Vrius MSN "cOol-th1ng.info"

Bonjour,

1) Télécharge MSNFix.zip (de !aur3n7) sur ton bureau:
http://sosvirus.changelog.fr/MSNFix.zip

Décompresse-le (clic droit >> Extraire ici) et place les fichiers dans C:\MSNFix (très important).

Double cliquer sur le fichier MSNFix.bat.
- Exécutez l'option R.
-- Si l'infection est détectée, un message l'indiquera et il suffira de presser une touche pour lancer le nettoyage

Note :
Si une erreur de suppression est détectée un message s'affichera demandant de redémarrer l'ordinateur afin de terminer les opérations. Dans ce cas il suffit de redémarrer l'ordinateur en mode normal

- Le rapport sera enregistré dans le même dossier que MSNFix sous forme date_heure.txt


2) Clique sur ce lien
http://www.trendsecure.com/portal/en-US/threat_analytics/HJT­Install.exe
pour télécharger le fichier d'installation d'HijackThis.

Enregistre HJTInstall.exe sur ton bureau.

Double-clique sur HJTInstall.exe pour lancer le programme

Par défaut, il s'installera là :
C:\Program Files\Trend Micro\HijackThis

Accepte la license en cliquant sur le bouton "I Accept"



Ferme Hijackthis en cliquant sur la croix-rouge.

Télécharge DSS (Deckard's System Scanner de Deckard) sur ton Bureau à partir de ce lien :

http://www.techsupportforum.com/sectools/Deckard/dss.exe

Choisis "Enregistrer" et "Bureau" comme emplacement.

Ferme toutes les applications en cours (très important, sinon l'ordi peut planter).

Double-clique sur DSS.exe pour lancer l'outil.

S'il ne trouve pas HijackThis, clique sur Oui.

Clique sur OK à chaque fois que cela sera demandé.

L'analyse finie, un fichier texte s'affichera. Poste son contenu dans ta réponse.

Le rapport se trouve ici : C:\Deckard\System Scanner\main.txt.
@+
N'acceptez jamais une désinfection par mp.

Deckard's System Scanner v20071014.68
Run by robin on 2008-05-08 11:42:15
Computer is in Normal Mode.
------------------------------------------------------------­--------------------

-- Last 5 Restore Point(s) --
10: 2008-05-06 17:33:54 UTC - RP72 - Windows Update
9: 2008-05-05 17:10:14 UTC - RP71 - Sauvegarde Windows
8: 2008-05-04 17:00:09 UTC - RP70 - Sauvegarde Windows
7: 2008-05-03 09:51:04 UTC - RP69 - Installation du package de pilote logiciel : VSO Software
6: 2008-05-02 16:56:23 UTC - RP68 - Windows Update


-- First Restore Point --
1: 2008-04-20 19:50:08 UTC - RP63 - Point de contrôle planifié


Backed up registry hives.
Performed disk cleanup.



-- HijackThis (run as robin.exe) -----------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:45:46, on 08/05/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16643)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\DellTPad\Apoint.exe
C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Windows\WindowsMobile\wmdc.exe
C:\Program Files\Java\jre1.6.0\bin\jusched.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\WLTRAY.EXE
C:\Program Files\Dell\MediaDirect\PCMService.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Orange\Systray\SystrayApp.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\Program Files\Orange\Launcher\Launcher.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Windows\ehome\ehmsas.exe
c:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\DellTPad\ApMsgFwd.exe
C:\Program Files\DellTPad\HidFind.exe
C:\Program Files\DellTPad\Apntex.exe
C:\Program Files\Orange\Deskboard\deskboard.exe
C:\Program Files\Orange\connectivity\connectivitymanager.exe
C:\Program Files\Orange\connectivity\CoreCom\CoreCom.exe
C:\Program Files\Orange\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Windows\ehome\ehshell.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Orange\browser\browser.exe
C:\Windows\system32\conime.exe
C:\Users\robin\Downloads\dss.exe
C:\Windows\system32\SearchFilterHost.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\robin.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.msn.fr/spbasic.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer fourni par Dell
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [ECenter] C:\Dell\E-Center\EULALauncher.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\sttray.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe C:\Windows\system32\nvHotkey.dll,Start
O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "c:\Program Files\Java\jre1.6.0\bin\jusched.exe"
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\MediaDirect\PCMService.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\Orange\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: QuickSet.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: Envoyer au périphérique &Bluetooth... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O8 - Extra context menu item: Envoyer l'&image au périphérique Bluetooth... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O13 - Gopher Prefix:
O15 - Trusted Zone: http://www.orange.fr
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.­cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.ca­b
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\system32\aestsrv.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: SigmaTel Audio Service (STacSV) - IDT, Inc. - C:\Windows\system32\STacSV.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
End of file - 12522 bytes

-- File Associations -----------------------------------------------------------

All associations okay.


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

All drivers whitelisted.


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 Apple Mobile Device - "c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe" <Not Verified; Apple, Inc.; Apple Mobile Device Service>
R2 Bonjour Service (Service Bonjour) - "c:\program files\bonjour\mdnsresponder.exe" <Not Verified; Apple Inc.; Bonjour>
R2 FTRTSVC (France Telecom Routing Table Service) - "c:\progra~1\common~1\france telecom\shared modules\ftrtsvc\0\ftrtsvc.exe" <Not Verified; France Telecom SA; CSS-Corporate>

S3 stllssvr - "c:\program files\common files\surething shared\stllssvr.exe" <Not Verified; MicroVision Development, Inc.; SureThing CD Labeler>


-- Device Manager: Disabled ----------------------------------------------------

No disabled devices found.


-- Scheduled Tasks ------------------------------------------------------------­-

2008-05-04 19:49:18 408 --a------ C:\Windows\Tasks\Norton Security Scan.job


-- Files created between 2008-04-08 and 2008-05-08 -----------------------------

2008-05-08 11:40:52 0 d-------- C:\Program Files\Trend Micro
2008-05-07 22:11:20 0 d-------- C:\Program Files\SLD Codec Pack
2008-05-03 12:05:59 0 d-------- C:\Users\All Users\AVS4YOU
2008-05-03 12:05:12 0 d-------- C:\Program Files\Common Files\AVSMedia
2008-05-03 12:05:06 413760 --a------ C:\Windows\system32\mpg4c32.dll <Not Verified; Microsoft Corporation; Microsoft MPEG-4 Video Codec>
2008-05-03 12:05:06 261632 --a------ C:\Windows\system32\mcdvd_32.dll <Not Verified; MainConcept; MainConcept DV Codec "2.0.4>
2008-05-03 12:05:06 1700352 --a------ C:\Windows\system32\GdiPlus.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-05-03 12:05:06 638976 --a------ C:\Windows\system32\divx.dll <Not Verified; DivXNetworks, Inc.; DivX Video for Windows Codec>
2008-05-03 12:05:06 0 d-------- C:\Program Files\AVS4YOU
2008-05-01 09:52:45 0 d-------- C:\videodvdmaker
2008-04-25 19:03:44 0 d-------- C:\Program Files\Apple Software Update
2008-04-25 18:00:34 0 d-------- C:\Program Files\Common Files\Symantec Shared
2008-04-25 15:21:36 0 d-------- C:\Users\All Users\Symantec
2008-04-19 15:04:24 0 d-------- C:\Program Files\Electronic Arts


-- Find3M Report ------------------------------------------------------------­---

