bug internet

Bonjour,

Pour commencer je suis sous windows XP SP2 , mon FAI est NEUF , et j'utilise internet explorer.
Alors, depuis quelques jours , ( aucun logiciels installé ) internet est vraiment tres lent ( inhabituel ) plus de 2O secondes pour ouvrir google et x temps pour ouvrir une page plus " chargée " . De nombreuses fenetres s'ouvrent avec des publicités ( desailly , site x , ou " aucune page a afficher " et ceux en permanence a partir du moment ou je suis connecté .. En Revanche la vitesse de telechargement reste la meme . j'ai appelé Neuf qui me confirme que tout va bien sur ma ligne . ceci est vraiment tres penible donc je vous remercie par avance . je vous poste un rapport hijackthis ( si cela peut vous aider ) et j'attends vos reponses ..
merci d'avance !

Logfile of HijackThis v1.99.1
Scan saved at 15:36:51, on 13/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\program files\powerstrip\pstrip.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\RECYCLER\msnservice.exe
C:\Program Files\SuperCopier2\SuperCopier2.exe
C:\WINDOWS\system32\messengerr.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\MSN Messenger\livecall.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\Anthony\Mes documents\Logiciels\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [PowerStrip] c:\program files\powerstrip\pstrip.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [MSN Services] C:\RECYCLER\msnservice.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [MSN MESSENGER 9.0] messengerr.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\RunServices: [MSN MESSENGER 9.0] messengerr.exe
O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - HKCU\..\Run: [MSN MESSENGER 9.0] messengerr.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Startup: TribalWeb.lnk = C:\Program Files\TribalWeb.net\tribalweb.exe
O4 - Startup: TribalWeb.net.lnk = C:\Program Files\TribalWeb.net\tribalweb.exe
O4 - Global Startup: Bluetooth Manager.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.mypix.com/fr/fr/importer/ImageUploader4.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

Bonjour,
Voilà j'ai fais tout ce que tu as dis et je te poste les rapports ...
le rapport SDFix :

SDFix: Version 1.114

Run by Anthony on 14/11/2007 at 08:34

Microsoft Windows XP [version 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Normal Mode:
Checking Files:

Trojan Files Found:

C:\RECYCLER\msnservice.exe - Deleted
C:\WINDOWS\system32\messengerr.exe - Deleted



Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.



Final Check:

catchme 0.3.1262.1 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-14 08:48:39
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\000a9402c44d]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\000a9402c44d]

scanning hidden registry entries ...

scanning hidden files ...

