What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[amok dupe face save]

15 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
hi,

I can't fix those [amok dupe face save] and my PC is very slow…
can you help me?
here is my HijackThis.log file

Logfile of HijackThis v1.99.1
Scan saved at 1:27:13, on 13/08/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\system32\wwSecure.exe
C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\Dit.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxtray.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\GetRight\getright.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Thunderbird\thunderbird.exe
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CNetscape_France.src"); (C:\Documents and Settings\Noel\Application Data\Mozilla\Profiles\default\41x57daf.slt\prefs.js)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKLM\..\Run: [Amok dupe face save] C:\Documents and Settings\All Users\Application Data\creativechicamokdupe\Pop Pile.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -onlytray
O4 - HKLM\..\Run: [Dimension4] C:\Program Files\D4\D4.exe
O4 - HKLM\..\Run: [Absolute StartUp monitor] C:\Program Files\F-Group\Absolute StartUp\ASMon.exe
O4 - HKLM\..\RunOnce: [WinSideBySideSetupCleanup 1802562] rundll32 sxs.dll,SxspRunDllDeleteDirectory C:\WINDOWS\WinSxS\InstallTemp\1802562
O4 - HKLM\..\RunOnce: [WinSideBySideSetupCleanup 1803555] rundll32 sxs.dll,SxspRunDllDeleteDirectory C:\WINDOWS\WinSxS\InstallTemp\1803555
O4 - HKCU\..\Run: [Amok dupe face save] C:\Documents and Settings\All Users\Application Data\creativechicamokdupe\exit acid.exe
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [Default Iso] C:\DOCUME~1\Noel\APPLIC~1\GPLJUN~1\The Grey.exe
O4 - Startup: Mozilla Thunderbird.lnk = C:\Program Files\Mozilla Thunderbird\thunderbird.exe
O4 - Global Startup: GetRight - Tray Icon.lnk = C:\Program Files\GetRight\getright.exe
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Program Files\IrfanView\Ebay\Ebay.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .csm: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .csml: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .cub: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .cube: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .dx: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .emb: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .embl: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .gau: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .jdx: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .mol: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .mop: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .pdb: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .rxn: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .scr: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .skc: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .spt: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .tgf: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .xyz: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {68A2C3BD-7809-11D3-8ACF-0050046F2F9A} (AXELPlayer Class) - http://www.lachimie.com/AXELPlayerAX_Win32.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = mysweet.home
O17 - HKLM\Software\..\Telephony: DomainName = mysweet.home
O17 - HKLM\System\CCS\Services\Tcpip\..\{65B8EB9D-F1AC-4977-8377-D471D97BE0A1}: NameServer = 195.238.2.22
O17 - HKLM\System\CCS\Services\Tcpip\..\{8CC62E68-CC60-4051-A532-DD1BD760E7AB}: Domain = mysweet.home
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = mysweet.home
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
O23 - Service: Apache - Unknown owner - c:\eZpublish\apache\apache.exe" –ntservice (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: ServersCheck Monitoring Service (ServersCheck) - ServersCheck BVBA - C:\Program Files\ServersCheck_Monitoring\s-service.exe
O23 - Service: ServersCheck Configuration Service (ServersCheck Configuration) - ServersCheck, a division of Eklatant - C:\Program Files\ServersCheck_Monitoring\server-service.exe
O23 - Service: Moteur Webroot Spy Sweeper (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
O23 - Service: Washer Security Access (wwSecSvc) - Webroot Software, Inc. - C:\WINDOWS\system32\wwSecure.exe
Post #2
First download ewido anti-spyware from HERE and save that file to your
desktop.
This is a 30 day trial of the program
  • Once you have downloaded ewido anti-spyware, locate the icon on the desktop
    and double-click it to launch the set up program.
  • Once the setup is complete you will need run ewido and update the definition
    files.
  • On the main screen select the icon "Update" then select the "
    Update now    " link.
    • Next select the "Start Update" button, the update will start and a
      progress bar will show the updates being installed.
  • Once the update has completed select the "Scanner" icon at the top of
    the screen, then select the "Settings" tab.
  • Once in the Settings screen click on "Recommended actions" and then
    select "Quarantine".
  • Under "Reports"
    • Select "Automatically generate report after every scan"
    • Un-Select "Only if threats were found"
Close ewido anti-spyware, Do Not run a scan just yet, we will shortly.
  • Reboot your computer into SafeMode. You can do this by restarting
    your computer and continually tapping the F8 key until a menu appears.

    Use your up arrow key to highlight SafeMode then hit enter.
    IMPORTANT: Do not open any other windows or
    programs while ewido is scanning, it may interfere with the scanning proccess:
  • Lauch ewido-anti-spyware by double-clicking the icon on your desktop.
  • Select the "Scanner" icon at the top and then the "Scan" tab
    then click on "Complete System Scan".
  • ewido will now begin the scanning process, be patient this may take a little
    time.
    Once the scan is complete do the following:
  • If you have any infections you will prompted, then select "Apply all
    actions    "
  • Next select the "Reports" icon at the top.
  • Select the "Save report as" button in the lower left hand of the
    screen and save it to a text file on your system (make sure to remember where
    you saved that file, this is important).
  • Close ewido and reboot your system back into Normal Mode and post the
    results of the ewido report scan.
Please do not put you log in quates this time.
Post #3
here is my ewido scan report (the amoks are still there) ——————————————————— ewido anti-spyware - Scan Report ——————————————————— + Created at: 9:40:19 13/08/2006 + Scan result: C:\Program Files\NewDotNet -> Adware.NewDotNet : Cleaned with backup (quarantined). C:\Program Files\NewDotNet\newdotnet3_88.dll -> Adware.NewDotNet : Cleaned with backup (quarantined). C:\Program Files\NewDotNet\readme.html -> Adware.NewDotNet : Cleaned with backup (quarantined). C:\Program Files\NewDotNet\readme.txt -> Adware.NewDotNet : Cleaned with backup (quarantined). C:\Program Files\NewDotNet\uninstall3_88.exe -> Adware.NewDotNet : Cleaned with backup (quarantined). C:\Program Files\NewDotNet\uninstall6_38.exe -> Adware.NewDotNet : Cleaned with backup (quarantined). C:\WINDOWS\NDNuninstall6_38.exe -> Adware.NewDotNet : Cleaned with backup (quarantined). C:\Documents and Settings\Noel\Mes documents\clonecd\SlySoft_CloneCD_5.2.9.1.zip/startxxx.exe -> Downloader.Zlob.aco : Cleaned with backup (quarantined). C:\Program Files\RealVNC\VNC4\winvnc4.exe -> Not-A-Virus.RemoteAdmin.Win32.WinVNC.4110 : Cleaned with backup (quarantined). :mozilla.703:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned with backup (quarantined). :mozilla.704:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned with backup (quarantined). :mozilla.705:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned with backup (quarantined). :mozilla.706:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned with backup (quarantined). :mozilla.707:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned with backup (quarantined). :mozilla.708:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned with backup (quarantined). :mozilla.632:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.633:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.634:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.635:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.636:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.637:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.638:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.639:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.640:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.641:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.642:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.643:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.645:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.646:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.647:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.648:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.649:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.652:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.653:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.654:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.655:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.656:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.657:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.658:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.659:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.660:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.661:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.662:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.663:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.6:C:\Documents and Settings\Noel\Application Data\Mozilla\Profiles\default\41x57daf.slt\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.782:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.7:C:\Documents and Settings\Noel\Application Data\Mozilla\Profiles\default\41x57daf.slt\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). :mozilla.201:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned with backup (quarantined). :mozilla.202:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned with backup (quarantined). :mozilla.203:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned with backup (quarantined). :mozilla.214:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup (quarantined). :mozilla.215:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup (quarantined). :mozilla.237:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Adtech : Cleaned with backup (quarantined). :mozilla.238:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Adtech : Cleaned with backup (quarantined). :mozilla.292:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.296:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.297:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). :mozilla.351:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned with backup (quarantined). :mozilla.249:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Bluestreak : Cleaned with backup (quarantined). :mozilla.360:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned with backup (quarantined). :mozilla.361:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned with backup (quarantined). :mozilla.773:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined). :mozilla.381:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup (quarantined). :mozilla.382:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup (quarantined). :mozilla.383:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup (quarantined). :mozilla.384:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup (quarantined). :mozilla.734:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup (quarantined). :mozilla.735:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup (quarantined). :mozilla.875:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup (quarantined). :mozilla.879:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup (quarantined). :mozilla.884:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup (quarantined). :mozilla.885:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup (quarantined). :mozilla.886:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup (quarantined). :mozilla.887:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup (quarantined). :mozilla.888:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup (quarantined). :mozilla.891:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup (quarantined). :mozilla.896:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup (quarantined). :mozilla.900:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup (quarantined). :mozilla.901:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup (quarantined). :mozilla.903:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup (quarantined). :mozilla.519:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Comclick : Cleaned with backup (quarantined). :mozilla.520:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Comclick : Cleaned with backup (quarantined). :mozilla.521:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Comclick : Cleaned with backup (quarantined). :mozilla.522:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Comclick : Cleaned with backup (quarantined). :mozilla.340:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Coremetrics : Cleaned with backup (quarantined). :mozilla.895:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Cqcounter : Cleaned with backup (quarantined). :mozilla.247:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned with backup (quarantined). :mozilla.63:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Estat : Cleaned with backup (quarantined). C:\Documents and Settings\Noel\Cookies\noel@estat[2].txt -> TrackingCookie.Estat : Cleaned with backup (quarantined). :mozilla.342:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Etracker : Cleaned with backup (quarantined). :mozilla.669:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup (quarantined). :mozilla.670:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup (quarantined). :mozilla.246:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined). :mozilla.359:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined). :mozilla.15:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup (quarantined). :mozilla.389:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined). :mozilla.390:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined). :mozilla.391:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined). :mozilla.526:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined). :mozilla.527:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined). :mozilla.528:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined). :mozilla.529:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined). :mozilla.530:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined). :mozilla.531:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined). :mozilla.532:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined). :mozilla.618:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined). :mozilla.915:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined). :mozilla.148:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Hotlog : Cleaned with backup (quarantined). :mozilla.892:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup (quarantined). :mozilla.893:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup (quarantined). :mozilla.894:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup (quarantined). :mozilla.49:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned with backup (quarantined). :mozilla.784:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Myaffiliateprogram : Cleaned with backup (quarantined). :mozilla.315:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Overture : Cleaned with backup (quarantined). :mozilla.316:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Overture : Cleaned with backup (quarantined). :mozilla.880:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup (quarantined). :mozilla.881:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup (quarantined). :mozilla.882:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup (quarantined). :mozilla.883:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup (quarantined). :mozilla.205:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Revenue : Cleaned with backup (quarantined). :mozilla.554:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined). :mozilla.555:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined). :mozilla.556:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined). :mozilla.557:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined). :mozilla.558:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined). :mozilla.559:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined). :mozilla.560:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined). :mozilla.418:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned with backup (quarantined). :mozilla.419:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned with backup (quarantined). :mozilla.90:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned with backup (quarantined). :mozilla.91:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned with backup (quarantined). :mozilla.92:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned with backup (quarantined). :mozilla.93:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned with backup (quarantined). :mozilla.11:C:\Documents and Settings\Noel\Application Data\Mozilla\Profiles\default\41x57daf.slt\cookies.txt -> TrackingCookie.Spylog : Cleaned with backup (quarantined). :mozilla.160:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.161:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.162:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.163:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.164:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.165:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.166:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.167:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.168:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.169:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.170:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.171:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.172:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.173:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.174:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.175:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.176:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.177:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.178:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.179:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.180:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.181:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.182:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.183:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.184:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.185:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.186:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.187:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.188:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.189:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.190:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.191:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.192:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.193:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.194:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.195:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.196:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.197:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.198:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined). :mozilla.545:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined). :mozilla.546:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined). :mozilla.52:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup (quarantined). :mozilla.53:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup (quarantined). :mozilla.54:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup (quarantined). :mozilla.56:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup (quarantined). :mozilla.57:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup (quarantined). :mozilla.232:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned with backup (quarantined). :mozilla.287:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Valueclick : Cleaned with backup (quarantined). :mozilla.20:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Weborama : Cleaned with backup (quarantined). :mozilla.25:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Weborama : Cleaned with backup (quarantined). :mozilla.26:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Weborama : Cleaned with backup (quarantined). :mozilla.12:C:\Documents and Settings\Noel\Application Data\Mozilla\Profiles\default\41x57daf.slt\cookies.txt -> TrackingCookie.Yadro : Cleaned with backup (quarantined). :mozilla.150:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Yadro : Cleaned with backup (quarantined). :mozilla.155:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). :mozilla.156:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). :mozilla.157:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). :mozilla.876:C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup (quarantined). ::Report end
Post #4
Hi,

