probleme panneau de config+windows alertRésolu/Fermé

Question

Bonjour, 

J'ai 2 prôblèmes que je n'arrive pas à résoudre: 

1/ il y a un message windows security alert qui s'affiche toutes les 5 minutes qui dit que j'ai un spyware et qui me dit de télécharger un antispyware. Mé je fermé toujour la fenetre car je m'y conné pas du tout en informatique



2/ le deuxième problème est que je n'ai plus accès au panneau de configuration alors que je suis le seul utilisateur. J'ai essayé la méthode suivante sans résultat: 
- mode sans échec 
- administrateur 
- panneau de configuration et modifier mon compte 
Mais le problème s'est qu'il n'est pas accéssible non plus dans l'administrateur. 

voila

kimhassene · Answer

ton pc est pirater .....

tu peu faire ca  : 

clic droit démarrer--propriétés--personnalise(sur barre des tâches)--avancé--tu coches sur le dérouleur,
panneau de configuretion "afficher en tant que 
lien"--ok.

et tu redemarre ton pc

si sa rien donner il faut formater ton pc....

nardino · Answer

Bonsoir,
1°-Télécharge Smitfraud.fix de S!Ri Balltrap et Moe :
http://siri.urz.free.fr/Fix/SmitfraudFix.exe
Toujours charger avant l'utilisation pour profiter des dernières mises à jour.
Lance-le en cliquant sur SmitfraudFix.exe

	[*]Dans la fenêtre bleue, choisis l'option 1] et Entrée
	[*]Fais un copier coller du rapport qui s'ouvre dans ta prochaine réponse.
	[*]Ce rapport sera enregistré comme suit : C:\rapport.txt

2°-Télécharge Navifix de Il-Mafioso sur ton bureau:
http://il.mafioso.pagesperso-orange.fr/Navifix/Navilog1.exe

Installe-le en cliquant sur le fichier Navilog1.exe

	[*]Double-clique sur le raccourci créé sur le bureau.
	[*]Au menu principal suivant, choisis 1 et valide par Entrée.
	[*]Ne fais pas le choix 2,3 ou 4 sans mon avis.
	[*]Patiente jusqu'au message : *** Analyse Termine le ..... ***
	[*]Appuie sur une touche comme demandé, le blocnote va s'ouvrir.
	[*]Sauvegarde le blocnote qui s'ouvre sur le bureau sous cleanavi.txt
	[*]Poste-le par copier-coller dans ta réponse.

3°-Télécharge VundoFix de Atribune : 
http://www.atribune.org/ccount/click.php?id=4

	[*]Double clic sur Vundofix.exe.
	[*]Coche la case Run VundoFix as a task
	[*]Répond OK au popup qui s'ouvre.
Il va se refermer et réouvrir au bout d'une minute environ.
	[*]Quand il est rouvert, clique sur Scan for Vundo
	[*]Quand le scan est terminé, clique sur Remove Vundo
	[*]Réponds Yes à la demande de suppression des fichiers.
	[*]Il te sera demandé de redémarrer ton ordinateur, accepte bien sûr.
	[*]Copie/colle le rapport (c:\vundofix.txt) dans ta réponse

zouzou1089 · Answer

Coucou,
voici le rapport du 1 telechargement:

SmitFraudFix v2.253

Rapport fait à 15:06:12,17, 23/11/2007
Executé à partir de C:\Documents and Settings\jenni\Mes documents\Julien MATHE\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\ANTIVI~1\backweb\6588780\Program\SERVIC~1.EXE
C:\Program Files\AntivirusFirewall\Anti-Virus\fsgk32st.exe
C:\Program Files\AntivirusFirewall\backweb\6588780\program\fsbwsys.exe
C:\Program Files\AntivirusFirewall\Anti-Virus\FSGK32.EXE
C:\Program Files\AntivirusFirewall\Common\FSMA32.EXE
C:\Program Files\AntivirusFirewall\Anti-Virus\fssm32.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\AntivirusFirewall\Common\FSMB32.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\AntivirusFirewall\Common\FCH32.EXE
C:\Program Files\AntivirusFirewall\Common\FAMEH32.EXE
C:\Program Files\AntivirusFirewall\Anti-Virus\fsqh.exe
C:\Program Files\AntivirusFirewall\Anti-Virus\fsrw.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AntivirusFirewall\Anti-Virus\fsav32.exe
C:\Program Files\AntivirusFirewall\FWES\Program\fsdfwd.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\printer.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Hotbar\bin\10.0.342.0\OEAddOn.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\Hotbar\bin\10.0.342.0\HotbarSA.exe
C:\Program Files\Fichiers communs\SystemDoctor\USDR6cw.exe
C:\Program Files\Fichiers communs\SystemDoctor\usdrmdr.exe
C:\Program Files\Fichiers communs\SystemDoctor\usdrdc.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\AntivirusFirewall\Common\FSM32.EXE
C:\Program Files\AntivirusFirewall\FSGUI\ispnews.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AdVantage\AdVantage.exe
C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
C:\Program Files\Hotbar\bin\10.0.342.0\Weather.exe
C:\PROGRA~1\ANTIVI~1\ANTI-S~1\fsaw.exe
C:\Documents and Settings\DialMessenger\dialmessenger.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\AntivirusFirewall\backweb\6588780\Program\fspex.exe
C:\Program Files\AntivirusFirewall\FSGUI\fsguidll.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\PROGRA~1\Wanadoo\Watch.exe
C:\Program Files\Java\jre1.6.0_02\bin\jucheck.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\PROGRA~1\Wanadoo\WOOBrowser\WOOBrowser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hotbar\bin\10.0.342.0\Srv.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

C:\WINDOWS\system32\printer.exe PRESENT !
C:\WINDOWS\system32\WinAvXX.exe PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\jenni


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\jenni\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

C:\DOCUME~1\jenni\MENUDM~1\PROGRA~1\DMARRA~1\system.exe PRESENT !
C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\DMARRA~1\autorun.exe PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\jenni\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files 


»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
 
 

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\WINDOWS\system32\__c002C5C7.dat"
"LoadAppInit_DLLs"=dword:00000001


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Rustock



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Votre ordinateur est certainement victime d'un détournement de DNS: 85.255.x.x détecté !

Description: Carte Fast Ethernet compatible VIA - Miniport d'ordonnancement de paquets
DNS Server Search Order: 85.255.113.117
DNS Server Search Order: 85.255.112.191

HKLM\SYSTEM\CCS\Services\Tcpip\..\{37F1006E-4835-42DD-B11B-F42AFF40AC32}: DhcpNameServer=192.168.1.1 0.0.0.0
HKLM\SYSTEM\CCS\Services\Tcpip\..\{37F1006E-4835-42DD-B11B-F42AFF40AC32}: NameServer=85.255.113.117,85.255.112.191
HKLM\SYSTEM\CCS\Services\Tcpip\..\{7251D8C4-D353-4036-8EAD-E91404EEE1D6}: DhcpNameServer=85.255.113.117,85.255.112.191
HKLM\SYSTEM\CCS\Services\Tcpip\..\{EEEB59F3-67D4-4E66-B3B8-88098A744D2A}: DhcpNameServer=85.255.113.117,85.255.112.191
HKLM\SYSTEM\CCS\Services\Tcpip\..\{EEEB59F3-67D4-4E66-B3B8-88098A744D2A}: NameServer=85.255.113.117,85.255.112.191
HKLM\SYSTEM\CS1\Services\Tcpip\..\{37F1006E-4835-42DD-B11B-F42AFF40AC32}: DhcpNameServer=192.168.1.1 0.0.0.0
HKLM\SYSTEM\CS1\Services\Tcpip\..\{37F1006E-4835-42DD-B11B-F42AFF40AC32}: NameServer=85.255.113.117,85.255.112.191
HKLM\SYSTEM\CS1\Services\Tcpip\..\{7251D8C4-D353-4036-8EAD-E91404EEE1D6}: DhcpNameServer=85.255.113.117,85.255.112.191
HKLM\SYSTEM\CS1\Services\Tcpip\..\{EEEB59F3-67D4-4E66-B3B8-88098A744D2A}: DhcpNameServer=85.255.113.117,85.255.112.191
HKLM\SYSTEM\CS1\Services\Tcpip\..\{EEEB59F3-67D4-4E66-B3B8-88098A744D2A}: NameServer=85.255.113.117,85.255.112.191
HKLM\SYSTEM\CS2\Services\Tcpip\..\{37F1006E-4835-42DD-B11B-F42AFF40AC32}: DhcpNameServer=192.168.1.1 0.0.0.0
HKLM\SYSTEM\CS2\Services\Tcpip\..\{37F1006E-4835-42DD-B11B-F42AFF40AC32}: NameServer=85.255.113.117,85.255.112.191
HKLM\SYSTEM\CS2\Services\Tcpip\..\{7251D8C4-D353-4036-8EAD-E91404EEE1D6}: DhcpNameServer=85.255.113.117,85.255.112.191
HKLM\SYSTEM\CS2\Services\Tcpip\..\{EEEB59F3-67D4-4E66-B3B8-88098A744D2A}: DhcpNameServer=85.255.113.117,85.255.112.191
HKLM\SYSTEM\CS2\Services\Tcpip\..\{EEEB59F3-67D4-4E66-B3B8-88098A744D2A}: NameServer=85.255.113.117,85.255.112.191
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 0.0.0.0
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: NameServer=85.255.113.117 85.255.112.191
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 0.0.0.0
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: NameServer=85.255.113.117 85.255.112.191
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 0.0.0.0
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: NameServer=85.255.113.117 85.255.112.191


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

zouzou1089 · Answer

voici le raport du 2eme



Search Navipromo version 3.3.6 commencé le 23/11/2007 à 15:18:31,29

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files
avilog1
Mise à jour le 14.11.2007 à 18h00 par IL-MAFIOSO


Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 6.0.2900.2180 


*** Recherche Programmes installés ***




*** Recherche dossiers dans C:\WINDOWS ***



*** Recherche dossiers dans C:\Program Files ***



*** Recherche dossiers dans C:\Documents and Settings\All Users\Application Data ***




*** Recherche dossiers dans C:\Documents and Settings\jenni\Application Data ***


*** Recherche dossiers dans C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1 ***


*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net

Aucun fichier trouvé dans :

- C:\WINDOWS\system32
- C:\DOCUME~1\JENNI\LOCALS~1\APPLIC~1



*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans C:\WINDOWS\system32 *

* Recherche dans C:\DOCUME~1\JENNI\LOCALS~1\APPLIC~1 *



*** Recherche fichiers *** 




*** Recherche clés spécifiques dans le Registre ***


*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche fichiers connus:
C:\WINDOWS\system32\vyadd.ini2 trouvé ! infection Vundo possible non traitée par cet outil !
C:\WINDOWS\system32\cccdd.bak1 trouvé ! infection Vundo possible non traitée par cet outil !
C:\WINDOWS\system32\ddeeg.bak1 trouvé ! infection Vundo possible non traitée par cet outil !
C:\WINDOWS\system32\ffhkj.bak1 trouvé ! infection Vundo possible non traitée par cet outil !
C:\WINDOWS\system32\fhhkj.bak1 trouvé ! infection Vundo possible non traitée par cet outil !
C:\WINDOWS\system32\hgjlm.bak1 trouvé ! infection Vundo possible non traitée par cet outil !
C:\WINDOWS\system32\jlkkj.bak1 trouvé ! infection Vundo possible non traitée par cet outil !
C:\WINDOWS\system32\jlnmp.bak1 trouvé ! infection Vundo possible non traitée par cet outil !
C:\WINDOWS\system32\kjjlm.bak1 trouvé ! infection Vundo possible non traitée par cet outil !
C:\WINDOWS\system32\kjkmp.bak1 trouvé ! infection Vundo possible non traitée par cet outil !
C:\WINDOWS\system32
qstv.bak1 trouvé ! infection Vundo possible non traitée par cet outil !
C:\WINDOWS\system32
qtss.bak1 trouvé ! infection Vundo possible non traitée par cet outil !
C:\WINDOWS\system32\qtutv.bak1 trouvé ! infection Vundo possible non traitée par cet outil !
C:\WINDOWS\system32\qtvwa.bak1 trouvé ! infection Vundo possible non traitée par cet outil !
C:\WINDOWS\system32qstv.bak1 trouvé ! infection Vundo possible non traitée par cet outil !
C:\WINDOWS\system32\sttss.bak1 trouvé ! infection Vundo possible non traitée par cet outil !
C:\WINDOWS\system32\svvwa.bak1 trouvé ! infection Vundo possible non traitée par cet outil !
C:\WINDOWS\system32\uttss.bak1 trouvé ! infection Vundo possible non traitée par cet outil !
C:\WINDOWS\system32\vyadd.bak1 trouvé ! infection Vundo possible non traitée par cet outil !
C:\WINDOWS\system32\xbadd.bak1 trouvé ! infection Vundo possible non traitée par cet outil !
C:\WINDOWS\system32\xycdd.bak1 trouvé ! infection Vundo possible non traitée par cet outil !
C:\WINDOWS\system32\cccdd.bak2 trouvé ! infection Vundo possible non traitée par cet outil !
C:\WINDOWS\system32\vyadd.bak2 trouvé ! infection Vundo possible non traitée par cet outil !

2)Recherche Heuristique :



3)Recherche Certificats :

Certificat Egroup absent !


*** Analyse terminée le 23/11/2007 à 15:19:21,43 ***

zouzou1089 · Answer

et voici le dernier raport :
VundoFix V6.6.2

Checking Java version...

Scan started at 15:24:37 23/11/2007

Listing files found while scanning....

