Virus très perturbant

Bonsoir

Quel est ton antivirus ? Quel et ton parefeu ?

* Télécharge SmitfraudFix de S!Ri:
http://siri.urz.free.fr/Fix/SmitfraudFix.php
Tu le dézippes sur le Bureau.
Tu ouvres SmitfraudFix, tu double cliques sur SmitfraudFix.cmd et tu choisis l’option 1
Postes le rapport.

Bonjour

Tu es gentil Angeldark de continuer sans qu'il se protège.
Quand on regarde le rapport, il y a plusieurs infections dont certaines sont surement là depuis quelques temps. Mais comme il n'y avait pas de dysfonctionnement du système, cela n'était pas gênant...

cakissimo

Je te conseille fortement de te protèger.

- 1 (et 1 seul) pare-feu bien paramétré, gratuit
par exemple ZoneAlarm
http://www.zonelabs.com/
et son tutorial
http://speedweb1.free.fr/frames2.php?page=tuto1

- 1 (et 1 seul) antivirus résident bien paramétré et mis à jour régulièrement (quotidiennement s'il le faut) avec un scan complet régulier (journalier s'il le faut), gratuit
par exemple AVAST Home Edition FREE
http://www.avast.com/eng/down_home.html
avec inscription obligatoire
http://www.avast.com/i_kat_207.php?lang=ENG
et son tutorial
http://www.pcentraide.com/index.php?showtopic=120

Comme ont dit ,y'a que les cons qui changent pas d'avis.....
Pour la 3ème fois depuis que j'ai un pc ,j'ai réinstaller un antivirus/parefeu en espérant qu'il ont progressé dans ce domaine et qu'il me casse pas trop les cou***es.

Pourriez svp m'aidez à resoudre mon problème avant que çà me prenne trop la tête et que je formatte le pc...l'antivirus/antispyware n'étant pas capable d'y remedier...çà commence bien!!!

Bah justement je vient de dire que je l'ai réinstaller:

Pourquoi me faire reposter un rapport ?c'est la même chose ,l'antivirus/parefeu étant activé cette fois.....bref;

Logfile of HijackThis v1.99.1
Scan saved at 18:25:15, on 28/09/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\oodag.exe
H:\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\issearch.exe
C:\WINDOWS\system32\isnotify.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\WINDOWS\system32\svchost.exe
H:\StatBar\StatBar.exe
H:\System Mechanic Professional 6\SMSystemAnalyzer.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe
C:\Program Files\Internet Explorer\iexplore.exe
H:\System Mechanic Professional 6\PopupBlocker.exe
I:\FIREFOX\FIREFOX.EXE
C:\Documents and Settings\Olivier\Bureau\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.fr/keyword/%s
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\about.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {A8B28872-3324-4CD2-8AA3-7D555C872D96} - (no file)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://I%3A%5CNetscape%5Csearchplugins%5CNetscape_France.src" ); (C:\Documents and Settings\Olivier\Application Data\Mozilla\Profiles\default\v4j79961.slt\prefs.js)
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O3 - Toolbar: &VSToolBar - {821F87FF-8245-4972-9E28-732E92EC2F51} - C:\Program Files\VSToolbar\VSToolBar.dll
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKCU\..\Run: [StatBar] H:\StatBar\StatBar.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SMSystemAnalyzer] "H:\System Mechanic Professional 6\SMSystemAnalyzer.exe"
O4 - HKCU\..\Run: [System Mechanic Popup Blocker] "H:\System Mechanic Professional 6\PopupBlocker.exe"
O4 - Global Startup: Kaspersky Anti-Hacker.lnk = C:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe
O8 - Extra context menu item: Download All Links with IDM - H:\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download with IDM - H:\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://drivers1.free.fr/telecharge [...] 2&version=
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activ [...] asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{43E2F644-D133-4091-8724-52F179955BFC}: NameServer = 212.27.32.176,212.27.32.5
O17 - HKLM\System\CS1\Services\Tcpip\..\{43E2F644-D133-4091-8724-52F179955BFC}: NameServer = 212.27.32.176,212.27.32.5
O17 - HKLM\System\CS2\Services\Tcpip\..\{43E2F644-D133-4091-8724-52F179955BFC}: NameServer = 212.27.32.176,212.27.32.5
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O21 - SSODL: incestuously - {03413bf7-e34c-445b-bfc0-a2b127255871} - C:\WINDOWS\system32\urroxtl.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Kaspersky Anti-Virus Service (kavsvc) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - H:\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: wampapache - Unknown owner - H:\wamp\apache2\bin\Apache.exe" -k runservice (file missing)
O23 - Service: wampmysqld - Unknown owner - H:\wamp\mysql\bin\mysqld-nt.exe

Si si ,le voilà>>>H:\System Mechanic Professional6\SMSystemAnalyzer.exe
Sinon j'ai toujours le même problème.

SmitFraudFix v2.100

Rapport fait à 19:12:12,60, 28/09/2006
Executé à partir de C:\Documents and Settings\Olivier\Bureau\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Fix executé en mode sans echec

»»»»»»»»»»»»»»»»»»»»»»»» Avant SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés

C:\WINDOWS\system32\ixt?.dll supprimé

»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires


»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre

Nettoyage terminé.

»»»»»»»»»»»»»»»»»»»»»»»» Après SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

Logfile of HijackThis v1.99.1
Scan saved at 19:23:31, on 28/09/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\oodag.exe
H:\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
H:\StatBar\StatBar.exe
H:\System Mechanic Professional 6\SMSystemAnalyzer.exe
H:\System Mechanic Professional 6\PopupBlocker.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe
C:\Program Files\Internet Explorer\iexplore.exe
I:\Firefox\firefox.exe
H:\Winamp\winamp.exe
C:\Documents and Settings\Olivier\Bureau\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {A8B28872-3324-4CD2-8AA3-7D555C872D96} - (no file)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://I%3A%5CNetscape%5Csearchplugins%5CNetscape_France.src" ); (C:\Documents and Settings\Olivier\Application Data\Mozilla\Profiles\default\v4j79961.slt\prefs.js)
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O3 - Toolbar: &VSToolBar - {821F87FF-8245-4972-9E28-732E92EC2F51} - C:\Program Files\VSToolbar\VSToolBar.dll
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKCU\..\Run: [StatBar] H:\StatBar\StatBar.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SMSystemAnalyzer] "H:\System Mechanic Professional 6\SMSystemAnalyzer.exe"
O4 - HKCU\..\Run: [System Mechanic Popup Blocker] "H:\System Mechanic Professional 6\PopupBlocker.exe"
O4 - Global Startup: Kaspersky Anti-Hacker.lnk = C:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe
O8 - Extra context menu item: Download All Links with IDM - H:\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download with IDM - H:\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://drivers1.free.fr/telecharge [...] 2&version=
O17 - HKLM\System\CCS\Services\Tcpip\..\{43E2F644-D133-4091-8724-52F179955BFC}: NameServer = 212.27.32.176,212.27.32.5
O17 - HKLM\System\CS1\Services\Tcpip\..\{43E2F644-D133-4091-8724-52F179955BFC}: NameServer = 212.27.32.176,212.27.32.5
O17 - HKLM\System\CS2\Services\Tcpip\..\{43E2F644-D133-4091-8724-52F179955BFC}: NameServer = 212.27.32.176,212.27.32.5
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Kaspersky Anti-Virus Service (kavsvc) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - H:\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: wampapache - Unknown owner - H:\wamp\apache2\bin\Apache.exe" -k runservice (file missing)
O23 - Service: wampmysqld - Unknown owner - H:\wamp\mysql\bin\mysqld-nt.exe

Bonsoir Angeldark, chercheurpca et cakissimo,

(suis rentré de vacance pour ce qui me connaisse... LOL 3615 MYLIFE) bref on plaisante plus

cakissimo :

Suis les conseilles de cheucheurpca sur ta protection :

Car tu as installé Mechanic Pro qui est très très mal classé (heu... on va dire une daube).

[b]

Lorsque nous voyons sa, nous Helpers, ont prends peur (Aïïeeee les rimes.... pas terribles).

Breff.... je conclus (dsle pour les fautes) mais suis tous ce que nos chers amis te propose...

Ohhh la vache çà à pris au moins deux heures ,j'ai suivi les consignes à la lettre....

Ok merci de ton conseil ,je ferait çà apres car là c'est entrain de me pourrir la vie ce truc...

voici le rapport:
le probleme persite toujours...

---------------------------------------------------------
ewido anti-spyware - Scan Report
---------------------------------------------------------

+ Created at: 22:03:20 28/09/2006

+ Scan result:



C:\Installer4.exe -> Adware.Look2Me : Cleaned with backup (quarantined).
C:\WINDOWS\system32\iuwphbk.dll -> Adware.Look2Me : Cleaned with backup (quarantined).
C:\WINDOWS\system32\rzutetab.dll -> Adware.Look2Me : Cleaned with backup (quarantined).
C:\warebundlenewer.exe -> Adware.Look2Me : Cleaned with backup (quarantined).
[748] C:\WINDOWS\system32\murating.dll -> Adware.Look2Me : Cleaned with backup (quarantined).
[824] C:\WINDOWS\system32\murating.dll -> Adware.Look2Me : Error during cleaning.
C:\Program Files\themexp\Themexp.org File\NNWDAB638.EXE -> Adware.NewDotNet : Cleaned with backup (quarantined).
C:\Program Files\themexp\Themexp.org File\SetupInst.exe -> Adware.SaveNow : Cleaned with backup (quarantined).
H:\Glyph\slghex.dll -> Adware.SpywareStorm : Cleaned with backup (quarantined).
C:\ucmoreiex.exe/IUCMORE.DLL -> Adware.Ucmore : Cleaned with backup (quarantined).
C:\ucmoreiex.exe/UCMTSAIE.DLL -> Adware.Ucmore : Cleaned with backup (quarantined).
C:\ucmoreiex.exe/empty_00000001 -> Adware.Ucmore : Cleaned with backup (quarantined).
C:\Documents and Settings\Olivier\Local Settings\Temp\Temporary Internet Files\Content.IE5\KVSBQFU1\anti4[1].exe -> Adware.Virtumionde : Cleaned with backup (quarantined).
C:\drsmartload45a45a45k.exe -> Downloader.Adload.fu : Cleaned with backup (quarantined).
C:\ac3_0010.exe -> Downloader.Small : Cleaned with backup (quarantined).
C:\MTE3NDI6ODoxNgnew.exe -> Downloader.Small.buy : Cleaned with backup (quarantined).
C:\Program Files\Network Monitor\netmon.exe -> Not-A-Virus.Monitor.Win32.NetMon.a : Cleaned with backup (quarantined).
F:\Telecharger\part1\scripts\z4_tools\asterwin.exe -> Not-A-Virus.PSWTool.Win32.AsterWin.a : Cleaned with backup (quarantined).
:mozilla.461:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
:mozilla.462:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
:mozilla.463:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
:mozilla.465:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
:mozilla.466:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
:mozilla.467:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
:mozilla.615:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
:mozilla.771:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\Documents and Settings\Olivier\Local Settings\Temp\Cookies\olivier@cochranfirm.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\Documents and Settings\Olivier\Local Settings\Temp\Cookies\olivier@partygaming.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
:mozilla.451:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned with backup (quarantined).
:mozilla.452:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned with backup (quarantined).
:mozilla.453:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned with backup (quarantined).
:mozilla.455:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned with backup (quarantined).
:mozilla.456:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned with backup (quarantined).
:mozilla.459:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned with backup (quarantined).
C:\Documents and Settings\Olivier\Local Settings\Temp\Cookies\olivier@adbrite[1].txt -> TrackingCookie.Adbrite : Cleaned with backup (quarantined).
C:\Documents and Settings\Olivier\Local Settings\Temp\Cookies\olivier@ad.adition[3].txt -> TrackingCookie.Adition : Cleaned with backup (quarantined).
:mozilla.524:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Adtech : Cleaned with backup (quarantined).
:mozilla.525:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Adtech : Cleaned with backup (quarantined).
:mozilla.438:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined).
:mozilla.439:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined).
:mozilla.440:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined).
:mozilla.441:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined).
:mozilla.416:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned with backup (quarantined).
:mozilla.28:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Bluestreak : Cleaned with backup (quarantined).
C:\Documents and Settings\Olivier\Local Settings\Temp\Cookies\olivier@ads00.bpath[2].txt -> TrackingCookie.Bpath : Cleaned with backup (quarantined).
C:\Documents and Settings\Olivier\Local Settings\Temp\Cookies\olivier@ads05.bpath[1].txt -> TrackingCookie.Bpath : Cleaned with backup (quarantined).
C:\Documents and Settings\Olivier\Local Settings\Temp\Cookies\olivier@ads13.bpath[2].txt -> TrackingCookie.Bpath : Cleaned with backup (quarantined).
C:\Documents and Settings\Olivier\Local Settings\Temp\Cookies\olivier@ads18.bpath[2].txt -> TrackingCookie.Bpath : Cleaned with backup (quarantined).
C:\Documents and Settings\Olivier\Local Settings\Temp\Cookies\olivier@ads25.bpath[2].txt -> TrackingCookie.Bpath : Cleaned with backup (quarantined).
C:\Documents and Settings\Olivier\Local Settings\Temp\Cookies\olivier@ads27.bpath[2].txt -> TrackingCookie.Bpath : Cleaned with backup (quarantined).
C:\Documents and Settings\Olivier\Local Settings\Temp\Cookies\olivier@ads33.bpath[2].txt -> TrackingCookie.Bpath : Cleaned with backup (quarantined).
C:\Documents and Settings\Olivier\Local Settings\Temp\Cookies\olivier@ads43.bpath[2].txt -> TrackingCookie.Bpath : Cleaned with backup (quarantined).
C:\Documents and Settings\Olivier\Local Settings\Temp\Cookies\olivier@ads46.bpath[2].txt -> TrackingCookie.Bpath : Cleaned with backup (quarantined).
C:\Documents and Settings\Olivier\Local Settings\Temp\Cookies\olivier@ads49.bpath[2].txt -> TrackingCookie.Bpath : Cleaned with backup (quarantined).
C:\Documents and Settings\Olivier\Local Settings\Temp\Cookies\olivier@www.burstnet[1].txt -> TrackingCookie.Burstnet : Cleaned with backup (quarantined).
:mozilla.549:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined).
:mozilla.550:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined).
:mozilla.551:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined).
:mozilla.552:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined).
:mozilla.553:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined).
:mozilla.554:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined).
:mozilla.555:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined).
C:\Documents and Settings\Olivier\Local Settings\Temp\Cookies\olivier@cz8.clickzs[2].txt -> TrackingCookie.Clickzs : Cleaned with backup (quarantined).
:mozilla.417:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup (quarantined).
C:\Documents and Settings\Olivier\Local Settings\Temp\Cookies\olivier@com[1].txt -> TrackingCookie.Com : Cleaned with backup (quarantined).
:mozilla.402:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Comclick : Cleaned with backup (quarantined).
:mozilla.403:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Comclick : Cleaned with backup (quarantined).
:mozilla.404:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Comclick : Cleaned with backup (quarantined).
:mozilla.405:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Comclick : Cleaned with backup (quarantined).
:mozilla.406:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Comclick : Cleaned with backup (quarantined).
:mozilla.16:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned with backup (quarantined).
:mozilla.17:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned with backup (quarantined).
:mozilla.18:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned with backup (quarantined).
:mozilla.19:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned with backup (quarantined).
C:\Documents and Settings\Olivier\Cookies\olivier@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Cleaned with backup (quarantined).
:mozilla.75:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned with backup (quarantined).
:mozilla.737:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Enhance : Cleaned with backup (quarantined).
:mozilla.738:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Enhance : Cleaned with backup (quarantined).
C:\Documents and Settings\Olivier\Local Settings\Temp\Cookies\olivier@c.enhance[1].txt -> TrackingCookie.Enhance : Cleaned with backup (quarantined).
:mozilla.223:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Estat : Cleaned with backup (quarantined).
C:\Documents and Settings\Olivier\Local Settings\Temp\Cookies\olivier@adopt.euroclick[2].txt -> TrackingCookie.Euroclick : Cleaned with backup (quarantined).
:mozilla.407:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined).
:mozilla.408:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined).
:mozilla.409:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined).
:mozilla.410:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined).
:mozilla.411:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined).
:mozilla.850:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined).
:mozilla.851:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined).
:mozilla.852:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined).
:mozilla.853:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined).
:mozilla.854:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined).
:mozilla.668:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup (quarantined).
:mozilla.669:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup (quarantined).
:mozilla.670:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup (quarantined).
:mozilla.671:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup (quarantined).
:mozilla.673:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup (quarantined).
C:\Documents and Settings\Olivier\Local Settings\Temp\Cookies\olivier@c.goclick[1].txt -> TrackingCookie.Goclick : Cleaned with backup (quarantined).
C:\Documents and Settings\Olivier\Local Settings\Temp\Cookies\olivier@ilead.itrack[1].txt -> TrackingCookie.Itrack : Cleaned with backup (quarantined).
C:\Documents and Settings\Olivier\Local Settings\Temp\Cookies\olivier@ivwbox[1].txt -> TrackingCookie.Ivwbox : Cleaned with backup (quarantined).
:mozilla.563:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Linkbuddies : Cleaned with backup (quarantined).
:mozilla.728:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup (quarantined).
:mozilla.731:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup (quarantined).
:mozilla.732:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup (quarantined).
:mozilla.733:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup (quarantined).
:mozilla.412:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned with backup (quarantined).
C:\Documents and Settings\Olivier\Local Settings\Temp\Cookies\olivier@www.myaffiliateprogram[2].txt -> TrackingCookie.Myaffiliateprogram : Cleaned with backup (quarantined).
C:\Documents and Settings\Olivier\Local Settings\Temp\Cookies\olivier@banner.newyorkcasino[2].txt -> TrackingCookie.Newyorkcasino : Cleaned with backup (quarantined).
:mozilla.901:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Onestat : Cleaned with backup (quarantined).
:mozilla.902:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Onestat : Cleaned with backup (quarantined).
:mozilla.330:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Overture : Cleaned with backup (quarantined).
:mozilla.331:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Overture : Cleaned with backup (quarantined).
C:\Documents and Settings\Olivier\Local Settings\Temp\Cookies\olivier@data1.perf.overture[1].txt -> TrackingCookie.Overture : Cleaned with backup (quarantined).
C:\Documents and Settings\Olivier\Local Settings\Temp\Cookies\olivier@data2.perf.overture[1].txt -> TrackingCookie.Overture : Cleaned with backup (quarantined).
C:\Documents and Settings\Olivier\Local Settings\Temp\Cookies\olivier@data3.perf.overture[1].txt -> TrackingCookie.Overture : Cleaned with backup (quarantined).
:mozilla.490:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Paypopup : Cleaned with backup (quarantined).
:mozilla.491:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Paypopup : Cleaned with backup (quarantined).
:mozilla.492:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Paypopup : Cleaned with backup (quarantined).
:mozilla.880:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Planetactive : Cleaned with backup (quarantined).
C:\Documents and Settings\Olivier\Local Settings\Temp\Cookies\olivier@ads.realcastmedia[2].txt -> TrackingCookie.Realcastmedia : Cleaned with backup (quarantined).
:mozilla.508:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
:mozilla.509:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
:mozilla.510:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
:mozilla.511:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
:mozilla.512:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
:mozilla.513:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
:mozilla.514:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
:mozilla.515:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
:mozilla.516:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
:mozilla.517:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
:mozilla.518:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
:mozilla.519:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
:mozilla.520:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
:mozilla.521:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
:mozilla.522:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
:mozilla.523:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
C:\Documents and Settings\Olivier\Local Settings\Temp\Cookies\olivier@stats1.reliablestats[1].txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
C:\Documents and Settings\Olivier\Local Settings\Temp\Cookies\olivier@ads0.revenue[1].txt -> TrackingCookie.Revenue : Cleaned with backup (quarantined).
:mozilla.818:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined).
:mozilla.819:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined).
:mozilla.820:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined).
:mozilla.821:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined).
:mozilla.822:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined).
:mozilla.823:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined).
:mozilla.791:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned with backup (quarantined).
:mozilla.793:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned with backup (quarantined).
:mozilla.846:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned with backup (quarantined).
:mozilla.847:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned with backup (quarantined).
:mozilla.42:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned with backup (quarantined).
:mozilla.43:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned with backup (quarantined).
:mozilla.44:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned with backup (quarantined).
C:\Documents and Settings\Olivier\Local Settings\Temp\Cookies\olivier@adopt.specificclick[2].txt -> TrackingCookie.Specificclick : Cleaned with backup (quarantined).
:mozilla.533:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined).
:mozilla.534:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined).
:mozilla.535:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined).
:mozilla.536:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined).
:mozilla.537:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined).
:mozilla.538:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined).
:mozilla.539:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined).
:mozilla.540:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined).
:mozilla.541:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined).
:mozilla.542:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined).
:mozilla.543:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined).
:mozilla.544:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined).
:mozilla.545:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined).
:mozilla.546:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined).
:mozilla.547:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined).
:mozilla.389:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup (quarantined).
:mozilla.390:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup (quarantined).
:mozilla.391:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup (quarantined).
:mozilla.392:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup (quarantined).
:mozilla.393:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup (quarantined).
C:\Documents and Settings\Olivier\Cookies\olivier@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Cleaned with backup (quarantined).
:mozilla.564:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup (quarantined).
:mozilla.565:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup (quarantined).
:mozilla.566:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup (quarantined).
:mozilla.567:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup (quarantined).
:mozilla.625:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Valueclick : Cleaned with backup (quarantined).
:mozilla.626:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Valueclick : Cleaned with backup (quarantined).
C:\Documents and Settings\Olivier\Local Settings\Temp\Cookies\olivier@web-stat[2].txt -> TrackingCookie.Web-stat : Cleaned with backup (quarantined).
:mozilla.191:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Weborama : Cleaned with backup (quarantined).
:mozilla.192:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Weborama : Cleaned with backup (quarantined).
:mozilla.193:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Weborama : Cleaned with backup (quarantined).
:mozilla.194:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Weborama : Cleaned with backup (quarantined).
C:\Documents and Settings\Olivier\Local Settings\Temp\Cookies\olivier@yadro[1].txt -> TrackingCookie.Yadro : Cleaned with backup (quarantined).
:mozilla.10:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).
:mozilla.11:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).
:mozilla.12:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).
:mozilla.6:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).
:mozilla.7:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).
:mozilla.8:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).
:mozilla.9:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\gbf3a9lm.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).
C:\Documents and Settings\Olivier\Local Settings\Temp\Cookies\olivier@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).
F:\Telecharger\part1\scripts\gallery_maker_pro_1.5\patch.exe -> Trojan.Proxcrak.A : Cleaned with backup (quarantined).


::Report end

Salut esteban54 ,

Look2Me-Destroyer V1.0.12

Scanning for infected files.....
Scan started at 28/09/2006 23:33:03

Infected! C:\WINDOWS\system32\i8lo0i33e8.dll
Infected! C:\WINDOWS\system32\dugeng.dll
Infected! C:\WINDOWS\system32\j2l4lc3q1f.dll
Infected! C:\WINDOWS\system32\guard.tmp

Attempting to delete infected files...

Attempting to delete: C:\WINDOWS\system32\i8lo0i33e8.dll
C:\WINDOWS\system32\i8lo0i33e8.dll could not be deleted!

Attempting to delete: C:\WINDOWS\system32\dugeng.dll
C:\WINDOWS\system32\dugeng.dll could not be deleted!

Attempting to delete: C:\WINDOWS\system32\j2l4lc3q1f.dll
C:\WINDOWS\system32\j2l4lc3q1f.dll could not be deleted!

Attempting to delete: C:\WINDOWS\system32\guard.tmp
C:\WINDOWS\system32\guard.tmp could not be deleted!

Making registry repairs.

Removing: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ShellCompatibility

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{DABFC9D6-BE6A-4DE5-8773-CC1D925B7499}"
HKCR\Clsid\{DABFC9D6-BE6A-4DE5-8773-CC1D925B7499}

Restoring Windows certificates.

Replaced hosts file with default windows hosts file


Restoring SeDebugPrivilege for Administrateurs - Succeeded

O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://drivers1.free.fr/telecharge [...] 2&version=
O17 - HKLM\System\CCS\Services\Tcpip\..\{43E2F644-D133-4091-8724-52F179955BFC}: NameServer = 212.27.32.176,212.27.32.5
O17 - HKLM\System\CS1\Services\Tcpip\..\{43E2F644-D133-4091-8724-52F179955BFC}: NameServer = 212.27.32.176,212.27.32.5
O17 - HKLM\System\CS2\Services\Tcpip\..\{43E2F644-D133-4091-8724-52F179955BFC}: NameServer = 212.27.32.176,212.27.32.5
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - H:\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Kaspersky Anti-Virus Service (kavsvc) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing)
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - H:\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: wampapache - Unknown owner - H:\wamp\apache2\bin\Apache.exe" -k runservice (file missing)
O23 - Service: wampmysqld - Unknown owner - H:\wamp\mysql\bin\mysqld-nt.exe

Rapport de combofix:

Olivier - 06-09-29 0:36:52.23 Service Pack 2
ComboFix 06.09.28 - Running from: "C:\Documents and Settings\Olivier\Bureau"

((((((((((((((((((((((((((((((((((((((((((((( Look2Me's Log ))))))))))))))))))))))))))))))))))))))))))))))))))
C:\WINDOWS\system32\i8lo0i33e8.dll
C:\WINDOWS\system32\p88qlil518q.dll


Granting sedebugprivilege to Administrateurs ... successful


(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\dfndrff_e16.exe
C:\deskbar.exe
C:\deskbar_e13.exe
C:\deskbar_e15.exe
C:\kybrdff_e16.exe
C:\nwnmff_e16.exe
C:\WINDOWS\system32\wnsintsv.exe
C:\WINDOWS\uninstall_nmon.vbs
C:\Documents and Settings\LocalService\Application Data\NetMon
C:\Documents and Settings\NetworkService\Application Data\NetMon
C:\Program Files\Deskbar
C:\Program Files\network monitor
C:\WINDOWS\system32\components
C:\Program Files\Fichiers communs\{68BDA294-0A41-1036-0914-040403040021}

~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

Folders Quarantined:

C:\QooBox\Purity\WINDOWS\WNSXS~1


((((((((((((((((((((((((((((((( Files Created from 2006-08-29 to 2006-09-29 ))))))))))))))))))))))))))))))))))


2006-09-29 00:34 73,748 --a------ C:\WINDOWS\system32\munlxjgv.dll
2006-09-28 22:43 129,784 --------- C:\WINDOWS\system32\pxafs.dll
2006-09-28 22:43 115,880 --------- C:\WINDOWS\system32\pxinsi64.exe
2006-09-28 22:07 73,748 --a------ C:\WINDOWS\system32\qyfombjc.dll
2006-09-28 22:07 672,534 ---hs---- C:\WINDOWS\system32\edeeg.bak2
2006-09-28 22:07 45,525 --a------ C:\WINDOWS\system32\nparkqfm.dll
2006-09-28 19:11 53,248 --a------ C:\WINDOWS\system32\Process.exe
2006-09-28 19:11 40,960 --a------ C:\WINDOWS\system32\swsc.exe
2006-09-28 19:11 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2006-09-28 19:11 135,168 --a------ C:\WINDOWS\system32\swreg.exe
2006-09-28 19:08 92,803 --a------ C:\Pass2.cmd
2006-09-28 17:37 45,352 --a------ C:\WINDOWS\system32\drivers\klin.sys
2006-09-28 17:37 44,555 --a------ C:\WINDOWS\system32\drivers\klick.sys
2006-09-28 17:36 9,341 --a------ C:\WINDOWS\system32\drivers\filedisk.sys
2006-09-28 17:36 663,040 --a------ C:\WINDOWS\is-6EGLT.exe
2006-09-28 17:36 41,472 --a------ C:\WINDOWS\system32\iolobtdfg.exe
2006-09-28 17:36 25,264 --a------ C:\WINDOWS\system32\smrgdf.exe
2006-09-28 17:36 1,212,928 --a------ C:\WINDOWS\system32\Incinerator.dll
2006-09-28 17:23 73,748 --a------ C:\WINDOWS\system32\rtiuhmay.dll
2006-09-28 14:12 569 ---hs---- C:\WINDOWS\system32\edeeg.ini2
2006-09-27 18:34 45,525 --a------ C:\WINDOWS\system32\pbdsanxn.dll
2006-09-27 18:34 143,380 --a------ C:\WINDOWS\system32\fncihxww.exe
2006-09-27 17:26 577,588 --------- C:\WINDOWS\system32\geede.dll
2006-09-27 17:19 93,696 --a------ C:\WINDOWS\system32\yuxsnye.dll
2006-09-27 17:19 72,704 --a------ C:\WINDOWS\system32\xaxrwki.dll
2006-09-27 17:12 1,233 --a------ C:\WINDOWS\system32\chxfff30.sys


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-09-29 00:37 -------- d-------- C:\Program Files\Fichiers communs
2006-09-28 17:38 -------- d-------- C:\Program Files\Kaspersky Lab
2006-09-28 17:38 -------- d-------- C:\Program Files\Fichiers communs\Kaspersky Lab
2006-09-28 17:36 -------- d-------- C:\Program Files\iolo
2006-09-28 17:16 -------- d-------- C:\Program Files\Microsoft IntelliPoint
2006-09-28 17:15 -------- d-------- C:\Program Files\Microsoft IntelliPoint 5.5
2006-09-28 17:13 -------- d-------- C:\Program Files\HardwareDetection
2006-09-27 18:35 -------- d-------- C:\Documents and Settings\Olivier\Application Data\SearchToolbarCorp
2006-09-27 18:34 -------- d-------- C:\Program Files\VSToolbar
2006-09-16 08:41 -------- d-------- C:\Documents and Settings\Olivier\Application Data\DMCache
2006-09-10 17:34 -------- d-------- C:\Documents and Settings\Olivier\Application Data\Macromedia
2006-09-10 17:31 -------- d-------- C:\Program Files\Fichiers communs\Macromedia
2006-09-05 18:11 -------- d-------- C:\Documents and Settings\Olivier\Application Data\vlc
2006-09-03 20:24 -------- d-------- C:\Documents and Settings\Olivier\Application Data\IDM
2006-09-03 19:43 34308 --a------ C:\WINDOWS\system32\BASSMOD.dll
2006-08-25 05:47 36528 --------- C:\WINDOWS\system32\drivers\PxHelp20.sys
2006-08-22 20:30 -------- d-------- C:\Documents and Settings\Olivier\Application Data\Media Player Classic
2006-08-20 22:20 -------- d-------- C:\Program Files\Java
2006-08-20 21:37 -------- d-------- C:\Documents and Settings\Olivier\Application Data\Adobe
2006-08-20 09:51 -------- d-------- C:\Documents and Settings\Olivier\Application Data\PC Tools
2006-08-20 02:41 95440 --a------ C:\WINDOWS\GREUninstall.exe
2006-08-20 02:41 87184 --a------ C:\WINDOWS\NSUninst.exe
2006-08-20 02:41 -------- d--h----- C:\Program Files\InstallShield Installation Information
2006-08-20 02:41 -------- d-------- C:\Program Files\Viewpoint
2006-08-20 02:17 99024 --a------ C:\WINDOWS\MozillaUninstall.exe
2006-08-20 02:17 -------- d-------- C:\Program Files\Fichiers communs\mozilla.org
2006-08-20 02:17 -------- d-------- C:\Documents and Settings\Olivier\Application Data\Talkback
2006-08-20 02:17 -------- d-------- C:\Documents and Settings\Olivier\Application Data\Mozilla
2006-08-17 17:17 -------- d-------- C:\Documents and Settings\Olivier\Application Data\Ahead
2006-08-17 17:13 -------- d-------- C:\Program Files\Fichiers communs\Ahead
2006-08-17 17:09 -------- d-------- C:\Program Files\Nero
2006-08-16 15:36 8464 --a------ C:\WINDOWS\system32\sporder.dll
2006-08-16 15:36 -------- d-------- C:\Program Files\themexp
2006-08-16 15:33 -------- d-------- C:\Program Files\TGTSoft
2006-08-16 15:11 -------- d-------- C:\Program Files\Outlook Express
2006-08-16 15:11 -------- d-------- C:\Program Files\Internet Explorer
2006-08-15 16:14 -------- d-------- C:\Documents and Settings\Olivier\Application Data\NeroDCTemplates
2006-08-09 12:54 73216 --a------ C:\WINDOWS\ST6UNST.EXE
2006-08-09 12:54 286720 --------- C:\WINDOWS\Setup1.exe
2006-08-08 15:35 -------- d---s---- C:\Documents and Settings\Olivier\Application Data\Microsoft
2006-08-08 13:56 -------- d-------- C:\Program Files\eurobarre
2006-08-07 16:31 -------- d-------- C:\Program Files\Boontygames
2006-08-07 16:21 -------- d-------- C:\Program Files\Fichiers communs\BOONTY Shared
2006-08-07 16:21 -------- d-------- C:\Program Files\Boonty
2006-08-06 14:22 -------- d-------- C:\Program Files\Windows Media Player
2006-08-06 14:22 -------- d-------- C:\Program Files\Fichiers communs\LightScribe
2006-08-05 00:12 -------- d-------- C:\Program Files\Fichiers communs\SourceTec
2006-08-04 17:03 -------- d-------- C:\Program Files\Winamp
2006-08-04 15:08 -------- d-------- C:\Documents and Settings\Olivier\Application Data\Notepad++
2006-08-04 00:18 12464 --a------ C:\WINDOWS\system32\drivers\CdaC15BA.SYS
2006-08-04 00:18 -------- d-------- C:\Program Files\Fichiers communs\Macrovision Shared
2006-08-03 20:41 -------- d-------- C:\Documents and Settings\Olivier\Application Data\ATI
2006-08-03 20:39 -------- d-------- C:\Program Files\ATI Technologies
2006-08-02 12:59 223128 --a------ C:\WINDOWS\system32\drivers\vaxscsi.sys
2006-08-02 12:57 643072 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2006-07-31 15:42 -------- d-------- C:\Program Files\BFG
2006-07-31 15:37 -------- d-------- C:\Program Files\RapidLeecher
2006-07-19 04:58 258048 --a------ C:\WINDOWS\system32\ati2dvag.dll
2006-07-19 04:53 77824 --a------ C:\WINDOWS\system32\Oemdspif.dll
2006-07-19 04:53 26112 --a------ C:\WINDOWS\system32\Ati2mdxx.exe
2006-07-19 04:53 114688 --a------ C:\WINDOWS\system32\atipdlxx.dll
2006-07-19 04:52 86016 --a------ C:\WINDOWS\system32\ati2evxx.dll
2006-07-19 04:52 41984 --a------ C:\WINDOWS\system32\ati2edxx.dll
2006-07-19 04:51 53248 --a------ C:\WINDOWS\system32\ATIDDC.DLL
2006-07-19 04:51 401408 --a------ C:\WINDOWS\system32\ati2evxx.exe
2006-07-19 04:44 2732608 --a------ C:\WINDOWS\system32\ati3duag.dll
2006-07-19 04:39 1744416 --a------ C:\WINDOWS\system32\ativvaxx.dll
2006-07-19 04:27 204800 --a------ C:\WINDOWS\system32\atikvmag.dll
2006-07-19 04:26 17408 --a------ C:\WINDOWS\system32\atitvo32.dll
2006-07-19 04:23 307200 --a------ C:\WINDOWS\system32\atiiiexx.dll
2006-07-19 04:22 6684672 --a------ C:\WINDOWS\system32\atioglx1.dll
2006-07-19 04:22 286720 --a------ C:\WINDOWS\system32\ati2cqag.dll
2006-07-19 04:21 290816 --a------ C:\WINDOWS\system32\ATIDEMGR.dll
2006-07-19 04:13 5136384 --a------ C:\WINDOWS\system32\atioglxx.dll
2006-07-18 21:05 520192 --------- C:\WINDOWS\system32\ati2sgag.exe
2006-06-03 19:55 774144 --a------ C:\Program Files\RngInterstitial.dll
2006-06-03 17:21 62 --ahs---- C:\Documents and Settings\Olivier\Application Data\desktop.ini


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StatBar"="H:\\StatBar\\StatBar.exe"
"msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"
"SMSystemAnalyzer"="\"H:\\System Mechanic Professional 6\\SMSystemAnalyzer.exe\""
"System Mechanic Popup Blocker"="\"H:\\System Mechanic Professional 6\\PopupBlocker.exe\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelliPoint"="\"C:\\Program Files\\Microsoft IntelliPoint\\ipoint.exe\""
"WinampAgent"="H:\\Winamp\\winampa.exe"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000000

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Runonce]
"Config"=""
"nlsf"=""
"tscuninstall"=""

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Runonce]
"Config"=""
"nlsf"=""
"tscuninstall"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="ewido anti-spyware 4.0"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
"NoLowDiskSpaceChecks"=dword:00000001
"NoStartBanner"=hex:01,00,00,00
"MemCheckBoxInRunDlg"=dword:00000001
"NoSMBalloonTip"=dword:00000001
"NoDesktopCleanupWizard"=dword:00000001
"NoWelcomeScreen"=dword:00000001

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
"NoLowDiskSpaceChecks"=dword:00000001
"NoStartBanner"=hex:01,00,00,00
"MemCheckBoxInRunDlg"=dword:00000001
"NoSMBalloonTip"=dword:00000001
"NoDesktopCleanupWizard"=dword:00000001
"NoWelcomeScreen"=dword:00000001

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
"NoLowDiskSpaceChecks"=dword:00000001
"NoStartBanner"=hex:01,00,00,00
"MemCheckBoxInRunDlg"=dword:00000001
"NoSMBalloonTip"=dword:00000001
"NoDesktopCleanupWizard"=dword:00000001
"NoWelcomeScreen"=dword:00000001

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk]
"path"="C:\\Documents and Settings\\All Users\\Menu Démarrer\\Programmes\\Démarrage\\Lancement rapide d'Adobe Reader.lnk"
"backup"="C:\\WINDOWS\\pss\\Lancement rapide d'Adobe Reader.lnkCommon Startup"
"location"="Common Startup"
"command"="H:\\ACROBA~1.0\\Reader\\READER~1.EXE "
"item"="Lancement rapide d'Adobe Reader"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^Olivier^Menu Démarrer^Programmes^Démarrage^Adobe Gamma.lnk]
"path"="C:\\Documents and Settings\\Olivier\\Menu Démarrer\\Programmes\\Démarrage\\Adobe Gamma.lnk"
"backup"="C:\\WINDOWS\\pss\\Adobe Gamma.lnkStartup"
"location"="Startup"
"command"="C:\\PROGRA~1\\FICHIE~1\\Adobe\\CALIBR~1\\ADOBEG~1.EXE "
"item"="Adobe Gamma"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^Olivier^Menu Démarrer^Programmes^Démarrage^CariBarre.lnk]
"path"="C:\\Documents and Settings\\Olivier\\Menu Démarrer\\Programmes\\Démarrage\\CariBarre.lnk"
"backup"="C:\\WINDOWS\\pss\\CariBarre.lnkStartup"
"location"="Startup"
"command"="C:\\PROGRA~1\\CARIBA~1\\cb.exe "
"item"="CariBarre"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^Olivier^Menu Démarrer^Programmes^Démarrage^Eurobarre.lnk]
"path"="C:\\Documents and Settings\\Olivier\\Menu Démarrer\\Programmes\\Démarrage\\Eurobarre.lnk"
"backup"="C:\\WINDOWS\\pss\\Eurobarre.lnkStartup"
"location"="Startup"
"command"="C:\\PROGRA~1\\EUROBA~1\\eb.exe "
"item"="Eurobarre"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\ATICCC]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="CLIStart"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\ATI Technologies\\ATI.ACE\\CLIStart.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NMBgMonitor"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\Fichiers communs\\Ahead\\Lib\\NMBgMonitor.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\CloneCDTray]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="CloneCDTray"
"hkey"="HKLM"
"command"="\"H:\\CloneCD\\CloneCDTray.exe\" /s"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\CTSysVol]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="CTSysVol"
"hkey"="HKLM"
"command"="H:\\Creative\\SB Live! 24-bit\\Surround Mixer\\CTSysVol.exe /r"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\defender]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="dfndrff_e16"
"hkey"="HKLM"
"command"="C:\\\\dfndrff_e16.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\Glass2k]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Glass2k"
"hkey"="HKLM"
"command"="C:\\Program Files\\Glass2k\\Glass2k.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\IDMan]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="IDMan"
"hkey"="HKCU"
"command"="H:\\Internet Download Manager\\IDMan.exe /onboot"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\kernel64]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="getAes"
"hkey"="HKLM"
"command"="C:\\Documents and Settings\\Olivier\\Bureau\\getAes\\getAes.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\keyboard]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="kybrdff_e16"
"hkey"="HKLM"
"command"="C:\\\\kybrdff_e16.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\LClock]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="LClock"
"hkey"="HKLM"
"command"="C:\\Program Files\\LClock\\LClock.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\MessengerPlus3]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="MsgPlus"
"hkey"="HKCU"
"command"="\"H:\\MessengerPlus! 3\\MsgPlus.exe\" /WinStart"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\MsnMsgr]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="msnmsgr"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\NeroFilterCheck]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NeroCheck"
"hkey"="HKLM"
"command"="C:\\Program Files\\Fichiers communs\\Ahead\\Lib\\NeroCheck.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\New.net Startup]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NEWDOT~2"
"hkey"="HKLM"
"command"="rundll32 C:\\PROGRA~1\\NEWDOT~1\\NEWDOT~2.DLL,ClientStartup -s"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\newname]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="nwnmff_e16"
"hkey"="HKLM"
"command"="C:\\\\nwnmff_e16.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\OpwareSE2]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="OpwareSE2"
"hkey"="HKLM"
"command"="\"H:\\ScanSoft\\OmniPageSE2.0\\OpwareSE2.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\platform glue amok meta]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="DALE4"
"hkey"="HKLM"
"command"="C:\\Documents and Settings\\All Users\\Application Data\\film flag platform glue\\DALE4.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\Spyware Doctor]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="swdoctor"
"hkey"="HKCU"
"command"="\"H:\\Spyware Doctor\\swdoctor.exe\" /Q"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\STYLEXP]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="StyleXP"
"hkey"="HKCU"
"command"="C:\\Program Files\\TGTSoft\\StyleXP\\StyleXP.exe -Hide"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\SunJavaUpdateSched]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="jusched"
"hkey"="HKLM"
"command"="C:\\Program Files\\Java\\jre1.5.0_08\\bin\\jusched.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\szahmru]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="szahmru"
"hkey"="HKLM"
"command"="c:\\windows\\system32\\szahmru.exe szahmru"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\Trust Amok]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Wave Face Wma"
"hkey"="HKCU"
"command"="C:\\DOCUME~1\\Olivier\\APPLIC~1\\MAILGR~1\\Wave Face Wma.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\UpdReg]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="UpdReg"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\UpdReg.EXE"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\WinampAgent]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="winampa"
"hkey"="HKLM"
"command"="H:\\Winamp\\winampa.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\yuxsnye.dll]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="yuxsnye"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\rundll32.exe C:\\WINDOWS\\system32\\yuxsnye.dll,gsrwhfg"
"inimapping"="0"

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\geede

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders
securityproviders REG_SZ msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll

Logfile of HijackThis v1.99.1
Scan saved at 00:45:28, on 29/09/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\system32\CTsvcCDA.exe
H:\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\oodag.exe
H:\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
H:\StatBar\StatBar.exe
H:\System Mechanic Professional 6\SMSystemAnalyzer.exe
H:\System Mechanic Professional 6\PopupBlocker.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe
I:\Firefox\firefox.exe
C:\Documents and Settings\Olivier\Bureau\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://I%3A%5CNetscape%5Csearchplugins%5CNetscape_France.src" ); (C:\Documents and Settings\Olivier\Application Data\Mozilla\Profiles\default\v4j79961.slt\prefs.js)
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [WinampAgent] H:\Winamp\winampa.exe
O4 - HKCU\..\Run: [StatBar] H:\StatBar\StatBar.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SMSystemAnalyzer] "H:\System Mechanic Professional 6\SMSystemAnalyzer.exe"
O4 - HKCU\..\Run: [System Mechanic Popup Blocker] "H:\System Mechanic Professional 6\PopupBlocker.exe"
O4 - Global Startup: Kaspersky Anti-Hacker.lnk = C:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe
O8 - Extra context menu item: Download All Links with IDM - H:\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download with IDM - H:\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://drivers1.free.fr/telecharge [...] 2&version=
O17 - HKLM\System\CCS\Services\Tcpip\..\{43E2F644-D133-4091-8724-52F179955BFC}: NameServer = 212.27.32.176,212.27.32.5
O17 - HKLM\System\CS1\Services\Tcpip\..\{43E2F644-D133-4091-8724-52F179955BFC}: NameServer = 212.27.32.176,212.27.32.5
O17 - HKLM\System\CS2\Services\Tcpip\..\{43E2F644-D133-4091-8724-52F179955BFC}: NameServer = 212.27.32.176,212.27.32.5
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - H:\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Kaspersky Anti-Virus Service (kavsvc) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - H:\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: wampapache - Unknown owner - H:\wamp\apache2\bin\Apache.exe" -k runservice (file missing)
O23 - Service: wampmysqld - Unknown owner - H:\wamp\mysql\bin\mysqld-nt.exe

Esteban,

Du Vundo surement :

Télécharge VundoFix.exe (par Atribune) sur ton Bureau.

• Double-clique VundoFix.exe afin de le lancer
• Clique sur le bouton Scan for Vundo
• Lorsque le scan est complété, clique sur le bouton Remove Vundo
• Une invite te demandera si tu veux supprimer les fichiers, clique YES
• Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers
• Tu verras une invite qui t'annonce que ton PC va redémarrer; clique OK
• Copie/colle le contenu du rapport situé dans C:\vundofix.txt ainsi qu'un nouveau rapport HijackThis! dans ta prochaine réponse

Note: Il est possible que VundoFix soit confronté à un fichier qu'il ne peut supprimer. Si tel est le cas, l'outil se lancera au prochain redémarrage; il faut simplement suivre les instructions ci-haut, à partir de "clique sur le bouton Scan for Vundo".

Pas de probleme

Du Egdaccess ?

Apres on dit qu'on a pas besoin d'antivirus

Vundofix n'a pas detecte le fichier...