a new scan with ewido didn't found anything
———————————————————
ewido anti-spyware - Scan Report
———————————————————

+ Created at: 11:08:07 13/08/2006

+ Scan result:



Nothing found.


::Report end


amoks are still there as youn can see in my HijackThis log

Logfile of HijackThis v1.99.1
Scan saved at 11:17:27, on 13/08/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\oodag.exe
C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\Dit.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxtray.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\Program Files\GetRight\getright.exe
C:\Program Files\Mozilla Thunderbird\thunderbird.exe
C:\WINDOWS\system32\wwSecure.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CNetscape_France.src"); (C:\Documents and Settings\Noel\Application Data\Mozilla\Profiles\default\41x57daf.slt\prefs.js)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -onlytray
O4 - HKLM\..\Run: [Dimension4] C:\Program Files\D4\D4.exe
O4 - HKLM\..\Run: [Absolute StartUp monitor] C:\Program Files\F-Group\Absolute StartUp\ASMon.exe
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [Amok dupe face save] C:\Documents and Settings\All Users\Application Data\creativechicamokdupe\exit acid.exe
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [Default Iso] C:\DOCUME~1\Noel\APPLIC~1\GPLJUN~1\The Grey.exe
O4 - Startup: Mozilla Thunderbird.lnk = C:\Program Files\Mozilla Thunderbird\thunderbird.exe
O4 - Global Startup: GetRight - Tray Icon.lnk = C:\Program Files\GetRight\getright.exe
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Program Files\IrfanView\Ebay\Ebay.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .csm: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .csml: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .cub: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .cube: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .dx: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .emb: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .embl: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .gau: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .jdx: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .mol: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .mop: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .pdb: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .rxn: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .scr: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .skc: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .spt: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .tgf: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .xyz: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {68A2C3BD-7809-11D3-8ACF-0050046F2F9A} (AXELPlayer Class) - http://www.lachimie.com/AXELPlayerAX_Win32.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111…all/xscan53.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = mysweet.home
O17 - HKLM\Software\..\Telephony: DomainName = mysweet.home
O17 - HKLM\System\CCS\Services\Tcpip\..\{65B8EB9D-F1AC-4977-8377-D471D97BE0A1}: NameServer = 195.238.2.22
O17 - HKLM\System\CCS\Services\Tcpip\..\{8CC62E68-CC60-4051-A532-DD1BD760E7AB}: Domain = mysweet.home
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = mysweet.home
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
O23 - Service: Apache - Unknown owner - c:\eZpublish\apache\apache.exe" –ntservice (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: ServersCheck Monitoring Service (ServersCheck) - ServersCheck BVBA - C:\Program Files\ServersCheck_Monitoring\s-service.exe
O23 - Service: ServersCheck Configuration Service (ServersCheck Configuration) - ServersCheck, a division of Eklatant - C:\Program Files\ServersCheck_Monitoring\server-service.exe
O23 - Service: Moteur Webroot Spy Sweeper (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
O23 - Service: Washer Security Access (wwSecSvc) - Webroot Software, Inc. - C:\WINDOWS\system32\wwSecure.exe
Post #5
Scan with hijackthis and put a check beside these lines and choose FIX

O4 - HKCU\..\Run: [Amok dupe face save] C:\Documents and Settings\All Users\Application Data\creativechicamokdupe\exit acid.exe

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111…all/xscan53.cab

Reboot to safe mode (tap f8 while bios loads)

Then look for and delete this folder if present

C:\Documents and Settings\All Users\Application Data\creativechicamokdupe <<
Reboot and post a new hijackthis log please.
Post #6
no C:\Documents and Settings\All Users\Application Data\creativechicamokdupe <<
and this is my hjt log with still the amoks

Logfile of HijackThis v1.99.1
Scan saved at 16:12:08, on 13/08/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wwSecure.exe
C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\Dit.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxtray.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\GetRight\getright.exe
C:\Program Files\Mozilla Thunderbird\thunderbird.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\HijackThis\HijackThis.exe
C:\Program Files\Alwil Software\Avast4\setup\avast.setup

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CNetscape_France.src"); (C:\Documents and Settings\Noel\Application Data\Mozilla\Profiles\default\41x57daf.slt\prefs.js)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -onlytray
O4 - HKLM\..\Run: [Dimension4] C:\Program Files\D4\D4.exe
O4 - HKLM\..\Run: [Absolute StartUp monitor] C:\Program Files\F-Group\Absolute StartUp\ASMon.exe
O4 - HKLM\..\Run: [Amok dupe face save] C:\Documents and Settings\All Users\Application Data\creativechicamokdupe\Pop Pile.exe
O4 - HKLM\..\RunOnce: [WinSideBySideSetupCleanup 1802562] rundll32 sxs.dll,SxspRunDllDeleteDirectory C:\WINDOWS\WinSxS\InstallTemp\1802562
O4 - HKLM\..\RunOnce: [WinSideBySideSetupCleanup 1803555] rundll32 sxs.dll,SxspRunDllDeleteDirectory C:\WINDOWS\WinSxS\InstallTemp\1803555
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [Default Iso] C:\DOCUME~1\Noel\APPLIC~1\GPLJUN~1\The Grey.exe
O4 - HKCU\..\Run: [Amok dupe face save] C:\Documents and Settings\All Users\Application Data\creativechicamokdupe\exit acid.exe
O4 - Startup: Mozilla Thunderbird.lnk = C:\Program Files\Mozilla Thunderbird\thunderbird.exe
O4 - Global Startup: GetRight - Tray Icon.lnk = C:\Program Files\GetRight\getright.exe
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Program Files\IrfanView\Ebay\Ebay.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .csm: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .csml: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .cub: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .cube: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .dx: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .emb: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .embl: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .gau: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .jdx: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .mol: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .mop: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .pdb: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .rxn: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .scr: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .skc: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .spt: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .tgf: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .xyz: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {68A2C3BD-7809-11D3-8ACF-0050046F2F9A} (AXELPlayer Class) - http://www.lachimie.com/AXELPlayerAX_Win32.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = mysweet.home
O17 - HKLM\Software\..\Telephony: DomainName = mysweet.home
O17 - HKLM\System\CCS\Services\Tcpip\..\{65B8EB9D-F1AC-4977-8377-D471D97BE0A1}: NameServer = 195.238.2.22
O17 - HKLM\System\CCS\Services\Tcpip\..\{8CC62E68-CC60-4051-A532-DD1BD760E7AB}: Domain = mysweet.home
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = mysweet.home
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
O23 - Service: Apache - Unknown owner - c:\eZpublish\apache\apache.exe" –ntservice (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: ServersCheck Monitoring Service (ServersCheck) - ServersCheck BVBA - C:\Program Files\ServersCheck_Monitoring\s-service.exe
O23 - Service: ServersCheck Configuration Service (ServersCheck Configuration) - ServersCheck, a division of Eklatant - C:\Program Files\ServersCheck_Monitoring\server-service.exe
O23 - Service: Moteur Webroot Spy Sweeper (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
O23 - Service: Washer Security Access (wwSecSvc) - Webroot Software, Inc. - C:\WINDOWS\system32\wwSecure.exe
Post #7 last edited
Download http://swandog46.geekstogo.com/avenger.zip by Swandog46, and save it to your Desktop. Extract avenger.exe from the Zip file and save it to your desktop

Run avenger.exe by double-clicking on it.
Check the 'Input script manually' box.
Click on the magnifying glass icon.
Copy everything in the code box below (don't copy the word "CODE in the box header, just the box contents starting at Files to delete) and paste it in the box that opens:

WARNING: This script is not a general fix. If you are not this user, running this script could damage your system



Files to delete:
C:\Documents and Settings\All Users\Application Data\creativechicamokdupe\exit acid.exe


Folders to delete:
C:\Documents and Settings\All Users\Application Data\creativechicamokdupe



Now click the 'Done' button.
Click on the traffic light icon and OK the prompt.
You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it manually.