C:\windows\system32\__c002019D.dat
C:\windows\system32\__c00284B4.dat
C:\windows\system32\__c002C5C7.dat
C:\windows\system32\__c00396F4.dat
C:\windows\system32\__c003A6D4.dat
C:\windows\system32\__c003D160.dat
C:\windows\system32\__c0074EA4.dat
C:\windows\system32\__c008F683.dat
C:\windows\system32\__c0093100.dat
C:\windows\system32\__c00A1069.dat
C:\windows\system32\__c00A2A6A.dat
C:\windows\system32\__c00B8A8E.dat
C:\windows\system32\__c00B901F.dat
C:\windows\system32\__c00C4073.dat
C:\windows\system32\__c00C41D4.dat
C:\windows\system32\__c00D6509.dat
C:\windows\system32\__c00DC7D4.dat
C:\WINDOWS\system32\awvtq.dll
C:\WINDOWS\system32\awvvs.dll
C:\WINDOWS\system32\cccdd.bak1
C:\WINDOWS\system32\cccdd.bak2
C:\WINDOWS\system32\cccdd.ini
C:\WINDOWS\system32\ddabx.dll
C:\windows\system32\ddayv.dll
C:\WINDOWS\system32\ddccc.dll
C:\WINDOWS\system32\ddcyx.dll
C:\windows\system32\gdagdaue.dll
C:\WINDOWS\system32\geedd.dll
C:\WINDOWS\system32\jkhff.dll
C:\WINDOWS\system32\jkhhf.dll
C:\WINDOWS\system32\jkklj.dll
C:\windows\system32\knohhawb.dll
C:\WINDOWS\system32\mljgh.dll
C:\WINDOWS\system32\mljjk.dll
C:\WINDOWS\system32\pmkjk.dll
C:\WINDOWS\system32\pmnlj.dll
C:\WINDOWS\system32\qtvwa.bak1
C:\WINDOWS\system32\qtvwa.ini
C:\WINDOWS\system32\sstqn.dll
C:\WINDOWS\system32\sstts.dll
C:\WINDOWS\system32\ssttu.dll
C:\WINDOWS\system32\svvwa.bak1
C:\WINDOWS\system32\svvwa.ini
C:\WINDOWS\system32\vtsqn.dll
C:\WINDOWS\system32\vtsqr.dll
C:\WINDOWS\system32\vtutq.dll
C:\windows\system32\vyadd.bak1
C:\windows\system32\vyadd.bak2
C:\windows\system32\vyadd.ini
C:\windows\system32\vyadd.ini2
C:\windows\system32\vyadd.tmp
C:\WINDOWS\system32\xbadd.bak1
C:\WINDOWS\system32\xbadd.ini

Beginning removal...

 Attempting to delete C:\windows\system32\__c002019D.dat
C:\windows\system32\__c002019D.dat Has been deleted!

 Attempting to delete C:\windows\system32\__c00284B4.dat
C:\windows\system32\__c00284B4.dat Has been deleted!

 Attempting to delete C:\windows\system32\__c002C5C7.dat
C:\windows\system32\__c002C5C7.dat Could not be deleted.

 Attempting to delete C:\windows\system32\__c00396F4.dat
C:\windows\system32\__c00396F4.dat Has been deleted!

 Attempting to delete C:\windows\system32\__c003A6D4.dat
C:\windows\system32\__c003A6D4.dat Has been deleted!

 Attempting to delete C:\windows\system32\__c003D160.dat
C:\windows\system32\__c003D160.dat Has been deleted!

 Attempting to delete C:\windows\system32\__c0074EA4.dat
C:\windows\system32\__c0074EA4.dat Has been deleted!

 Attempting to delete C:\windows\system32\__c008F683.dat
C:\windows\system32\__c008F683.dat Has been deleted!

 Attempting to delete C:\windows\system32\__c0093100.dat
C:\windows\system32\__c0093100.dat Has been deleted!

 Attempting to delete C:\windows\system32\__c00A1069.dat
C:\windows\system32\__c00A1069.dat Has been deleted!

 Attempting to delete C:\windows\system32\__c00A2A6A.dat
C:\windows\system32\__c00A2A6A.dat Has been deleted!

 Attempting to delete C:\windows\system32\__c00B8A8E.dat
C:\windows\system32\__c00B8A8E.dat Has been deleted!

 Attempting to delete C:\windows\system32\__c00B901F.dat
C:\windows\system32\__c00B901F.dat Has been deleted!

 Attempting to delete C:\windows\system32\__c00C4073.dat
C:\windows\system32\__c00C4073.dat Has been deleted!

 Attempting to delete C:\windows\system32\__c00C41D4.dat
C:\windows\system32\__c00C41D4.dat Has been deleted!

 Attempting to delete C:\windows\system32\__c00D6509.dat
C:\windows\system32\__c00D6509.dat Has been deleted!

 Attempting to delete C:\windows\system32\__c00DC7D4.dat
C:\windows\system32\__c00DC7D4.dat Has been deleted!

 Attempting to delete C:\WINDOWS\system32\awvtq.dll
C:\WINDOWS\system32\awvtq.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\awvvs.dll
C:\WINDOWS\system32\awvvs.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\cccdd.bak1
C:\WINDOWS\system32\cccdd.bak1 Has been deleted!

 Attempting to delete C:\WINDOWS\system32\cccdd.bak2
C:\WINDOWS\system32\cccdd.bak2 Has been deleted!

 Attempting to delete C:\WINDOWS\system32\cccdd.ini
C:\WINDOWS\system32\cccdd.ini Has been deleted!

 Attempting to delete C:\WINDOWS\system32\ddabx.dll
C:\WINDOWS\system32\ddabx.dll Has been deleted!

 Attempting to delete C:\windows\system32\ddayv.dll
C:\windows\system32\ddayv.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\ddccc.dll
C:\WINDOWS\system32\ddccc.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\ddcyx.dll
C:\WINDOWS\system32\ddcyx.dll Has been deleted!

 Attempting to delete C:\windows\system32\gdagdaue.dll
C:\windows\system32\gdagdaue.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\geedd.dll
C:\WINDOWS\system32\geedd.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\jkhff.dll
C:\WINDOWS\system32\jkhff.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\jkhhf.dll
C:\WINDOWS\system32\jkhhf.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\jkklj.dll
C:\WINDOWS\system32\jkklj.dll Has been deleted!

 Attempting to delete C:\windows\system32\knohhawb.dll
C:\windows\system32\knohhawb.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\mljgh.dll
C:\WINDOWS\system32\mljgh.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\mljjk.dll
C:\WINDOWS\system32\mljjk.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\pmkjk.dll
C:\WINDOWS\system32\pmkjk.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\pmnlj.dll
C:\WINDOWS\system32\pmnlj.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\qtvwa.bak1
C:\WINDOWS\system32\qtvwa.bak1 Has been deleted!

 Attempting to delete C:\WINDOWS\system32\qtvwa.ini
C:\WINDOWS\system32\qtvwa.ini Has been deleted!

 Attempting to delete C:\WINDOWS\system32\sstqn.dll
C:\WINDOWS\system32\sstqn.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\sstts.dll
C:\WINDOWS\system32\sstts.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\ssttu.dll
C:\WINDOWS\system32\ssttu.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\svvwa.bak1
C:\WINDOWS\system32\svvwa.bak1 Has been deleted!

 Attempting to delete C:\WINDOWS\system32\svvwa.ini
C:\WINDOWS\system32\svvwa.ini Has been deleted!

 Attempting to delete C:\WINDOWS\system32\vtsqn.dll
C:\WINDOWS\system32\vtsqn.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\vtsqr.dll
C:\WINDOWS\system32\vtsqr.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\vtutq.dll
C:\WINDOWS\system32\vtutq.dll Has been deleted!

 Attempting to delete C:\windows\system32\vyadd.bak1
C:\windows\system32\vyadd.bak1 Has been deleted!

 Attempting to delete C:\windows\system32\vyadd.bak2
C:\windows\system32\vyadd.bak2 Has been deleted!

 Attempting to delete C:\windows\system32\vyadd.ini
C:\windows\system32\vyadd.ini Has been deleted!

 Attempting to delete C:\windows\system32\vyadd.ini2
C:\windows\system32\vyadd.ini2 Has been deleted!

 Attempting to delete C:\windows\system32\vyadd.tmp
C:\windows\system32\vyadd.tmp Has been deleted!

 Attempting to delete C:\WINDOWS\system32\xbadd.bak1
C:\WINDOWS\system32\xbadd.bak1 Has been deleted!

 Attempting to delete C:\WINDOWS\system32\xbadd.ini
C:\WINDOWS\system32\xbadd.ini Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.6.2

Checking Java version...

Scan started at 15:37:42 23/11/2007

Listing files found while scanning....

zouzou1089 · Answer

jvoulé te dire  le panneau de configuration a la 2eme etape été revenu é a la 3eme etape quand l'ordinateur c'est rallumé je n'avé plus le panneau de configuration

nardino · Answer

Bonsoir.
Télécharge FixWareout.exe :
http://downloads.subratam.org/Fixwareout.exe
ou
http://download.bleepingcomputer.com/lonny/Fixwareout.exe
Enregistre le fichier sur le Bureau.

Ferme tous les programmes en cours..
Double-clique sur FixWareout.exe pour le lancer.
Clique sur "Next", puis sur "Install"
Vérifie que la case "Run fixit" est cochée et clique sur "Finish".
Suivre les messages affichés dans la fenêtre type DOS:

"Appuyer sur une touche pour continuer ...", appuyer n'importe quelle touche du clavier.

Il est demandé de redémarrer l'ordinateur:
A l'affichage d'une fenêtre 'BFU', "Please allow your system to reboot ...": cliquer sur OK.
A l'affichage d'une fenêtre 'System Settings Change', "You must restart your computer before the new settings ...": cliquer sur Oui/Yes.

Le système va mettre plus de temps que d'habitude pour démarrer: c'est normal.

Après le redémarrage, suivre les invites des messages:
-Affichage d'une fenêtre 'BFU', "Beginning fix;", cliquer sur OK.
-Affichage d'une fenêtre 'BFU', "Still working. Please be patient.", cliquer sur OK.
-Affichage d'une fenêtre 'BFU', "Finished!", cliquer sur OK. 

Un rapport C:\fixwareout\report.txt sera créé, copier-coller ce dernier dans la prochaine réponse avec un nouveau rapport Hijackthis établi en mode normal.

Si nécessaire
Aller dans Démarrer - Panneau de configuration - Connexions, clic droit sur la connexion - Propriétés - onglet Gestion de réseau
Mettre en surbrillance Protocole Internet (TCP/IP) puis cliquer sur le bouton Propriétés.
Dans les options (serveur DNS préféré et serveur DNS auxiliaire) on trouvera une de ces adresses présentes dans le rapport hijackthis en ligne 017 :
(85.255.114.73 85.255.112.227 etc...)

Pour les éliminer, cocher : "Obtenir les adresses des serveurs DNS automatiquement" puis cliquer 2 fois sur"Ok" et redémarrer le PC.

Redémarre ton ordinateur en mode sans échec : https://www.malekal.com/demarrer-windows-mode-sans-echec/
Ouvre le dossier SmitfraudFix
Double clic sur [b]SmitfraudFix.cmd[/b] choisis l'option 2 et Entrée
Réponds O aux deux questions suivantes:
-Voulez-vous nettoyer le registre ?
-Corriger le fichier infecté ?
Un rapport.txt sera généré et tu le postes pour contrôle.

Installe cet utilitaire (Hijackthis):
http://www.trendsecure.com/portal/en-US/threat_analytics/hijackthis.php?page=download

Il sera dans C:\Program Files\TrendMicro\HijackThis2.0.2\HijackThis.exe

-Lance-le par Do a system scan and save a logfile.
-A la fin du scan, un blocnote va s'ouvrir, enregistre le sous HJT1.txt.
-Puis sans le fermer :
CTRL+A pour tout sélectionner
CTRL+C pour copier 
CTRL+V pour coller dans la réponse
-Et tu le refermes pour le moment.
-Tu attends les résultats de l'analyse.

zouzou1089 · Answer

voici le raport que tu m'a demandé:

Username "jenni" - 23/11/2007 23:34:43 [Fixwareout edited 9/01/2007]

~~~~~ Prerun check

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
"nameserver"="85.255.113.117 85.255.112.191" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services	cpip\parameters\interfaces\{37F1006E-4835-42DD-B11B-F42AFF40AC32} 
"nameserver"="85.255.113.117,85.255.112.191" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services	cpip\parameters\interfaces\{EEEB59F3-67D4-4E66-B3B8-88098A744D2A} 
"nameserver"="85.255.113.117,85.255.112.191" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services	cpip\parameters\interfaces\{7251D8C4-D353-4036-8EAD-E91404EEE1D6}
"DhcpNameServer"="85.255.113.117,85.255.112.191" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services	cpip\parameters\interfaces\{EEEB59F3-67D4-4E66-B3B8-88098A744D2A}
"DhcpNameServer"="85.255.113.117,85.255.112.191" <Value cleared.

Cache de résolution DNS vidé.


System was rebooted successfully. 
 
~~~~~ Postrun check 
HKLM\SOFTWARE\~\Winlogon\ "System"="" 
....
....
~~~~~ Misc files. 
....
~~~~~ Checking for older varients.
....

~~~~~ Current runs (hklm hkcu "run" Keys Only)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe"
"WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe"
"KernelFaultCheck"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,\
65,6d,33,32,5c,64,75,6d,70,72,65,70,20,30,20,2d,6b,00
"SunJavaUpdateSched"="\"C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe\""
"HotbarOE"="C:\Program Files\Hotbar\bin\10.0.342.0\OEAddOn.exe"
"HotbarSA"="\"C:\Program Files\Hotbar\bin\10.0.342.0\HotbarSA.exe\""
"WA6PV_Check"="\"C:\Program Files\Fichiers communs\DriveCleaner Free\udcwap.exe\""
"SDR6V_Check"="\"C:\Program Files\Fichiers communs\DriveCleaner Free\udcsdr.exe\""
"WinAVX"="C:\WINDOWS\system32\WinAvXX.exe"
"WinAntiVirus Pro 2007"="C:\Program Files\WinAntiVirus Pro 2007\WinAv.exe /min"
"USDR6cw"="C:\Program Files\Fichiers communs\SystemDoctor\USDR6cw.exe -c"
"MDRV_Check"="\"C:\Program Files\Fichiers communs\SystemDoctor\usdrmdr.exe\""
"DC6V_Check"="\"C:\Program Files\Fichiers communs\SystemDoctor\usdrdc.exe\""
"NBKeyScan"="\"C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe\""
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe"
"HP Software Update"="\"C:\Program Files\HP\HP Software Update\HPWuSchd2.exe\""
"F-Secure Manager"="\"C:\Program Files\AntivirusFirewall\Common\FSM32.EXE\" /splash"
"F-Secure TNB"="\"C:\Program Files\AntivirusFirewall\TNB\TNBUtil.exe\" /CHECKALL /WAITFORSW"
"F-Secure Startup Wizard"="\"C:\Program Files\AntivirusFirewall\FSGUI\FSSW.EXE\" /reboot"
"News Service"="\"C:\Program Files\AntivirusFirewall\FSGUI\ispnews.exe\""
"b8d37586"="rundll32.exe \"C:\WINDOWS\system32\rakadmvx.dll\",b"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe"
"AdVantage"="\"C:\Program Files\AdVantage\AdVantage.exe\""
"WOOKIT"="C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx"
"SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe"
"WeatherDPA"="\"C:\Program Files\Hotbar\bin\10.0.342.0\Weather.exe\" -auto"
"DialMessenger"="\"C:\Documents and Settings\DialMessenger\dialmessenger.exe\" -background"
"WinAVX"="C:\WINDOWS\system32\WinAvXX.exe"
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="\"C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe\""
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe"
"msnmsgr"="\"C:\Program Files\Windows Live\Messenger\msnmsgr.exe\" /background"
....
Hosts file was reset, If you use a custom hosts file please replace it...
~~~~~ End report ~~~~~

zouzou1089 · Answer

voici le 2eme raport

SmitFraudFix v2.253

Rapport fait à  0:00:18,84, 24/11/2007
Executé à partir de C:\Documents and Settings\jenni\Mes documents\Julien MATHE\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode sans echec

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus


»»»»»»»»»»»»»»»»»»»»»»»» hosts


192.168.200.3	ad.doubleclick.net
192.168.200.3	ad.fastclick.net
192.168.200.3	ads.fastclick.net
192.168.200.3	ar.atwola.com
192.168.200.3	atdmt.com
192.168.200.3	avp.ch
192.168.200.3	avp.com
192.168.200.3	avp.ru
192.168.200.3	awaps.net
192.168.200.3	banner.fastclick.net
192.168.200.3	banners.fastclick.net
192.168.200.3	ca.com
192.168.200.3	click.atdmt.com
192.168.200.3	clicks.atdmt.com
192.168.200.3	customer.symantec.com
192.168.200.3	dispatch.mcafee.com
192.168.200.3	download.mcafee.com
192.168.200.3	downloads-us1.kaspersky-labs.com
192.168.200.3	downloads-us2.kaspersky-labs.com
192.168.200.3	downloads-us3.kaspersky-labs.com
192.168.200.3	downloads1.kaspersky-labs.com
192.168.200.3	downloads2.kaspersky-labs.com
192.168.200.3	downloads3.kaspersky-labs.com
192.168.200.3	downloads4.kaspersky-labs.com
192.168.200.3	engine.awaps.net
192.168.200.3	f-secure.com
192.168.200.3	fastclick.net
192.168.200.3	ftp.avp.ch
192.168.200.3	ftp.downloads1.kaspersky-labs.com
192.168.200.3	ftp.downloads2.kaspersky-labs.com
192.168.200.3	ftp.downloads3.kaspersky-labs.com
192.168.200.3	ftp.f-secure.com
192.168.200.3	ftp.kasperskylab.ru
192.168.200.3	ftp.sophos.com
192.168.200.3	ids.kaspersky-labs.com
192.168.200.3	kaspersky-labs.com
192.168.200.3	kaspersky.com
192.168.200.3	liveupdate.symantec.com
192.168.200.3	liveupdate.symantecliveupdate.com
192.168.200.3	mast.mcafee.com
192.168.200.3	mcafee.com
192.168.200.3	media.fastclick.net
192.168.200.3	my-etrust.com
192.168.200.3	nai.com
192.168.200.3	networkassociates.com
192.168.200.3	norton.com
192.168.200.3	phx.corporate-ir.net
192.168.200.3	rads.mcafee.com
192.168.200.3	secure.nai.com
192.168.200.3	securityresponse.symantec.com
192.168.200.3	service1.symantec.com
192.168.200.3	sophos.com
192.168.200.3	spd.atdmt.com
192.168.200.3	symantec.com
192.168.200.3	trendmicro.com
192.168.200.3	update.symantec.com
192.168.200.3	updates.symantec.com
192.168.200.3	updates1.kaspersky-labs.com
192.168.200.3	updates2.kaspersky-labs.com
192.168.200.3	updates3.kaspersky-labs.com
192.168.200.3	updates4.kaspersky-labs.com
192.168.200.3	updates5.kaspersky-labs.com
192.168.200.3	us.mcafee.com
192.168.200.3	vil.nai.com
192.168.200.3	viruslist.com
192.168.200.3	viruslist.ru
192.168.200.3	virusscan.jotti.org
192.168.200.3	virustotal.com
192.168.200.3	www.avp.ch
192.168.200.3	www.avp.com
192.168.200.3	www.avp.ru
192.168.200.3	www.awaps.net
192.168.200.3	www.ca.com
192.168.200.3	www.f-secure.com
192.168.200.3	www.fastclick.net
192.168.200.3	www.grisoft.com
192.168.200.3	www.kaspersky-labs.com
192.168.200.3	www.kaspersky.com
192.168.200.3	www.kaspersky.ru
192.168.200.3	www.mcafee.com
192.168.200.3	www.my-etrust.com
192.168.200.3	www.nai.com
192.168.200.3	www.networkassociates.com
192.168.200.3	www.sophos.com
192.168.200.3	www.symantec.com
192.168.200.3	www.symantec.com 
192.168.200.3	www.trendmicro.com
192.168.200.3	www.viruslist.com
192.168.200.3	www.viruslist.ru
192.168.200.3	www.virustotal.com
192.168.200.3	www3.ca.com

»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés

C:\WINDOWS\system32\printer.exe supprimé
C:\WINDOWS\system32\WinAvXX.exe supprimé
C:\DOCUME~1\jenni\MENUDM~1\PROGRA~1\DMARRA~1\system.exe supprimé
C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\DMARRA~1\autorun.exe supprimé

»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{37F1006E-4835-42DD-B11B-F42AFF40AC32}: DhcpNameServer=192.168.1.1 0.0.0.0
HKLM\SYSTEM\CS1\Services\Tcpip\..\{37F1006E-4835-42DD-B11B-F42AFF40AC32}: DhcpNameServer=192.168.1.1 0.0.0.0
HKLM\SYSTEM\CS2\Services\Tcpip\..\{37F1006E-4835-42DD-B11B-F42AFF40AC32}: DhcpNameServer=192.168.1.1 0.0.0.0
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 0.0.0.0
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 0.0.0.0
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 0.0.0.0


»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre
 
Nettoyage terminé. 
 
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

zouzou1089 · Answer

voici le dernier raport


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:18:50, on 24/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\ANTIVI~1\backweb\6588780\Program\SERVIC~1.EXE
C:\Program Files\AntivirusFirewall\Anti-Virus\fsgk32st.exe
C:\Program Files\AntivirusFirewall\backweb\6588780\program\fsbwsys.exe
C:\Program Files\AntivirusFirewall\Anti-Virus\FSGK32.EXE
C:\Program Files\AntivirusFirewall\Common\FSMA32.EXE
C:\Program Files\AntivirusFirewall\Anti-Virus\fssm32.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\AntivirusFirewall\Common\FSMB32.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\AntivirusFirewall\Common\FCH32.EXE
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AntivirusFirewall\Anti-Virus\fsqh.exe
C:\Program Files\AntivirusFirewall\Common\FAMEH32.EXE
C:\Program Files\AntivirusFirewall\Anti-Virus\fsrw.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\AntivirusFirewall\FWES\Program\fsdfwd.exe
C:\Program Files\AntivirusFirewall\Anti-Virus\fsav32.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\Hotbar\bin\10.0.342.0\OEAddOn.exe
C:\Program Files\Hotbar\bin\10.0.342.0\HotbarSA.exe
C:\Program Files\Fichiers communs\SystemDoctor\USDR6cw.exe
C:\Program Files\Fichiers communs\SystemDoctor\usdrmdr.exe
C:\Program Files\Fichiers communs\SystemDoctor\usdrdc.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\AntivirusFirewall\Common\FSM32.EXE
C:\Program Files\AntivirusFirewall\FSGUI\ispnews.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AdVantage\AdVantage.exe
C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
C:\Program Files\Hotbar\bin\10.0.342.0\Weather.exe
C:\Documents and Settings\DialMessenger\dialmessenger.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\AntivirusFirewall\backweb\6588780\Program\fspex.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\ANTIVI~1\ANTI-S~1\fsaw.exe
C:\Program Files\AntivirusFirewall\FSGUI\fsguidll.exe
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\PROGRA~1\Wanadoo\Watch.exe
C:\PROGRA~1\Wanadoo\WOOBrowser\WOOBrowser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Java\jre1.6.0_02\bin\jucheck.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE	oolbar.dll
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\system32\printer.exe
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE	oolbar.dll
O3 - Toolbar: Hotbar - {07AA283A-43D7-4CBE-A064-32A21112D94D} - C:\Program Files\Hotbar\bin\10.0.342.0\HostIE.dll
O3 - Toolbar: VMN Toolbar - {4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} - C:\PROGRA~1\VMNTOO~1\VMNTOO~1.DLL
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [HotbarOE] C:\Program Files\Hotbar\bin\10.0.342.0\OEAddOn.exe
O4 - HKLM\..\Run: [HotbarSA] "C:\Program Files\Hotbar\bin\10.0.342.0\HotbarSA.exe"
O4 - HKLM\..\Run: [WA6PV_Check] "C:\Program Files\Fichiers communs\DriveCleaner Free\udcwap.exe"
O4 - HKLM\..\Run: [SDR6V_Check] "C:\Program Files\Fichiers communs\DriveCleaner Free\udcsdr.exe"
O4 - HKLM\..\Run: [WinAntiVirus Pro 2007] C:\Program Files\WinAntiVirus Pro 2007\WinAv.exe /min
O4 - HKLM\..\Run: [USDR6cw] C:\Program Files\Fichiers communs\SystemDoctor\USDR6cw.exe -c
O4 - HKLM\..\Run: [MDRV_Check] "C:\Program Files\Fichiers communs\SystemDoctor\usdrmdr.exe"
O4 - HKLM\..\Run: [DC6V_Check] "C:\Program Files\Fichiers communs\SystemDoctor\usdrdc.exe"
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\AntivirusFirewall\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\AntivirusFirewall\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\AntivirusFirewall\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [News Service] "C:\Program Files\AntivirusFirewall\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [b8d37586] rundll32.exe "C:\WINDOWS\system32akadmvx.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AdVantage] "C:\Program Files\AdVantage\AdVantage.exe"
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKCU\..\Run: [WeatherDPA] "C:\Program Files\Hotbar\bin\10.0.342.0\Weather.exe" -auto
O4 - HKCU\..\Run: [DialMessenger] "C:\Documents and Settings\DialMessenger\dialmessenger.exe" -background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Antivirus Firewall.lnk = C:\Program Files\AntivirusFirewall\backweb\6588780\Program\fspex.exe
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &Bloquer cette fenêtre publicitaire - C:\Program Files\AntivirusFirewall\Anti-Spyware\blockpopups.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Protection Internet Explorer - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\AntivirusFirewall\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: Protection Internet Explorer... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\AntivirusFirewall\Anti-Spyware\ieshield.dll
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://s.tf1.fr/mmdia/static/rawflow/clients/5.3.1.0/Rawflow.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\__c002C5C7.dat
O20 - Winlogon Notify: cbxvwuu - cbxvwuu.dll (file missing)
O20 - Winlogon Notify: fccyyaa - C:\WINDOWS\SYSTEM32\fccyyaa.dll
O23 - Service: Antivirus Firewall (BackWeb Plug-in - 6588780) - Securitoo Portal - C:\PROGRA~1\ANTIVI~1\backweb\6588780\Program\SERVIC~1.EXE
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\AntivirusFirewall\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\AntivirusFirewall\backweb\6588780\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\AntivirusFirewall\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\AntivirusFirewall\Common\FSMA32.EXE
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

zouzou1089 · Answer

par contre je ne peux tjr pas allé dans le panneau don configuration 
voila merci ton aide

nardino · Answer

Bonsoir.

Il me manque le rapport Hijackthis.

Dans un blocnote ( Tous les programmes-Accessoires) tu copies-colles ce qui suit en gras.
Dans Format, veille à bien retirer la coche devant Retour à la ligne automatique.
Fais un retour chariot ( Entrée) après la dernière ligne.

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HotbarOE"=- 
"HotbarSA"=-
"WA6PV_Check"=-
"SDR6V_Check"=-
"WinAVX"=-
"WinAntiVirus Pro 2007"=-
"USDR6cw"=-
"MDRV_Check"=-
"DC6V_Check"=-
"b8d37586"=-
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SweetIM"=-
"WeatherDPA"=-
"WinAVX"=-

Dans Fichier, Enregistrer sous, Tous les fichiers, sur le bureau tu enregistres sous le nom fix.reg
Si le fichier obtenu est appelé fix.reg.txt, tu le renommes en supprimant .txt à la fin

Ensuite tu double-clique sur ce fichier et tu choisis Fusionner et tu acceptes.
Un message t'avertira de la bonne exécution du fix.
L'icône du fichier : https://www.118712.fr/sortir.html

Télécharge OTMoveIt : http://download.bleepingcomputer.com/oldtimer/OTMoveIt.exe Sur ton bureau. Important.

Tu le lances, il ne nécessite pas d'installation.

Tu inscris (ou tu colles) le chemin du fichier/dossier à supprimer dans la fenêtre de gauche (Paste List of Files/Folders to be moved) et tu cliques sur MoveIt!.
(La case Unregister Dll's and OCX's doit être cochée.)
Vérifies dans Ajout/Suppression des programmes la présence éventuelle de Hotbar, WinAntiVirus Pro 2007 et Macrogaming.
Si oui commence  par les désinstaller par ce biais. 

C:\Program Files\Hotbar
C:\Program Files\Fichiers communs\DriveCleaner Free
C:\Program Files\WinAntiVirus Pro 2007
C:\Program Files\Fichiers communs\SystemDoctor
C:\Program Files\Macrogaming
C:\WINDOWS\system32\WinAvXX.exe
C:\WINDOWS\system32\rakadmvx.dll

Le fichier passe alors dans la fenêtre de droite.
Et tu obtiendras à la racine du système un dossier C:\_OTMoveIt
Dans ce dernier un sous-dossier Moved Files dans lequel il y aura une sauvegarde du/des fichier(s) supprimé(s) et un fichier de ce type
 ********_******.log (mm/jj/aaaa_hh/mm/ss = date et horaire de la suppression).
Tu le posteras par copier-coller pour contrôle.

Si un redémarrage est demandé, accepte-le après avoir fermé tes applications en cours et terminé la procédure.

Télécharge sur ton bureau RHosts (Merci à S!ri)
http://siri.urz.free.fr/Softs/RHosts.exe

Double-clique sur Rhosts.exe et clique sur "restaurer".

Poste donc :
-un rapport Hijackthis
-le rapport OtMoveIt 20071122.******.txt
-un nouveau rapport Smitfraudfix.txt
-des infos sur tes problèmes restants s'il en existe encore.


Edit.
Pour le Panneau de configuration, chaque chose en son temps.
Pour le moment on assainit la situation.

zouzou1089 · Answer

le raport de hijackthis c'est le dernier raport ke je té donné

zouzou1089 · Answer

coucou je ne peux pas ouvrir le dossier fix.reg il me dit la modification de registre a été modifié par votre admistrateur

zouzou1089 · Answer

é ce ke je peux continué la suite

nardino · Answer

Bonsoir,
Bien sur que tu continues.
Pour le fichier .reg, c'est ce qu'on lui demandant.

zouzou1089 · Answer

bonsoir excuse moi mé c'est le fichier reg que je dois mettre dans la fenetre movelt jcomprend pas tro la dsl

nardino · Answer

Bonjour.

Pour OtMoveIt, tu colles la liste en gras qui est dans le chapitre et non pas la liste du fichier .reg

zouzou1089 · Answer

je pense ke c'est ca le raport ke tu as besoin:



File/Folder C:\Program Files\Hotbar not found.
File/Folder C:\Program Files\Fichiers communs\DriveCleaner Free not found.
File/Folder C:\Program Files\WinAntiVirus Pro 2007 not found.
File/Folder C:\Program Files\Fichiers communs\SystemDoctor not found.
File/Folder C:\Program Files\Macrogaming not found.
File/Folder C:\WINDOWS\system32\WinAvXX.exe not found.
File/Folder C:\WINDOWS\system32\rakadmvx.dll not found.
 
Created on 11/26/2007 20:53:49

zouzou1089 · Answer

voici le raport sminaudfix


SmitFraudFix v2.253

Rapport fait à 21:05:09,73, 26/11/2007
Executé à partir de C:\Documents and Settings\jenni\Mes documents\Julien MATHE\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\ANTIVI~1\backweb\6588780\Program\SERVIC~1.EXE
C:\Program Files\AntivirusFirewall\Anti-Virus\fsgk32st.exe
C:\Program Files\AntivirusFirewall\backweb\6588780\program\fsbwsys.exe
C:\Program Files\AntivirusFirewall\Anti-Virus\FSGK32.EXE
C:\Program Files\AntivirusFirewall\Common\FSMA32.EXE
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\AntivirusFirewall\Anti-Virus\fssm32.exe
C:\Program Files\AntivirusFirewall\Common\FSMB32.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\slserv.exe
C:\Program Files\AntivirusFirewall\Common\FCH32.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AntivirusFirewall\Common\FAMEH32.EXE
C:\Program Files\AntivirusFirewall\Anti-Virus\fsqh.exe
C:\Program Files\AntivirusFirewall\Anti-Virus\fsrw.exe
C:\Program Files\AntivirusFirewall\FWES\Program\fsdfwd.exe
C:\Program Files\AntivirusFirewall\Anti-Virus\fsav32.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Hotbar\bin\10.0.342.0\OEAddOn.exe
C:\Program Files\Fichiers communs\SystemDoctor\USDR6cw.exe
C:\Program Files\Fichiers communs\SystemDoctor\usdrmdr.exe
C:\Program Files\Fichiers communs\SystemDoctor\usdrdc.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\AntivirusFirewall\Common\FSM32.EXE
C:\Program Files\AntivirusFirewall\FSGUI\ispnews.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AdVantage\AdVantage.exe
C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
C:\Program Files\Hotbar\bin\10.0.342.0\Weather.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Documents and Settings\DialMessenger\dialmessenger.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\AntivirusFirewall\backweb\6588780\Program\fspex.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\ANTIVI~1\ANTI-S~1\fsaw.exe
C:\Program Files\AntivirusFirewall\FSGUI\fsguidll.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Java\jre1.6.0_02\bin\jucheck.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\PROGRA~1\Wanadoo\Watch.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\jenni


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\jenni\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\jenni\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files 


»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
 
 

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\WINDOWS\system32\__c002C5C7.dat"
"LoadAppInit_DLLs"=dword:00000001


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Rustock



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Carte Fast Ethernet compatible VIA - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.1.1
DNS Server Search Order: 0.0.0.0

HKLM\SYSTEM\CCS\Services\Tcpip\..\{37F1006E-4835-42DD-B11B-F42AFF40AC32}: DhcpNameServer=192.168.1.1 0.0.0.0
HKLM\SYSTEM\CS1\Services\Tcpip\..\{37F1006E-4835-42DD-B11B-F42AFF40AC32}: DhcpNameServer=192.168.1.1 0.0.0.0
HKLM\SYSTEM\CS2\Services\Tcpip\..\{37F1006E-4835-42DD-B11B-F42AFF40AC32}: DhcpNameServer=192.168.1.1 0.0.0.0
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 0.0.0.0
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 0.0.0.0
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 0.0.0.0


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

zouzou1089 · Answer

voici le raport de hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:08:24, on 26/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\ANTIVI~1\backweb\6588780\Program\SERVIC~1.EXE
C:\Program Files\AntivirusFirewall\Anti-Virus\fsgk32st.exe
C:\Program Files\AntivirusFirewall\backweb\6588780\program\fsbwsys.exe
C:\Program Files\AntivirusFirewall\Anti-Virus\FSGK32.EXE
C:\Program Files\AntivirusFirewall\Common\FSMA32.EXE
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\AntivirusFirewall\Anti-Virus\fssm32.exe
C:\Program Files\AntivirusFirewall\Common\FSMB32.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\slserv.exe
C:\Program Files\AntivirusFirewall\Common\FCH32.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AntivirusFirewall\Common\FAMEH32.EXE
C:\Program Files\AntivirusFirewall\Anti-Virus\fsqh.exe
C:\Program Files\AntivirusFirewall\Anti-Virus\fsrw.exe
C:\Program Files\AntivirusFirewall\FWES\Program\fsdfwd.exe
C:\Program Files\AntivirusFirewall\Anti-Virus\fsav32.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Hotbar\bin\10.0.342.0\OEAddOn.exe
C:\Program Files\Fichiers communs\SystemDoctor\USDR6cw.exe
C:\Program Files\Fichiers communs\SystemDoctor\usdrmdr.exe
C:\Program Files\Fichiers communs\SystemDoctor\usdrdc.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\AntivirusFirewall\Common\FSM32.EXE
C:\Program Files\AntivirusFirewall\FSGUI\ispnews.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AdVantage\AdVantage.exe
C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
C:\Program Files\Hotbar\bin\10.0.342.0\Weather.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Documents and Settings\DialMessenger\dialmessenger.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\AntivirusFirewall\backweb\6588780\Program\fspex.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\ANTIVI~1\ANTI-S~1\fsaw.exe
C:\Program Files\AntivirusFirewall\FSGUI\fsguidll.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Java\jre1.6.0_02\bin\jucheck.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\PROGRA~1\Wanadoo\Watch.exe
C:\PROGRA~1\Wanadoo\WOOBrowser\WOOBrowser.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE	oolbar.dll (file missing)
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\system32\printer.exe
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE	oolbar.dll (file missing)
O3 - Toolbar: Hotbar - {07AA283A-43D7-4CBE-A064-32A21112D94D} - C:\Program Files\Hotbar\bin\10.0.342.0\HostIE.dll (file missing)
O3 - Toolbar: VMN Toolbar - {4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} - C:\PROGRA~1\VMNTOO~1\VMNTOO~1.DLL
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [HotbarOE] C:\Program Files\Hotbar\bin\10.0.342.0\OEAddOn.exe
O4 - HKLM\..\Run: [HotbarSA] "C:\Program Files\Hotbar\bin\10.0.342.0\HotbarSA.exe"
O4 - HKLM\..\Run: [WA6PV_Check] "C:\Program Files\Fichiers communs\DriveCleaner Free\udcwap.exe"
O4 - HKLM\..\Run: [SDR6V_Check] "C:\Program Files\Fichiers communs\DriveCleaner Free\udcsdr.exe"
O4 - HKLM\..\Run: [WinAntiVirus Pro 2007] C:\Program Files\WinAntiVirus Pro 2007\WinAv.exe /min
O4 - HKLM\..\Run: [USDR6cw] C:\Program Files\Fichiers communs\SystemDoctor\USDR6cw.exe -c
O4 - HKLM\..\Run: [MDRV_Check] "C:\Program Files\Fichiers communs\SystemDoctor\usdrmdr.exe"
O4 - HKLM\..\Run: [DC6V_Check] "C:\Program Files\Fichiers communs\SystemDoctor\usdrdc.exe"
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\AntivirusFirewall\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\AntivirusFirewall\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\AntivirusFirewall\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [News Service] "C:\Program Files\AntivirusFirewall\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [b8d37586] rundll32.exe "C:\WINDOWS\system32akadmvx.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AdVantage] "C:\Program Files\AdVantage\AdVantage.exe"
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKCU\..\Run: [WeatherDPA] "C:\Program Files\Hotbar\bin\10.0.342.0\Weather.exe" -auto
O4 - HKCU\..\Run: [DialMessenger] "C:\Documents and Settings\DialMessenger\dialmessenger.exe" -background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Antivirus Firewall.lnk = C:\Program Files\AntivirusFirewall\backweb\6588780\Program\fspex.exe
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &Bloquer cette fenêtre publicitaire - C:\Program Files\AntivirusFirewall\Anti-Spyware\blockpopups.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Protection Internet Explorer - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\AntivirusFirewall\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: Protection Internet Explorer... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\AntivirusFirewall\Anti-Spyware\ieshield.dll
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://s.tf1.fr/mmdia/static/rawflow/clients/5.3.1.0/Rawflow.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\__c002C5C7.dat
O20 - Winlogon Notify: cbxvwuu - cbxvwuu.dll (file missing)
O20 - Winlogon Notify: fccyyaa - C:\WINDOWS\SYSTEM32\fccyyaa.dll
O23 - Service: Antivirus Firewall (BackWeb Plug-in - 6588780) - Securitoo Portal - C:\PROGRA~1\ANTIVI~1\backweb\6588780\Program\SERVIC~1.EXE
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\AntivirusFirewall\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\AntivirusFirewall\backweb\6588780\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\AntivirusFirewall\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\AntivirusFirewall\Common\FSMA32.EXE
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

nardino · Answer

Bonsoir.

A exécuter dans cet ordre précis:

1° Tu lances OtMoveIt et tu cliques sur CleanUp
Puis dans le popup [b]Cleanup list download successful. Begin cleanup process ?[/b], accepte par [b]Yes[/b]

2° Tu télécharges Vundofix de Atribune : 
http://www.atribune.org/ccount/click.php?id=4

	[*]Double clic sur Vundofix.exe.
	[*]Coche la case Run VundoFix as a task
	[*]Répond OK au popup qui s'ouvre.
Il va se refermer et réouvrir au bout d'une minute environ.
	[*]Quand il est rouvert, clique sur Scan for Vundo
	[*]Quand le scan est terminé, clique sur Remove Vundo
	[*]Réponds Yes à la demande de suppression des fichiers.
	[*]Il te sera demandé de redémarrer ton ordinateur, accepte bien sûr.
	[*]Copie/colle le rapport (c:\vundofix.txt) dans ta réponse avec un nouveau rapport Hijackthis.

3° Télécharge OTMoveIt :
 http://download.bleepingcomputer.com/oldtimer/OTMoveIt.exe Sur ton bureau. Important.
Et tu ne le lances pas pour le moment.

zouzou1089 · Answer

voici le raport de vundofix

VundoFix V6.6.2

Checking Java version...

Scan started at 23:01:28 26/11/2007

Listing files found while scanning....

C:\windows\system32\__c002C5C7.dat

Beginning removal...

 Attempting to delete C:\windows\system32\__c002C5C7.dat
C:\windows\system32\__c002C5C7.dat Could not be deleted.

Performing Repairs to the registry.
Done!

Beginning removal...

VundoFix V6.6.2

Checking Java version...

Scan started at 23:17:28 26/11/2007

Listing files found while scanning....

C:\windows\system32\__c002C5C7.dat

Beginning removal...

 Attempting to delete C:\windows\system32\__c002C5C7.dat
C:\windows\system32\__c002C5C7.dat Could not be deleted.

Performing Repairs to the registry.
Done!

VundoFix V6.6.2

Checking Java version...

Scan started at 23:28:57 26/11/2007

Listing files found while scanning....

C:\windows\system32\__c002C5C7.dat

zouzou1089 · Answer

é voici le raport hijackthis


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:14:43, on 27/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\ANTIVI~1\backweb\6588780\Program\SERVIC~1.EXE
C:\Program Files\AntivirusFirewall\Anti-Virus\fsgk32st.exe
C:\Program Files\AntivirusFirewall\backweb\6588780\program\fsbwsys.exe
C:\Program Files\AntivirusFirewall\Anti-Virus\FSGK32.EXE
C:\Program Files\AntivirusFirewall\Common\FSMA32.EXE
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\AntivirusFirewall\Anti-Virus\fssm32.exe
C:\Program Files\AntivirusFirewall\Common\FSMB32.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\AntivirusFirewall\Common\FCH32.EXE
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AntivirusFirewall\Common\FAMEH32.EXE
C:\Program Files\AntivirusFirewall\Anti-Virus\fsqh.exe
C:\Program Files\AntivirusFirewall\Anti-Virus\fsrw.exe
C:\Program Files\AntivirusFirewall\FWES\Program\fsdfwd.exe
C:\Program Files\AntivirusFirewall\Anti-Virus\fsav32.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\AntivirusFirewall\Common\FSM32.EXE
C:\Program Files\AntivirusFirewall\FSGUI\ispnews.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AdVantage\AdVantage.exe
C:\Documents and Settings\DialMessenger\dialmessenger.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\AntivirusFirewall\backweb\6588780\Program\fspex.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\ANTIVI~1\ANTI-S~1\fsaw.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\AntivirusFirewall\FSGUI\fsguidll.exe
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\PROGRA~1\Wanadoo\Watch.exe
C:\WINDOWS\system32
otepad.exe
C:\PROGRA~1\Wanadoo\WOOBrowser\WOOBrowser.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE	oolbar.dll (file missing)
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\system32\printer.exe
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE	oolbar.dll (file missing)
O3 - Toolbar: Hotbar - {07AA283A-43D7-4CBE-A064-32A21112D94D} - C:\Program Files\Hotbar\bin\10.0.342.0\HostIE.dll (file missing)
O3 - Toolbar: VMN Toolbar - {4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} - C:\PROGRA~1\VMNTOO~1\VMNTOO~1.DLL
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [HotbarOE] C:\Program Files\Hotbar\bin\10.0.342.0\OEAddOn.exe
O4 - HKLM\..\Run: [HotbarSA] "C:\Program Files\Hotbar\bin\10.0.342.0\HotbarSA.exe"
O4 - HKLM\..\Run: [WA6PV_Check] "C:\Program Files\Fichiers communs\DriveCleaner Free\udcwap.exe"
O4 - HKLM\..\Run: [SDR6V_Check] "C:\Program Files\Fichiers communs\DriveCleaner Free\udcsdr.exe"
O4 - HKLM\..\Run: [WinAntiVirus Pro 2007] C:\Program Files\WinAntiVirus Pro 2007\WinAv.exe /min
O4 - HKLM\..\Run: [USDR6cw] C:\Program Files\Fichiers communs\SystemDoctor\USDR6cw.exe -c
O4 - HKLM\..\Run: [MDRV_Check] "C:\Program Files\Fichiers communs\SystemDoctor\usdrmdr.exe"
O4 - HKLM\..\Run: [DC6V_Check] "C:\Program Files\Fichiers communs\SystemDoctor\usdrdc.exe"
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\AntivirusFirewall\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\AntivirusFirewall\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\AntivirusFirewall\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [News Service] "C:\Program Files\AntivirusFirewall\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [b8d37586] rundll32.exe "C:\WINDOWS\system32akadmvx.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AdVantage] "C:\Program Files\AdVantage\AdVantage.exe"
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKCU\..\Run: [WeatherDPA] "C:\Program Files\Hotbar\bin\10.0.342.0\Weather.exe" -auto
O4 - HKCU\..\Run: [DialMessenger] "C:\Documents and Settings\DialMessenger\dialmessenger.exe" -background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Antivirus Firewall.lnk = C:\Program Files\AntivirusFirewall\backweb\6588780\Program\fspex.exe
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &Bloquer cette fenêtre publicitaire - C:\Program Files\AntivirusFirewall\Anti-Spyware\blockpopups.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Protection Internet Explorer - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\AntivirusFirewall\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: Protection Internet Explorer... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\AntivirusFirewall\Anti-Spyware\ieshield.dll
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://s.tf1.fr/mmdia/static/rawflow/clients/5.3.1.0/Rawflow.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\__c002C5C7.dat
O20 - Winlogon Notify: cbxvwuu - cbxvwuu.dll (file missing)
O20 - Winlogon Notify: fccyyaa - C:\WINDOWS\SYSTEM32\fccyyaa.dll
O23 - Service: Antivirus Firewall (BackWeb Plug-in - 6588780) - Securitoo Portal - C:\PROGRA~1\ANTIVI~1\backweb\6588780\Program\SERVIC~1.EXE
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\AntivirusFirewall\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\AntivirusFirewall\backweb\6588780\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\AntivirusFirewall\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\AntivirusFirewall\Common\FSMA32.EXE
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

nardino · Answer

Bonjour.

**Démarrage en mode sans échec**

Après la fermeture de la première fenêtre, au tout début de la phase de démarrage du PC (boot), appuyer sur F8.
Une fenêtre de type DOS s'ouvre, sélectionner Mode sans échec à l'aide des flèches du clavier et cliquer sur Entrée (Enter) une fois surligné.
Ne t'inquiète pas de l'aspect, Windows démarre avec le minimum nécessaire.
"Il faut choisir la même session que celle qui est infectée et non pas la sesssion Administrateur qui n'apparaît que sous ce mode."

**Hijackthis**

Tu lances Hijackthis par le bouton "Scanner seulement/Scan only", selon la version et tu coches:

R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE	oolbar.dll (file missing)
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\system32\printer.exe 
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE	oolbar.dll (file missing) 
O3 - Toolbar: Hotbar - {07AA283A-43D7-4CBE-A064-32A21112D94D} - C:\Program Files\Hotbar\bin\10.0.342.0\HostIE.dll (file missing)
O3 - Toolbar: VMN Toolbar - {4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} - C:\PROGRA~1\VMNTOO~1\VMNTOO~1.DLL 
O4 - HKLM\..\Run: [HotbarOE] C:\Program Files\Hotbar\bin\10.0.342.0\OEAddOn.exe 
O4 - HKLM\..\Run: [HotbarSA] "C:\Program Files\Hotbar\bin\10.0.342.0\HotbarSA.exe" 
O4 - HKLM\..\Run: [WA6PV_Check] "C:\Program Files\Fichiers communs\DriveCleaner Free\udcwap.exe"
O4 - HKLM\..\Run: [SDR6V_Check] "C:\Program Files\Fichiers communs\DriveCleaner Free\udcsdr.exe"
O4 - HKLM\..\Run: [WinAntiVirus Pro 2007] C:\Program Files\WinAntiVirus Pro 2007\WinAv.exe /min
O4 - HKLM\..\Run: [USDR6cw] C:\Program Files\Fichiers communs\SystemDoctor\USDR6cw.exe -c
O4 - HKLM\..\Run: [MDRV_Check] "C:\Program Files\Fichiers communs\SystemDoctor\usdrmdr.exe"
O4 - HKLM\..\Run: [DC6V_Check] "C:\Program Files\Fichiers communs\SystemDoctor\usdrdc.exe" 
O4 - HKLM\..\Run: [b8d37586] rundll32.exe "C:\WINDOWS\system32akadmvx.dll",b 
O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKCU\..\Run: [WeatherDPA] "C:\Program Files\Hotbar\bin\10.0.342.0\Weather.exe" -auto 
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O20 - AppInit_DLLs: C:\WINDOWS\system32\__c002C5C7.dat
O20 - Winlogon Notify: cbxvwuu - cbxvwuu.dll (file missing)
O20 - Winlogon Notify: fccyyaa - C:\WINDOWS\SYSTEM32\fccyyaa.dll 

Tu cliques sur "Fixer objet/Fix checked" et tu refermes Hijackthis.

**Nettoyage**

Utilise OTMoveIt.
Pour cela ouvre-le:
Copie et colle la liste ci-dessous  dans le volet de gauche et clique sur "MoveIt!" pour lancer la suppression.

C:\Program Files\Macrogaming
C:\Program Files\Hotbar
C:\Program Files\WinAntiVirus Pro 2007
C:\Program Files\WMN Toolbar
C:\Program Files\Fichiers communs\DriveCleaner Free
C:\WINDOWS\system32akadmvx.dll
C:\WINDOWS\SYSTEM32\fccyyaa.dll

Le résultat apparaitra dans le cadre Results à droite.
Clique sur Exit pour fermer.
Un rapport sera enregistré dans C:\_OTMoveIt\MovedFiles.(xxxxxxxx_xxxxxx.log)
Les x sont des chiffres qui correspondent à la date et l'heure du scan.

**Envoi des rapports**

Après avoir redémarré en mode normal, tu postes:
-un nouveau rapport Hijackthis
-le rapport OtMoveIt 20071127_******.log
-des informations sur l'évolution de tes problèmes.

zouzou1089 · Answer

voici le raport hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:14:27, on 28/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ANTIVI~1\backweb\6588780\Program\SERVIC~1.EXE
C:\Program Files\AntivirusFirewall\Anti-Virus\fsgk32st.exe
C:\Program Files\AntivirusFirewall\Anti-Virus\FSGK32.EXE
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\AntivirusFirewall\backweb\6588780\program\fsbwsys.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\AntivirusFirewall\Common\FSM32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AdVantage\AdVantage.exe
C:\Documents and Settings\DialMessenger\dialmessenger.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\AntivirusFirewall\Common\FSMA32.EXE
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\AntivirusFirewall\Common\FSMB32.EXE
C:\Program Files\AntivirusFirewall\Anti-Virus\fssm32.exe
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\AntivirusFirewall\Common\FCH32.EXE
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\Program Files\AntivirusFirewall\backweb\6588780\Program\fspex.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\AntivirusFirewall\Common\FAMEH32.EXE
C:\Program Files\AntivirusFirewall\Anti-Virus\fsqh.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\Program Files\AntivirusFirewall\Anti-Virus\fsrw.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\Program Files\AntivirusFirewall\FWES\Program\fsdfwd.exe
C:\Program Files\AntivirusFirewall\Anti-Virus\fsav32.exe
C:\PROGRA~1\ANTIVI~1\ANTI-S~1\fsaw.exe
C:\Program Files\AntivirusFirewall\FSGUI\fsguidll.exe
C:\PROGRA~1\Wanadoo\Watch.exe
C:\PROGRA~1\Wanadoo\WOOBrowser\WOOBrowser.exe
C:\Program Files\Java\jre1.6.0_02\bin\jucheck.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\AntivirusFirewall\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\AntivirusFirewall\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\AntivirusFirewall\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [News Service] "C:\Program Files\AntivirusFirewall\FSGUI\ispnews.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AdVantage] "C:\Program Files\AdVantage\AdVantage.exe"
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [DialMessenger] "C:\Documents and Settings\DialMessenger\dialmessenger.exe" -background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Antivirus Firewall.lnk = C:\Program Files\AntivirusFirewall\backweb\6588780\Program\fspex.exe
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Bloquer cette fenêtre publicitaire - C:\Program Files\AntivirusFirewall\Anti-Spyware\blockpopups.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Protection Internet Explorer - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\AntivirusFirewall\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: Protection Internet Explorer... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\AntivirusFirewall\Anti-Spyware\ieshield.dll
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://s.tf1.fr/mmdia/static/rawflow/clients/5.3.1.0/Rawflow.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\__c002C5C7.dat
O23 - Service: Antivirus Firewall (BackWeb Plug-in - 6588780) - Securitoo Portal - C:\PROGRA~1\ANTIVI~1\backweb\6588780\Program\SERVIC~1.EXE
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\AntivirusFirewall\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\AntivirusFirewall\backweb\6588780\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\AntivirusFirewall\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\AntivirusFirewall\Common\FSMA32.EXE
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

nardino · Answer

Bonjour.
Reste ce fichier à supprimer avec OtMoveIt  :
C:\WINDOWS\system32\__c002C5C7.dat 
Et poste le rapport.

zouzou1089 · Answer

File move failed. C:\WINDOWS\system32\__c002C5C7.dat scheduled to be moved on reboot.
 
Created on 11/28/2007 16:46:16
 
voici le raport ke g eu

nardino · Answer

As-tu redémarré ?
Si oui , reposte un rappoprt Hijackthis.
Si non redémarre avant.

zouzou1089 · Answer

oui je l'est rdemaré jte poste le raport

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:17:43, on 28/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\AntivirusFirewall\Common\FSM32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AdVantage\AdVantage.exe
C:\Documents and Settings\DialMessenger\dialmessenger.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\PROGRA~1\ANTIVI~1\backweb\6588780\Program\SERVIC~1.EXE
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\Program Files\AntivirusFirewall\Anti-Virus\fsgk32st.exe
C:\Program Files\AntivirusFirewall\backweb\6588780\program\fsbwsys.exe
C:\Program Files\AntivirusFirewall\Anti-Virus\FSGK32.EXE
C:\Program Files\AntivirusFirewall\Common\FSMA32.EXE
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\AntivirusFirewall\Anti-Virus\fssm32.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\Program Files\AntivirusFirewall\Common\FSMB32.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\Program Files\AntivirusFirewall\backweb\6588780\Program\fspex.exe
C:\Program Files\AntivirusFirewall\Common\FCH32.EXE
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AntivirusFirewall\Common\FAMEH32.EXE
C:\Program Files\AntivirusFirewall\Anti-Virus\fsqh.exe
C:\Program Files\AntivirusFirewall\Anti-Virus\fsrw.exe
C:\Program Files\AntivirusFirewall\FWES\Program\fsdfwd.exe
C:\Program Files\AntivirusFirewall\Anti-Virus\fsav32.exe
C:\PROGRA~1\ANTIVI~1\ANTI-S~1\fsaw.exe
C:\Program Files\AntivirusFirewall\FSGUI\fsguidll.exe
C:\PROGRA~1\Wanadoo\Watch.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\PROGRA~1\Wanadoo\WOOBrowser\WOOBrowser.exe
C:\Program Files\Java\jre1.6.0_02\bin\jucheck.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\AntivirusFirewall\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\AntivirusFirewall\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\AntivirusFirewall\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [News Service] "C:\Program Files\AntivirusFirewall\FSGUI\ispnews.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AdVantage] "C:\Program Files\AdVantage\AdVantage.exe"
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [DialMessenger] "C:\Documents and Settings\DialMessenger\dialmessenger.exe" -background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Antivirus Firewall.lnk = C:\Program Files\AntivirusFirewall\backweb\6588780\Program\fspex.exe
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Bloquer cette fenêtre publicitaire - C:\Program Files\AntivirusFirewall\Anti-Spyware\blockpopups.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Protection Internet Explorer - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\AntivirusFirewall\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: Protection Internet Explorer... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\AntivirusFirewall\Anti-Spyware\ieshield.dll
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://s.tf1.fr/mmdia/static/rawflow/clients/5.3.1.0/Rawflow.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\__c002C5C7.dat
O23 - Service: Antivirus Firewall (BackWeb Plug-in - 6588780) - Securitoo Portal - C:\PROGRA~1\ANTIVI~1\backweb\6588780\Program\SERVIC~1.EXE
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\AntivirusFirewall\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\AntivirusFirewall\backweb\6588780\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\AntivirusFirewall\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\AntivirusFirewall\Common\FSMA32.EXE
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

nardino · Answer

Bonsoir.

En mode sans échec, tu fixes ces trois lignes avec Hijackthis et tu cliques sur Fix checked.

O4 - HKCU\..\Run: [AdVantage] "C:\Program Files\AdVantage\AdVantage.exe" 
O4 - HKCU\..\Run: [DialMessenger] "C:\Documents and Settings\DialMessenger\dialmessenger.exe" -background 
O20 - AppInit_DLLs: C:\WINDOWS\system32\__c002C5C7.dat 

Puis tu lances OtMoveIt et tu colles :

C:\Program Files\AdVantage
C:\Documents and Settings\DialMessenger
C:\WINDOWS\system32\__c002C5C7.dat

Et tu cliques sur MoveIt.

Tu redémarres et tu postes un nouveau Hijackthis et le rapport OtMoveIt que tu trouveras dans C:\_OtMoveIt\Moved Files.

Télécharge Combofix de sUBs : 
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

	[*]Ferme toutes les fenêtres
	[*]Double-clique sur combofix.exe (ne clique pas sur la fenêtre qui s'ouvre)
	[*]Appuie sur Y pour lancer le scan
	[*]A la fin du scan (cela peut prendre du temps), un rapport sera créé.

Poste ce rapport avec les deux autres. 

@+

zouzou1089 · Answer

voici le raport de hijacthis


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:59:53, on 28/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\ANTIVI~1\backweb\6588780\Program\SERVIC~1.EXE
C:\Program Files\AntivirusFirewall\Anti-Virus\fsgk32st.exe
C:\Program Files\AntivirusFirewall\backweb\6588780\program\fsbwsys.exe
C:\Program Files\AntivirusFirewall\Anti-Virus\FSGK32.EXE
C:\Program Files\AntivirusFirewall\Common\FSMA32.EXE
C:\Program Files\AntivirusFirewall\Anti-Virus\fssm32.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\AntivirusFirewall\Common\FSMB32.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\AntivirusFirewall\Common\FCH32.EXE
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AntivirusFirewall\Common\FAMEH32.EXE
C:\Program Files\AntivirusFirewall\Anti-Virus\fsqh.exe
C:\Program Files\AntivirusFirewall\Anti-Virus\fsrw.exe
C:\Program Files\AntivirusFirewall\FWES\Program\fsdfwd.exe
C:\Program Files\AntivirusFirewall\Anti-Virus\fsav32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\AntivirusFirewall\Common\FSM32.EXE
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\AntivirusFirewall\FSGUI\ispnews.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\AntivirusFirewall\backweb\6588780\Program\fspex.exe
C:\PROGRA~1\ANTIVI~1\ANTI-S~1\fsaw.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\AntivirusFirewall\FSGUI\fsguidll.exe
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\PROGRA~1\Wanadoo\Watch.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\PROGRA~1\Wanadoo\WOOBrowser\WOOBrowser.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\AntivirusFirewall\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\AntivirusFirewall\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\AntivirusFirewall\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [News Service] "C:\Program Files\AntivirusFirewall\FSGUI\ispnews.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Antivirus Firewall.lnk = C:\Program Files\AntivirusFirewall\backweb\6588780\Program\fspex.exe
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Bloquer cette fenêtre publicitaire - C:\Program Files\AntivirusFirewall\Anti-Spyware\blockpopups.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Protection Internet Explorer - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\AntivirusFirewall\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: Protection Internet Explorer... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\AntivirusFirewall\Anti-Spyware\ieshield.dll
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://s.tf1.fr/mmdia/static/rawflow/clients/5.3.1.0/Rawflow.cab
O23 - Service: Antivirus Firewall (BackWeb Plug-in - 6588780) - Securitoo Portal - C:\PROGRA~1\ANTIVI~1\backweb\6588780\Program\SERVIC~1.EXE
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\AntivirusFirewall\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\AntivirusFirewall\backweb\6588780\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\AntivirusFirewall\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\AntivirusFirewall\Common\FSMA32.EXE
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

zouzou1089 · Answer

voici le raport de otmoveit


File/Folder c:\programFiles\advantages not found.
File/Folder c:\documentsandSettings\dialMessengers not found.
File/Folder c:\windows\system32\_c002c5c7.dat not found.
 
Created on 11/28/2007 20:54:21

zouzou1089 · Answer

voici le dernier raport


ComboFix 07-11-19.4C - jenni 2007-11-28 21:07:21.1 - NTFSx86
Microsoft Windows XP Édition familiale  5.1.2600.2.1252.1.1036.18.147 [GMT 1:00]
Running from: C:\Documents and Settings\jenni\Mes documents\Julien MATHE\combofix.exe
 * Created a new restore point
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data.\salesmonitor
C:\Documents and Settings\All Users\Application Data\HotbarSA
C:\Documents and Settings\All Users\Application Data\HotbarSA\HotbarSA.dat
C:\Documents and Settings\All Users\Application Data\HotbarSA\HotbarSA_kyf.dat
C:\Documents and Settings\All Users\Application Data\HotbarSA\HotbarSAAbout.mht
C:\Documents and Settings\All Users\Application Data\HotbarSA\HotbarSAau.dat
C:\Documents and Settings\All Users\Application Data\HotbarSA\HotbarSAEula.mht
C:\Documents and Settings\All Users\Application Data\SystemDoctor Free
C:\Documents and Settings\All Users\Application Data\SystemDoctor Free\Data\Abbr
C:\Documents and Settings\All Users\Application Data\SystemDoctor Free\Data\ActivationCode
C:\Documents and Settings\All Users\Application Data\SystemDoctor Free\Data\HOURS
C:\Documents and Settings\All Users\Application Data\SystemDoctor Free\Data\ProductCode
C:\Documents and Settings\All Users\Application Data\WinAntiVirus Pro 2007
C:\Documents and Settings\All Users\Application Data\WinAntiVirus Pro 2007\Data\Abbr
C:\Documents and Settings\All Users\Application Data\WinAntiVirus Pro 2007\Data\ActivationCode
C:\Documents and Settings\All Users\Application Data\WinAntiVirus Pro 2007\Data\ProductCode
C:\Documents and Settings\jenni\Application Data\Hotbar
C:\Documents and Settings\jenni\Application Data\Hotbar\eskin\[u]0[/u]40107ta313_arrow.ani
C:\Documents and Settings\jenni\Application Data\Hotbar\eskin\[u]0[/u]40107ta313_cr.htm
C:\Documents and Settings\jenni\Application Data\Hotbar\eskin\[u]0[/u]40107ta313_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\eskin\[u]0[/u]40107ta319_arrow.ani
C:\Documents and Settings\jenni\Application Data\Hotbar\eskin\[u]0[/u]40107ta319_cr.htm
C:\Documents and Settings\jenni\Application Data\Hotbar\eskin\[u]0[/u]40107ta319_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\eskin\[u]0[/u]60107yac3_arrow.ani
C:\Documents and Settings\jenni\Application Data\Hotbar\eskin\[u]0[/u]60107yac3_cr.htm
C:\Documents and Settings\jenni\Application Data\Hotbar\eskin\[u]0[/u]60107yac3_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\eskin\100602us_sharpei.jpg
C:\Documents and Settings\jenni\Application Data\Hotbar\eskin\100602us_sharpei_prv.jpg
C:\Documents and Settings\jenni\Application Data\Hotbar\eskin\100602us_sharpei_st.htm
C:\Documents and Settings\jenni\Application Data\Hotbar\eskin\100602us_sharpei_st.xml
C:\Documents and Settings\jenni\Application Data\Hotbar\eskin\FileManager.txt
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]30104_emte10_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]30104_emte11_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]30104_emte12_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]30104_emte13_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]30104_emte14_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]30104_emte19_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]30104_emte20_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]30104_emte21_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]30104_emte9_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]30203lib_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]33102angel_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]33102bigluf_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]33102bigsmile_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]33102birthday_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]33102cheers_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]33102flo_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]33102good_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]33102jump_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]33102king_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]33102lough_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]33102luf_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]33102smile_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]33102smiled_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]33102sor_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]33102thanx_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]33102uhu_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]40103ahh_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]40103wow_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]40104_emi2_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]42102_1134_112_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]50103big_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]50103gig_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]50103hm_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]50103nomail_emoti_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]50103norm_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]60104_ema15_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]60104_ema16_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]60104_ema17_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]60104_ema18_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]60104_ema19_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]60104_ema20_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]60104_ema21_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]60104_ema24_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]60104_ema25_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]60104_ema26_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]60104_ema30_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]60104_ema33_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]60104_ema34_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]62802hippi_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]62802jumpie_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]80402argh_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]80402oops_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]80402ouch_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]82502no_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]82502yes_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\110103_boring1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\110103_confused_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\110103_crying_ugly_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\110103_fantastic_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\110103_feel_better_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\110103_gimme_break_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\110103_heehee_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\110103_hlopaet_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\110103_ign_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\110103_lol_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\110103_no_comment_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\110103_peace_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\110103_smashing_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\110103_talk2thehand_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\block_sm.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\block_sm2.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\block_smli.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\block_smli2.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\blocked.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\blocked2.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\btn_add-but.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\btn_back-but.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\btn_left_cut_enabled_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\btn_left_enabled_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\btn_left_pressed_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\btn_middle_enabled_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\btn_middle_pressed_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\btn_right_cut_enabled_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\btn_right_enabled_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\btn_right_pressed_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\business_promo.htm
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\buttondir.txt
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\components.cdf
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\css_cattree.css
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\css_flashpreview.css
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\css2_main.css
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\css2_pagingmodule.css
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\css2_topbuttons.css
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\delete.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\edit_clear_sound.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\edit_fs.htm
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\edit_select.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\email-def-511745-514279.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\email-def-email-backgrounds.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\email-def-email-bcards.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\email-def-email-ecards.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\email-def-email-edit.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\email-def-email-emoticons.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\email-def-email-estationery.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\email-def-email-funny.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\email-def-email-help.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\email-def-email-images.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\email-def-email-info.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\email-def-email-more.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\email-def-email-my.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\email-def-email-people.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\email-def-email-photo.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\email-def-email-tell.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\email-def-email-temp.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\email-def-email-temp_OI.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\email-def-email-text.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\email-def-email-voice.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\email-def.cdf
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\email-premium-email-premium.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\email-premium-email-premium_OI.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\email-t1-bg.res
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\email-temp-bg.res
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\estatationery.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\flashpatch.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\flashpreview.htm
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\fs3.htm
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\hotbar_promo.htm
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\icon_checked_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\icon_close_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\icon_close_pressed_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\icon_edit_preview.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\icon_edit_send.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\icon_flash_preview.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\icon_recently_used.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\icon_remove_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\icon_remove_pressed_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\icon_sand-clock2.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\icon_tell_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\icon_tell_pressed_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\icon_tree_null.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\icon_unchecked_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\icon_unchecked_pressed_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\img_barlayout.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\img_barlayout2.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\img_barlayout4.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\img_corner_left.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\img_local_logo.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\js2_basetemplate.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\js2_hbgroups.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\js2_hbobject3.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\js2_hbobjectset3.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\js2_hotbarwrapper.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\js2_iteratorsandreaders3nf.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\js2_pagingmoduleobj3.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\js2_texts3.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\js2_xmltree3nf.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\layout.cdf
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\linkpathlegal.txt
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\more.res
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\n.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\nav_b_2.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\nav_bb_2.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\nav_f_2.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\nav_ff_2.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\progress.res
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\searchbtn.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\submit.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\tab_bg.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\tab_bga.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\tab_bgia.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\tab_l.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\tab_la.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\tab_lia.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\tab_r.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\tab_ra.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\tab_ria.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\tree_dots.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\tree_minus.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\tree_plus.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\treedata_animations.xml
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\treedata_backgrounds.xml
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\treedata_ecards.xml
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\treedata_emoticons.xml
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\treedata_notifiers.xml
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\treedata_text.xml
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]30104_emte10_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]30104_emte11_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]30104_emte12_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]30104_emte13_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]30104_emte14_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]30104_emte19_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]30104_emte20_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]30104_emte21_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]30104_emte9_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]30203lib_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]33102angel_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]33102bigluf_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]33102bigsmile_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]33102birthday_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]33102cheers_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]33102flo_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]33102good_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]33102jump_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]33102king_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]33102lough_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]33102luf_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]33102smile_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]33102smiled_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]33102sor_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]33102thanx_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]33102uhu_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]40103ahh_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]40103wow_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]40104_emi2_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]42102_1134_112_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]50103big_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]50103gig_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]50103hm_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]50103nomail_emoti_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]50103norm_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]60104_ema15_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]60104_ema16_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]60104_ema17_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]60104_ema18_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]60104_ema19_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]60104_ema20_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]60104_ema21_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]60104_ema24_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]60104_ema25_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]60104_ema26_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]60104_ema30_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]60104_ema33_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]60104_ema34_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]62802hippi_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]62802jumpie_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]80402argh_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]80402oops_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]80402ouch_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]82502no_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]82502yes_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\110103_boring1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\110103_confused_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\110103_crying_ugly_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\110103_fantastic_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\110103_feel_better_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\110103_gimme_break_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\110103_heehee_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\110103_hlopaet_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\110103_ign_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\110103_lol_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\110103_no_comment_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\110103_peace_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\110103_smashing_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\110103_talk2thehand_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\block_sm.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\block_sm2.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\block_smli.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\block_smli2.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\blocked.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\blocked2.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\btn_add-but.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\btn_back-but.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\btn_left_cut_enabled_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\btn_left_enabled_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\btn_left_pressed_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\btn_middle_enabled_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\btn_middle_pressed_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\btn_right_cut_enabled_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\btn_right_enabled_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\btn_right_pressed_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\business_promo.htm
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\buttondir.txt
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\components.cdf
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\css_cattree.css
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\css_flashpreview.css
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\css2_main.css
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\css2_pagingmodule.css
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\css2_topbuttons.css
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\delete.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\edit_clear_sound.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\edit_fs.htm
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\edit_select.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\email-def-511745-514279.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\email-def-email-backgrounds.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\email-def-email-bcards.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\email-def-email-ecards.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\email-def-email-edit.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\email-def-email-emoticons.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\email-def-email-estationery.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\email-def-email-funny.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\email-def-email-help.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\email-def-email-images.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\email-def-email-info.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\email-def-email-more.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\email-def-email-my.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\email-def-email-people.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\email-def-email-photo.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\email-def-email-tell.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\email-def-email-temp.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\email-def-email-temp_OI.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\email-def-email-text.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\email-def-email-voice.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\email-def.cdf
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\email-premium-email-premium.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\email-premium-email-premium_OI.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\email-t1-bg.res
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\email-temp-bg.res
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\estatationery.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\flashpatch.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\flashpreview.htm
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\fs3.htm
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\hotbar_promo.htm
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\icon_checked_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\icon_close_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\icon_close_pressed_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\icon_edit_preview.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\icon_edit_send.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\icon_flash_preview.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\icon_recently_used.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\icon_remove_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\icon_remove_pressed_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\icon_sand-clock2.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\icon_tell_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\icon_tell_pressed_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\icon_tree_null.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\icon_unchecked_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\icon_unchecked_pressed_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\img_barlayout.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\img_barlayout2.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\img_barlayout4.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\img_corner_left.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\img_local_logo.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\js2_basetemplate.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\js2_hbgroups.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\js2_hbobject3.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\js2_hbobjectset3.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\js2_hotbarwrapper.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\js2_iteratorsandreaders3nf.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\js2_pagingmoduleobj3.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\js2_texts3.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\js2_xmltree3nf.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\layout.cdf
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\linkpathlegal.txt
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\more.res
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\n.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\nav_b_2.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\nav_bb_2.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\nav_f_2.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\nav_ff_2.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\progress.res
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\searchbtn.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\submit.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\tab_bg.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\tab_bga.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\tab_bgia.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\tab_l.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\tab_la.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\tab_lia.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\tab_r.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\tab_ra.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\tab_ria.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\tree_dots.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\tree_minus.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\tree_plus.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\treedata_animations.xml
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\treedata_backgrounds.xml
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\treedata_ecards.xml
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\treedata_emoticons.xml
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\treedata_notifiers.xml
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\treedata_text.xml
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\DownLoad\business_promo.xip
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\DownLoad\buttondir.xip
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\DownLoad\code.xip
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\DownLoad\email-def.xip
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\DownLoad\email-t1-bg.xip
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\DownLoad\email-temp-bg.xip
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\DownLoad\hotbar_promo.xip
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\DownLoad\images.xip
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\DownLoad\layout.xip
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\DownLoad\linkpathlegal.xip
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\DownLoad\localcontent.xip
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\DownLoad\more.xip
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\DownLoad\progress.xip
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\DownLoad\treexml.xip
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]30104_emte10_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]30104_emte11_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]30104_emte12_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]30104_emte13_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]30104_emte14_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]30104_emte19_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]30104_emte20_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]30104_emte21_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]30104_emte9_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]30203lib_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]33102angel_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]33102bigluf_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]33102bigsmile_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]33102birthday_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]33102cheers_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]33102flo_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]33102good_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]33102jump_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]33102king_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]33102lough_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]33102luf_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]33102smile_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]33102smiled_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]33102sor_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]33102thanx_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]33102uhu_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]40103ahh_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]40103wow_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]40104_emi2_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]42102_1134_112_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]50103big_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]50103gig_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]50103hm_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]50103nomail_emoti_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]50103norm_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]60104_ema15_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]60104_ema16_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]60104_ema17_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]60104_ema18_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]60104_ema19_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]60104_ema20_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]60104_ema21_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]60104_ema24_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]60104_ema25_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]60104_ema26_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]60104_ema30_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]60104_ema33_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]60104_ema34_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]62802hippi_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]62802jumpie_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]80402argh_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]80402oops_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]80402ouch_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]82502no_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]82502yes_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\110103_boring1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\110103_confused_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\110103_crying_ugly_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\110103_fantastic_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\110103_feel_better_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\110103_gimme_break_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\110103_heehee_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\110103_hlopaet_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\110103_ign_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\110103_lol_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\110103_no_comment_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\110103_peace_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\110103_smashing_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\110103_talk2thehand_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\block_sm.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\block_sm2.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\block_smli.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\block_smli2.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\blocked.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\blocked2.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\btn_add-but.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\btn_back-but.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\btn_left_cut_enabled_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\btn_left_enabled_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\btn_left_pressed_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\btn_middle_enabled_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\btn_middle_pressed_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\btn_right_cut_enabled_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\btn_right_enabled_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\btn_right_pressed_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\business_promo.htm
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\buttondir.txt
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\components.cdf
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\css_cattree.css
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\css_flashpreview.css
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\css2_main.css
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\css2_pagingmodule.css
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\css2_topbuttons.css
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\delete.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\edit_clear_sound.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\edit_fs.htm
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\edit_select.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-511724-543450.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-511724-548964.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-511724-589306.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-511724-591943.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-511724-592579.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-511724-598579.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-511724-603763.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-511724-9595.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-511724-9696.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-511745-514279.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-email-backgrounds.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-email-bcards.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-email-ecards.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-email-emoticons.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-email-estationery.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-email-funny.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-email-help.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-email-images.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-email-info.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-email-more.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-email-my.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-email-new.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-email-new2.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-email-options.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-email-people.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-email-photo.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-email-tell.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-email-temp.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-email-text.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-email-voice.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def.cdf
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-premium-email-premium.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-t1-bg.res
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-temp-bg.res
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\estatationery.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\flashpatch.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\flashpreview.htm
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\fs3.htm
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\hotbar_promo.htm
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\icon_checked_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\icon_close_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\icon_close_pressed_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\icon_edit_preview.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\icon_edit_send.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\icon_flash_preview.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\icon_recently_used.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\icon_remove_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\icon_remove_pressed_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\icon_sand-clock2.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\icon_tell_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\icon_tell_pressed_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\icon_tree_null.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\icon_unchecked_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\icon_unchecked_pressed_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\img_barlayout.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\img_barlayout2.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\img_barlayout4.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\img_corner_left.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\img_local_logo.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\js2_basetemplate.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\js2_hbgroups.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\js2_hbobject3.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\js2_hbobjectset3.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\js2_hotbarwrapper.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\js2_iteratorsandreaders3nf.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\js2_pagingmoduleobj3.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\js2_texts3.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\js2_xmltree3nf.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\layout.cdf
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\linkpathlegal.txt
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\more.res
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\n.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\nav_b_2.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\nav_bb_2.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\nav_f_2.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\nav_ff_2.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\pro_hb_fo_word.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\progress.res
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\sales_buttons.res
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\searchbtn.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\submit.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\tab_bg.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\tab_bga.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\tab_bgia.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\tab_l.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\tab_la.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\tab_lia.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\tab_r.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\tab_ra.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\tab_ria.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\tree_dots.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\tree_minus.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\tree_plus.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\treedata_animations.xml
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\treedata_backgrounds.xml
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\treedata_ecards.xml
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\treedata_emoticons.xml
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\treedata_notifiers.xml
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\treedata_text.xml
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\2\[u]0[/u]30104_emte10_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\2\[u]0[/u]30104_emte11_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\2\[u]0[/u]30104_emte12_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\2\[u]0[/u]30104_emte13_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\2\[u]0[/u]30104_emte14_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\2\[u]0[/u]30104_emte19_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\2\[u]0[/u]30104_emte20_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\2\[u]0[/u]30104_emte21_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\2\[u]0[/u]30104_emte9_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\2\[u]0[/u]30203lib_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\2\[u]0[/u]33102angel_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\2\[u]0[/u]33102bigluf_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\2\[u]0[/u]33102bigsmile_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\2\[u]0[/u]33102birthday_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\2\[u]0[/u]33102cheers_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\2\[u]0[/u]33102flo_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\2\[u]0[/u]33102good_1_prv.gif

zouzou1089 · Answer

voici le dernier raport


ComboFix 07-11-19.4C - jenni 2007-11-28 21:07:21.1 - NTFSx86
Microsoft Windows XP Édition familiale  5.1.2600.2.1252.1.1036.18.147 [GMT 1:00]
Running from: C:\Documents and Settings\jenni\Mes documents\Julien MATHE\combofix.exe
 * Created a new restore point
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data.\salesmonitor
C:\Documents and Settings\All Users\Application Data\HotbarSA
C:\Documents and Settings\All Users\Application Data\HotbarSA\HotbarSA.dat
C:\Documents and Settings\All Users\Application Data\HotbarSA\HotbarSA_kyf.dat
C:\Documents and Settings\All Users\Application Data\HotbarSA\HotbarSAAbout.mht
C:\Documents and Settings\All Users\Application Data\HotbarSA\HotbarSAau.dat
C:\Documents and Settings\All Users\Application Data\HotbarSA\HotbarSAEula.mht
C:\Documents and Settings\All Users\Application Data\SystemDoctor Free
C:\Documents and Settings\All Users\Application Data\SystemDoctor Free\Data\Abbr
C:\Documents and Settings\All Users\Application Data\SystemDoctor Free\Data\ActivationCode
C:\Documents and Settings\All Users\Application Data\SystemDoctor Free\Data\HOURS
C:\Documents and Settings\All Users\Application Data\SystemDoctor Free\Data\ProductCode
C:\Documents and Settings\All Users\Application Data\WinAntiVirus Pro 2007
C:\Documents and Settings\All Users\Application Data\WinAntiVirus Pro 2007\Data\Abbr
C:\Documents and Settings\All Users\Application Data\WinAntiVirus Pro 2007\Data\ActivationCode
C:\Documents and Settings\All Users\Application Data\WinAntiVirus Pro 2007\Data\ProductCode
C:\Documents and Settings\jenni\Application Data\Hotbar
C:\Documents and Settings\jenni\Application Data\Hotbar\eskin\[u]0[/u]40107ta313_arrow.ani
C:\Documents and Settings\jenni\Application Data\Hotbar\eskin\[u]0[/u]40107ta313_cr.htm
C:\Documents and Settings\jenni\Application Data\Hotbar\eskin\[u]0[/u]40107ta313_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\eskin\[u]0[/u]40107ta319_arrow.ani
C:\Documents and Settings\jenni\Application Data\Hotbar\eskin\[u]0[/u]40107ta319_cr.htm
C:\Documents and Settings\jenni\Application Data\Hotbar\eskin\[u]0[/u]40107ta319_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\eskin\[u]0[/u]60107yac3_arrow.ani
C:\Documents and Settings\jenni\Application Data\Hotbar\eskin\[u]0[/u]60107yac3_cr.htm
C:\Documents and Settings\jenni\Application Data\Hotbar\eskin\[u]0[/u]60107yac3_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\eskin\100602us_sharpei.jpg
C:\Documents and Settings\jenni\Application Data\Hotbar\eskin\100602us_sharpei_prv.jpg
C:\Documents and Settings\jenni\Application Data\Hotbar\eskin\100602us_sharpei_st.htm
C:\Documents and Settings\jenni\Application Data\Hotbar\eskin\100602us_sharpei_st.xml
C:\Documents and Settings\jenni\Application Data\Hotbar\eskin\FileManager.txt
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]30104_emte10_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]30104_emte11_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]30104_emte12_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]30104_emte13_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]30104_emte14_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]30104_emte19_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]30104_emte20_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]30104_emte21_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]30104_emte9_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]30203lib_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]33102angel_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]33102bigluf_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]33102bigsmile_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]33102birthday_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]33102cheers_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]33102flo_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]33102good_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]33102jump_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]33102king_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]33102lough_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]33102luf_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]33102smile_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]33102smiled_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]33102sor_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]33102thanx_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]33102uhu_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]40103ahh_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]40103wow_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]40104_emi2_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]42102_1134_112_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]50103big_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]50103gig_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]50103hm_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]50103nomail_emoti_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]50103norm_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]60104_ema15_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]60104_ema16_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]60104_ema17_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]60104_ema18_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]60104_ema19_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]60104_ema20_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]60104_ema21_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]60104_ema24_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]60104_ema25_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]60104_ema26_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]60104_ema30_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]60104_ema33_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]60104_ema34_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]62802hippi_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]62802jumpie_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]80402argh_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]80402oops_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]80402ouch_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]82502no_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\[u]0[/u]82502yes_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\110103_boring1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\110103_confused_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\110103_crying_ugly_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\110103_fantastic_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\110103_feel_better_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\110103_gimme_break_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\110103_heehee_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\110103_hlopaet_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\110103_ign_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\110103_lol_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\110103_no_comment_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\110103_peace_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\110103_smashing_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\110103_talk2thehand_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\block_sm.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\block_sm2.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\block_smli.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\block_smli2.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\blocked.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\blocked2.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\btn_add-but.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\btn_back-but.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\btn_left_cut_enabled_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\btn_left_enabled_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\btn_left_pressed_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\btn_middle_enabled_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\btn_middle_pressed_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\btn_right_cut_enabled_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\btn_right_enabled_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\btn_right_pressed_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\business_promo.htm
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\buttondir.txt
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\components.cdf
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\css_cattree.css
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\css_flashpreview.css
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\css2_main.css
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\css2_pagingmodule.css
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\css2_topbuttons.css
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\delete.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\edit_clear_sound.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\edit_fs.htm
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\edit_select.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\email-def-511745-514279.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\email-def-email-backgrounds.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\email-def-email-bcards.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\email-def-email-ecards.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\email-def-email-edit.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\email-def-email-emoticons.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\email-def-email-estationery.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\email-def-email-funny.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\email-def-email-help.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\email-def-email-images.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\email-def-email-info.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\email-def-email-more.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\email-def-email-my.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\email-def-email-people.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\email-def-email-photo.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\email-def-email-tell.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\email-def-email-temp.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\email-def-email-temp_OI.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\email-def-email-text.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\email-def-email-voice.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\email-def.cdf
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\email-premium-email-premium.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\email-premium-email-premium_OI.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\email-t1-bg.res
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\email-temp-bg.res
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\estatationery.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\flashpatch.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\flashpreview.htm
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\fs3.htm
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\hotbar_promo.htm
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\icon_checked_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\icon_close_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\icon_close_pressed_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\icon_edit_preview.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\icon_edit_send.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\icon_flash_preview.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\icon_recently_used.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\icon_remove_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\icon_remove_pressed_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\icon_sand-clock2.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\icon_tell_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\icon_tell_pressed_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\icon_tree_null.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\icon_unchecked_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\icon_unchecked_pressed_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\img_barlayout.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\img_barlayout2.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\img_barlayout4.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\img_corner_left.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\img_local_logo.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\js2_basetemplate.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\js2_hbgroups.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\js2_hbobject3.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\js2_hbobjectset3.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\js2_hotbarwrapper.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\js2_iteratorsandreaders3nf.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\js2_pagingmoduleobj3.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\js2_texts3.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\js2_xmltree3nf.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\layout.cdf
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\linkpathlegal.txt
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\more.res
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\n.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\nav_b_2.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\nav_bb_2.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\nav_f_2.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\nav_ff_2.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\progress.res
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\searchbtn.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\submit.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\tab_bg.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\tab_bga.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\tab_bgia.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\tab_l.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\tab_la.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\tab_lia.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\tab_r.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\tab_ra.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\tab_ria.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\tree_dots.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\tree_minus.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\tree_plus.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\treedata_animations.xml
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\treedata_backgrounds.xml
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\treedata_ecards.xml
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\treedata_emoticons.xml
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\treedata_notifiers.xml
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\1\treedata_text.xml
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]30104_emte10_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]30104_emte11_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]30104_emte12_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]30104_emte13_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]30104_emte14_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]30104_emte19_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]30104_emte20_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]30104_emte21_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]30104_emte9_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]30203lib_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]33102angel_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]33102bigluf_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]33102bigsmile_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]33102birthday_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]33102cheers_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]33102flo_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]33102good_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]33102jump_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]33102king_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]33102lough_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]33102luf_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]33102smile_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]33102smiled_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]33102sor_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]33102thanx_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]33102uhu_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]40103ahh_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]40103wow_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]40104_emi2_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]42102_1134_112_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]50103big_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]50103gig_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]50103hm_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]50103nomail_emoti_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]50103norm_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]60104_ema15_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]60104_ema16_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]60104_ema17_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]60104_ema18_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]60104_ema19_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]60104_ema20_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]60104_ema21_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]60104_ema24_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]60104_ema25_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]60104_ema26_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]60104_ema30_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]60104_ema33_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]60104_ema34_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]62802hippi_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]62802jumpie_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]80402argh_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]80402oops_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]80402ouch_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]82502no_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\[u]0[/u]82502yes_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\110103_boring1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\110103_confused_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\110103_crying_ugly_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\110103_fantastic_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\110103_feel_better_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\110103_gimme_break_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\110103_heehee_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\110103_hlopaet_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\110103_ign_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\110103_lol_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\110103_no_comment_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\110103_peace_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\110103_smashing_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\110103_talk2thehand_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\block_sm.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\block_sm2.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\block_smli.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\block_smli2.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\blocked.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\blocked2.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\btn_add-but.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\btn_back-but.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\btn_left_cut_enabled_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\btn_left_enabled_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\btn_left_pressed_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\btn_middle_enabled_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\btn_middle_pressed_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\btn_right_cut_enabled_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\btn_right_enabled_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\btn_right_pressed_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\business_promo.htm
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\buttondir.txt
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\components.cdf
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\css_cattree.css
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\css_flashpreview.css
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\css2_main.css
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\css2_pagingmodule.css
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\css2_topbuttons.css
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\delete.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\edit_clear_sound.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\edit_fs.htm
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\edit_select.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\email-def-511745-514279.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\email-def-email-backgrounds.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\email-def-email-bcards.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\email-def-email-ecards.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\email-def-email-edit.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\email-def-email-emoticons.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\email-def-email-estationery.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\email-def-email-funny.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\email-def-email-help.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\email-def-email-images.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\email-def-email-info.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\email-def-email-more.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\email-def-email-my.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\email-def-email-people.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\email-def-email-photo.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\email-def-email-tell.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\email-def-email-temp.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\email-def-email-temp_OI.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\email-def-email-text.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\email-def-email-voice.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\email-def.cdf
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\email-premium-email-premium.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\email-premium-email-premium_OI.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\email-t1-bg.res
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\email-temp-bg.res
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\estatationery.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\flashpatch.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\flashpreview.htm
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\fs3.htm
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\hotbar_promo.htm
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\icon_checked_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\icon_close_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\icon_close_pressed_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\icon_edit_preview.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\icon_edit_send.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\icon_flash_preview.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\icon_recently_used.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\icon_remove_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\icon_remove_pressed_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\icon_sand-clock2.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\icon_tell_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\icon_tell_pressed_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\icon_tree_null.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\icon_unchecked_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\icon_unchecked_pressed_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\img_barlayout.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\img_barlayout2.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\img_barlayout4.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\img_corner_left.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\img_local_logo.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\js2_basetemplate.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\js2_hbgroups.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\js2_hbobject3.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\js2_hbobjectset3.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\js2_hotbarwrapper.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\js2_iteratorsandreaders3nf.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\js2_pagingmoduleobj3.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\js2_texts3.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\js2_xmltree3nf.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\layout.cdf
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\linkpathlegal.txt
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\more.res
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\n.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\nav_b_2.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\nav_bb_2.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\nav_f_2.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\nav_ff_2.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\progress.res
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\searchbtn.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\submit.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\tab_bg.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\tab_bga.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\tab_bgia.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\tab_l.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\tab_la.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\tab_lia.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\tab_r.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\tab_ra.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\tab_ria.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\tree_dots.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\tree_minus.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\tree_plus.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\treedata_animations.xml
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\treedata_backgrounds.xml
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\treedata_ecards.xml
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\treedata_emoticons.xml
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\treedata_notifiers.xml
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\2\treedata_text.xml
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\DownLoad\business_promo.xip
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\DownLoad\buttondir.xip
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\DownLoad\code.xip
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\DownLoad\email-def.xip
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\DownLoad\email-t1-bg.xip
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\DownLoad\email-temp-bg.xip
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\DownLoad\hotbar_promo.xip
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\DownLoad\images.xip
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\DownLoad\layout.xip
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\DownLoad\linkpathlegal.xip
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\DownLoad\localcontent.xip
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\DownLoad\more.xip
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\DownLoad\progress.xip
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOI\static\DownLoad\treexml.xip
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]30104_emte10_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]30104_emte11_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]30104_emte12_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]30104_emte13_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]30104_emte14_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]30104_emte19_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]30104_emte20_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]30104_emte21_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]30104_emte9_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]30203lib_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]33102angel_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]33102bigluf_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]33102bigsmile_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]33102birthday_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]33102cheers_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]33102flo_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]33102good_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]33102jump_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]33102king_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]33102lough_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]33102luf_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]33102smile_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]33102smiled_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]33102sor_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]33102thanx_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]33102uhu_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]40103ahh_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]40103wow_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]40104_emi2_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]42102_1134_112_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]50103big_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]50103gig_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]50103hm_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]50103nomail_emoti_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]50103norm_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]60104_ema15_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]60104_ema16_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]60104_ema17_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]60104_ema18_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]60104_ema19_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]60104_ema20_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]60104_ema21_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]60104_ema24_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]60104_ema25_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]60104_ema26_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]60104_ema30_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]60104_ema33_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]60104_ema34_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]62802hippi_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]62802jumpie_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]80402argh_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]80402oops_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]80402ouch_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]82502no_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\[u]0[/u]82502yes_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\110103_boring1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\110103_confused_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\110103_crying_ugly_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\110103_fantastic_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\110103_feel_better_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\110103_gimme_break_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\110103_heehee_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\110103_hlopaet_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\110103_ign_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\110103_lol_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\110103_no_comment_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\110103_peace_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\110103_smashing_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\110103_talk2thehand_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\block_sm.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\block_sm2.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\block_smli.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\block_smli2.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\blocked.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\blocked2.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\btn_add-but.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\btn_back-but.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\btn_left_cut_enabled_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\btn_left_enabled_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\btn_left_pressed_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\btn_middle_enabled_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\btn_middle_pressed_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\btn_right_cut_enabled_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\btn_right_enabled_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\btn_right_pressed_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\business_promo.htm
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\buttondir.txt
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\components.cdf
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\css_cattree.css
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\css_flashpreview.css
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\css2_main.css
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\css2_pagingmodule.css
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\css2_topbuttons.css
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\delete.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\edit_clear_sound.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\edit_fs.htm
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\edit_select.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-511724-543450.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-511724-548964.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-511724-589306.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-511724-591943.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-511724-592579.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-511724-598579.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-511724-603763.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-511724-9595.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-511724-9696.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-511745-514279.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-email-backgrounds.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-email-bcards.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-email-ecards.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-email-emoticons.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-email-estationery.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-email-funny.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-email-help.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-email-images.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-email-info.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-email-more.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-email-my.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-email-new.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-email-new2.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-email-options.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-email-people.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-email-photo.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-email-tell.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-email-temp.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-email-text.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-email-voice.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-def.cdf
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-premium-email-premium.mnu
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-t1-bg.res
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\email-temp-bg.res
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\estatationery.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\flashpatch.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\flashpreview.htm
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\fs3.htm
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\hotbar_promo.htm
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\icon_checked_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\icon_close_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\icon_close_pressed_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\icon_edit_preview.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\icon_edit_send.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\icon_flash_preview.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\icon_recently_used.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\icon_remove_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\icon_remove_pressed_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\icon_sand-clock2.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\icon_tell_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\icon_tell_pressed_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\icon_tree_null.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\icon_unchecked_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\icon_unchecked_pressed_1.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\img_barlayout.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\img_barlayout2.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\img_barlayout4.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\img_corner_left.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\img_local_logo.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\js2_basetemplate.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\js2_hbgroups.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\js2_hbobject3.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\js2_hbobjectset3.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\js2_hotbarwrapper.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\js2_iteratorsandreaders3nf.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\js2_pagingmoduleobj3.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\js2_texts3.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\js2_xmltree3nf.js
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\layout.cdf
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\linkpathlegal.txt
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\more.res
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\n.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\nav_b_2.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\nav_bb_2.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\nav_f_2.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\nav_ff_2.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\pro_hb_fo_word.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\progress.res
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\sales_buttons.res
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\searchbtn.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\submit.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\tab_bg.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\tab_bga.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\tab_bgia.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\tab_l.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\tab_la.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\tab_lia.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\tab_r.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\tab_ra.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\tab_ria.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\tree_dots.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\tree_minus.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\tree_plus.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\treedata_animations.xml
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\treedata_backgrounds.xml
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\treedata_ecards.xml
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\treedata_emoticons.xml
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\treedata_notifiers.xml
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\1\treedata_text.xml
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\2\[u]0[/u]30104_emte10_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\2\[u]0[/u]30104_emte11_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\2\[u]0[/u]30104_emte12_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\2\[u]0[/u]30104_emte13_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\2\[u]0[/u]30104_emte14_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\2\[u]0[/u]30104_emte19_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\2\[u]0[/u]30104_emte20_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\2\[u]0[/u]30104_emte21_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\2\[u]0[/u]30104_emte9_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\2\[u]0[/u]30203lib_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\2\[u]0[/u]33102angel_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\2\[u]0[/u]33102bigluf_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\2\[u]0[/u]33102bigsmile_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\2\[u]0[/u]33102birthday_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\2\[u]0[/u]33102cheers_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\2\[u]0[/u]33102flo_1_prv.gif
C:\Documents and Settings\jenni\Application Data\Hotbar\v3.0\HostOL\static\2\[u]0[/u]33102good_1_prv.gif

nardino · Answer

Bonsoir.
Tu m'as mis deux fois la même chose et de plus il n'est pas complet.
Poste un nouveau Hiajckthis et donne des informations sur tes problèmes.


@plus
nardino

zouzou1089 · Answer

voila le raport

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:56:25, on 28/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\ANTIVI~1\backweb\6588780\Program\SERVIC~1.EXE
C:\Program Files\AntivirusFirewall\Anti-Virus\fsgk32st.exe
C:\Program Files\AntivirusFirewall\backweb\6588780\program\fsbwsys.exe
C:\Program Files\AntivirusFirewall\Anti-Virus\FSGK32.EXE
C:\Program Files\AntivirusFirewall\Common\FSMA32.EXE
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\AntivirusFirewall\Anti-Virus\fssm32.exe
C:\Program Files\AntivirusFirewall\Common\FSMB32.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\AntivirusFirewall\Common\FCH32.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AntivirusFirewall\Common\FAMEH32.EXE
C:\Program Files\AntivirusFirewall\Anti-Virus\fsqh.exe
C:\Program Files\AntivirusFirewall\Anti-Virus\fsrw.exe
C:\Program Files\AntivirusFirewall\FWES\Program\fsdfwd.exe
C:\Program Files\AntivirusFirewall\Anti-Virus\fsav32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\AntivirusFirewall\Common\FSM32.EXE
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\AntivirusFirewall\FSGUI\ispnews.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\AntivirusFirewall\backweb\6588780\Program\fspex.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\ANTIVI~1\ANTI-S~1\fsaw.exe
C:\Program Files\AntivirusFirewall\FSGUI\fsguidll.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\PROGRA~1\Wanadoo\Watch.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\PROGRA~1\Wanadoo\WOOBrowser\WOOBrowser.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\AntivirusFirewall\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\AntivirusFirewall\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\AntivirusFirewall\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [News Service] "C:\Program Files\AntivirusFirewall\FSGUI\ispnews.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Antivirus Firewall.lnk = C:\Program Files\AntivirusFirewall\backweb\6588780\Program\fspex.exe
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Bloquer cette fenêtre publicitaire - C:\Program Files\AntivirusFirewall\Anti-Spyware\blockpopups.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Protection Internet Explorer - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\AntivirusFirewall\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: Protection Internet Explorer... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\AntivirusFirewall\Anti-Spyware\ieshield.dll
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://s.tf1.fr/mmdia/static/rawflow/clients/5.3.1.0/Rawflow.cab
O23 - Service: Antivirus Firewall (BackWeb Plug-in - 6588780) - Securitoo Portal - C:\PROGRA~1\ANTIVI~1\backweb\6588780\Program\SERVIC~1.EXE
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\AntivirusFirewall\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\AntivirusFirewall\backweb\6588780\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\AntivirusFirewall\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\AntivirusFirewall\Common\FSMA32.EXE
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

zouzou1089 · Answer

é j'en é pas d'otre la a part le panneau de configuration

nardino · Answer

Bonjour.
Comme je ne vois pas d'informations sur l'évolution du problème comme demandé plus haut et que le dernier rapport Hijackthis est propre tu peux passer la question en résolu.

zouzou1089 · Answer

jte remercie bocoup bocoup bocoup de ton aide 
bisous a plus

Probleme panneau de config+windows alert

40 réponses

Newsletters