2008-05-08 10:59:42 27335 --a------ C:\Users\robin\AppData\Roaming\nvModes.001
2008-05-08 10:42:26 0 d-------- C:\Program Files\Norton Security Scan
2008-05-08 10:31:44 690832 --a------ C:\Windows\system32\perfh00C.dat
2008-05-08 10:31:44 117572 --a------ C:\Windows\system32\perfc00C.dat
2008-05-07 22:34:27 1634 --a------ C:\Windows\bthservsdp.dat
2008-05-03 18:18:42 1206 --a------ C:\Users\robin\AppData\Roaming\wklnhst.dat
2008-05-03 12:06:03 0 d-------- C:\Users\robin\AppData\Roaming\AVS4YOU
2008-05-03 12:05:12 0 d-------- C:\Program Files\Common Files
2008-05-03 11:58:57 0 d-------- C:\Users\robin\AppData\Roaming\Vso
2008-05-03 11:58:57 33 --a------ C:\Users\robin\AppData\Roaming\pcouffin.log
2008-05-03 11:58:56 7887 --a------ C:\Users\robin\AppData\Roaming\pcouffin.cat
2008-05-03 11:56:27 668 --a------ C:\Users\robin\AppData\Roaming\vso_ts_preview.xml
2008-05-03 11:40:56 0 d-------- C:\Users\robin\AppData\Roaming\dvdcss
2008-05-02 19:43:56 27335 --a------ C:\Users\robin\AppData\Roaming\nvModes.dat
2008-05-01 09:52:45 0 d-------- C:\Users\robin\AppData\Roaming\Video DVD Maker FREE
2008-05-01 09:40:50 0 d-------- C:\Users\robin\AppData\Roaming\Roxio
2008-04-25 19:06:36 0 d-------- C:\Program Files\Safari
2008-04-19 15:27:15 0 dr-h----- C:\Users\robin\AppData\Roaming\SecuROM
2008-04-10 19:17:52 0 d-------- C:\Program Files\Windows Mail
2008-04-07 21:34:00 0 d-------- C:\Program Files\iTunes
2008-04-07 21:33:48 0 d-------- C:\Program Files\iPod
2008-04-07 21:31:15 0 d-------- C:\Program Files\QuickTime
2008-04-02 22:23:07 0 d-------- C:\Program Files\Messenger Plus! Live
2008-03-22 08:45:45 0 d-------- C:\Users\robin\AppData\Roaming\Apple Computer
2008-03-13 23:06:21 0 d-------- C:\Users\robin\AppData\Roaming\Google
2008-03-13 22:59:56 0 d-------- C:\Program Files\Google
2008-03-09 20:47:01 0 d-------- C:\Program Files\Common Files\Adobe
2008-03-09 18:33:35 0 d-------- C:\Users\robin\AppData\Roaming\Adobe
2008-03-09 16:46:15 0 d-------- C:\Users\robin\AppData\Roaming\Template
2008-03-08 21:03:12 0 d-------- C:\Program Files\Bonjour
2008-03-08 20:59:39 0 d-------- C:\Program Files\Common Files\Apple
2008-03-08 20:34:38 0 d-------- C:\Users\robin\AppData\Roaming\vlc
2008-03-08 20:33:55 0 d-------- C:\Program Files\VideoLAN
2008-03-08 20:09:45 0 d-------- C:\Program Files\eMule


-- Registry Dump ------------------------------------------------------------­---

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersio­n\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [23/12/2007 00:48]
"ECenter"="C:\Dell\E-Center\EULALauncher.exe&­quot; [25/05/2007 08:03]
"Apoint"="C:\Program Files\DellTPad\Apoint.exe" [24/09/2007 11:27]
"SigmatelSysTrayApp"="C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe" [07/09/2007 20:23]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [25/09/2007 10:41]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll&­quot; [25/09/2007 10:40]
"NvMediaCenter"="C:\Windows\system32\NvMcTray­.dll" [25/09/2007 10:40]
"NVHotkey"="C:\Windows\system32\nvHotkey.dll&­quot; [25/09/2007 10:40]
"Windows Mobile Device Center"="%windir%\WindowsMobile\wmdc.exe" []
"SunJavaUpdateSched"="c:\Program Files\Java\jre1.6.0\bin\jusched.exe" [22/12/2007 17:18]
"Broadcom Wireless Manager UI"="C:\Windows\system32\WLTRAY.exe" [21/03/2007 21:33]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [03/10/2006 13:37]
"@"="" []
"RoxWatchTray"="C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [05/11/2006 13:22]
"PCMService"="C:\Program Files\Dell\MediaDirect\PCMService.exe" [16/04/2007 18:10]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [22/12/2007 17:32]
"dscactivate"="C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" [15/11/2007 11:24]
"SystrayORAHSS"="C:\Program Files\Orange\Systray\SystrayApp.exe" [25/09/2007 21:08]
"ORAHSSSessionManager"="C:\Program Files\Orange\SessionManager\SessionManager.exe" [25/09/2007 20:10]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp­.exe" [29/03/2008 19:37]
"LogitechCommunicationsManager"="C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [25/07/2007 17:02]
"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam\Quickcam.exe" [25/07/2007 17:06]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [11/01/2008 23:16]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [28/03/2008 23:37]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [30/03/2008 10:36]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion­\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [18/10/2007 12:34]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe&quo­t; [02/11/2006 14:35]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
BTTray.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [03/11/2006 19:55:50]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [22/12/2007 17:21:55]
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [05/03/2008 22:52:03]
QuickSet.lnk - C:\Windows\Installer\{7F0C4457-8E64-491B-8D7B-991504365D1E}\­NewShortcut2_53A01CC614B04512A2E710D39BF83DC4.exe [22/12/2007 17:20:58]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversio­n\policies\system]
"ConsentPromptBehaviorAdmin"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=C:\PROGRA~1\Google\GOOGLE~2\GOEC62~­1.DLL

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoo­t\Minimal\AppInfo]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoo­t\Minimal\KeyIso]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoo­t\Minimal\NTDS]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoo­t\Minimal\ProfSvc]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoo­t\Minimal\sacsvr]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoo­t\Minimal\SWPRV]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoo­t\Minimal\TabletInputService]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoo­t\Minimal\TBS]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoo­t\Minimal\TrustedInstaller]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoo­t\Minimal\VDS]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoo­t\Minimal\volmgr.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoo­t\Minimal\volmgrx.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoo­t\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoo­t\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoo­t\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}]
@="IEEE 1394 Bus host controllers"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoo­t\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}]
@="SBP2 IEEE 1394 Devices"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoo­t\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}]
@="SecurityDevices"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalSystemNetworkRestricted hidserv UxSms WdiSystemHost Netman trkwks AudioEndpointBuilder WUDFSvc irmon sysmain IPBusEnum dot3svc PcaSvc EMDMgmt TabletInputService wlansvc WPDBusEnum
bthsvcs BthServ
WindowsMobile wcescomm rapimgr
LocalServiceRestricted WcesComm RapiMgr

*Newly Created Service* - ERASERUTILDRV10741

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
C:\Windows\system32\unregmp2.exe /ShowWMP

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
%SystemRoot%\system32\unregmp2.exe /FirstLogon /Shortcuts /RegBrowsers /ResetMUI



-- End of Deckard's System Scanner: finished at 2008-05-08 11:47:34 ------------

Re,

le rapport de MSNFix stp.
@+
N'acceptez jamais une désinfection par mp.

Deckard's System Scanner v20071014.68
Extra logfile - please post this as an attachment with your post.
------------------------------------------------------------­--------------------

-- System Information ----------------------------------------------------------

Microsoft® Windows Vista™ Édition Familiale Premium (build 6000)
Architecture: X86; Language: French

CPU 0: Intel(R) Core(TM)2 Duo CPU T5250 @ 1.50GHz
Percentage of Memory in Use: 58%
Physical Memory (total/avail): 2045.43 MiB / 851.85 MiB
Pagefile Memory (total/avail): 4309.15 MiB / 2806.4 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1917.88 MiB

C: is Fixed (NTFS) - 136.43 GiB total, 62.56 GiB free.
D: is Fixed (NTFS) - 10 GiB total, 0.28 GiB free.
E: is CDROM (Unformatted)

\\.\PHYSICALDRIVE0 - WDC WD1600BEVS-75RST0 - 149.05 GiB - 4 partitions
\PARTITION0 - Unknown - 117.63 MiB
\PARTITION1 - Système de fichiers installable - 10 GiB - D:
\PARTITION2 (bootable) - Système de fichiers installable - 136.43 GiB - C:
\PARTITION3 - Étendu avec Inter. 13 étendue - 2.5 GiB



-- Security Center ------------------------------------------------------------­-

AUOptions is scheduled to auto-install.
Windows Internal Firewall is enabled.

AV: avast! antivirus 4.8.1169 [VPS 080507-0] v4.8.1169 (ALWIL Software)
AS: Windows Defender v1.1.1505.0 (Microsoft Corporation)
AS: avast! antivirus 4.8.1169 [VPS 080507-0] v4.8.1169 (ALWIL Software)

[HKLM\System\CurrentControlSet\Services\SharedAccess\Paramet­ers\FirewallPolicy\DomainProfile\AuthorizedApplications\List­]

[HKLM\System\CurrentControlSet\Services\SharedAccess\Paramet­ers\FirewallPolicy\StandardProfile\AuthorizedApplications\Li­st]
"C:\\Program Files\\Orange\\Connectivity\\ConnectivityManager.exe"=&­quot;C:\\Program Files\\Orange\\Connectivity\\ConnectivityManager.exe:*:enabl­ed:CSS"


-- Environment Variables -------------------------------------------------------

ALLUSERSPROFILE=C:\ProgramData
APPDATA=C:\Users\robin\AppData\Roaming
CLASSPATH=.;C:\Program Files\Java\jre1.6.0\lib\ext\QTJava.zip
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=PC-DE-ROBIN
ComSpec=C:\Windows\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Users\robin
LOCALAPPDATA=C:\Users\robin\AppData\Local
LOGONSERVER=\\PC-DE-ROBIN
NUMBER_OF_PROCESSORS=2
OS=Windows_NT
Path=C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem­;C:\Program Files\Common Files\Roxio Shared\DLLShared\;C:\Program Files\Common Files\Roxio Shared\DLLShared\;C:\Program Files\Common Files\Roxio Shared\9.0\DLLShared\;C:\Program Files\QuickTime\QTSystem\
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MS­C
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 6 Model 15 Stepping 13, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=0f0d
ProgramData=C:\ProgramData
ProgramFiles=C:\Program Files
PROMPT=$P$G
PUBLIC=C:\Users\Public
QTJAVA=C:\Program Files\Java\jre1.6.0\lib\ext\QTJava.zip
RoxioCentral=C:\Program Files\Common Files\Roxio Shared\9.0\Roxio Central33\
SystemDrive=C:
SystemRoot=C:\Windows
TEMP=C:\Users\robin\AppData\Local\Temp
TMP=C:\Users\robin\AppData\Local\Temp
USERDOMAIN=PC-de-robin
USERNAME=robin
USERPROFILE=C:\Users\robin
windir=C:\Windows


-- User Profiles ------------------------------------------------------------­---

robin


-- Add/Remove Programs ---------------------------------------------------------

Adobe Flash Player ActiveX --> C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Reader 8.1.2 - Français --> MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A81200000003}
Adobe Shockwave Player --> C:\Windows\System32\Macromed\SHOCKW~1\UNWISE.EXE C:\Windows\System32\Macromed\SHOCKW~1\Install.log
Apple Mobile Device Support --> MsiExec.exe /I{44734179-8A79-4DEE-BB08-73037F065543}
Apple Software Update --> MsiExec.exe /I{02DFF6B1-1654-411C-8D7B-FD6052EF016F}
Assistant de connexion Windows Live --> MsiExec.exe /I{AFA4E5FD-ED70-4D92-99D0-162FD56DC986}
avast! Antivirus --> C:\Program Files\Alwil Software\Avast4\aswRunDll.exe "C:\Program Files\Alwil Software\Avast4\Setup\setiface.dll",RunSetup
Bonjour --> MsiExec.exe /I{47BF1BD6-DCAC-468F-A0AD-E5DECC2211C3}
Broadcom Management Programs --> MsiExec.exe /I{C99C0593-3B48-41D9-B42F-6E035B320449}
Browser Address Error Redirector --> MsiExec.exe /I{62230596-37E5-4618-A329-0D21F529A86F}
Conexant HDA D330 MDC V.92 Modem --> C:\Program Files\CONEXANT\CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2C06&SUBSYS_1­4F1000F\HXFSETUP.EXE -U -Idel000fz.inf
Dell Support Center --> MsiExec.exe /X{E3BFEE55-39E2-4BE0-B966-89FE583822C1}
Dell Touchpad --> C:\Program Files\DellTPad\Uninstap.exe ADDREMOVE
Dell Wireless WLAN Card --> "C:\Program Files\Dell\Dell Wireless WLAN Card\bcmwlu00.exe" verbose /rootkey="Software\Broadcom\802.11\UninstallInfo" /rootdir="C:\Program Files\Dell\Dell Wireless WLAN Card"
Digital Line Detect --> C:\Program Files\InstallShield Installation Information\{E646DCF0-5A68-11D5-B229-002078017FBF}\setup.exe­ -runfromtemp -l0x040c -removeonly
eMule --> "C:\Program Files\eMule\Uninstall.exe"
Galerie de photos Windows Live --> MsiExec.exe /X{A70FA218-6598-4AC9-813D-63597C5DD068}
Gestionnaire pour appareils Windows Mobile --> MsiExec.exe /X{904CCF62-818D-4675-BC76-D37EB399F917}
Google Desktop --> C:\Program Files\Google\Google Desktop Search\GoogleDesktopSetup.exe -uninstall
Google Earth --> MsiExec.exe /I{1E04F83B-2AB9-4301-9EF7-E86307F79C72}
Google Toolbar for Internet Explorer --> MsiExec.exe /I{DBEA1034-5882-4A88-8033-81C4EF0CFA29}
Google Toolbar for Internet Explorer --> regsvr32 /u /s "c:\program files\google\googletoolbar1.dll"
Guide de l'utilisateur --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,Lau­nchSetup "C:\Program Files\InstallShield Installation Information\{5CD29180-A95E-11D3-A4EB-00C04F7BDB2C}\setup.exe­"
Guide de mise en route Dell --> MsiExec.exe /I{9954484F-6EE4-4040-94E3-4B380646F867}
HijackThis 2.0.2 --> "C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
iTunes --> MsiExec.exe /I{585776BC-4BD6-4BD2-A19A-1D6CB44A403B}
Java(TM) SE Runtime Environment 6 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160000}
livebox --> C:\Program Files\InstallShield Installation Information\{17342E3B-0818-4A6F-BFF8-99476605ADD6}\Setup.exe­ -runfromtemp -l0x040c -removeonly
Logitech Desktop Messenger --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32­\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{900B1197-53F5-4F46-A882-2CFFFE2EEDCB}\Setup.exe­" -l0x40c UNINSTALL
Logitech QuickCam --> MsiExec.exe /X{364EC092-93CF-4DDC-9D7A-7278452028E0}
MediaDirect --> C:\Program Files\InstallShield Installation Information\{9C6978E8-B6D0-4AB7-A7A0-D81A74FBF745}\setup.exe­ -runfromtemp -l0x040c -cluninstall
Messenger Plus! Live --> "C:\Program Files\Messenger Plus! Live\Uninstall.exe"
Microsoft SQL Server 2005 Compact Edition [ENU] --> MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
Microsoft Visual C++ 2005 Redistributable --> MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Works --> MsiExec.exe /I{6B1CB38D-E2E4-4a30-933D-EFDEBA76AD9C}
Mise à jour du pilote du Gestionnaire pour appareils Windows Mobile --> MsiExec.exe /X{E7044E25-3038-4A76-9064-344AC038043E}
MSXML 4.0 SP2 (KB936181) --> MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB941833) --> MsiExec.exe /I{C523D256-313D-4866-B36A-F3DE528246EF}
MVision --> MsiExec.exe /I{35725FBC-A136-4A46-9F29-091759D9BB93}
Navigateur Orange --> C:\Program Files\Orange\Uninstall\Browser\Shell.exe MainUninstall.shl
Need for Speed™ ProStreet --> MsiExec.exe /X{2E1A71D5-7897-4F3F-B0E3-B412C86A646D}
NetWaiting --> C:\Program Files\InstallShield Installation Information\{3F92ABBB-6BBF-11D5-B229-002078017FBF}\setup.exe­ -runfromtemp -l0x040c -removeonly
Norton Security Scan --> MsiExec.exe /I{1A8A214F-6BAC-4E01-A27D-25C19A484908}
NVIDIA Drivers --> C:\Windows\system32\NVUNINST.EXE UninstallGUI
Orange - Logiciels Internet --> C:\Program Files\Orange\installation\core\Installgui.exe -u
Orange Preload --> MsiExec.exe /I{38496EC2-78B7-412A-9398-FC6B7DB8E182}
Outil de diagnostic de modem --> MsiExec.exe /I{F63A3748-B93D-4360-9AD4-B064481A5C7B}
OutlookAddinSetup --> MsiExec.exe /I{9BDEF074-020E-458D-ADC5-8FF68E0C9B56}
Programme de gestion Camera de Logitech® --> "C:\Program Files\Common Files\LogiShrd\QCDRV\BIN\SETUP.EXE" UNINSTALL REMOVEPROMPT
QuickSet --> MsiExec.exe /I{7F0C4457-8E64-491B-8D7B-991504365D1E}
QuickTime --> MsiExec.exe /I{1838C5A2-AB32-4145-85C1-BB9B8DFA24CD}
Roxio Creator Audio --> MsiExec.exe /I{83FFCFC7-88C6-41c6-8752-958A45325C82}
Roxio Creator BDAV Plugin --> MsiExec.exe /I{880AF49C-34F7-4285-A8AD-8F7A3D1C33DC}
Roxio Creator Copy --> MsiExec.exe /I{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}
Roxio Creator Data --> MsiExec.exe /I{0D397393-9B50-4c52-84D5-77E344289F87}
Roxio Creator DE --> MsiExec.exe /I{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}
Roxio Creator Tools --> MsiExec.exe /I{0394CDC8-FABD-4ed8-B104-03393876DFDF}
Roxio Express Labeler --> MsiExec.exe /I{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}
Roxio MyDVD DE --> MsiExec.exe /I{D639085F-4B6E-4105-9F37-A0DBB023E2FB}
Roxio Update Manager --> MsiExec.exe /I{30465B6C-B53F-49A1-9EBA-A3F187AD502E}
Safari --> MsiExec.exe /I{40589552-3892-409E-B92C-9F5032A4B2F0}
Security Update for CAPICOM (KB931906) --> MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906) --> MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
SLD Codec Pack --> C:\Program Files\SLD Codec Pack\uninstall.exe
Sonic Activation Module --> MsiExec.exe /I{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}
VideoLAN VLC media player 0.8.6e --> C:\Program Files\VideoLAN\VLC\uninstall.exe
WIDCOMM Bluetooth Software 6.0.1.3100 --> MsiExec.exe /X{A13E07E1-A423-44FB-9DEE-B24C75C1BAF2}
Windows Live installer --> MsiExec.exe /X{FD44E544-E7D0-4DBA-9FA0-8AE1A1300390}
Windows Live Messenger --> MsiExec.exe /X{BADF6744-3787-48F6-B8C9-4C4995401D65}
Windows Live Writer --> MsiExec.exe /X{3DFF4274-EBB0-4356-9692-972965018954}


-- Application Event Log -------------------------------------------------------

Event Record #/Type4309 / Success
Event Submitted/Written: 05/08/2008 10:34:10 AM
Event ID/Source: 12001 / usnjsvc
Event Description:
The Messenger Sharing USN Journal Reader service started successfully.

Event Record #/Type4304 / Error
Event Submitted/Written: 05/08/2008 10:27:23 AM
Event ID/Source: 1000 / Application Error
Event Description:
Application défaillante SystrayApp.exe, version 1.0.39.739, horodatage 0x46f94eba, module défaillant SystrayApp.exe, version 1.0.39.739, horodatage 0x46f94eba, code d’exception 0xc0000005, décalage d’erreur 0x00001c1c,
ID du processus 0xa00, heure de début de l’application 0xSystrayApp.exe0.

Event Record #/Type4296 / Success
Event Submitted/Written: 05/08/2008 10:27:08 AM
Event ID/Source: 5617 / WinMgmt
Event Description:


Event Record #/Type4295 / Success
Event Submitted/Written: 05/08/2008 10:27:07 AM
Event ID/Source: 5615 / WinMgmt
Event Description:


Event Record #/Type4289 / Success
Event Submitted/Written: 05/08/2008 10:26:25 AM
Event ID/Source: 902 / Software Licensing Service
Event Description:
Le service de gestion des licences du logiciel a démarré.



-- Security Event Log ----------------------------------------------------------

No Errors/Warnings found.


-- System Event Log ------------------------------------------------------------­

Event Record #/Type21722 / Warning
Event Submitted/Written: 05/08/2008 11:46:02 AM
Event ID/Source: 3004 / WinDefend
Event Description:
L’agent de protection en temps réel %PC-de-robin27 a détecté des modifications. Microsoft vous recommande d’analyser les logiciels responsables de ces modifications, à la recherche de risques potentiels. Vous pouvez vous servir des informations relatives au fonctionnement de ces programmes pour autoriser ou non leur exécution, ou pour les supprimer de l’ordinateur. N’autorisez les modifications que si vous faites confiance au programme ou à l’éditeur de logiciel. %PC-de-robin27 ne peut pas annuler les modifications que vous autorisez.

Pour plus d’informations, consultez les données suivantes :
%PC-de-robin275

ID d’analyse : {631DF4CD-9E33-4A12-988C-46DE86C3965D}

Utilisateur : PC-de-robin\robin

Nom : %PC-de-robin271

ID : %PC-de-robin272

ID de gravité : %PC-de-robin273

ID de catégorie : %PC-de-robin274

Chemin d’accès trouvé : %PC-de-robin276

Type d’alerte : %PC-de-robin278

Type de détection : 1.1.1505.02

Event Record #/Type21721 / Warning
Event Submitted/Written: 05/08/2008 11:46:02 AM
Event ID/Source: 3004 / WinDefend
Event Description:
L’agent de protection en temps réel %PC-de-robin27 a détecté des modifications. Microsoft vous recommande d’analyser les logiciels responsables de ces modifications, à la recherche de risques potentiels. Vous pouvez vous servir des informations relatives au fonctionnement de ces programmes pour autoriser ou non leur exécution, ou pour les supprimer de l’ordinateur. N’autorisez les modifications que si vous faites confiance au programme ou à l’éditeur de logiciel. %PC-de-robin27 ne peut pas annuler les modifications que vous autorisez.

Pour plus d’informations, consultez les données suivantes :
%PC-de-robin275

ID d’analyse : {2F0D7EB5-DCE4-405F-B85F-1B9B4A50C46A}

Utilisateur : PC-de-robin\robin

Nom : %PC-de-robin271

ID : %PC-de-robin272

ID de gravité : %PC-de-robin273

ID de catégorie : %PC-de-robin274

Chemin d’accès trouvé : %PC-de-robin276

Type d’alerte : %PC-de-robin278

Type de détection : 1.1.1505.02

Event Record #/Type21720 / Warning
Event Submitted/Written: 05/08/2008 11:46:02 AM
Event ID/Source: 3004 / WinDefend
Event Description:
L’agent de protection en temps réel %PC-de-robin27 a détecté des modifications. Microsoft vous recommande d’analyser les logiciels responsables de ces modifications, à la recherche de risques potentiels. Vous pouvez vous servir des informations relatives au fonctionnement de ces programmes pour autoriser ou non leur exécution, ou pour les supprimer de l’ordinateur. N’autorisez les modifications que si vous faites confiance au programme ou à l’éditeur de logiciel. %PC-de-robin27 ne peut pas annuler les modifications que vous autorisez.

Pour plus d’informations, consultez les données suivantes :
%PC-de-robin275

ID d’analyse : {598C8B6A-D07B-4D99-85CE-2819F7FFF6E6}

Utilisateur : PC-de-robin\robin

Nom : %PC-de-robin271

ID : %PC-de-robin272

ID de gravité : %PC-de-robin273

ID de catégorie : %PC-de-robin274

Chemin d’accès trouvé : %PC-de-robin276

Type d’alerte : %PC-de-robin278

Type de détection : 1.1.1505.02

Event Record #/Type21719 / Warning
Event Submitted/Written: 05/08/2008 11:46:02 AM
Event ID/Source: 3004 / WinDefend
Event Description:
L’agent de protection en temps réel %PC-de-robin27 a détecté des modifications. Microsoft vous recommande d’analyser les logiciels responsables de ces modifications, à la recherche de risques potentiels. Vous pouvez vous servir des informations relatives au fonctionnement de ces programmes pour autoriser ou non leur exécution, ou pour les supprimer de l’ordinateur. N’autorisez les modifications que si vous faites confiance au programme ou à l’éditeur de logiciel. %PC-de-robin27 ne peut pas annuler les modifications que vous autorisez.

Pour plus d’informations, consultez les données suivantes :
%PC-de-robin275

ID d’analyse : {F60D8D17-4F67-4D6E-8DBC-80C4989B71F4}

Utilisateur : PC-de-robin\robin

Nom : %PC-de-robin271

ID : %PC-de-robin272

ID de gravité : %PC-de-robin273

ID de catégorie : %PC-de-robin274

Chemin d’accès trouvé : %PC-de-robin276

Type d’alerte : %PC-de-robin278

Type de détection : 1.1.1505.02

Event Record #/Type21717 / Warning
Event Submitted/Written: 05/08/2008 11:44:49 AM
Event ID/Source: 4 / Client Side Rendering Spooler
Event Description:
Le spouleur d’impression n’a pas pu rouvrir une connexion d’imprimante existante car il n’a pas pu lire les informations de configuration dans la clé de Registre S-1-5-18\Printers\Connections. Le spouleur d’impression n’a pas pu ouvrir la clé de Registre. Ceci peut se produire si la clé de Registre est endommagée ou absente, ou si le Registre est momentanément indisponible.



-- End of Deckard's System Scanner: finished at 2008-05-08 11:47:34 ------------




Je n'ai eu d'afficher que des fichiers "extra.txt" et "main.txt"! Si ce n'est pas le fichier attendu, indiquez moi comment vous l'envoyer svp.merci

en cherchant dans le dossier MSNFix, j'ai trouvé cela. J'espère que c'est ce que vous vouliez.


C:\Windows\system32\rhdsa.exe
C:\Windows\system32\msese.exe
C:\Windows\system32\mssee.exe
C:\Windows\system32\wafps.exe
C:\Windows\system32\wagfxds.exe
C:\Windows\system32\wclis.exe
C:\Windows\system32\msnapp.exe
C:\Windows\system32\msnstartup.exe
C:\Windows\system32\wssl.exe
C:\Users\robin\AppData\Roaming\addon.dat
C:\Windows\Wild_Party_jpg.zip
C:\Windows\Bifrost\klog.dat
C:\Windows\Bifrost\serveur.exe
C:\Program Files\Common Files\delsim\del.exe
C:\wen6j4d5.exe
C:\9w3l6u1g1.exe
C:\v1r6j8q4s5j5.exe
C:\o5w1b5a9j5p4.exe
C:\x9e7f6y6j2k7.exe
C:\a5c3x8p2r8t8.exe
C:\m9r2h2z5l7v8.exe
C:\d5t6jb6k8f8.exe
C:\xx7c7c3n5d8d.exe
C:\7c3n5d8d.exe
C:\c3n5d8d.exe
C:\Users\robin\AppData\Local\Temp\New-Photo-*.zip
C:\Windows\system32\Microsoft\svchost.exe
C:\Windows\system32\ddesharer.exe
C:\Windows\system32\dfrgfat32.exe
C:\Windows\system32\logonagt.exe
C:\Windows\system32\mnmsrv.exe
C:\Windows\system32\msl.exe
C:\Windows\system32\service.exe
C:\Windows\system32\winupdates.exe
C:\Windows\system32\updates.exe
C:\Windows\system32\wlliveapp.exe
C:\Windows\system32\wintmp.exe
C:\Windows\system32\csrhost.exe
C:\Windows\princ.exe
C:\Users\robin\AppData\Local\Temp\1.reg
C:\Windows\system32\system.exe
C:\Windows\system32\aqwsde.exe
C:\Windows\system32\msl.exe
C:\Windows\system32\clipsv.exe
C:\Windows\system32\system.exe
C:\Windows\gearsec.exe
C:\Windows\system32\windowslogonb.exe
C:\Windows\adminlogg.txt
C:\Windows\windvrhost.exe
C:\Windows\system32\keymaker.exe
C:\Windows\system32\win32dll.exe
C:\Windows\system32\wbem\winscrvs.exe
C:\Windows\windvrhost.exe
C:\Windows\system32\clipsv.exe
C:\Windows\system32\svcthreading.exe
C:\Windows\system32\wifiloader.exe
C:\Windows\system32\windowsboot.exe
C:\Windows\system32\xwwfrpo.exe
C:\Windows\system32\iplogsec.exe
C:\Windows\system32\msnlvclient.exe
C:\Windows\system32\mstinitial.exe
C:\Windows\system32\msnconfig.exe
C:\Windows\system32\xhxugzoyubc.exe
C:\Windows\system32\winupdates.exe
C:\Windows\system32\smhost.exe
C:\Windows\system32\wifiboot.exe
C:\Windows\system32\livemsngr.exe
C:\Windows\system32\msupdate.exe
C:\Windows\system32\cleanmg.exe
C:\Windows\system32\msnserv.exe
C:\Windows\system32\msnmgrsv.exe
C:\Windows\system32\msmsnserver.exe
C:\Windows\system32\msnsoftware.exe
C:\Windows\system32\msnupnp.exe
C:\Windows\system32\msnserv.exe
C:\Windows\system32\msnservicer.exe
C:\Windows\system32\msnhosts.exe
C:\Windows\system32\wifiload.exe
C:\Windows\system32\win32dll.exe
C:\Windows\system32\sysmgr.exe
C:\Windows\system32\msmsgs.exe
C:\Windows\system32\msnmgr.exe
C:\Windows\system32\chkdsker.exe
C:\Windows\system32\winsystem.exe
C:\Windows\system32\websploit.exe
C:\Windows\adminlogg.txt
C:\Windows\windvrhost.exe
C:\Windows\system32\msnshare.exe
C:\Windows\system32\texds.exe
C:\Windows\system32\kernels32.exe
C:\Windows\system32\msavus.exe
C:\Windows\system32\dlh9jkd1q8.exe
C:\Windows\system32\wrsm.exe
C:\Windows\system32\ulfs.exe
C:\Windows\system32\chkdsker.exe
C:\Windows\system32\cliconfig.exe
C:\Windows\system32\clipsv.exe
C:\Windows\system32\cscripts.exe
C:\Windows\system32\ipsec7.exe
C:\Windows\system32\ipxrouter.exe
C:\Windows\system32\wllmsngr.exe
C:\Windows\system32\mqtsvc.exe
C:\Windows\system32\mstinitial.exe
C:\Windows\system32\msnpopblck.exe
C:\Windows\system32\cisvr.exe
C:\Windows\system32\cleanmg.exe
C:\Windows\system32\ie4uini.exe
C:\Windows\system32\iexpresser.exe
C:\Windows\system32\msnservices.exe
C:\Windows\system32\bt\Systemx.exe
C:\Windows\system32\winlogonpc.exe
C:\Windows\system32\WINWGPX.EXE
C:\Windows\system32\bootk.exe
C:\Windows\system32\bootvfy.exe
C:\Windows\system32\dvdupgd.exe
C:\Windows\system32\fontviewer.exe
C:\Windows\system32\msavus.exe
C:\Windows\system32\wrsm.exe
C:\Windows\system32\bootst.exe
C:\Windows\windvrhost.exe
C:\Windows\winloadmgr.exe
C:\Windows\mstinitial.exe
C:\Windows\msnpopupblck.exe
C:\Windows\system32\bootk.exe
C:\Windows\system32\bootvfy.exe
C:\Windows\system32\dvdupgd.exe
C:\Windows\system32\fontviewer.exe
C:\Windows\system32\funnymovies.txt
C:\Users\robin\AppData\Local\Temp\load3.exe
C:\Users\robin\AppData\Local\Temp\win32.exe
C:\Windows\system32\wind32.exe
C:\Windows\system32\dllgh8jkd1q8.exe
C:\Windows\system32\cbevtsvc.exe
C:\Program Files\InetGet2\YazzleBundle-1560.exe
C:\Program Files\Common Files\Yazzle1560OinAdmin.exe
C:\Users\robin\AppData\Local\Temp\mshtml3.exe
C:\Users\robin\AppData\Local\Temp\mshtml2.exe
C:\Windows\system32\dllgh8jkd1q8.exe
C:\Windows\system32\wind32.exe
C:\Windows\system32\drmupgd.exe
C:\Windows\system32\mspainter.exe
C:\Users\robin\AppData\Roaming\WinTouch\wintouch.cfg
C:\Users\robin\AppData\Roaming\WinTouch\WTUninstaller.exe
C:\Program Files\CPV\CPV8.dll
C:\Program Files\Fichiers communs\Yazzle1560OinUninstaller.exe
C:\Program Files\JavaCore\JavaCore.exe
C:\Program Files\JavaCore\UnInstall.exe
C:\Program Files\nvcoi\mst.stt
C:\Program Files\outerinfo\FF\chrome.manifest
C:\Program Files\outerinfo\FF\components\FF.dll
C:\Program Files\outerinfo\FF\components\OuterinfoAds.xpt
C:\Program Files\outerinfo\FF\install.rdf
C:\Program Files\outerinfo\Terms.rtf
C:\Windows\b153.exe
C:\Windows\b156.exe
C:\Windows\Downloaded Program Files\setup.inf
C:\Windows\system32\ayv.dll
C:\Windows\system32\mcrh.tmp
C:\Windows\system32\TCMlnnpo.ini
C:\Windows\system32\TCMlnnpo.ini2
C:\Users\robin\AppData\Roaming\SpeedRunner\config.cfg
C:\Users\robin\AppData\Roaming\SpeedRunner\SRUninstall.exe
C:\Program Files\InetGet2\SRInstaller.exe
C:\Program Files\Twain\Twain.exe
C:\Users\robin\AppData\Local\Temp\bestwiner.stt
C:\Program Files\Twain\Twain.exe
C:\Users\robin\AppData\Local\Temp\365.dat
C:\Users\robin\AppData\Roaming\Microsoft\Windows\qganni.exe
C:\Windows\system32\msnbootcfg.exe
C:\Windows\system32\msnstartup.exe
C:\Windows\system\smvss.exe
C:\Windows\system32\msnmanegers.exe
C:\delextra.exe
C:\Windows\system32\csrcs.exe
C:\Windows\system32\msnmanegers.exe
C:\Windows\system32\msnbootcfg.exe
C:\Windows\system32\msnstartup.exe
C:\7c7c3n5d8d.exe
C:\Windows\system32\msrmsvc.exe
C:\Windows\system32\wllivemsgr.exe
C:\Windows\system32\livemsngr.exe
C:\Windows\system32\aromis.exe
C:\Windows\system32\aromis.config
C:\Windows\system32\bootst.exe
C:\Windows\system32\spool1*.exe
C:\Windows\system32\spool2*.exe
C:\Windows\system32\spool3*.exe
C:\Windows\system32\spool4*.exe
C:\Windows\system32\spool5*.exe
C:\Windows\system32\spool6*.exe
C:\Windows\system32\spool7*.exe
C:\Windows\system32\spool8*.exe
C:\Windows\system32\spool9*.exe
C:\Windows\system32\csf.exe
C:\Windows\system32\msnmgrsv.exe
C:\Windows\system32\livemsngr.exe
C:\Windows\system32\msrmsvc.exe
C:\Windows\system32\msnlvclient.exe
C:\Windows\system32\wllivemsgr.exe
C:\Windows\freshphotos.zip
C:\Windows\wspl.exe
C:\Users\robin\AppData\Local\Temp\service.exe
C:\Users\robin\AppData\Local\Temp\msnmsgs.exe
C:\Setup32.exe
C:\w7c7c3n5d8d.exe
C:\Windows\system32\servl.dll
C:\Windows\system32\servl2.dll
C:\Windows\system32\msnsoftware.exe
C:\Windows\system32\teim.exe
C:\Windows\system32\cdmsn.exe
C:\Windows\system32\livemsngr.exe
C:\Windows\system32\msupnp.exe
C:\Users\robin\AppData\Local\Temp\misfotos_*.zip
C:\Windows\system32\wifisetup.exe
C:\Windows\system32\msnusr.exe
C:\Windows\system32\msnupdsv.exe
C:\Windows\system32\prov.exe
C:\Windows\system32\ysmngr.exe
C:\Windows\system32\wnd32.exe
C:\Windows\system32\psknowoxbli.exe
C:\Windows\system32\msnlvclient.exe
C:\Windows\system32\msnupnp.exe
C:\Windows\system32\svho.exe
C:\RECYCLER\svchost.exe
C:\Windows\system32\libmsns.dll
C:\Windows\system32\msninet.exe
C:\Windows\system32\mswnm.exe
C:\Windows\system32\wcds.exe
C:\Windows\Msshield.exe
C:\Windows\smss.exe
C:\Conf\msm.scr
C:\Windows\system32\resmsvc.exe
C:\Windows\system32\msnbooster.exe
C:\Windows\system32\microsoft.exe
C:\Windows\system32\msnusr.exe
C:\Windows\system32\msnsoftware.exe
C:\Windows\system32\msnupnp.exe
C:\Windows\system32\scvhost.exe
C:\Windows\system32\sychost.exe
C:\Windows\system32\winhosts.exe
C:\Windows\system32\msnloader.exe
C:\Windows\system32\msnbootcfg.exe
C:\Windows\system32\servcr.exe
C:\Windows\system32\sysmgr.exe
C:\Windows\system32\dpcsvc.exe
C:\Windows\system32\nspsvc.exe
C:\Windows\Fonts\RAYMAN.EXE
C:\jbig2dec.exe
C:\Users\robin\AppData\Roaming\Microsoft\Windows\vvpmyvaw.ex­e
C:\Users\robin\AppData\Roaming\WinTouch\wintouch.cfg
C:\Users\robin\AppData\Roaming\WinTouch\WinTouch.exe
C:\Users\robin\AppData\Roaming\WinTouch\WTUninstaller.exe
C:\Program Files\nvcoi\mst.stt
C:\Program Files\nvcoi\nvcoi.exe
C:\Program Files\Temporary\InsiDERInst.exe
C:\Windows\system32\sychost.exe
C:\Program Files\Temporary\InstCPV.exe
C:\Program Files\CPV\CPV7.dll
C:\Windows\system32\doguwwe.exe
C:\Windows\system32\iaxcfg32.dll
C:\Windows\system32\msnbootcfg.exe
C:\Windows\system32\msnsoftware.exe
C:\Program Files\My_Love.exe
C:\Windows\system32\msmpserv.exe
C:\Windows\system32\msnmgrsv.exe
C:\Windows\system32\msnserv.exe
C:\Windows\system32\msnuserv.exe
C:\Windows\system32\winboot.exe
C:\Users\robin\AppData\Local\Temp\myPic*.zip
C:\Users\robin\AppData\Local\Temp\Picture_*.zip
C:\Windows\system32\winsplr.exe
C:\Windows\system32\sysmgr.exe
C:\Windows\system32\servcr.exe
C:\Windows\system32\msnserv.exe
C:\Windows\system32\msnbootcfg.exe
C:\Windows\system32\msmpserv.exe
C:\Windows\system32\servicez.exe
C:\Windows\system32\winsplr.exe
C:\Windows\system32\msnuserv.exe
C:\Windows\system32\winhosts.exe
C:\Windows\wscmgr.exe
C:\Windows\system32\zotjoup.exe
C:\Windows\system32\yznygrb.exe
C:\Windows\system32\windrivers.exe
C:\Windows\system32\webcp.exe
C:\Windows\system32\wdlrss.exe
C:\Windows\system32\uzysfrl.exe
C:\Windows\system32\upcvk.exe
C:\Windows\system32\svcdllhost.exe
C:\Windows\system32\svcbrunner.exe
C:\Windows\system32\sbvdflyuh.exe
C:\Windows\system32\qvsblzlxrqpy.exe
C:\Windows\system32\qp.exe
C:\Windows\system32\poolsc.exe
C:\Windows\system32\inetsrv.exe
C:\Windows\system32\ihpbdt.exe
C:\Windows\system32\doco.exe
C:\Windows\system32\dbvccjgbcpkb.exe
C:\Windows\system32\d.exe
C:\Windows\system\smss.exe
C:\Windows\live.messenger.com
C:\Windows\help\msn.exe
C:\Windows\system32\msnstartup.exe
C:\Windows\system32\msnserver.exe
C:\Windows\system32\windowsboot.exe
C:\Windows\system32\windowsconf.exe
C:\Windows\system32\windriver.exe
C:\Windows\system32\windowsconf.exe
C:\Windows\system32\ServiceLayer.exe
C:\Windows\system32\msnloader.exe
C:\Windows\system32\windowsboot.exe
C:\Windows\system32\msnhost.exe
C:\Users\robin\AppData\Local\Temp\1.html
C:\Windows\winsyn32.dll
C:\Windows\system32\msmsgs.exe
C:\Windows\system32\svcjogger.exe
C:\Windows\system32\svcjog.exe
C:\Windows\system32\\wnd32.exe
C:\Windows\system32\sysmgr.exe"
C:\Users\robin\lsass.exe
C:\Windows\winini.exe
C:\Windows\system32\svccert.exe
C:\Windows\system32\msthosts.exe
C:\Windows\system32\expent.exe
C:\Windows\system32\wifibooter.exe
C:\Windows\system32\windowsupdate.exe
C:\Windows\system32\svcthreads.exe
C:\Windows\system32\mstasker.exe
C:\Windows\system32\svctowers.exe
C:\Windows\system32\exploresys.exe
C:\Windows\system32\dllcache\qxchost.exe
C:\Windows\system32\mstasks.exe
C:\Windows\system32\soundvol32.exe
C:\Windows\system32\rundll64.exe
C:\Windows\system32\soundvol64.exe
C:\Windows\system32\rundll1128.exe
C:\Windows\system32\soundvol128.exe
C:\Windows\system32\scheduler.exe
C:\Windows\system32\wmserver.exe
C:\Windows\system32\wmserv.exe
C:\Windows\admintxt.txt
C:\Windows\live.messenger.com
C:\Windows\system32\rtsbsvc.exe
C:\Windows\system-dll.exe
C:\Windows\Fonts\svchost.exe
C:\Windows\system32\svcjog.exe
C:\Windows\system32\spool87.exe
C:\Windows\system32\winsystem.exe
C:\Windows\system32\winsysmgr.exe
C:\sys????.exe
C:\Windows\system32\msssrv.exe
C:\Windows\system32\winconf.exe
C:\Windows\system32\winsysmgr.exe
C:\Windows\system32\bootconf.exe
C:\Windows\system32\msnconfigs.exe
C:\Windows\system32\winconfig.exe
C:\Windows\system32\windrivers.exe
C:\Windows\system32\bootconfig.exe
C:\Windows\system32\usndebug.exe
C:\Windows\system32\windfrag.exe
C:\Windows\system32\windefrag.exe
C:\Windows\system32\winbooter.exe
C:\Windows\system32\windrive.exe
C:\Windows\system32\winserv.exe
C:\Windows\system32\winsvr.exe
C:\Windows\system32\svcguides.exe
C:\Windows\system32\winbooter.exe
C:\Windows\system32\wificon.exe
C:\Windows\system32\wifisetup.exe
C:\Windows\system32\wifiloader.exe
C:\Windows\system32\wifiboot.exe
C:\Windows\system32\wificonnect.exe
C:\Windows\system32\wificonfigs.exe
C:\Windows\system32\wifidebug.exe
C:\Windows\system32\wifiload.exe
C:\Windows\system32\wifibooter.exe
C:\Windows\system32\wificonfig.exe
C:\s2l4k9s2e1e3.exe
C:\v1i1e8e6e8w5.exe
C:\d5t6j8b6k8f8.exe
C:\Windows\WNDXP.exe
C:\Windows\system32\inserv.exe
C:\Windows\system32\winboot.exe
C:\Windows\msn.com
C:\Windows\system32\winbooter.exe
C:\Windows\system32\wificon.exe
C:\Windows\system32\wifisetup.exe
C:\Windows\system32\wifiloader.exe
C:\Windows\system32\wifiboot.exe
C:\Windows\system32\wificonnect.exe
C:\Windows\system32\wificonfigs.exe
C:\Windows\system32\wifidebug.exe
C:\Windows\system32\wifiload.exe
C:\Windows\system32\wifibooter.exe
C:\Windows\system32\wificonfig.exe
C:\Windows\system32\pmsvcr.exe
C:\Windows\lala.txt
C:\Windows\system32\winhosts.exe
C:\Windows\system32\servicez.exe
C:\Windows\system32\svsmanager.exe
C:\Windows\system32\cmnvc.exe
C:\Windows\system32\winhosts.exe
C:\Windows\system32\winhost.exe
C:\Windows\system32\resmsvc.exe
C:\Windows\system32\svccert.exe
C:\Windows\system32\svcjogg.exe
C:\Windows\system32\svcjoger.exe
C:\Windows\system32\svctowing.exe
C:\Windows\system32\svmanager.exe
C:\Windows\Win24DLL.exe
C:\Windows\system32\microsoft.exe
C:\Windows\system32\imglog.exe
C:\Windows\system32\bsyys.scr
C:\Program Files\msn_livers.exe
C:\Windows\system32\orkutkut.exe
C:\Windows\system32\Explorer.exe
C:\Windows\system32\windr128.exe
C:\Windows\system32\servcr.exe
C:\Windows\system32\dpcsvc.exe
C:\Windows\system32\msssrv.exe
C:\Windows\system32\mssvc.exe
C:\Windows\system32\kxgelc.exe
C:\Windows\windosremote.exe
C:\Windows\GbpServer32.exe
C:\Windows\sistemas.exe
C:\Windows\WinUpdatedata.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\maind­wxp.exe
C:\Windows\system32\maindwxp.exe
C:\Windows\system32\vbsxkh.exe
C:\Windows\system32\msthost.exe
C:\Windows\system32\msthosts.exe
C:\Windows\system32\wbcsvc.exe
C:\Users\robin\AppData\Local\Temp\MyPhoto*.zip
C:\Windows\system32\msnmgnr.exe
C:\Windows\system32\fsiocu.exe
C:\Windows\system32\agtsvc.exe
C:\Windows\system32\ngpsvc.exe
C:\Windows\system32\wmscheduler.exe
C:\Windows\system32\scheduler.exe
C:\Windows\system32\svcguide.exe
C:\Windows\system32\exploresys.exe
C:\Windows\system32\svcthreads.exe
C:\Windows\system32\svctowers.exe
C:\Windows\system32\mstasks.exe
C:\Windows\system32\mstasker.exe
C:\Windows\system32\wmserv.exe
C:\Windows\system32\bios.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\msdoc­.exe
C:\Windows\system32\msdoc.exe
C:\Windows\images.zip
C:\Windows\netstats.exe
C:\Windows\system32\keymaker.exe
C:\Windows\system32\netstats.exe
C:\fumkmdgq.exe
C:\wcbcapm.exe
C:\ypvrinp.exe
C:\fumkmdgq.exe
C:\xkufbjjc.exe
C:\ypvrinp.exe
C:\Windows\system32\omnlroth.exe
C:\Users\robin\AppData\Local\Temp\svcghost.exe
C:\Windows\system32\wmscheduler.exe
C:\Windows\system32\wmserver.exe
C:\Windows\system32\cdrss.exe
C:\Users\robin\AppData\Local\Temp\NewPhoto*.zip
C:\Windows\Fonts\Setup.exe
C:\??????.exe
C:\Windows\system32\msdts.exe
C:\Windows\system32\msstc.exe
C:\Windows\system32\nspsvc.exe
C:\Windows\system32\smhost.exe
C:\Windows\system32\winstruct32.exe
C:\Windows\system32\winstruct64.exe
C:\Windows\system32\winstruct128.exe
C:\Windows\system32\winstruct.exe
C:\Windows\system32\winkeyboard.exe
C:\Windows\system32\wmserver.exe
C:\Windows\system32\winmouse.exe
C:\Windows\system32\winmouse64.exe
C:\Windows\system32\winmouse32.exe
C:\Windows\system32\winmouse128.exe
C:\Windows\system32\nspsvc.exe
C:\Windows\system32\npssvc.exe
C:\Windows\ipcbind.exe
C:\Windows\irfnga.exe
C:\Windows\system32\winvsvc.exe
C:\Windows\images.zip
C:\Users\robin\AppData\Local\Temp\NewPicture*.zip
C:\Windows\scvhost.exe
C:\Windows\system32\microsoft.exe
C:\Windows\scvhost.exe
C:\Windows\system32\npcsvc.exe
C:\Windows\system32\npssvc.exe
C:\Windows\system32\nspsvc.exe
C:\Users\robin\AppData\Local\Temp\services.msnfix
C:\Users\robin\AppData\Local\Temp\winlogon.msnfix
C:\Users\robin\AppData\Roaming\addon.dat
C:\Users\robin\AppData\Roaming\inside.exe
C:\Users\robin\AppData\Roaming\Microsoft\Windows\fkoym.exe
C:\Users\robin\AppData\Roaming\WinTouch\wintouch.cfg
C:\Users\robin\AppData\Roaming\WinTouch\WinTouch.exe
C:\Users\robin\AppData\Roaming\WinTouch\WTUninstaller.exe
C:\Users\Public\DOCUME~1\Settings\config.ini
C:\Users\Public\DOCUME~1\Settings\partnership.dll
C:\Users\Public\DOCUME~1\Settings\partnership.dll.msnfix
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Carlson\carlt­on
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Delsim\del.ex­e
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\Micro­soft Office.lnk
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Yazzle1560Oin­Admin.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Yazzle1560Oin­Uninstaller.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\carlton
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\Antiv­irus32.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\ashDi­sp.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\ashSe­rv.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\atimv­ex.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\atrvm­mx.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\bios.­exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\biosv­aisefude.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\BRISA­.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\bsyys­.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\bsyys­.scr
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\carlt­on
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\ccssr­ss.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\cmd.e­xe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\Compu­tador.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\Diup.­exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\dll.e­xe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\dllvi­rtual.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\eixdr­v.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\ExAli­en.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\fbgua­d.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\firef­oxx.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\Flash­.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\GbpSv­c.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\gtalt­g.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\HelpD­esk.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\Hide3­2.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\hork.­exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\icpld­rvx.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\imglo­g.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\Insta­llHelp.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\javau­pd.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\javsu­.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\juche­k.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\jvasu­.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\JVM0.­exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\jvms.­exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\klpp.­exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\logon­.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\lsssa­s.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\mdll.­exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\messe­ngerr.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\messe­nup.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\messg­rr.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\mhtsv­ho.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\mjava­s.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\msdoc­.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\msdos­s.com
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\msm.c­md
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\msmsg­xs.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\MSN_M­SS.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\msnco­nf.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\MSNEN­VIA.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\msnfi­le.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\msng.­exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\msnms­g.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\msnms­gr.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\msnsg­s.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\mxjxd­e.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\My_Lo­ve.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\Ndtst­at.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\norto­n32.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\ntvvm­.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\pdvsy­m.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\qtapp­.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\Quick­time Music.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\regfi­xxsx.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\regis­ttry.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\remot­e.cmd
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\repar­a_ae.bat
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\Rg2ca­tbd.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\rundl­32.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\rxnet­q.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\smss.­scr
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\svcho­st.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\svcho­stss.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\svhos­sst.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\svhos­t.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\svmrh­os.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\sxror­k.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\sxrsy­m.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\syst.­exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\syste­m32.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\syste­mdll.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\task.­exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\taskm­grrr.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\Tasks­.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\udll.­exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\verif­ysystemtitle.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\voieu­p.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\voior­k.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\wbnnt­.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\wcktt­s.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\wepai­nt.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\Win XP.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\win.s­cr
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\Windo­ws Update.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\windo­ws32.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\Windo­ws32.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\Windo­wsUpdate.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\windo­wsupdate.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\Windo­wsUpdate.scr
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\Winho­st.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\winup­dbc.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\WMedP­layer.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\wrdmg­r.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\wrlog­inpro.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\wsnct­fy.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\wuauc­ltt.exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\ying.­exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\yong.­exe
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\ZaZ.e­xe
C:\Users\robin\Desktop\aindateamo.exe
C:\Users\robin\Desktop\cartao.exe
C:\Users\robin\Desktop\cartaozinho.exe
C:\Users\robin\Desktop\mensagem__amor.exe
C:\Users\robin\Desktop\photo.exe
C:\Users\robin\Desktop\portal.exe
C:\Users\robin\Desktop\software\aindateamo.udd
C:\Windows\Fonts\svchost.exe
C:\i.mages.zip
C:\Program Files\Driver32x\bradesco.exe
C:\Program Files\Driver32x\caixa.exe
C:\Program Files\7za.exe
C:\Program Files\a.txt
C:\Program Files\Adobe\AdobeLanc.exe
C:\Program Files\Ajuda.exe
C:\Program Files\Amor.exe
C:\Program Files\Bifrost\klog.dat
C:\Program Files\Bifrost\server.exe
C:\Program Files\Bifrost\sys32.exe
C:\Program Files\Cica.exe
C:\Program Files\Common Files\System\SystemUpgrade.exe
C:\Program Files\Common Files\Yazzle1560OinAdmin.exe
C:\Program Files\Config\Config.exe
C:\Program Files\dll.exe
C:\Program Files\dllvirtual.exe
C:\Program Files\dllwin.exe
C:\Program Files\Dot1XCfg\Dot1XCfg.exe
C:\Program Files\Driver32x\bb.exe
C:\Program Files\Driver32x\iek.exe
C:\Program Files\Driver32x\install\wweb.exe
C:\Program Files\Driver32x\itau.exe
C:\Program Files\Driver32x\live.exe
C:\Program Files\Driver32x\msgex.exe
C:\Program Files\Driver32x\net.exe
C:\Program Files\Driver32x\nsvcrmx.exe
C:\Program Files\Driver32x\nsvcrmx.exe
C:\Program Files\Driver32x\rds.exe
C:\Program Files\Driver32x\Readme.exe
C:\Program Files\Driver32x\real.exe
C:\Program Files\Driver32x\santanderbanespa.exe
C:\Program Files\Driver32x\sendchat.exe
C:\Program Files\Driver32x\varios.exe
C:\Program Files\Driver32x\vcdg.bat
C:\Program Files\ExAlien.exe
C:\Program Files\Favoritos.exe
C:\Program Files\fer.exe
C:\Program Files\Fichiers communs\Carlson\carlton
C:\Program Files\Fichiers communs\Yazzle1560OinUninstaller.exe
C:\Program Files\Firewall.exe
C:\Program Files\Flash.exe
C:\Program Files\GbPlugin\GbpSvc.exe
C:\Program Files\GbPlugin\mdll.exe
C:\Program Files\GbPlugin\msng.exe
C:\Program Files\GbPlugin\Ndtstat.exe
C:\Program Files\GbPlugin\Rg2catbd.exe
C:\Program Files\GbPlugin\udll.exe
C:\Program Files\GbPlugin\yong.exe
C:\Program Files\GbpSvc.exe
C:\Program Files\help.exe
C:\Program Files\HelpDesk.exe
C:\Program Files\icpldrvx.exe
C:\Program Files\iexplorer.exe
C:\Program Files\iixplorer1.exe
C:\Program Files\iixplorer2.exe
C:\Program Files\ildredr.exe
C:\Program Files\InetGet2\emg.exe
C:\Program Files\InetGet2\emg.exe
C:\Program Files\InetGet2\emg.exe.lzma
C:\Program Files\InetGet2\FINAL -- Fort 5.6_MST-ONLY.exe
C:\Program Files\InetGet2\FINAL -- Fort 5.6_MST-ONLY.exe
C:\Program Files\InetGet2\Installeur.exe
C:\Program Files\inetget2\installeur.exe
C:\Program Files\InetGet2\Installeur.exe
C:\Program Files\InetGet2\Installeur.exe.lzma
C:\Program Files\InetGet2\WinTouchInstaller_channel1.exe
C:\Program Files\Insider\Insider.exe
C:\Program Files\Insider\Insider.exe.lzma
C:\Program Files\Insider\UnInstall.exe
C:\Program Files\Insider\UnInstall.exe.lzma
C:\Program Files\installer.js
C:\Program Files\Instant Driver\install\wweb.exe
C:\Program Files\Instant Driver\trmninwn.exe
C:\Program Files\Instant Driver\vcdg.bat
C:\Program Files\Internet Explorer\bb.exe
C:\Program Files\Internet Explorer\desc.exe
C:\Program Files\Internet Explorer\loadie.exe
C:\Program Files\Internet Explorer\mezenoca77798.exe
C:\Program Files\Internet Explorer\realplayerp.exe
C:\Program Files\ISM2\ISMPack7.exe
C:\Program Files\JavaCore\JavaCore.exe
C:\Program Files\JavaCore\UnInstall.exe
C:\Program Files\jsload32\mwnming.exe
C:\Program Files\jsload32\nsvcrmx.exe
C:\Program Files\klog.dat
C:\Program Files\login.scr
C:\Program Files\Logun.exe
C:\Program Files\MapEDC\IDE.stt
C:\Program Files\MapEDC\MapEDC.exe
C:\Program Files\mdll.exe
C:\Program Files\messenger.exe
C:\Program Files\Messenger\msmsg.exe
C:\Program Files\Messenger\Msnmsgr.exe
C:\Program Files\mexe*.exe
C:\Program Files\Microsoft Office Update\file.exe
C:\Program Files\microsoft studio files\asw34.bat
C:\Program Files\microsoft studio files\bradesco.bxz
C:\Program Files\microsoft studio files\bradesco.exe
C:\Program Files\microsoft studio files\caixa.bxz
C:\Program Files\microsoft studio files\caixa.exe
C:\Program Files\Microsoft Studio Files\file.exe
C:\Program Files\Microsoft Studio Files\fttlo33.ko
C:\Program Files\microsoft studio files\iek.exe
C:\Program Files\microsoft studio files\itau.bxz
C:\Program Files\microsoft studio files\itau.exe
C:\Program Files\microsoft studio files\locaweb.bxz
C:\Program Files\Microsoft Studio Files\lsass.exe
C:\Program Files\microsoft studio files\msgex.exe
C:\Program Files\microsoft studio files\net.bxz
C:\Program Files\microsoft studio files\net.exe
C:\Program Files\microsoft studio files\nossacaixa.bxz
C:\Program Files\microsoft studio files\nossacaixa.exe
C:\Program Files\microsoft studio files\notfir0006dfjf541.dll
C:\Program Files\microsoft studio files\pcname.drv
C:\Program Files\microsoft studio files\pv.exe
C:\Program Files\microsoft studio files\readme.exe
C:\Program Files\microsoft studio files\real.bxz
C:\Program Files\microsoft studio files\real.exe
C:\Program Files\microsoft studio files\registro.bxz
C:\Program Files\microsoft studio files\santanderbanespa.bxz
C:\Program Files\microsoft studio files\santanderbanespa.exe
C:\Program Files\microsoft studio files\sdrivw.exe
C:\Program Files\microsoft studio files\sec\fx.reg
C:\Program Files\microsoft studio files\sec\ref-allu
C:\Program Files\microsoft studio files\sec\ref-commonfiles
C:\Program Files\microsoft studio files\sec\ref-profile
C:\Program Files\microsoft studio files\sec\ref-programfiles
C:\Program Files\microsoft studio files\sec\ref-startup
C:\Program Files\microsoft studio files\sec\ref-sysdrive
C:\Program Files\microsoft studio files\sec\ref-system
C:\Program Files\microsoft studio files\sec\ref-system32
C:\Program Files\microsoft studio files\sec\ref-temp
C:\Program Files\microsoft studio files\sec\ref-wincommon
C:\Program Files\microsoft studio files\sec\ref-windows
C:\Program Files\microsoft studio files\sendchat.exe
C:\Program Files\microsoft studio files\tmp84667.txt
C:\Program Files\microsoft studio files\varios.exe
C:\Program Files\Microsoft Studio Files\vcdg.bat
C:\Program Files\microsoft studio files\vcdg.bat
C:\Program Files\microsoft studio files\wininfo1.vxd
C:\Program Files\Microsoft Studio Files\Winlsass32.exe
C:\Program Files\microsoft studio files\winvxhfythg34a.rd
C:\Program Files\Microsoft Update\bradesco.exe
C:\Program Files\Microsoft Update\caixa.exe
C:\Program Files\Microsoft Update\iek.exe
C:\Program Files\Microsoft Update\itau.exe
C:\Program Files\Microsoft Update\live.exe
C:\Program Files\Microsoft Update\live.txt
C:\Program Files\Microsoft Update\mnwinvx.exe
C:\Program Files\Microsoft Update\msgex.exe
C:\Program Files\Microsoft Update\net.exe
C:\Program Files\Microsoft Update\nossacaixa.exe
C:\Program Files\Microsoft Update\Readme.exe
C:\Program Files\Microsoft Update\real.exe
C:\Program Files\Microsoft Update\santanderbanespa.exe.exe
C:\Program Files\Microsoft Update\sec\fx.reg
C:\Program Files\Microsoft Update\sendchat.exe
C:\Program Files\Microsoft Update\varios.exe
C:\Program Files\Microsoft Update\wininfo1.vxd
C:\Program Files\Microsoft\svhost32.exe