Please post a new HijackThis log and the log file from Avenger at C:\avenger.txt
Post #8
avenger.txt

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\lkbtcptk

*******************

Script file located at: \??\C:\Program Files\rufaaqyc.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:



Could not open file C:\Documents and Settings\All Users\Application Data\creativechicamokdupe\exit acid.exe for deletion
Deletion of file C:\Documents and Settings\All Users\Application Data\creativechicamokdupe\exit acid.exe failed!

Could not process line:
C:\Documents and Settings\All Users\Application Data\creativechicamokdupe\exit acid.exe
Status: 0xc000003a



Folder C:\Documents and Settings\All Users\Application Data\creativechicamokdupe not found!
Deletion of folder C:\Documents and Settings\All Users\Application Data\creativechicamokdupe failed!

Could not process line:
C:\Documents and Settings\All Users\Application Data\creativechicamokdupe
Status: 0xc0000034


Completed script processing.

hjt log file

Logfile of HijackThis v1.99.1
Scan saved at 18:56:20, on 13/08/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\Dit.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxtray.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\GetRight\getright.exe
C:\Program Files\Mozilla Thunderbird\thunderbird.exe
C:\WINDOWS\system32\wwSecure.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\PROGRA~1\MOBILE~1\bin\DESProxy.exe
C:\PROGRA~1\MOBILE~1\bin\SPHONE~1.EXE
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\cidaemon.exe
C:\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CNetscape_France.src"); (C:\Documents and Settings\Noel\Application Data\Mozilla\Profiles\default\41x57daf.slt\prefs.js)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -onlytray
O4 - HKLM\..\Run: [Dimension4] C:\Program Files\D4\D4.exe
O4 - HKLM\..\Run: [Absolute StartUp monitor] C:\Program Files\F-Group\Absolute StartUp\ASMon.exe
O4 - HKLM\..\Run: [Amok dupe face save] C:\Documents and Settings\All Users\Application Data\creativechicamokdupe\Pop Pile.exe
O4 - HKLM\..\Run: [lwatapys] C:\vvarnfxm.bat
O4 - HKLM\..\RunOnce: [WinSideBySideSetupCleanup 1802562] rundll32 sxs.dll,SxspRunDllDeleteDirectory C:\WINDOWS\WinSxS\InstallTemp\1802562
O4 - HKLM\..\RunOnce: [WinSideBySideSetupCleanup 1803555] rundll32 sxs.dll,SxspRunDllDeleteDirectory C:\WINDOWS\WinSxS\InstallTemp\1803555
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [Default Iso] C:\DOCUME~1\Noel\APPLIC~1\GPLJUN~1\The Grey.exe
O4 - HKCU\..\Run: [Amok dupe face save] C:\Documents and Settings\All Users\Application Data\creativechicamokdupe\exit acid.exe
O4 - Startup: Mozilla Thunderbird.lnk = C:\Program Files\Mozilla Thunderbird\thunderbird.exe
O4 - Global Startup: GetRight - Tray Icon.lnk = C:\Program Files\GetRight\getright.exe
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Program Files\IrfanView\Ebay\Ebay.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .csm: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .csml: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .cub: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .cube: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .dx: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .emb: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .embl: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .gau: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .jdx: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .mol: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .mop: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .pdb: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .rxn: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .scr: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .skc: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .spt: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .tgf: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .xyz: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {68A2C3BD-7809-11D3-8ACF-0050046F2F9A} (AXELPlayer Class) - http://www.lachimie.com/AXELPlayerAX_Win32.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = mysweet.home
O17 - HKLM\Software\..\Telephony: DomainName = mysweet.home
O17 - HKLM\System\CCS\Services\Tcpip\..\{65B8EB9D-F1AC-4977-8377-D471D97BE0A1}: NameServer = 195.238.2.22
O17 - HKLM\System\CCS\Services\Tcpip\..\{8CC62E68-CC60-4051-A532-DD1BD760E7AB}: Domain = mysweet.home
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = mysweet.home
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
O23 - Service: Apache - Unknown owner - c:\eZpublish\apache\apache.exe" –ntservice (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: ServersCheck Monitoring Service (ServersCheck) - ServersCheck BVBA - C:\Program Files\ServersCheck_Monitoring\s-service.exe
O23 - Service: ServersCheck Configuration Service (ServersCheck Configuration) - ServersCheck, a division of Eklatant - C:\Program Files\ServersCheck_Monitoring\server-service.exe
O23 - Service: Moteur Webroot Spy Sweeper (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
O23 - Service: Washer Security Access (wwSecSvc) - Webroot Software, Inc. - C:\WINDOWS\system32\wwSecure.exe
Post #9
Please disable ewido guardans sptsweeper or it could block the fix

Download TheKillbox from here http://www.downloads.subratam.org/KillBox.zip Save to your Desktop and double click it to open it up. In the 'Enter Full Path and Filename to Delete' box, copy and paste these entries one by one, clicking 'Find and Kill This File' after each one:

C:\Documents and Settings\All Users\Application Data\creativechicamokdupe\Pop Pile.exe

C:\Documents and Settings\All Users\Application Data\creativechicamokdupe\exit acid.exe

Next scan with hijackthis and put a chck beside these lines and choose FIX

O4 - HKLM\..\Run: [Amok dupe face save] C:\Documents and Settings\All Users\Application Data\creativechicamokdupe\Pop Pile.exe
O4 - HKLM\..\RunOnce: [WinSideBySideSetupCleanup 1802562] rundll32 sxs.dll,SxspRunDllDeleteDirectory C:\WINDOWS\WinSxS\InstallTemp\1802562
O4 - HKLM\..\RunOnce: [WinSideBySideSetupCleanup 1803555] rundll32 sxs.dll,SxspRunDllDeleteDirectory C:\WINDOWS\WinSxS\InstallTemp\1803555

O4 - HKCU\..\Run: [Amok dupe face save] C:\Documents and Settings\All Users\Application Data\creativechicamokdupe\exit acid.exe

Next, make sure all hidden files are visable

Windows XP
Click Start.

Open My Computer.

Select the Tools menu and click Folder Options.

Select the View Tab.

Under the Hidden files and folders heading select Show hidden files and folders.

Uncheck the Hide protected operating system files (recommended) option.

Click Yes to confirm.

Click OK.

Then look for and delete this folder if present

C:\Documents and Settings\All Users\Application Data\creativechicamokdupe

Reboot

Please scan these at the link below and posts the logs
O4 - HKLM\..\Run: [lwatapys] C:\vvarnfxm.bat
O4 - HKCU\..\Run: [Default Iso] C:\DOCUME~1\Noel\APPLIC~1\GPLJUN~1\The Grey.exe

Scan here >>>> http://virusscan.jotti.org/

Also need a new hijackthis log please.
Post #10
C:\Documents and Settings\All Users\Application Data\creativechicamokdupe\Pop Pile.exe
C:\Documents and Settings\All Users\Application Data\creativechicamokdupe\exit acid.exe
C:\DOCUME~1\Noel\APPLIC~1\GPLJUN~1\The Grey.exe

files and folders doesn't exist!

C:\vvarnfxm.bat was from avenger.exe and I deleted this item.

strange: I don't have a Nokia mobile phone (I installed once and removed the nokia pcsuite software a long time ago!)

O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -onlytray
O4 - HKLM\..\Run: [Dimension4] C:\Program Files\D4\D4.exe
O4 - HKLM\..\Run: [Absolute StartUp monitor] C:\Program Files\F-Group\Absolute StartUp\ASMon.exe
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog

those files nor directories doesn't exist on my HD!

no change in the HJT
Logfile of HijackThis v1.99.1
Scan saved at 21:56:54, on 13/08/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\Dit.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxtray.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\GetRight\getright.exe
C:\Program Files\Mozilla Thunderbird\thunderbird.exe
C:\WINDOWS\system32\wwSecure.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\PROGRA~1\MOBILE~1\bin\DESProxy.exe
C:\PROGRA~1\MOBILE~1\bin\SPHONE~1.EXE
C:\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CNetscape_France.src"); (C:\Documents and Settings\Noel\Application Data\Mozilla\Profiles\default\41x57daf.slt\prefs.js)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -onlytray
O4 - HKLM\..\Run: [Dimension4] C:\Program Files\D4\D4.exe
O4 - HKLM\..\Run: [Absolute StartUp monitor] C:\Program Files\F-Group\Absolute StartUp\ASMon.exe
O4 - HKLM\..\Run: [Amok dupe face save] C:\Documents and Settings\All Users\Application Data\creativechicamokdupe\Pop Pile.exe
O4 - HKLM\..\RunOnce: [WinSideBySideSetupCleanup 1802562] rundll32 sxs.dll,SxspRunDllDeleteDirectory C:\WINDOWS\WinSxS\InstallTemp\1802562
O4 - HKLM\..\RunOnce: [WinSideBySideSetupCleanup 1803555] rundll32 sxs.dll,SxspRunDllDeleteDirectory C:\WINDOWS\WinSxS\InstallTemp\1803555
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [Default Iso] C:\DOCUME~1\Noel\APPLIC~1\GPLJUN~1\The Grey.exe
O4 - HKCU\..\Run: [Amok dupe face save] C:\Documents and Settings\All Users\Application Data\creativechicamokdupe\exit acid.exe
O4 - Startup: Mozilla Thunderbird.lnk = C:\Program Files\Mozilla Thunderbird\thunderbird.exe
O4 - Global Startup: GetRight - Tray Icon.lnk = C:\Program Files\GetRight\getright.exe
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Program Files\IrfanView\Ebay\Ebay.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .csm: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .csml: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .cub: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .cube: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .dx: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .emb: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .embl: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .gau: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .jdx: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .mol: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .mop: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .pdb: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .rxn: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .scr: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .skc: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .spt: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .tgf: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .xyz: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {68A2C3BD-7809-11D3-8ACF-0050046F2F9A} (AXELPlayer Class) - http://www.lachimie.com/AXELPlayerAX_Win32.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = mysweet.home
O17 - HKLM\Software\..\Telephony: DomainName = mysweet.home
O17 - HKLM\System\CCS\Services\Tcpip\..\{65B8EB9D-F1AC-4977-8377-D471D97BE0A1}: NameServer = 195.238.2.22
O17 - HKLM\System\CCS\Services\Tcpip\..\{8CC62E68-CC60-4051-A532-DD1BD760E7AB}: Domain = mysweet.home
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = mysweet.home
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
O23 - Service: Apache - Unknown owner - c:\eZpublish\apache\apache.exe" –ntservice (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: ServersCheck Monitoring Service (ServersCheck) - ServersCheck BVBA - C:\Program Files\ServersCheck_Monitoring\s-service.exe
O23 - Service: ServersCheck Configuration Service (ServersCheck Configuration) - ServersCheck, a division of Eklatant - C:\Program Files\ServersCheck_Monitoring\server-service.exe
O23 - Service: Moteur Webroot Spy Sweeper (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
O23 - Service: Washer Security Access (wwSecSvc) - Webroot Software, Inc. - C:\WINDOWS\system32\wwSecure.exe
Post #11
Download Blacklight Beta from here:
http://www.f-secure.com/blacklight/try.shtml
Hit I accept. It will take you to download page.
Download blbeta.exe and save it to the Desktop.
Once saved… double click blbeta.exe to install the program.
Click accept agreement and Click scan
This app too may fire off a warning from antivirus. Let the driver load.
Wait for it to finish.
If it displays any items…don't do anything with them yet. Just hit exit (close)
It will drop a log on Desktop that starts with fsbl….big number
Please post contents of log.

NEXT

Please do an online scan with Kaspersky Online Scanner

You will be promted to install an ActiveX component from Kaspersky, Click Yes.
  • The program will launch and then start to download the latest definition files.
  • Once the scanner is installed and the definitions downloaded, click Next.
  • Now click on Scan Settings
  • In the scan settings make that the following are selected:
    • Scan using the following Anti-Virus database:
      • Extended (If available otherwise Standard)
    • Scan Options:
      • Scan Archives
      • Scan Mail Bases
  • Click OK
  • Now under select a target to scan select My Computer
  • The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
  • Now click on the Save as Text button:
  • Save the file to your desktop.
  • Copy and paste that information in your next post as well as a bew hijackthis log please.
Post #12
here are the asked log files
I start also a deep Trend Micro™ Anti-Spyware for the Web - Free Online Spyware Scan
at http://www.trendmicro.com/spyware-scan/free_spyware_scan.asp

and I will send you the results as soon I get them (the scan takes a while!)

blacklight log file
08/14/06 09:07:03 [Info]: BlackLight Engine 1.0.42 initialized
08/14/06 09:07:03 [Info]: OS: 5.1 build 2600 (Service Pack 2)
08/14/06 09:07:03 [Note]: 7019 4
08/14/06 09:07:03 [Note]: 7005 0
08/14/06 09:07:40 [Note]: 7006 0
08/14/06 09:07:40 [Note]: 7011 2680
08/14/06 09:07:41 [Note]: 7026 0
08/14/06 09:07:41 [Note]: 7026 0
08/14/06 09:08:06 [Note]: FSRAW library version 1.7.1019
08/14/06 09:26:01 [Note]: 7007 0

kaspersky log file

——————————————————————————-
KASPERSKY ONLINE SCANNER REPORT
Monday, August 14, 2006 1:34:29 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 14/08/2006
Kaspersky Anti-Virus database records: 214633
——————————————————————————-

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\
Y:\

Scan Statistics:
Total number of scanned objects: 137901
Number of viruses found: 10
Number of infected objects: 69 / 0
Number of suspicious objects: 0
Duration of the scan process: 03:32:06

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Data\settings.dat Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS028202B1-E6C6-455E-878E-12C9E99BB7FF.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS03C1101C-73FC-40A6-9B23-E77234867540.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS05273F77-80ED-4727-8E55-2304AF82C2D9.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS05E78E23-5EB6-45DB-BBE7-9A2F9D03B4BA.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS089DB02E-3042-471F-BCE1-7403DF5B8D5E.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS09F177FE-1933-4309-9E04-3E82D21999E5.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS0A1CB8F4-AB28-487F-8E57-FFCF71B92FD9.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS0AB02920-8291-4161-9A98-4FF54E64C6AB.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS0AD07492-852B-462A-9319-2F852FD2C3F9.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS0BBC7574-A814-41F3-AED1-41FA41B3015A.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS0F278818-184E-463D-BA11-4A9D1E907771.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS110D14AF-A1B0-4033-A27E-6ED9ACFC506E.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS11114F4B-0124-469C-A45B-B8F5B08CDEA2.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS12C8E4C4-C7BE-40BF-BB9F-6DFBAE925991.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS16A47203-901A-4A1A-A85F-F2CC3D8577EF.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS19383802-4EA1-4236-A1E4-BCA7A2ABE8A0.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS1A76F5ED-44A4-4B1A-8C38-71284974108F.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS1B58D83E-6CB9-4ECB-BC9A-FB517632F692.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS1B8E279F-939A-4F63-A9F7-6E8F6BF51306.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS1E6CF3B3-6B77-4CF1-872F-48BC89A4E94B.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS1EE5475D-FE57-4D9E-B35D-8A771D337861.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS2000FD49-D373-4F9F-8E52-9A9E24EAEF46.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS2168E82E-890E-4F7F-A9CF-4DAB29D48128.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS2356F96B-7CED-4D3C-98BD-C69A98D9C1B6.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS2C4E3417-0056-4DBA-955E-F0597EABAEF7.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS2D01D2CF-624C-4F96-94C6-A703D407C64C.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS2F947D49-DA92-4D34-B7F6-F963A53C5B5E.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS3188F9C0-1750-41EE-82D7-4EEBB3758CEE.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS35C2DFC6-B81D-4CE2-8452-1DBEDF1E1BA0.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS3771C9F0-0CB0-4564-8174-0F27B055F038.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS3AFB4738-F171-42AF-A28B-9BF8936E0CCF.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS40870F12-E77B-452D-9731-FC916C75D7D7.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS41E059DC-0678-4BB0-A513-5F025FEFEE9B.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS46463F70-2122-404D-A3CC-D03BADBC32A3.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS4832BFB3-9C9A-4631-9A35-4A7562F6596E.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS48CF3901-21B0-44EE-B5CA-449122499680.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS490E5FB7-8324-4A27-ABB9-903CD2A32DC3.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS4DDCC479-1D6B-4A30-8228-64F69B0CCE42.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS4FC5D67F-2C7C-451A-9ED7-9EF97B555012.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS55385D7F-DFF2-4FD8-9238-E2753048EFA4.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS56FA3C30-1D27-4E74-9EE9-678057F80FAB.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS57A7BB5C-287C-421C-AD80-78CF405F1685.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS5AAAFE2A-D26B-4829-AC3B-E2B6A766F72B.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS5DD8D7D5-A332-4200-BFAF-5C455217D32B.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS5EB24D7A-7CC9-4930-8D39-7293C79DCAF2.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS5EFF283C-FE64-420B-8663-1454906F8DDC.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS5FDF74DA-6FAF-4A8D-B94A-867F07E94A84.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS601C595D-B627-42CD-977C-656E95680F52.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS60F9499D-2BC9-44E6-BA01-4D3F6BEF9E06.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS621E88F2-EEE9-434D-8470-93AD110344E6.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS66E2F3B3-4A69-4EE6-8085-3AB4130A10F9.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS6A5392CB-E6A1-4AB2-B881-023F1E4D3A9A.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS6AB33E19-4717-486A-9E62-6042A198ED24.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS71406EDC-C133-41B9-9AA7-4A1EAA9EA692.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS715BBA1C-A93C-4CF9-8590-A3C021485D91.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS71C53909-58AA-4757-9508-613C52E48EBC.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS730C462A-D23E-4FBD-A033-752912868DA4.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS76E6BA9A-3F47-43E8-8CEC-40A57A1C38FB.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS793A1056-D36A-4ED3-9DD3-C1F88C8E6FC3.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS7C196831-F87C-4086-9E6A-25FC358925CF.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS7CFDCD0B-7390-4C44-8D36-429D52C76386.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS849A8BBD-4AD3-4C6B-975F-FF9D4D61EC4D.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS8591BD55-0550-4354-82DC-F7032FE3BBFE.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS869ACD45-9BDE-437C-9849-6C9696B5A2BE.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS886738C7-51D2-4FCE-8D14-EA8D76E460C3.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS8C05300E-56C0-4C18-850B-CA3C4D5ECE0E.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS8CFD12ED-BAB8-4BF6-BDE1-76659DBE075A.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS8DB07C1B-C7D1-4A73-A2F3-2B747117DBD6.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS8F704442-85E7-42D3-962D-BF1A98EE600C.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS9173AB17-B616-4697-8219-5DCFBE31B08A.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS9182697D-6CF0-49AA-9571-2962C164AEF2.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS9622B4FF-DB04-49F6-8E5C-753EE50354B6.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS9E2ACB96-0529-4443-8FB0-F68ED3323BE9.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS9F633D7D-12AC-4FAC-89AD-7C66D9B56A28.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSA55102D0-9AC0-4A5E-87BC-7E5AA094B361.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSA55E2F43-C16E-4CF8-A8D4-E2CD11B2E1A6.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSAB50E3D2-1DDC-408E-9491-5D5C065A884A.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSABB178B0-2248-485E-BDE8-09D22773347B.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSAE44D167-C394-4DB9-8710-7B1958327FC8.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSAED83EB9-22D1-4D2B-8397-C2312FDF8FEB.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSB05A96CB-B0AE-4513-AFE4-1212214E99F3.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSB190CAB0-7577-4910-8580-BC3FD163B0D0.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSB4952E4F-07E7-4AFF-9326-38E05E5613FE.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSB6F96935-BF79-4A08-ADA1-A1C8127B40FC.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSBC649536-A4F2-4B2D-A82C-6DCCAF14D81E.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSC0BF10F0-08A1-4BAD-BBEB-330A9DE6A96F.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSC7D8CE19-7F6D-4FB6-BD55-3B8DB649A3C8.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSC80B8E92-7E14-415B-ACFF-F927D5685E88.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSCAB312F1-64E2-440F-B4D7-5D827EA9347D.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSCB401765-D365-4AD4-A1A8-597D072FFDF1.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSCC3883B8-42BF-4101-BE49-021200ADED1E.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSCE8CD2A3-B4C6-4138-B54B-4854B068774F.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSCF668018-93F9-4DC5-BFA9-79B60DC4F7C6.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSD34EF699-5C6F-45ED-A3E9-C68E3015B35E.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSD3850D19-FA9C-4259-B8FD-DF8A137D8F9C.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSD4FAD013-187C-4238-A5D9-4ED3785EA9DD.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSD7B20DDE-5869-46E6-81E7-879AF36EBC2E.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSDD43E1E7-4BB3-4FFD-80BF-C2F2EE0C4AAB.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSDDBD4443-F2D3-4ACF-9ADA-0CB865054108.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSE415595D-63B2-4E40-93AB-393DEE31A7E6.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSE693CD79-9848-4CC3-A4CE-61F793C12A17.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSE7AD222B-6A9D-492F-B0DF-FE52B4BF6ABB.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSE7E9BBFB-10B8-4FE8-A333-E435902C6CA3.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSEAF2FCED-D847-4C0E-8BDD-1CEAB1650D3B.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSEBC2333A-C57C-43A4-8F6B-6ECC87804FDC.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSEEE7A5EC-D8FA-4ADA-9688-9A3B0E80C8F6.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSF7716724-3AEF-43AB-8CBE-313001D3334B.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSF9051442-B4C8-4AB4-A52F-462B4B05704C.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSF9EB05BA-C9A7-487B-A424-41580DF95040.tmp Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Historique\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\cert8.db Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\flashgot.log Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\formhistory.dat Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\history.dat Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\key3.db Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Mozilla\Firefox\Profiles\trtdgkv7.default\parent.lock Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\abook.mab Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\cert8.db Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\key3.db Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\Local Folders\Inbox.msf Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\Local Folders\Junk.msf Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\Local Folders\Templates.msf Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\Local Folders\Trash.msf Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\mail.la57ieme-1.net\Inbox/[From "Claire Tassin" <[removed]>][Date Sun, 7 Aug 2005 19:45:53 +0200]/UNNAMED/[From processed: message from valid local sender)][Date Fri, 9 Sep 2005 12:24:11 +0200]/UNNAMED/[From =?windows-1252?Q?No=EBl_Nachtegael?= <[removed]>][Date Fri, 16 Sep 2005 13:37:03 +0200]/text/[From "Francis Castiaux" <[removed]>][Date … /[From from 8bit t … /[From "Xavier Nachtegael" <[removed]>][Date Mon, 13 Feb 2006 14:3 … … /data0001 Infected: Trojan-Clicker.Win32.VB.lj skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\mail.la57ieme-1.net\Inbox/[From "Claire Tassin" <[removed]>][Date Sun, 7 Aug 2005 19:45:53 +0200]/UNNAMED/[From processed: message from valid local sender)][Date Fri, 9 Sep 2005 12:24:11 +0200]/UNNAMED/[From =?windows-1252?Q?No=EBl_Nachtegael?= <[removed]>][Date Fri, 16 Sep 2005 13:37:03 +0200]/text/[From "Francis Castiaux" <[removed]>][Date … /[From from 8bit t … /[From "Xavier Nachtegael" <[removed]>][Date Mon, 13 Feb 2006 14:3 … /c … /stream Infected: Trojan-Clicker.Win32.VB.lj skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\mail.la57ieme-1.net\Inbox/[From "Claire Tassin" <[removed]>][Date Sun, 7 Aug 2005 19:45:53 +0200]/UNNAMED/[From processed: message from valid local sender)][Date Fri, 9 Sep 2005 12:24:11 +0200]/UNNAMED/[From =?windows-1252?Q?No=EBl_Nachtegael?= <[removed]>][Date Fri, 16 Sep 2005 13:37:03 +0200]/text/[From "Francis Castiaux" <[removed]>][Date … /[From from 8bit t … /[From "Xavier Nachtegael" <[removed]>][Date Mon, 13 Feb 2006 14:3 … /crack-inf.exe Infected: Trojan-Clicker.Win32.VB.lj skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\mail.la57ieme-1.net\Inbox/[From "Claire Tassin" <[removed]>][Date Sun, 7 Aug 2005 19:45:53 +0200]/UNNAMED/[From processed: message from valid local sender)][Date Fri, 9 Sep 2005 12:24:11 +0200]/UNNAMED/[From =?windows-1252?Q?No=EBl_Nachtegael?= <[removed]>][Date Fri, 16 Sep 2005 13:37:03 +0200]/text/[From "Francis Castiaux" <[removed]>][Date … /[From from 8bit t … /[From "Xavier Nachtegael" <[removed]>][Date Mon, 13 Feb 2006 14:35:35 + … /UNNAMED Infected: Trojan-Clicker.Win32.VB.lj skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\mail.la57ieme-1.net\Inbox/[From "Claire Tassin" <[removed]>][Date Sun, 7 Aug 2005 19:45:53 +0200]/UNNAMED/[From processed: message from valid local sender)][Date Fri, 9 Sep 2005 12:24:11 +0200]/UNNAMED/[From =?windows-1252?Q?No=EBl_Nachtegael?= <[removed]>][Date Fri, 16 Sep 2005 13:37:03 +0200]/text/[From "Francis Castiaux" <[removed]>][Date … /[From from 8bit t … /[From "Xavier Nachtegael" <[removed]>][Date Mon, 13 Feb 2006 14:35:35 +0100]/UNNAMED Infected: Trojan-Clicker.Win32.VB.lj skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\mail.la57ieme-1.net\Inbox/[From "Claire Tassin" <[removed]>][Date Sun, 7 Aug 2005 19:45:53 +0200]/UNNAMED/[From processed: message from valid local sender)][Date Fri, 9 Sep 2005 12:24:11 +0200]/UNNAMED/[From =?windows-1252?Q?No=EBl_Nachtegael?= <[removed]>][Date Fri, 16 Sep 2005 13:37:03 +0200]/text/[From "Francis Castiaux" <[removed]>][Date … /[From from 8bit to … /[From "Claire Tassin" <[removed]>][Date Sun, 15 Jan 2006 10:55:30 +0000 (GMT)]/UNNAMED Infected: Trojan-Clicker.Win32.VB.lj skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\mail.la57ieme-1.net\Inbox/[From "Claire Tassin" <[removed]>][Date Sun, 7 Aug 2005 19:45:53 +0200]/UNNAMED/[From processed: message from valid local sender)][Date Fri, 9 Sep 2005 12:24:11 +0200]/UNNAMED/[From =?windows-1252?Q?No=EBl_Nachtegael?= <[removed]>][Date Fri, 16 Sep 2005 13:37:03 +0200]/text/[From "Francis Castiaux" <[removed]>][Date … /[From from 8bit to quoted-printable by outmx028.isp.belgacom.be id j8P9CFKc026859][Date Sun, 25 Sep 2005 11:12:13 +0200]/text Infected: Trojan-Clicker.Win32.VB.lj skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\mail.la57ieme-1.net\Inbox/[From "Claire Tassin" <[removed]>][Date Sun, 7 Aug 2005 19:45:53 +0200]/UNNAMED/[From processed: message from valid local sender)][Date Fri, 9 Sep 2005 12:24:11 +0200]/UNNAMED/[From =?windows-1252?Q?No=EBl_Nachtegael?= <[removed]>][Date Fri, 16 Sep 2005 13:37:03 +0200]/text/[From "Francis Castiaux" <[removed]>][Date Mon, 19 Sep 2005 17:56:49 +0200]/UNNAMED Infected: Trojan-Clicker.Win32.VB.lj skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\mail.la57ieme-1.net\Inbox/[From "Claire Tassin" <[removed]>][Date Sun, 7 Aug 2005 19:45:53 +0200]/UNNAMED/[From processed: message from valid local sender)][Date Fri, 9 Sep 2005 12:24:11 +0200]/UNNAMED/[From =?windows-1252?Q?No=EBl_Nachtegael?= <[removed]>][Date Fri, 16 Sep 2005 13:37:03 +0200]/text Infected: Trojan-Clicker.Win32.VB.lj skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\mail.la57ieme-1.net\Inbox/[From "Claire Tassin" <[removed]>][Date Sun, 7 Aug 2005 19:45:53 +0200]/UNNAMED/[From processed: message from valid local sender)][Date Fri, 9 Sep 2005 12:24:11 +0200]/UNNAMED Infected: Trojan-Clicker.Win32.VB.lj skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\mail.la57ieme-1.net\Inbox/[From "Claire Tassin" <[removed]>][Date Sun, 7 Aug 2005 19:45:53 +0200]/UNNAMED Infected: Trojan-Clicker.Win32.VB.lj skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\mail.la57ieme-1.net\Inbox Mail Berkeley mbox: infected - 11 skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\mail.la57ieme-1.net\Inbox.msf Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\mail.la57ieme-1.net\Trash.msf Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\mail.la57ieme-10.net\Inbox.msf Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\mail.la57ieme-10.net\Junk.msf Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\mail.la57ieme-11.net\Inbox.msf Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\mail.la57ieme-11.net\Junk.msf Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\mail.la57ieme-11.net\Trash.msf Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\mail.la57ieme-12.net\Inbox.msf Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\mail.la57ieme-12.net\Junk.msf Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\mail.la57ieme-12.net\Trash.msf Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\mail.la57ieme-13.net\Inbox.msf Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\mail.la57ieme-13.net\Junk.msf Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\mail.la57ieme-14.net\Inbox.msf Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\mail.la57ieme-14.net\Junk.msf Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\mail.la57ieme-14.net\Trash.msf Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\mail.la57ieme-15.net\Inbox.msf Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\mail.la57ieme-15.net\Junk.msf Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\mail.la57ieme-15.net\Trash.msf Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\mail.la57ieme-16.net\Inbox.msf Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\mail.la57ieme-16.net\Junk.msf Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\mail.la57ieme-17.net\Inbox.msf Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\mail.la57ieme-17.net\Junk.msf Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\mail.la57ieme-17.net\Trash.msf Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\mail.la57ieme-18.net\Inbox.msf Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\mail.la57ieme-2.net\Inbox.msf Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\mail.la57ieme-3.net\Inbox.msf Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\mail.la57ieme-3.net\Junk.msf Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\mail.la57ieme-3.net\Trash.msf Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\mail.la57ieme-4.net\Inbox.msf Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\mail.la57ieme-4.net\Junk.msf Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\mail.la57ieme-5.net\Inbox.msf Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\mail.la57ieme-5.net\Junk.msf Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\mail.la57ieme-5.net\Trash.msf Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\mail.la57ieme-6.net\Inbox.msf Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\mail.la57ieme-6.net\Trash.msf Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\mail.la57ieme-7.net\Inbox.msf Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\mail.la57ieme-7.net\Junk.msf Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\mail.la57ieme-7.net\Trash.msf Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\mail.la57ieme-8.net\Inbox.msf Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\mail.la57ieme-8.net\Junk.msf Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\mail.liguedesfamilles.be\Inbox.msf Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\mail.liguedesfamilles.be\Junk.msf Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\mail.liguedesfamilles.be\Trash.msf Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\Nouvelles et Blogs\d0ed0933.msf Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\Nouvelles et Blogs\Trash.msf Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\pop.skynet-1.be\Inbox.msf Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\Mail\pop.skynet-1.be\Junk.msf Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\panacea.dat Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Thunderbird\Profiles\w2u0ypyf.default\parent.lock Object is locked skipped
C:\Documents and Settings\Noel\Application Data\Webroot\Spy Sweeper\Logs\060813125018.ses Object is locked skipped
C:\Documents and Settings\Noel\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Noel\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Noel\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Noel\Local Settings\Historique\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Noel\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Noel\Mes documents\Downloads\keyfinder.exe/data.rar/officekey.exe Infected: not-a-virus:PSWTool.Win32.RAS.a skipped
C:\Documents and Settings\Noel\Mes documents\Downloads\keyfinder.exe/data.rar Infected: not-a-virus:PSWTool.Win32.RAS.a skipped
C:\Documents and Settings\Noel\Mes documents\Downloads\keyfinder.exe RarSFX: infected - 2 skipped
C:\Documents and Settings\Noel\Mes documents\Downloads\key_changer_15b3.zip/keyfinder.exe/data.rar/officekey.exe Infected: not-a-virus:PSWTool.Win32.RAS.a skipped
C:\Documents and Settings\Noel\Mes documents\Downloads\key_changer_15b3.zip/keyfinder.exe/data.rar Infected: not-a-virus:PSWTool.Win32.RAS.a skipped
C:\Documents and Settings\Noel\Mes documents\Downloads\key_changer_15b3.zip/keyfinder.exe Infected: not-a-virus:PSWTool.Win32.RAS.a skipped
C:\Documents and Settings\Noel\Mes documents\Downloads\key_changer_15b3.zip ZIP: infected - 3 skipped
C:\Documents and Settings\Noel\Mes documents\mail-ligue\Boîte de réception.dbx/[From "Patrick Dekeuleneer" <[removed]>][Date Wed, 13 Apr 2005 17:26:53 +0200]/UNNAMED/sniffers.zip/xpca_setup.exe/WISE0023.BIN Infected: not-a-virus:PSWTool.Win32.Cain.i skipped
C:\Documents and Settings\Noel\Mes documents\mail-ligue\Boîte de réception.dbx/[From "Patrick Dekeuleneer" <[removed]>][Date Wed, 13 Apr 2005 17:26:53 +0200]/UNNAMED/sniffers.zip/xpca_setup.exe/WISE0025.BIN Infected: not-a-virus:PSWTool.Win32.Cain.e skipped
C:\Documents and Settings\Noel\Mes documents\mail-ligue\Boîte de réception.dbx/[From "Patrick Dekeuleneer" <[removed]>][Date Wed, 13 Apr 2005 17:26:53 +0200]/UNNAMED/sniffers.zip/xpca_setup.exe Infected: not-a-virus:PSWTool.Win32.Cain.e skipped
C:\Documents and Settings\Noel\Mes documents\mail-ligue\Boîte de réception.dbx/[From "Patrick Dekeuleneer" <[removed]>][Date Wed, 13 Apr 2005 17:26:53 +0200]/UNNAMED/sniffers.zip Infected: not-a-virus:PSWTool.Win32.Cain.e skipped
C:\Documents and Settings\Noel\Mes documents\mail-ligue\Boîte de réception.dbx/[From "Patrick Dekeuleneer" <[removed]>][Date Wed, 13 Apr 2005 17:26:53 +0200]/UNNAMED Infected: not-a-virus:PSWTool.Win32.Cain.e skipped
C:\Documents and Settings\Noel\Mes documents\mail-ligue\Boîte de réception.dbx Mail MS Outlook 5: infected - 5 skipped
C:\Documents and Settings\Noel\Mes documents\mail-ligue\Outlook Express.zip/Boîte de réception.dbx/[From "Patrick Dekeuleneer" <[removed]>][Date Wed, 13 Apr 2005 17:26:53 +0200]/UNNAMED/sniffers.zip/xpca_setup.exe/WISE0023.BIN Infected: not-a-virus:PSWTool.Win32.Cain.i skipped
C:\Documents and Settings\Noel\Mes documents\mail-ligue\Outlook Express.zip/Boîte de réception.dbx/[From "Patrick Dekeuleneer" <[removed]>][Date Wed, 13 Apr 2005 17:26:53 +0200]/UNNAMED/sniffers.zip/xpca_setup.exe/WISE0025.BIN Infected: not-a-virus:PSWTool.Win32.Cain.e skipped
C:\Documents and Settings\Noel\Mes documents\mail-ligue\Outlook Express.zip/Boîte de réception.dbx/[From "Patrick Dekeuleneer" <[removed]>][Date Wed, 13 Apr 2005 17:26:53 +0200]/UNNAMED/sniffers.zip/xpca_setup.exe Infected: not-a-virus:PSWTool.Win32.Cain.e skipped
C:\Documents and Settings\Noel\Mes documents\mail-ligue\Outlook Express.zip/Boîte de réception.dbx/[From "Patrick Dekeuleneer" <[removed]>][Date Wed, 13 Apr 2005 17:26:53 +0200]/UNNAMED/sniffers.zip Infected: not-a-virus:PSWTool.Win32.Cain.e skipped
C:\Documents and Settings\Noel\Mes documents\mail-ligue\Outlook Express.zip/Boîte de réception.dbx/[From "Patrick Dekeuleneer" <[removed]>][Date Wed, 13 Apr 2005 17:26:53 +0200]/UNNAMED Infected: not-a-virus:PSWTool.Win32.Cain.e skipped
C:\Documents and Settings\Noel\Mes documents\mail-ligue\Outlook Express.zip/Boîte de réception.dbx Infected: not-a-virus:PSWTool.Win32.Cain.e skipped
C:\Documents and Settings\Noel\Mes documents\mail-ligue\Outlook Express.zip ZIP: infected - 6 skipped
C:\Documents and Settings\Noel\Mes documents\my-video-tools\MediaChance_DVD-lab_v1.3.1_www.crack.cd_.zip/exet.exe Infected: Trojan-Downloader.Win32.INService.gen skipped
C:\Documents and Settings\Noel\Mes documents\my-video-tools\MediaChance_DVD-lab_v1.3.1_www.crack.cd_.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Noel\Mes documents\video\MediaChance_DVD-lab_v1.3.1_www.crack.cd_\exet.exe Infected: Trojan-Downloader.Win32.INService.gen skipped
C:\Documents and Settings\Noel\Mes documents\video\MediaChance_DVD-lab_v1.3.1_www.crack.cd_.zip/exet.exe Infected: Trojan-Downloader.Win32.INService.gen skipped
C:\Documents and Settings\Noel\Mes documents\video\MediaChance_DVD-lab_v1.3.1_www.crack.cd_.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Noel\ntuser.dat Object is locked skipped
C:\Documents and Settings\Noel\ntuser.dat.LOG Object is locked skipped
C:\downloads\boot screens misc\bootscreens\45637.exe/WISE0016.BIN Infected: not-a-virus:AdWare.Win32.SaveNow.bo skipped
C:\downloads\boot screens misc\bootscreens\45637.exe/WISE0017.BIN Infected: not-a-virus:AdWare.Win32.NewDotNet skipped
C:\downloads\boot screens misc\bootscreens\45637.exe/WISE0018.BIN Infected: Trojan-Downloader.Win32.Small.bke skipped
C:\downloads\boot screens misc\bootscreens\45637.exe WiseSFX: infected - 3 skipped
C:\downloads\boot screens misc\bootscreens\45637.exe WiseSFX Dropper: infected - 3 skipped
C:\downloads\boot screens misc\bootscreens\alien.exe/WISE0016.BIN Infected: not-a-virus:AdWare.Win32.SaveNow.bo skipped
C:\downloads\boot screens misc\bootscreens\alien.exe/WISE0017.BIN Infected: not-a-virus:AdWare.Win32.NewDotNet skipped
C:\downloads\boot screens misc\bootscreens\alien.exe/WISE0018.BIN Infected: Trojan-Downloader.Win32.Small.bke skipped
C:\downloads\boot screens misc\bootscreens\alien.exe WiseSFX: infected - 3 skipped
C:\downloads\boot screens misc\bootscreens\alien.exe WiseSFX Dropper: infected - 3 skipped
C:\downloads\boot screens misc\bootscreens\careedition.exe/WISE0016.BIN Infected: not-a-virus:AdWare.Win32.SaveNow.bo skipped
C:\downloads\boot screens misc\bootscreens\careedition.exe/WISE0017.BIN Infected: not-a-virus:AdWare.Win32.NewDotNet skipped
C:\downloads\boot screens misc\bootscreens\careedition.exe/WISE0018.BIN Infected: Trojan-Downloader.Win32.Small.bke skipped
C:\downloads\boot screens misc\bootscreens\careedition.exe WiseSFX: infected - 3 skipped
C:\downloads\boot screens misc\bootscreens\careedition.exe WiseSFX Dropper: infected - 3 skipped
C:\downloads\boot screens misc\bootscreens\croixrouge.exe/WISE0013.BIN Infected: not-a-virus:AdWare.Win32.SaveNow.bo skipped
C:\downloads\boot screens misc\bootscreens\croixrouge.exe/WISE0014.BIN Infected: not-a-virus:AdWare.Win32.NewDotNet skipped
C:\downloads\boot screens misc\bootscreens\croixrouge.exe/WISE0015.BIN Infected: Trojan-Downloader.Win32.Small.bke skipped
C:\downloads\boot screens misc\bootscreens\croixrouge.exe WiseSFX: infected - 3 skipped
C:\downloads\boot screens misc\bootscreens\croixrouge.exe WiseSFX Dropper: infected - 3 skipped
C:\downloads\boot screens misc\bootscreens\intelligent.exe/WISE0013.BIN Infected: not-a-virus:AdWare.Win32.SaveNow.bo skipped
C:\downloads\boot screens misc\bootscreens\intelligent.exe/WISE0014.BIN Infected: not-a-virus:AdWare.Win32.NewDotNet skipped
C:\downloads\boot screens misc\bootscreens\intelligent.exe/WISE0015.BIN Infected: Trojan-Downloader.Win32.Small.bke skipped
C:\downloads\boot screens misc\bootscreens\intelligent.exe WiseSFX: infected - 3 skipped
C:\downloads\boot screens misc\bootscreens\intelligent.exe WiseSFX Dropper: infected - 3 skipped
C:\downloads\vnc\vnc-4_1_1-x86_win32.exe/data0001 Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4110 skipped
C:\downloads\vnc\vnc-4_1_1-x86_win32.exe Inno: infected - 1 skipped
C:\Program Files\Alwil Software\Avast4\DATA\aswResp.dat Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\Avast4.db Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\log\AshWebSv.ws Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\log\aswMaiSv.log Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\log\nshield.log Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\report\Protection résidente.txt Object is locked skipped
C:\Program Files\RealVNC\VNC4\wm_hooks.dll Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 skipped
C:\Program Files\Webroot\Spy Sweeper\Masters\masters.bak Object is locked skipped
C:\Program Files\Webroot\Spy Sweeper\Masters\Masters.const Object is locked skipped
C:\Program Files\Webroot\Spy Sweeper\Masters\masters.mst Object is locked skipped
C:\Program Files\Webroot\Spy Sweeper\Masters.base Object is locked skipped
C:\System Volume Information\catalog.wci\00000002.ps1 Object is locked skipped
C:\System Volume Information\catalog.wci\00000002.ps2 Object is locked skipped
C:\System Volume Information\catalog.wci\00010003.ci Object is locked skipped
C:\System Volume Information\catalog.wci\cicat.fid Object is locked skipped
C:\System Volume Information\catalog.wci\cicat.hsh Object is locked skipped
C:\System Volume Information\catalog.wci\CiCL0001.000 Object is locked skipped
C:\System Volume Information\catalog.wci\CiP10000.000 Object is locked skipped
C:\System Volume Information\catalog.wci\CiP20000.000 Object is locked skipped
C:\System Volume Information\catalog.wci\CiPT0000.000 Object is locked skipped
C:\System Volume Information\catalog.wci\CiSL0001.000 Object is locked skipped
C:\System Volume Information\catalog.wci\CiSP0000.000 Object is locked skipped
C:\System Volume Information\catalog.wci\CiST0000.000 Object is locked skipped
C:\System Volume Information\catalog.wci\CiVP0000.000 Object is locked skipped
C:\System Volume Information\catalog.wci\INDEX.000 Object is locked skipped
C:\System Volume Information\catalog.wci\propstor.bk1 Object is locked skipped
C:\System Volume Information\catalog.wci\propstor.bk2 Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{1691485A-2A47-46B9-9573-4F35ED364DC3}\RP349\A0113494.dll Infected: not-a-virus:AdWare.Win32.NewDotNet skipped
C:\System Volume Information\_restore{1691485A-2A47-46B9-9573-4F35ED364DC3}\RP349\A0113496.exe Infected: not-a-virus:AdWare.Win32.NewDotNet skipped
C:\System Volume Information\_restore{1691485A-2A47-46B9-9573-4F35ED364DC3}\RP349\A0113497.exe Infected: not-a-virus:AdWare.Win32.NewDotNet skipped
C:\System Volume Information\_restore{1691485A-2A47-46B9-9573-4F35ED364DC3}\RP349\A0113498.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4110 skipped
C:\System Volume Information\_restore{1691485A-2A47-46B9-9573-4F35ED364DC3}\RP351\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\pfirewall.log Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\DEFAULT.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\SOFTWARE.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\SYSTEM.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_16c.dat Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_270.dat Object is locked skipped
C:\WINDOWS\Temp\_avast4_\Webshlock.txt Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.

HJT log file
Logfile of HijackThis v1.99.1
Scan saved at 13:43:16, on 14/08/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\system32\wwSecure.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\Dit.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxtray.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\GetRight\getright.exe
C:\Program Files\Mozilla Thunderbird\thunderbird.exe
C:\WINDOWS\system32\cidaemon.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\WINDOWS\system32\notepad.exe
C:\Program Files\UltraEdit\uedit32.exe
C:\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CNetscape_France.src"); (C:\Documents and Settings\Noel\Application Data\Mozilla\Profiles\default\41x57daf.slt\prefs.js)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -onlytray
O4 - HKLM\..\Run: [Dimension4] C:\Program Files\D4\D4.exe
O4 - HKLM\..\Run: [Absolute StartUp monitor] C:\Program Files\F-Group\Absolute StartUp\ASMon.exe
O4 - HKLM\..\Run: [Amok dupe face save] C:\Documents and Settings\All Users\Application Data\creativechicamokdupe\Pop Pile.exe
O4 - HKLM\..\RunOnce: [WinSideBySideSetupCleanup 1802562] rundll32 sxs.dll,SxspRunDllDeleteDirectory C:\WINDOWS\WinSxS\InstallTemp\1802562
O4 - HKLM\..\RunOnce: [WinSideBySideSetupCleanup 1803555] rundll32 sxs.dll,SxspRunDllDeleteDirectory C:\WINDOWS\WinSxS\InstallTemp\1803555
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [Default Iso] C:\DOCUME~1\Noel\APPLIC~1\GPLJUN~1\The Grey.exe
O4 - HKCU\..\Run: [Amok dupe face save] C:�
Post #13
http://be.trendmicro-europe.com/housecall/v6.5/? didn't find anything!

result screen of the complete scan:

Everything ok?
Yes, everything's alright! 

HouseCall did not find any potential threats on your computer- you can go on working reliably.

If we summarize:
from the HJT log (see complete log after this)
O4 - HKLM\..\Run: [Amok dupe face save] C:\Documents and Settings\All Users\Application Data\creativechicamokdupe\Pop Pile.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -onlytray
O4 - HKLM\..\Run: [Dimension4] C:\Program Files\D4\D4.exe
O4 - HKLM\..\Run: [Absolute StartUp monitor] C:\Program Files\F-Group\Absolute StartUp\ASMon.exe
O4 - HKLM\..\RunOnce: [WinSideBySideSetupCleanup 1802562] rundll32 sxs.dll,SxspRunDllDeleteDirectory C:\WINDOWS\WinSxS\InstallTemp\1802562
O4 - HKLM\..\RunOnce: [WinSideBySideSetupCleanup 1803555] rundll32 sxs.dll,SxspRunDllDeleteDirectory C:\WINDOWS\WinSxS\InstallTemp\1803555
O4 - HKCU\..\Run: [Amok dupe face save] C:\Documents and Settings\All Users\Application Data\creativechicamokdupe\exit acid.exe
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [Default Iso] C:\DOCUME~1\Noel\APPLIC~1\GPLJUN~1\The Grey.exe
are linked together and are pointing to non-existent files and folders!!!

:scratch: strange isn't it? :scratch:

what do you think about this situation?
Am I alone? I don't find anything on google about those amoks!


Logfile of HijackThis v1.99.1
Scan saved at 23:57:50, on 14/08/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\Dit.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxtray.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\GetRight\getright.exe
C:\Program Files\Mozilla Thunderbird\thunderbird.exe
C:\WINDOWS\system32\wwSecure.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Documents and Settings\Noel\Bureau\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CNetscape_France.src"); (C:\Documents and Settings\Noel\Application Data\Mozilla\Profiles\default\41x57daf.slt\prefs.js)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKLM\..\Run: [Amok dupe face save] C:\Documents and Settings\All Users\Application Data\creativechicamokdupe\Pop Pile.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -onlytray
O4 - HKLM\..\Run: [Dimension4] C:\Program Files\D4\D4.exe
O4 - HKLM\..\Run: [Absolute StartUp monitor] C:\Program Files\F-Group\Absolute StartUp\ASMon.exe
O4 - HKLM\..\RunOnce: [WinSideBySideSetupCleanup 1802562] rundll32 sxs.dll,SxspRunDllDeleteDirectory C:\WINDOWS\WinSxS\InstallTemp\1802562
O4 - HKLM\..\RunOnce: [WinSideBySideSetupCleanup 1803555] rundll32 sxs.dll,SxspRunDllDeleteDirectory C:\WINDOWS\WinSxS\InstallTemp\1803555
O4 - HKCU\..\Run: [Amok dupe face save] C:\Documents and Settings\All Users\Application Data\creativechicamokdupe\exit acid.exe
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [Default Iso] C:\DOCUME~1\Noel\APPLIC~1\GPLJUN~1\The Grey.exe
O4 - Startup: Mozilla Thunderbird.lnk = C:\Program Files\Mozilla Thunderbird\thunderbird.exe
O4 - Global Startup: GetRight - Tray Icon.lnk = C:\Program Files\GetRight\getright.exe
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Program Files\IrfanView\Ebay\Ebay.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .csm: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .csml: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .cub: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .cube: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .dx: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .emb: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .embl: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .gau: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .jdx: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .mol: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .mop: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .pdb: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .rxn: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .scr: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .skc: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .spt: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .tgf: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .xyz: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {68A2C3BD-7809-11D3-8ACF-0050046F2F9A} (AXELPlayer Class) - http://www.lachimie.com/AXELPlayerAX_Win32.cab
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Trend Micro ActiveX Scan Agent 6.5) - http://eu-housecall.trendmicro-europe.com/…ivex/hcImpl.cab
O16 - DPF: {B1826A9F-4AA0-4510-BA77-9013E74E4B9B} - http://www.trendmicro.com/spyware-scan/as4web.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = mysweet.home
O17 - HKLM\Software\..\Telephony: DomainName = mysweet.home
O17 - HKLM\System\CCS\Services\Tcpip\..\{65B8EB9D-F1AC-4977-8377-D471D97BE0A1}: NameServer = 195.238.2.22
O17 - HKLM\System\CCS\Services\Tcpip\..\{8CC62E68-CC60-4051-A532-DD1BD760E7AB}: Domain = mysweet.home
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = mysweet.home
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
O23 - Service: Apache - Unknown owner - c:\eZpublish\apache\apache.exe" –ntservice (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: ServersCheck Monitoring Service (ServersCheck) - ServersCheck BVBA - C:\Program Files\ServersCheck_Monitoring\s-service.exe
O23 - Service: ServersCheck Configuration Service (ServersCheck Configuration) - ServersCheck, a division of Eklatant - C:\Program Files\ServersCheck_Monitoring\server-service.exe
O23 - Service: Moteur Webroot Spy Sweeper (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
O23 - Service: Washer Security Access (wwSecSvc) - Webroot Software, Inc. - C:\WINDOWS\system32\wwSecure.exe
Post #14
Download MicroWorld virus scan here >>> Micro World http://www.mwti.net/antivirus/free_utilities.asp

To run the virus scan make sure you click the following

memory, registry, startup folders, system folders, services, drive (all drives will be added) then click on scan clean. When the scan is complete hilight all the files in the LOWER box. Then ctrl + c and paste them into the thread ctrl + v.

I warn you the scan will take a long time to run and will not fix anything just identifies bad files.
Post #15
:D THE AMOKS ARE GONE :D

after giving my details on the site http://www.mwti.net/antivirus/free_utilities.asp I could download and install the AV es_awne.exe (35.5 Mo).
  • OK for startup installation in my webroot/spysweeper warnings
  • reboot of the system
  • conflict with my webroot/spysweeper and stopping the pgm by hand
  • conflicts with the avast resident portions and stopping the resident shields by hand
  • scan of the memory and registries (see log 1)
  • modify the scan options to high level
  • new scan of the memory and registries (see log 2)
  • reboot of the system (same conflicts than above)
  • HJT scan and THE AMOKS and other linked entries are gone (see hjt log)
I can see that the amoks were in HKLM and HKCU /run entries…do you think that only removing them from both locations was solving the problem?

log 1: first run
Tue Aug 15 08:26:03 2006 => **********************************************************
Tue Aug 15 08:26:03 2006 => eScan utilitaire AntiVirus.
Tue Aug 15 08:26:03 2006 => Copyright © 2003-2004, MicroWorld Technologies Inc.
Tue Aug 15 08:26:03 2006 => **********************************************************
Tue Aug 15 08:26:03 2006 => Version 8.5.1
Tue Aug 15 08:26:03 2006 => Journal d'événement: C:\PROGRA~1\ESCAN\LOG\15080000.LOG
Tue Aug 15 08:26:03 2006 => MWAV Registered: TRUE.
Tue Aug 15 08:26:03 2006 => User Account: Noel
Tue Aug 15 08:26:03 2006 => OS Type: Windows Workstation
Tue Aug 15 08:26:03 2006 => OS: Windows XP
Tue Aug 15 08:26:03 2006 => Ver: Service Pack 2 (Build 2600)
Tue Aug 15 08:26:03 2006 => Windows Root Folder: C:\WINDOWS
Tue Aug 15 08:26:03 2006 => Windows Sys32 Folder: C:\WINDOWS\system32
Tue Aug 15 08:26:03 2006 => Local Fixed Drives: c:\
Tue Aug 15 08:26:03 2006 => MWAV Mode: Scan and Clean files (for viruses, adware and spyware).
Tue Aug 15 08:26:03 2006 => Option de Ligne de Commande Donné: /MEM /REG /STARTUP /SER /SC /S /WaitToExit /Log=C:\PROGRA~1\eScan\Log\15080000.log
Tue Aug 15 08:26:03 2006 => Database Path in KL Key: C:\PROGRA~1\eScan.
Tue Aug 15 08:26:05 2006 => Dernière Mise a Jours de KL key: 15 Aug 2006 08:40:19.
Tue Aug 15 08:26:07 2006 => Dernière Mise a Jours de MWAV: 15 Aug 2006 08:40:19.
Tue Aug 15 08:26:07 2006 => Dossier d'Installation eScan: C:\PROGRA~1\eScan\
Tue Aug 15 08:26:07 2006 => Dossier d'Installation MailScan: C:\PROGRA~1\eScan\
Tue Aug 15 08:26:27 2006 => Setting Database Path to C:\DOCUME~1\Noel\LOCALS~1\Temp\MWBASES
Tue Aug 15 08:26:34 2006 => Librairie Anti-virus chargé…

Tue Aug 15 08:26:35 2006 => **********************************************************
Tue Aug 15 08:26:35 2006 => eScan utilitaire AntiVirus.
Tue Aug 15 08:26:35 2006 => Copyright © 2003-2004, MicroWorld Technologies Inc.
Tue Aug 15 08:26:35 2006 =>
Tue Aug 15 08:26:35 2006 => Support: [removed]
Tue Aug 15 08:26:35 2006 => Web: http://www.mwti.net
Tue Aug 15 08:26:35 2006 => **********************************************************
Tue Aug 15 08:26:35 2006 => Version 8.5.1
Tue Aug 15 08:26:35 2006 => Journal d'événement: C:\PROGRA~1\ESCAN\LOG\15080000.LOG
Tue Aug 15 08:26:35 2006 => User Account: Noel
Tue Aug 15 08:26:35 2006 => Windows Root Folder: C:\WINDOWS
Tue Aug 15 08:26:35 2006 => Windows Sys32 Folder: C:\WINDOWS\system32
Tue Aug 15 08:26:35 2006 => OS: Windows XP
Tue Aug 15 08:26:35 2006 => Ver: Service Pack 2 (Build 2600)
Tue Aug 15 08:26:35 2006 => Database Path in KL Key: C:\PROGRA~1\eScan.
Tue Aug 15 08:26:36 2006 => Dernière Mise a Jours de KL key: 15 Aug 2006 08:40:19.
Tue Aug 15 08:26:37 2006 => Dernière Mise a Jours de MWAV: 15 Aug 2006 08:40:19.

Tue Aug 15 08:26:37 2006 => Options Selectionné par l'utilisateur:
Tue Aug 15 08:26:37 2006 => Vérification de la mémoire: Activé
Tue Aug 15 08:26:37 2006 => Vérification de la base de Registre: Activé
Tue Aug 15 08:26:37 2006 => Vérification des Répertoires de démarrage: Activé
Tue Aug 15 08:26:37 2006 => Vérification des Répertoires Système: Désactivé
Tue Aug 15 08:26:37 2006 => Vérification du System: Désactivé
Tue Aug 15 08:26:37 2006 => Vérification des Services: Activé
Tue Aug 15 08:26:37 2006 => Options de vérification des disques désactivé
Tue Aug 15 08:26:37 2006 => Répertoire vérifié: Désactivé

Tue Aug 15 08:26:40 2006 => ***** Scanne des fichiers en mémoire *****

Tue Aug 15 08:27:13 2006 => ***** Scan Des la Base de Registre *****

Tue Aug 15 08:27:13 2006 => Scanne HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad

Tue Aug 15 08:27:13 2006 => Scanne HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad

Tue Aug 15 08:27:13 2006 => Scanne HKLM\SOFTWARE\Microsoft\Internet Explorer\Plugins\Extension

Tue Aug 15 08:27:14 2006 => Scanne HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar

Tue Aug 15 08:27:14 2006 => Scanne HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects

Tue Aug 15 08:27:14 2006 => Scanne HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\SharedTaskScheduler

Tue Aug 15 08:27:15 2006 => Scanne HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved

Tue Aug 15 08:27:23 2006 => Scanne HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows

Tue Aug 15 08:27:23 2006 => Scanne HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Tue Aug 15 08:27:25 2006 => Scanne HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Tue Aug 15 08:27:25 2006 => Scanne HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System

Tue Aug 15 08:27:25 2006 => Scanne HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows

Tue Aug 15 08:27:25 2006 => Scanne HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AEDEBUG

Tue Aug 15 08:27:25 2006 => Scanne HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options

Tue Aug 15 08:27:25 2006 => Scanne HKCU\Control Panel\Desktop

Tue Aug 15 08:27:25 2006 => Scanne HKLM\SYSTEM\CurrentControlSet\Control\WOW

Tue Aug 15 08:27:25 2006 => Scanne HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components

Tue Aug 15 08:27:26 2006 => Scanne HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

Tue Aug 15 08:27:26 2006 => Scanne HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

Tue Aug 15 08:27:26 2006 => Scanne HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Run

Tue Aug 15 08:27:26 2006 => Scanne HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Run

Tue Aug 15 08:27:26 2006 => Scanne HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Tue Aug 15 08:27:26 2006 => Scanne Fichier C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
Tue Aug 15 08:27:26 2006 => Scanne Fichier C:\WINDOWS\Dit.exe
Tue Aug 15 08:27:26 2006 => *** Fichier C:\PROGRA~1\Webroot\SPYSWE~1\SPYSWE~2.EXE sous restriction de taille ***. Filesize 3781 kb > 2560 kb…
Tue Aug 15 08:27:26 2006 => Scanne Fichier C:\PROGRA~1\Webroot\SPYSWE~1\SPYSWE~2.EXE [**]
Tue Aug 15 08:27:26 2006 => ERROR!!! Invalid Entry Amok dupe face save = C:\Documents and Settings\All Users\Application Data\creativechicamokdupe\Pop Pile.exe (in key SOFTWARE\Microsoft\Windows\CurrentVersion\Run). Removing it.
Tue Aug 15 08:27:26 2006 => ERROR!!! Invalid Entry PCSuiteTrayApplication = C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -onlytray (in key SOFTWARE\Microsoft\Windows\CurrentVersion\Run). Removing it.
Tue Aug 15 08:27:26 2006 => ERROR!!! Invalid Entry Dimension4 = C:\Program Files\D4\D4.exe (in key SOFTWARE\Microsoft\Windows\CurrentVersion\Run). Removing it.
Tue Aug 15 08:27:26 2006 => ERROR!!! Invalid Entry Absolute StartUp monitor = C:\Program Files\F-Group\Absolute StartUp\ASMon.exe (in key SOFTWARE\Microsoft\Windows\CurrentVersion\Run). Removing it.
Tue Aug 15 08:27:26 2006 => Scanne Fichier C:\PROGRA~1\eScan\TRAYICOS.EXE
Tue Aug 15 08:27:26 2006 => Scanne Fichier C:\PROGRA~1\eScan\AVPMWrap.EXE

Tue Aug 15 08:27:28 2006 => Scanne HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Tue Aug 15 08:27:28 2006 => Scanne Fichier C:\WINDOWS\system32\rundll32.exe
Tue Aug 15 08:27:28 2006 => Scanne Fichier C:\WINDOWS\system32\rundll32.exe

Tue Aug 15 08:27:28 2006 => Scanne HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx

Tue Aug 15 08:27:28 2006 => Scanne HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices

Tue Aug 15 08:27:28 2006 => Scanne HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce

Tue Aug 15 08:27:28 2006 => Scanne HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Tue Aug 15 08:27:28 2006 => ERROR!!! