:\Program Files\Dealio\kb127\rules\rules.1.310.46

C:\Program Files\Dealio\kb127\rules\rules.1.311.43

C:\Program Files\Dealio\kb127\rules\rules.1.315.43

C:\Program Files\Dealio\kb127\rules\rules.1.316.43

C:\Program Files\Dealio\kb127\rules\rules.1.317.43

C:\Program Files\Dealio\kb127\rules\rules.1.318.43

C:\Program Files\Dealio\kb127\rules\rules.1.319.49

C:\Program Files\Dealio\kb127\rules\rules.1.32.48

C:\Program Files\Dealio\kb127\rules\rules.1.334.44

C:\Program Files\Dealio\kb127\rules\rules.1.335.60

C:\Program Files\Dealio\kb127\rules\rules.1.336.44

C:\Program Files\Dealio\kb127\rules\rules.1.337.44

C:\Program Files\Dealio\kb127\rules\rules.1.338.75

C:\Program Files\Dealio\kb127\rules\rules.1.339.47

C:\Program Files\Dealio\kb127\rules\rules.1.34.43

C:\Program Files\Dealio\kb127\rules\rules.1.340.47

C:\Program Files\Dealio\kb127\rules\rules.1.341.47

C:\Program Files\Dealio\kb127\rules\rules.1.349.50

C:\Program Files\Dealio\kb127\rules\rules.1.35.48

C:\Program Files\Dealio\kb127\rules\rules.1.350.50

C:\Program Files\Dealio\kb127\rules\rules.1.351.51

C:\Program Files\Dealio\kb127\rules\rules.1.352.54

C:\Program Files\Dealio\kb127\rules\rules.1.353.51

C:\Program Files\Dealio\kb127\rules\rules.1.354.51

C:\Program Files\Dealio\kb127\rules\rules.1.357.62

C:\Program Files\Dealio\kb127\rules\rules.1.358.52

C:\Program Files\Dealio\kb127\rules\rules.1.359.52

C:\Program Files\Dealio\kb127\rules\rules.1.360.53

C:\Program Files\Dealio\kb127\rules\rules.1.361.54

C:\Program Files\Dealio\kb127\rules\rules.1.362.68

C:\Program Files\Dealio\kb127\rules\rules.1.363.58

C:\Program Files\Dealio\kb127\rules\rules.1.364.54

C:\Program Files\Dealio\kb127\rules\rules.1.365.53

C:\Program Files\Dealio\kb127\rules\rules.1.367.56

C:\Program Files\Dealio\kb127\rules\rules.1.368.58

C:\Program Files\Dealio\kb127\rules\rules.1.369.55

C:\Program Files\Dealio\kb127\rules\rules.1.370.56

C:\Program Files\Dealio\kb127\rules\rules.1.371.56

C:\Program Files\Dealio\kb127\rules\rules.1.372.57

C:\Program Files\Dealio\kb127\rules\rules.1.373.55

C:\Program Files\Dealio\kb127\rules\rules.1.375.56

C:\Program Files\Dealio\kb127\rules\rules.1.376.57

C:\Program Files\Dealio\kb127\rules\rules.1.377.55

C:\Program Files\Dealio\kb127\rules\rules.1.378.65

C:\Program Files\Dealio\kb127\rules\rules.1.384.58

C:\Program Files\Dealio\kb127\rules\rules.1.386.71

C:\Program Files\Dealio\kb127\rules\rules.1.387.59

C:\Program Files\Dealio\kb127\rules\rules.1.388.59

C:\Program Files\Dealio\kb127\rules\rules.1.389.59

C:\Program Files\Dealio\kb127\rules\rules.1.390.60

C:\Program Files\Dealio\kb127\rules\rules.1.391.60

C:\Program Files\Dealio\kb127\rules\rules.1.392.60

C:\Program Files\Dealio\kb127\rules\rules.1.393.60

C:\Program Files\Dealio\kb127\rules\rules.1.394.60

C:\Program Files\Dealio\kb127\rules\rules.1.396.61

C:\Program Files\Dealio\kb127\rules\rules.1.397.61

C:\Program Files\Dealio\kb127\rules\rules.1.398.60

C:\Program Files\Dealio\kb127\rules\rules.1.399.60

C:\Program Files\Dealio\kb127\rules\rules.1.403.61

C:\Program Files\Dealio\kb127\rules\rules.1.404.63

C:\Program Files\Dealio\kb127\rules\rules.1.405.61

C:\Program Files\Dealio\kb127\rules\rules.1.406.61

C:\Program Files\Dealio\kb127\rules\rules.1.407.76

C:\Program Files\Dealio\kb127\rules\rules.1.408.63

C:\Program Files\Dealio\kb127\rules\rules.1.409.61

C:\Program Files\Dealio\kb127\rules\rules.1.412.62

C:\Program Files\Dealio\kb127\rules\rules.1.413.62

C:\Program Files\Dealio\kb127\rules\rules.1.414.62

C:\Program Files\Dealio\kb127\rules\rules.1.415.62

C:\Program Files\Dealio\kb127\rules\rules.1.416.62

C:\Program Files\Dealio\kb127\rules\rules.1.417.62

C:\Program Files\Dealio\kb127\rules\rules.1.418.62

C:\Program Files\Dealio\kb127\rules\rules.1.419.62

C:\Program Files\Dealio\kb127\rules\rules.1.420.62

C:\Program Files\Dealio\kb127\rules\rules.1.421.62

C:\Program Files\Dealio\kb127\rules\rules.1.423.63

C:\Program Files\Dealio\kb127\rules\rules.1.424.63

C:\Program Files\Dealio\kb127\rules\rules.1.425.63

C:\Program Files\Dealio\kb127\rules\rules.1.426.63

C:\Program Files\Dealio\kb127\rules\rules.1.427.63

C:\Program Files\Dealio\kb127\rules\rules.1.428.65

C:\Program Files\Dealio\kb127\rules\rules.1.429.63

C:\Program Files\Dealio\kb127\rules\rules.1.430.63

C:\Program Files\Dealio\kb127\rules\rules.1.432.65

C:\Program Files\Dealio\kb127\rules\rules.1.433.64

C:\Program Files\Dealio\kb127\rules\rules.1.434.65

C:\Program Files\Dealio\kb127\rules\rules.1.435.64

C:\Program Files\Dealio\kb127\rules\rules.1.436.76

C:\Program Files\Dealio\kb127\rules\rules.1.437.64

C:\Program Files\Dealio\kb127\rules\rules.1.438.71

C:\Program Files\Dealio\kb127\rules\rules.1.439.71

C:\Program Files\Dealio\kb127\rules\rules.1.440.75

C:\Program Files\Dealio\kb127\rules\rules.1.442.73

C:\Program Files\Dealio\kb127\rules\rules.1.443.73

C:\Program Files\Dealio\kb127\rules\rules.1.444.73

C:\Program Files\Dealio\kb127\rules\rules.1.445.68

C:\Program Files\Dealio\kb127\rules\rules.1.446.69

C:\Program Files\Dealio\kb127\rules\rules.1.450.67

C:\Program Files\Dealio\kb127\rules\rules.1.451.67

C:\Program Files\Dealio\kb127\rules\rules.1.452.68

C:\Program Files\Dealio\kb127\rules\rules.1.453.68

C:\Program Files\Dealio\kb127\rules\rules.1.454.69

C:\Program Files\Dealio\kb127\rules\rules.1.456.69

C:\Program Files\Dealio\kb127\rules\rules.1.457.75

C:\Program Files\Dealio\kb127\rules\rules.1.458.70

C:\Program Files\Dealio\kb127\rules\rules.1.459.70

C:\Program Files\Dealio\kb127\rules\rules.1.460.69

C:\Program Files\Dealio\kb127\rules\rules.1.462.74

C:\Program Files\Dealio\kb127\rules\rules.1.463.69

C:\Program Files\Dealio\kb127\rules\rules.1.464.70

C:\Program Files\Dealio\kb127\rules\rules.1.465.68

C:\Program Files\Dealio\kb127\rules\rules.1.468.70

C:\Program Files\Dealio\kb127\rules\rules.1.469.70

C:\Program Files\Dealio\kb127\rules\rules.1.470.70

C:\Program Files\Dealio\kb127\rules\rules.1.471.73

C:\Program Files\Dealio\kb127\rules\rules.1.472.70

C:\Program Files\Dealio\kb127\rules\rules.1.478.74

C:\Program Files\Dealio\kb127\rules\rules.1.479.73

C:\Program Files\Dealio\kb127\rules\rules.1.480.68

C:\Program Files\Dealio\kb127\rules\rules.1.481.71

C:\Program Files\Dealio\kb127\rules\rules.1.482.74

C:\Program Files\Dealio\kb127\rules\rules.1.49.67

C:\Program Files\Dealio\kb127\rules\rules.1.50.43

C:\Program Files\Dealio\kb127\rules\rules.1.500.71

C:\Program Files\Dealio\kb127\rules\rules.1.501.74

C:\Program Files\Dealio\kb127\rules\rules.1.502.71

C:\Program Files\Dealio\kb127\rules\rules.1.51.69

C:\Program Files\Dealio\kb127\rules\rules.1.52.72

C:\Program Files\Dealio\kb127\rules\rules.1.520.76

C:\Program Files\Dealio\kb127\rules\rules.1.521.76

C:\Program Files\Dealio\kb127\rules\rules.1.522.76

C:\Program Files\Dealio\kb127\rules\rules.1.53.51

C:\Program Files\Dealio\kb127\rules\rules.1.531.76

C:\Program Files\Dealio\kb127\rules\rules.1.532.75

C:\Program Files\Dealio\kb127\rules\rules.1.534.75

C:\Program Files\Dealio\kb127\rules\rules.1.54.47

C:\Program Files\Dealio\kb127\rules\rules.1.55.45

C:\Program Files\Dealio\kb127\rules\rules.1.56.69

C:\Program Files\Dealio\kb127\rules\rules.1.57.43

C:\Program Files\Dealio\kb127\rules\rules.1.58.47

C:\Program Files\Dealio\kb127\rules\rules.1.593.76

C:\Program Files\Dealio\kb127\rules\rules.1.595.76

C:\Program Files\Dealio\kb127\rules\rules.1.63.57

C:\Program Files\Dealio\kb127\rules\rules.1.66.47

C:\Program Files\Dealio\kb127\rules\rules.1.70.75

C:\Program Files\Dealio\kb127\rules\rules.1.71.43

C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Dealio

C:\DOCUME~1\Jibione\APPLIC~1\Search Settings

C:\DOCUME~1\Jibione\APPLIC~1\Search Settings\kb127

C:\DOCUME~1\Jibione\APPLIC~1\Search Settings\kb127\res

C:\DOCUME~1\Jibione\APPLIC~1\Search Settings\kb127\temp

C:\DOCUME~1\Jibione\APPLIC~1\Search Settings\kb127\temp\ws-14251.log

C:\DOCUME~1\Jibione\APPLIC~1\Search Settings\kb127\temp\ws-14252.log

C:\DOCUME~1\Jibione\APPLIC~1\Search Settings\kb127\temp\ws-14253.log

C:\DOCUME~1\Jibione\APPLIC~1\Search Settings\kb127\temp\ws-14254.log

C:\Program Files\Search Settings

C:\Program Files\Search Settings\kb127

C:\Program Files\Search Settings\SearchSettings.exe

C:\Program Files\Search Settings\kb127\res

C:\Program Files\Search Settings\kb127\SearchSettings.dll

C:\Program Files\Search Settings\kb127\SearchSettingsRes409.dll

C:\Program Files\Search Settings\kb127\temp

-----------\\ Extensions

(Jibione) - {E9A1DEE0-C623-4439-8932-001E7D17607D} => ajtoolbar

-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

"Local Page"="C:\\WINDOWS\\system32\\blank.htm"

"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"'>http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"'>http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"'>http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"

"Search Bar"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"

"Start Page"="http://yahoo.fr/"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]

"Default_Page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"

"Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"

"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"

"Start Page"="http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home"

--------------------\\ Recherche d'autres infections

C:\Program Files\WebMediaPlayer

C:\Program Files\WebMediaPlayer\resources

C:\Program Files\WebMediaPlayer\skins

C:\Program Files\WebMediaPlayer\sqlite3.dll

C:\Program Files\WebMediaPlayer\uninst.exe

C:\Program Files\WebMediaPlayer\updates

C:\Program Files\WebMediaPlayer\WebMediaPlayer.exe

C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\WebMediaPlayer

C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\WebMediaPlayer\Conditions g‚n‚rales.url

C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\WebMediaPlayer\Confidentialit‚.url

C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\WebMediaPlayer\D‚sinstaller.lnk

C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\WebMediaPlayer\WebMediaPlayer.lnk

C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\WebMediaPlayer\Website.url

C:\DOCUME~1\Jibione\LOCALS~1\APPLIC~1\giwmqwy.dat

C:\DOCUME~1\Jibione\LOCALS~1\APPLIC~1\giwmqwy.exe

C:\DOCUME~1\Jibione\LOCALS~1\APPLIC~1\giwmqwy_nav.dat

C:\DOCUME~1\Jibione\LOCALS~1\APPLIC~1\giwmqwy_navps.dat

==> EGDACCESS <==

C:\WINDOWS\system32\ban_list.txt

==> BAGLE <==

--------------------\\ ROOTKIT !!

Rootkit Bagle ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SROSA]

Rootkit Bagle ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Enum\Root\LEGACY_SROSA]

Rootkit Bagle ! .. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA]

--------------------\\ Cracks & Keygens ..

C:\DOCUME~1\Jibione\Desktop\Prg\Adobe Photoshop CS 9 + Keygen.iso

C:\DOCUME~1\Jibione\My Documents\My Games\wolf\Crack

C:\DOCUME~1\Jibione\My Documents\My Games\wolf\Crack\Return to Castle Wolfenstein Key Generator.exe

C:\DOCUME~1\Jibione\My Documents\My Music\I am\De La Planete Mars [uK]\06 Crack.wma

C:\DOCUME~1\Jibione\My Documents\My Music\Iam\De La Planete Mars [uK]\06 Crack.mp3

C:\DOCUME~1\Jibione\My Documents\My Music\iTunes\iTunes Music\Kanye West_The Game\Late Registration\08 Crack Music.mp3

C:\DOCUME~1\Jibione\Recent\Adobe Photoshop CS3 [Key.Serial.Crack.Keygen].txt.lnk

C:\DOCUME~1\Jibione\Recent\avs-video-converter-6.2.keygen.jpg.lnk

C:\DOCUME~1\Jibione\Recent\Return to The Castle of Wolfenstein + patch v1.41 + Keygen.ISO.lnk

C:\DOCUME~1\Jibione\Recent\Windows.Xp.Sp2.Keygen.with.auto.key.changer.rar.lnk

1 - "C:\ToolBar SD\TB_1.txt" - 09/01/2009|18:31 - Option : [1]

2 - "C:\ToolBar SD\TB_2.txt" - 10/01/2009|12:33 - Option : [1]

-----------\\ Fin du rapport a 12:33:15,82

Falkra · le 10 janvier 2009

Bonjour, la machine a été infectée par des cracks.

Le logiciel qui suit n'est à utiliser que prescrit par un helper qualifié et formé à l'outil.

Ne pas utiliser en dehors de ce cas de figure : dangereux.

Attention à bien suivre ces instructions en détail, ne pas oublier de renommer combofix.exe AVANT qu'il ne soit téléchargé, quand on peut encore changer le nom du fichier et dire au navigateur où le télécharger.

Télécharge combofix.exe de sUBs et renomme-le TRALALA.exe avant de le sauvegarder sur ton bureau (et pas ailleurs).

Assure toi que tous les programmes sont fermés avant de commencer.
Double-clique combo-fix.exe afin de l'exécuter.
Clique sur "Oui" au message de Limitation de Garantie qui s'affiche.
Il est possible que ton parefeu te demande si tu acceptes ou non l'accès de nircmd.cfexe à la zone sûre: accepte.
Ne ferme pas la fenêtre qui vient de s'ouvrir, tu te retrouverais avec un bureau vide.
Lorsque l'analyse sera terminée, un rapport apparaîtra.
Copie-colle ce rapport dans ta prochaine réponse.
Le rapport se trouve dans : C:\Combofix.txt (si jamais).

Jibione · le 11 janvier 2009

Tout d'abord, un grand merci à toi de te pencher sur mon problème.

C'est vraiment nice

Voici donc le rapport de combofix :

ComboFix 09-01-09.03 - Jibione 2009-01-11 23:05:23.2 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.547 [GMT 1:00]

Lancé depuis: c:\documents and settings\Jibione\Desktop\TRALALA.exe

.

((((((((((((((((((((((((((((( Fichiers créés du 2008-12-11 au 2009-01-11 ))))))))))))))))))))))))))))))))))))

.

2009-01-10 13:02 . 2009-01-10 13:24 <DIR> d-------- c:\program files\Navilog1

2009-01-10 12:57 . 2009-01-10 12:57 <DIR> d-------- c:\documents and settings\Jibione\Application Data\AVSMedia

2009-01-10 12:55 . 2009-01-10 12:55 <DIR> d-------- c:\program files\AVSMedia

2009-01-10 12:55 . 2007-02-27 19:36 261,632 --a------ c:\windows\system32\mcdvd_32.dll

2009-01-10 12:55 . 2007-02-27 19:36 221,215 --a------ c:\windows\system32\divxdec.ax

2009-01-10 12:55 . 2007-02-27 19:36 156,910 --a------ c:\windows\WMSysPr8.prx

2009-01-10 12:55 . 2007-02-27 19:36 82,944 --a------ c:\windows\system32\vct3216.acm

2009-01-10 12:55 . 2007-02-27 19:36 53,248 --a------ c:\windows\system32\xvid.ax

2009-01-10 12:55 . 2007-02-27 19:36 38,912 --a------ c:\windows\system32\alf2cd.acm

2009-01-10 12:55 . 2007-02-27 19:36 13,239 --a------ c:\windows\system32\Scg726.acm

2009-01-09 18:25 . 2009-01-10 12:33 <DIR> d-------- C:\ToolBar SD

2009-01-09 17:38 . 2009-01-11 04:20 <DIR> d--h----- c:\documents and settings\Jibione\Application Data\drivers

2009-01-09 17:32 . 2009-01-09 18:49 <DIR> d-------- C:\VideoFiles

2009-01-09 17:31 . 2009-01-09 17:31 <DIR> d-------- c:\program files\AliveMedia

2009-01-09 17:31 . 2002-05-23 20:40 110,080 --a------ c:\windows\system32\nLame.dll

2009-01-09 17:31 . 2001-06-23 21:20 23,040 --a------ c:\windows\system32\auth.dll

2009-01-09 17:23 . 2009-01-09 17:23 <DIR> d-------- c:\program files\DivX

2009-01-09 17:23 . 2009-01-09 17:23 <DIR> d-------- c:\documents and settings\Jibione\.drdivx2

2009-01-08 20:07 . 2009-01-08 20:08 <DIR> d-------- c:\program files\RaPiZ PSP Software

2009-01-08 20:00 . 2009-01-08 20:12 <DIR> d-------- c:\program files\WinAVI Video Converter

2009-01-07 04:28 . 2009-01-07 04:28 <DIR> d-------- c:\documents and settings\Jibione\Application Data\Search Settings

2009-01-06 07:14 . 2009-01-08 20:13 <DIR> d-------- C:\Virtual-DivX

2009-01-05 20:34 . 2009-01-05 20:35 <DIR> d-------- c:\program files\E.M. DVD Copy

2009-01-05 20:25 . 2009-01-08 19:53 <DIR> d-------- c:\program files\HT MPEG Encoder 7.0 Trial

2009-01-05 20:19 . 2009-01-05 20:19 <DIR> d-------- c:\program files\Search Settings

2009-01-05 20:19 . 2009-01-05 20:19 <DIR> d-------- c:\program files\Dealio

2009-01-05 20:19 . 2009-01-05 20:19 <DIR> d-------- c:\documents and settings\Jibione\Application Data\Dealio

2009-01-05 20:18 . 2009-01-05 20:18 <DIR> d-------- c:\program files\Ipod Video Converter

2009-01-05 20:18 . 2005-05-14 20:09 2,179,072 --a------ c:\windows\system32\mfc71d.dll

2009-01-05 20:18 . 2006-07-11 18:06 544,768 --a------ c:\windows\system32\msvcr71d.dll

2009-01-05 20:18 . 2006-05-12 08:37 490,496 --a------ c:\windows\system32\MP4Splitter.ax

2009-01-05 20:18 . 2004-01-10 17:02 258,048 --a------ c:\windows\system32\GplMpgDec.ax

2009-01-05 20:18 . 1998-06-24 00:00 164,144 --a------ c:\windows\system32\COMCT232.OCX

2009-01-05 20:18 . 2005-09-28 01:31 24,576 --a------ c:\windows\system32\ControlSubX.ocx

2009-01-05 20:18 . 1998-07-13 00:00 20,992 --a------ c:\windows\system32\CMCT2FR.DLL

2008-12-31 18:27 . 2008-12-31 18:27 <DIR> d-------- c:\documents and settings\Jibione\Application Data\AVS4YOU

2008-12-31 18:26 . 2008-12-31 18:26 <DIR> d-------- c:\documents and settings\All Users\Application Data\AVS4YOU

2008-12-31 18:24 . 2009-01-10 12:57 <DIR> d-------- c:\program files\Common Files\AVSMedia

2008-12-31 18:24 . 2008-12-31 18:25 <DIR> d-------- c:\program files\AVS4YOU

2008-12-31 18:24 . 2007-02-27 18:36 1,700,352 --a------ c:\windows\system32\GdiPlus.dll

2008-12-31 18:24 . 2007-02-27 18:36 974,848 --a------ c:\windows\system32\mfc70.dll

2008-12-31 18:24 . 2007-02-27 18:36 487,424 --a------ c:\windows\system32\msvcp70.dll

2008-12-31 18:24 . 2007-02-27 18:36 24,576 --a------ c:\windows\system32\msxml3a.dll

2008-12-28 14:25 . 2008-12-28 14:25 268 --ah----- C:\sqmdata16.sqm

2008-12-28 14:25 . 2008-12-28 14:25 244 --ah----- C:\sqmnoopt16.sqm

2008-12-28 00:16 . 2008-12-28 00:16 268 --ah----- C:\sqmdata15.sqm

2008-12-28 00:16 . 2008-12-28 00:16 244 --ah----- C:\sqmnoopt15.sqm

2008-12-25 23:48 . 2008-12-25 23:48 268 --ah----- C:\sqmdata14.sqm

2008-12-25 23:48 . 2008-12-25 23:48 244 --ah----- C:\sqmnoopt14.sqm

2008-12-14 11:56 . 2008-12-16 07:21 <DIR> d-------- c:\program files\UltraVNC

2008-12-13 20:00 . 2008-12-13 20:47 <DIR> d-------- c:\documents and settings\Jibione\Application Data\DiskAid

2008-12-13 19:53 . 2008-12-13 19:53 <DIR> d-------- c:\program files\DigiDNA

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-01-10 18:37 --------- d-----w c:\program files\eMule

2009-01-08 19:14 --------- d-----w c:\program files\Return to Castle Wolfenstein

2009-01-08 18:53 --------- d--h--w c:\program files\InstallShield Installation Information

2009-01-05 21:35 --------- d-----w c:\documents and settings\Jibione\Application Data\dvdcss

2008-12-31 16:44 --------- d-----w c:\documents and settings\All Users\Application Data\DVD Shrink

2008-11-26 07:05 --------- d-----w c:\program files\QuickTime

2008-11-26 07:03 --------- d-----w c:\program files\Java

2008-11-26 06:33 --------- d-----w c:\program files\Google

2008-11-25 17:06 --------- d-----w c:\program files\PacificPoker

2008-11-25 17:06 --------- d-----w c:\documents and settings\Jibione\Application Data\PacificPoker

2008-11-25 17:04 --------- d-----w c:\program files\MeuhMeuhTV Alpha

2008-11-24 19:07 --------- d-----w c:\documents and settings\All Users\Application Data\wmp

2008-11-23 11:22 --------- d-----w c:\program files\AskBarDis

2008-11-22 18:54 --------- d-----w c:\program files\Common Files\DirectX

2008-11-22 15:07 --------- d-----w c:\program files\Common Files\DVDVIDEOSOFT

2008-11-22 15:06 --------- d-----w c:\program files\DVDVIDEOSOFT

2008-11-22 10:56 --------- d-----w c:\program files\WinSCP

2008-11-22 09:47 --------- d-----w c:\program files\iTunes

2008-11-22 09:47 --------- d-----w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}

2008-11-22 09:46 --------- d-----w c:\program files\iPod

2008-11-22 09:46 --------- d-----w c:\program files\Common Files\Apple

2008-11-15 11:21 --------- d-----w c:\documents and settings\Jibione\Application Data\Apple Computer

.

((((((((((((((((((((((((((((( snapshot@2009-01-11_ 4.26.04.53 )))))))))))))))))))))))))))))))))))))))))

.

+ 2009-01-11 22:08:54 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_7a8.dat

.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"flockbox"="c:\program files\My Lockbox\flockbox.exe" [2007-12-15 1071472]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-26 136600]

"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-01-10 81000]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-06 413696]

"au"="c:\program files\Dealio\DealioAU.exe" [2008-05-26 595296]

"SearchSettings"="c:\program files\Search Settings\SearchSettings.exe" [2008-06-12 991584]

"RTHDCPL"="RTHDCPL.EXE" [2007-11-06 c:\windows\RTHDCPL.exe]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Authentication Packages REG_MULTI_SZ msv1_0 nwprovau

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk

backup=c:\windows\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Synchronizer.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Synchronizer.lnk

backup=c:\windows\pss\Adobe Acrobat Synchronizer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk

backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk

backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Outil de mise à jour Google.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Outil de mise à jour Google.lnk

backup=c:\windows\pss\Outil de mise à jour Google.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

--a------ 2008-11-20 13:20 290088 c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]

--------- 2004-10-13 17:24 1694208 c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

--a------ 2008-09-06 15:09 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\eMule\\emule.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"5900:TCP"= 5900:TCP:vnc5900

"5800:TCP"= 5800:TCP:vnc5800

R0 MPRIFL;MPRIFL;c:\windows\system32\drivers\mprifl.sys [2008-01-10 17264]

R4 AMDRAIDXpert;AMD RAIDXpert;c:\program files\AMD\RAIDXpert\jetty\extra\win32\Wrapper.exe [2003-09-29 110592]

R4 uvnc_service;uvnc_service;c:\program files\UltraVNC\winvnc.exe [2008-12-14 1608256]

S1 aswSP;avast! Self Protection; [x]

S3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\system32\drivers\ASPI32.SYS [2008-01-16 16512]

S3 EverestDriver;Lavalys EVEREST Kernel Driver;c:\program files\Lavalys\EVEREST Home Edition\kerneld.wnt [2005-08-18 7168]

S3 fbxusb;Carte réseau virtuelle FreeBox USB;c:\windows\system32\drivers\fbxusb32.sys [2008-03-16 21344]

S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-11-06 34064]

S4 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys --> c:\windows\system32\DRIVERS\aswFsBlk.sys [?]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0cdd83a2-bffb-11dc-af5e-be0ac0faea2a}]

\Shell\AutoRun\command - D:\Autorun.exe /run

\Shell\Shell00\Command - D:\Autorun.exe /run

\Shell\Shell01\Command - D:\Autorun.exe /action

\Shell\Shell02\Command - D:\Autorun.exe /uninstall

.

Contenu du dossier 'Tâches planifiées'

2009-01-07 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

.

- - - - ORPHELINS SUPPRIMES - - - -

URLSearchHooks-{E312764E-7706-43F1-8DAB-FCDD2B1E416D} - (no file)

.

------- Examen supplémentaire -------

.

uStart Page = hxxp://yahoo.fr/

uInternet Settings,ProxyOverride = *.local

IE: Compare Prices with &Dealio - c:\documents and settings\Jibione\Application Data\Dealio\kb127\res\DealioSearch.html

IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

TCP: {45BCFF62-AB81-4033-A84F-C015C618050B} = 212.27.53.252,212.27.54.252

FF - ProfilePath - c:\documents and settings\Jibione\Application Data\Mozilla\Firefox\Profiles\3qb0duha.default\

FF - prefs.js: browser.startup.homepage - hxxp://yahoo.fr/

FF - plugin: c:\program files\ma-config.com\nphardwaredetection.dll

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-01-11 23:10:47

Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès

Fichiers cachés: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\EverestDriver]

"ImagePath"="\??\c:\program files\Lavalys\EVEREST Home Edition\kerneld.wnt"

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•A~*]

"C040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"

.

--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(884)

c:\windows\system32\Ati2evxx.dll

.

------------------------ Autres processus actifs ------------------------

.

c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

c:\program files\AMD\RAIDXpert\_jvm\bin\java.exe

c:\program files\iPod\bin\iPodService.exe

c:\windows\system32\notepad.exe

.

**************************************************************************

.

Heure de fin: 2009-01-11 23:13:44 - La machine a redémarré

ComboFix-quarantined-files.txt 2009-01-11 22:13:41

ComboFix2.txt 2009-01-11 03:30:24

Avant-CF: 20 276 199 424 bytes free

Après-CF: 20,274,470,912 bytes free

217 --- E O F --- 2008-12-19 06:03:18

Falkra · le 12 janvier 2009

Rien là dedans, auras-tu déjà utilisé combofix pour traiter ça ? (le rapport indique que oui, on dirait)

Il va falloir réinstaller ton antivirus, Bagle les endommage.

Télécharge Toolbar-S&D (Team IDN) sur ton Bureau.

Double-clique maintenant sur le fichier téléchargé.
Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.
Choisis maintenant l'option (Recherche). Patiente jusqu'à la fin de la recherche.
Poste le rapport généré. (C:\TB.txt)

Jibione · le 12 janvier 2009

Disons que j'avais utilisé Toolbar SD pour poster le premier rapport de mon sujet.

Je viens de le remouliner, et ça donne ça :

-----------\\ ToolBar S&D 1.2.8 XP/Vista

Microsoft Windows XP Professional ( v5.1.2600 ) Service Pack 2

X86-based PC ( Multiprocessor Free : Genuine Intel® CPU 2140 @ 1.60GHz )

BIOS : Phoenix - AwardBIOS v6.00PG

USER : Jibione ( Administrator )

BOOT : Normal boot

Antivirus : avast! antivirus 4.8.1296 [VPS 090108-0] 4.8.1296 (Not Activated)

C:\ (Local Disk) - NTFS - Total:111 Go (Free:18 Go)

D:\ (Local Disk) - FAT32 - Total:232 Go (Free:160 Go)

E:\ (USB)

F:\ (USB)

G:\ (USB)

H:\ (USB)

I:\ (Local Disk) - NTFS - Total:111 Go (Free:13 Go)

J:\ (CD or DVD)

L:\ (CD or DVD)

"C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )

Option : [1] ( 12/01/2009|18:34 )