Télécharge ce fichier - combofix.exe
et sauvegarde le sur ton bureau et pas ailleurs!

Clic sur le menu Démarrer puis executer et copie/colle ceci :
"%userprofile%\Bureau\combofix.exe" /v geede
puis clic sur OK.

Suis les invites.

Ne touche a rien et attends que combofix ait terminé, un rapport sera créé. Poste le rapport.

- Télécharge Clean.zip (de Malekal),
décompresse-le sur ton bureau (clic droit / extraire tout), tu dois obtenir un dossier clean.

Redémarre en mode sans échec

- Ouvre le dossier clean qui se trouve sur ton bureau, et double-clic sur clean.cmd, une fenêtre noire va apparaître pendant un instant, laisse la ouverte.

Redémarre normalement

- Le rapport clean : Poste de travail / double clic sur disque C / double-clic sur rapport_clean.txt et copier/coller le contenu ici C:\rapport_clean.txt

Ton ordi se comporte mieux ?

- Fais un scan en ligne Kaspersky :
. Scan la zone critique
. Sauvegarde puis colle le rapport en fin d'analyse
Aide pour le scan en ligne.

NOTES :

- Si ce message apparaît :
"La licence de Kaspersky On-line Scanner est périmée"
Vas dans Ajout/Suppression de programmes pour désinstaller l'Online Scanner
Retente ensuite le scan.

- Si tu n'arrive toujours pas à utiliser le scan en ligne, fait un scan en ligne Panda
. /!\ Lorsqu'il te faudra entrée ton adresse e-mail, clique sur I don't accept (en bas)
. Poste le rapport en fin d'analyse
. Si tu as Avast! désactive-le.

Boonty Games est considere comme dansgereux :

Boonty_Games Used with Boonty box. Will not uninstall from Add/Remove programs. This is from their Privacy Policy. "We also may share payment information with third parties who provide payment services and share aggregate data regarding the type and number of videogames you download, your age, gender, occupation, education level, geographic location, computer equipment data and on-line and video game interests, activities and practices to game publishers. In addition, we share e-mail addresses with third party e-mail carriers who assist us in sending out our e-mails to many of our customers at the same time. Subsidiaries and controlled affiliates are not viewed as third parties for the purpose of data transfers, and hence personal information may be shared within those subsidiaries and affiliates without obtaining additional consent."

Je parle bien de Boonty.

Fais le scan en ligne stp.

Infection Egdaccess.

La procédure est longue et en partie en mode sans échec,
imprime ou mets dans un fichier texte les instructions.
Les manipulations sont à faire sans interruption et dans l'ordre.
Si tu ne comprends pas quelque chose, demande des explications avant de commencer.

Télécharge:

Brute Force Uninstaller
Créé un nouveau dossier directement sur le C:\ et nomme-le BFU. Décompresse le fichier téléchargé dans ce nouveau dossier (C:\BFU)

FAIS UN CLIC-DROIT ICI et choisis "Enregistrer la cible sous..." afin de télécharger EGDACCESS.bfu (de Metallica). Sauvegarde dans le dossier créé (C:\BFU). **Note : si tu utlises Internet Explorer; lors de la sauvegarde, assure-toi que le champs "Type :" affiche "Tous les fichiers". Tu dois maintenant avoir deux fichiers dans le dossier C:\BFU : EGDACCESS.bfu et BFU.exe (très important).

delcmdservice (par Marckie), et sauvegardez-le sur ton Bureau.
- Décompresse le contenu sur votre Bureau (un dossier nommé delcmdservice)
- Double-clique sur le dossier delcmdservice
- Double-clique sur delreg.bat afin de lancer l'outil
- Ensuite clique sur le menu Démarrer puis executez
- Dans le champs, tape Services.msc
- Dans la liste vérifie que Command Service n'est pas présent, si c'est le cas, double-clique dessus
- Positionne le type de démarrage sur désactiver

Ouvre le Bloc-Notes et copie-colle les lignes en rouge ci-dessous :

RegDeleteKey HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\szahmru
RegDelValue HKLM\Software\Microsoft\Windows\CurrentVersion\Run|szahmru
FileDelete %SYSDIR%\szahmru_navps.dat
FileDelete %SYSDIR%\szahmru_nav.dat
FileDelete %SYSDIR%\szahmru.dat
FileDelete %SYSDIR%\szahmru.exe
FileDelete %WINDIR%\PREFETCH\szahmru.exe*.pf

SystemEmptyRecycleBin

FileDelete C:\egd.txt
SystemRun regedit|/e C:\egd.txt "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"|0

OptionBFUExit

Sauvegarde dans le dossier créé (C:\BFU) (Nom du fichier : "Fixme.bfu " -sans inclure les guillemets- ; Type : Tous les fichiers).

Redémarre en mode Sans Échec : au redémarrage, tapote immédiatement la touche F8; tu verras un écran avec choix de démarrages apparaître. Utilisant les flèches du clavier, choisis "Mode Sans Échec" et valide avec "Entrée". Choisis ton compte usuel, et non Administrateur.

Démarre le "Brute Force Uninstaller" en double-cliquant BFU.exe (du dossier C:\BFU)

- Clique sur le petit dossier jaune, à la droite de la boîte Scriptline to execute, et double-clique sur :

EGDACCESS.bfu

- Dans la boîte "Scriptline to execute", tu devrais maintenant voir ceci : C:\BFU\EGDACCESS.bfu

Clique sur Execute et laisse-le faire son travail.

Attendre que Complete script execution apparaîsse et clique sur OK.
Clique Exit pour fermer le programme BFU.

Relance ensuite BFU
- Clique sur le petit dossier jaune, à la droite de la boîte Scriptline to execute, et double-clique sur :

Fixme.bfu

Clique sur Execute et laisse-le faire son travail.

Démarrer/Exécuter/Regedit, supprime :
hkey_local_machine\software\microsoft\windows\currentversion\shareddlls\C:\WINDOWS\system32\drivers\uwasfsd.sys

Supprime ensuite :
C:\WINDOWS\system32\cmdow.exe
F:\Telecharger\part1\scripts\freegate5.1\freegate5.1.exe
H:\Plugin\DlPlugin-Moz\npdlplug.dll
H:\Plugin\DlPlugin-Moz\setup2.exe

Redémarre normalement.

Poste le rapport situé ici :
C:\egd.txt

NOTE :

Si tu ne sais pas où trouver le Bloc-Notes, voici comment le trouver rapidement :
Démarrer-> Exécuter...-> Tape Notepad puis valide

Et là ?
(moi je le vois bien)

Ca me semble bon.

sélectionne les instructions en maintenant la souris sur la gauche du post
et copie/colle les dans le bloc-notes (ou dans word su tu préfère conserver les couleur, le gras...)

edit : sinon ton Fixme.txt est ok.