C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\75\775-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v775-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v775-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1304 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\01\801-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v801-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v801-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1264 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\02\802-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v802-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v802-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1296 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\18\818-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v818-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v818-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 128 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\56\56-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v56-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v56-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 30108 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\56\56-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v56-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v56-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2 2136 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\56\56-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v56-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v56-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3408 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\57\57-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v57-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v57-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 51582 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\57\57-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v57-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v57-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2 3702 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\57\57-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v57-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v57-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 5840 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\61\61-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v61-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v61-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 45966 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\61\61-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v61-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v61-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2 3360 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\61\61-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v61-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v61-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 5120 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\61\761-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v761-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v761-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1208 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\62\62-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v62-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v62-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 76818 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\62\62-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v62-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v62-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2 5448 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\62\62-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v62-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v62-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 8664 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\62\762-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v762-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v762-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1176 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\63\763-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v763-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v763-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1168 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\64\764-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v764-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v764-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1272 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\65\765-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v765-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v765-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1288 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\66\66-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v66-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v66-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 112080 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\66\66-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v66-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v66-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2 7914 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\66\66-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v66-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v66-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 12472 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\66\766-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v766-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v766-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1176 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\67\67-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v67-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v67-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 70968 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\67\67-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v67-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v67-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2 4944 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\67\67-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v67-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v67-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 7856 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\67\767-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v767-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v767-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1176 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\68\68-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v68-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v68-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 135174 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\68\68-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v68-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v68-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2 9498 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\68\68-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v68-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v68-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 14984 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\68\768-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v768-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v768-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1264 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\69\69-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v69-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v69-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 34140 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\69\69-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v69-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v69-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2 2478 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\69\69-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v69-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v69-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3856 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\69\769-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v769-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v769-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1264 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\70\70-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v70-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v70-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 32898 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\70\70-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v70-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v70-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2 2424 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\70\70-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v70-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v70-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3648 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\70\770-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v770-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v770-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 11388 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\70\770-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v770-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v770-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1288 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\71\771-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v771-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v771-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1288 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\72\772-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v772-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v772-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1168 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\73\773-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v773-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v773-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1272 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\74\774-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v774-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v774-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1184 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\76\76-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v76-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v76-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 58530 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\76\76-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v76-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v76-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2 4044 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\76\76-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v76-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v76-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 6440 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\76\776-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v776-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v776-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1192 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\77\777-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v777-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v777-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1264 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\78\778-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v778-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v778-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1280 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\78\78-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v78-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v78-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 6654 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\78\78-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v78-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v78-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 736 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\79\779-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v779-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v779-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1200 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\79\79-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v79-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v79-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 6816 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\79\79-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v79-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v79-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 744 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\80\780-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v780-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v780-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1184 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\80\80-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v80-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v80-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 6618 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\80\80-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v80-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v80-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 752 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\81\781-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v781-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v781-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1248 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\81\81-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v81-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v81-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 6672 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\81\81-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v81-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v81-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 736 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\82\782-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v782-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v782-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1200 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\82\82-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v82-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v82-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 6888 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\82\82-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v82-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v82-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 752 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\83\783-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v783-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v783-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1184 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\83\83-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v83-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v83-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 6870 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\83\83-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v83-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v83-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 736 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\84\784-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v784-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v784-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 80 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\84\84-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v84-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v84-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 6636 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\84\84-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v84-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v84-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 744 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\85\785-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v785-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v785-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 80 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\85\85-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v85-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v85-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 6690 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\85\85-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v85-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v85-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 744 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\86\86-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v86-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v86-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 6672 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\86\86-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v86-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v86-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 736 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\87\787-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v787-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v787-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 2288 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\87\87-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v87-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v87-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 6960 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\87\87-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v87-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v87-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 776 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\88\788-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v788-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v788-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1304 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\88\88-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v88-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v88-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 6906 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\88\88-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v88-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v88-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 776 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\89\789-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v789-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v789-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1272 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\89\89-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v89-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v89-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 6906 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\89\89-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v89-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v89-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 768 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\90\790-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v790-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v790-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1176 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\90\90-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v90-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v90-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 6636 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\90\90-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v90-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v90-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 744 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\91\791-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v791-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v791-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1312 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\91\91-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v91-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v91-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 6564 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\91\91-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v91-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v91-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 744 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\92\792-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v792-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v792-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1168 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\92\92-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v92-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v92-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 6546 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\92\92-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v92-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v92-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 744 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\93\793-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v793-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v793-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1288 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\93\93-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v93-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v93-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 6564 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\93\93-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v93-{9E883CE8-87B6-47D7-BF6F-1C62102D2987}-v93-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 744 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\94\794-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v794-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v794-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1288 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\96\796-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v796-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v796-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1304 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\97\797-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v797-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v797-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1264 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\98\798-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v798-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v798-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1320 bytes hidden from API
C:\Documents and Settings\Anthony\Local Settings\Application Data\Microsoft\Messenger\smprod1@hotmail.com\SharingMetadata\kikilapeste13@hotmail.com\DFSR\Staging\CS{7B2C04E2-8454-FC9F-CF4A-12DD79DE947A}\99\799-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v799-{C9374B0C-E972-4085-9B55-3347878FD0BF}-v799-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1192 bytes hidden from API

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 103


Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"C:\\Program Files\\uTorrent\\utorrent.exe"="C:\\Program Files\\uTorrent\\utorrent.exe:*:Enabled:æTorrent"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\RECYCLER\\msnservice.exe"="C:\\RECYCLER\\msnservice.exe:*:Enabled:RSBX"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

Remaining Files:
---------------

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes:

Wed 6 Jun 2007 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Mon 19 Mar 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Sun 2 Sep 2007 1,881 ...HR --- "C:\Documents and Settings\Anthony\Application Data\SecuROM\UserData\securom_v7_01.bak"

Finished!



le rapport AVSCAN:


AntiVir PersonalEdition Classic
Report file date: mercredi 14 novembre 2007 09:25

Scanning for 928552 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Username: SYSTEM
Computer name: XPSP2-A22419C5D

Version information:
BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00
AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 13:16:29
AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 12:23:51
LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 15:32:47
LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 12:35:20
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 14:27:15
ANTIVIR1.VDF : 7.0.0.0 1640448 Bytes 13/09/2007 14:26:55
ANTIVIR2.VDF : 7.0.0.198 1206272 Bytes 11/11/2007 08:05:53
ANTIVIR3.VDF : 7.0.0.212 52224 Bytes 14/11/2007 08:05:53
AVEWIN32.DLL : 7.6.0.34 3125760 Bytes 14/11/2007 08:05:53
AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 10:36:26
AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 07:39:17
AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:16:24
AVPACK32.DLL : 7.3.0.15 360488 Bytes 03/08/2007 08:46:00
AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 07:17:06
AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 12:26:33
AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 07:10:18
NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 11:09:42
RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 12:38:13
RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 12:50:37
SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 09:37:21

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: C:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: mercredi 14 novembre 2007 09:25

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'emule.exe' - '1' Module(s) have been scanned
Scan process 'IEXPLORE.EXE' - '1' Module(s) have been scanned
Scan process 'TosBtHSP.exe' - '1' Module(s) have been scanned
Scan process 'TosA2dp.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'TosBtMng.exe' - '1' Module(s) have been scanned
Scan process 'rejuysqi.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'SuperCopier2.exe' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'realsched.exe' - '1' Module(s) have been scanned
Scan process 'LVComS.exe' - '1' Module(s) have been scanned
Scan process 'pstrip.exe' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'notepad.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'wscntfy.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
38 processes with 38 modules were scanned

Start scanning boot sectors:
Boot sector 'C:\'
[NOTE] No virus was found!

Starting to scan the registry.
The registry was scanned ( '39' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\ZlobVideoActiveXAccess3.zip
[DETECTION] Contains suspicious code GEN/PwdZIP
[INFO] The file was moved to '47a9b18f.qua'!
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\ZlobVideoActiveXAccess7.zip
[DETECTION] Contains suspicious code GEN/PwdZIP
[INFO] The file was moved to '47a9b191.qua'!
C:\Documents and Settings\Anthony\Mes documents\BER\Serge Lama Integral.zip
[0] Archive type: ZIP
--> Serge Lama Int‚gral.ace
[1] Archive type: ACE
--> Serge Lama\Serge Lama 1973 Je suis malade\13 Les ptites femmes de Pigale (Karaok&#138.avi
[WARNING] Error creating the file
--> Serge Lama\Thumbs.db
[WARNING] No further files can be extracted from this archive. The archive will be closed
[WARNING] No further files can be extracted from this archive. The archive will be closed
C:\Documents and Settings\Anthony\Mes documents\Logiciels\backups\backup-20070510-192634-638.dll
[DETECTION] Is the Trojan horse TR/BHO.IEHomeChange
[INFO] The file was moved to '479dc35a.qua'!
C:\SDFix\backups\backups.zip
[0] Archive type: ZIP
--> backups/msnservice.exe
[DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Agent.aox Backdoor server programs
[INFO] The file was moved to '479dcc51.qua'!
C:\WINDOWS\pubprm.vbs
[DETECTION] Contains detection pattern of the VBS script virus VBS/StartPage.AY
[INFO] The file was moved to '479ccc6c.qua'!


End of the scan: mercredi 14 novembre 2007 11:31
Used time: 2:06:20 min

The scan has been done completely.

2424 Scanning directories
153968 Files were scanned
3 viruses and/or unwanted programs were found
2 Files were classified as suspicious:
0 files were deleted
0 files were repaired
5 files were moved to quarantine
0 files were renamed
1 Files cannot be scanned
153965 Files not concerned
1115 Archives were scanned
4 Warnings
0 Notes

. Et enfin le rapport Hijackthis :
Logfile of HijackThis v1.99.1
Scan saved at 11:39:03, on 14/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\program files\powerstrip\pstrip.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\SuperCopier2\SuperCopier2.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avscan.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\Anthony\Mes documents\Logiciels\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [PowerStrip] c:\program files\powerstrip\pstrip.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Startup: TribalWeb.lnk = C:\Program Files\TribalWeb.net\tribalweb.exe
O4 - Startup: TribalWeb.net.lnk = C:\Program Files\TribalWeb.net\tribalweb.exe
O4 - Global Startup: Bluetooth Manager.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.mypix.com/fr/fr/importer/ImageUploader4.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

.

Merci .

Bonjour


C'est beaucoup mieux.

Télécharge Navilog (par Il Mafioso) sur le Bureau
http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe
Ensuite double clique sur navilog1.exe pour lancer l'installation.
Une fois l'installation terminée, le fix s'exécutera automatiquement.
(Si ce n'est pas le cas, double-clique sur le raccourci Navilog1 présent sur le bureau).

Laisse-toi guider. Au menu principal, choisis 1 et valide.
(ne fais pas le choix 2,3 ou 4 sans notre avis/accord)

Patiente jusqu'au message :
*** Analyse Termine le ..... ***
Appuie sur une touche comme demandé, le blocnote va s'ouvrir.
Copie-colle l'intégralité dans une réponse. Referme le blocnote.
Le rapport est en outre sauvegardé à la racine du disque (fixnavi.txt)

On continue.


Double clique sur le raccourci Navilog1 présent sur le bureau et laisse-toi guider.
Au menu principal, choisis 2 et valide.

Le fix va t'informer qu'il va alors redémarrer ton PC
Ferme toutes les fenêtres ouvertes et enregistre tes documents personnels ouverts
Appuie sur une touche comme demandé.
(si ton Pc ne redémarre pas automatiquement, fais le toi même)
Au redémarrage de ton PC, choisis ta session habituelle.

Patiente jusqu'au message :
*** Nettoyage Termine le ..... ***
Le blocnote va s'ouvrir.
Sauvegarde le rapport de manière à le retrouver
Referme le blocnote. Ton bureau va réapparaitre

PS:Si ton bureau ne réapparait pas, fais CTRL+ALT+SUPP pour ouvrir le gestionnaire de tâches.
Puis rends-toi à l'onglet "processus". Clique en haut à gauche sur fichiers et choisis "exécuter"
Tape explorer et valide. Celà te fera apparaitre ton bureau.

Poste son rapport avec un nouveau Hijackthis.

Bonjour

Désactive temporairement ton antivirus le temps du scan.

Télécharge Combofix.exe (par sUBs) sur ton Bureau
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Double clique combofix.exe et suis les invites.
Lorsque le scan sera complété, un rapport apparaîtra.

Copie/colle ce rapport dans ta prochaine réponse avec un nouveau HijackThis.

Bonjour

Combofix a nettoyé deux infections différentes.
On vérifie s'il reste des choses.

Télécharge SmitfraudFix de S!Ri:
http://siri.urz.free.fr/Fix/SmitfraudFix.exe
Tu le mets sur le Bureau.
Tu ouvres SmitfraudFix, tu double cliques sur SmitfraudFix.cmd et tu choisis l’option 1
Poste le rapport.

Télécharge Navilog (par Il Mafioso) sur le Bureau
http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe
Ensuite double clique sur navilog1.exe pour lancer l'installation.
Une fois l'installation terminée, le fix s'exécutera automatiquement.
(Si ce n'est pas le cas, double-clique sur le raccourci Navilog1 présent sur le bureau).

Laisse-toi guider. Au menu principal, choisis 1 et valide.
(ne fais pas le choix 2,3 ou 4 sans notre avis/accord)

Patiente jusqu'au message :
*** Analyse Termine le ..... ***
Appuie sur une touche comme demandé, le blocnote va s'ouvrir.
Copie-colle l'intégralité dans une réponse. Referme le blocnote.
Le rapport est en outre sauvegardé à la racine du disque (fixnavi.txt)

Rien avec Navilog.


Ta version de Smitfraudfix est ancienne.
Relance le, choisis l'option 4 pour faire la mise à jour.

Refais un scan option 1 et poste le.

Rien avec Smitfraudfix.


Fais une analyse antivirus en ligne sur Kaspersky
http://webscanner.kaspersky.fr/
Clique sur Démarrer Online Scanner.
Sélectionne le poste de travail comme analyse.
Colle son rapport ici.

Aide toi de ce lien.
http://www.infos-du-net.com/forum/ [...] -kaspersky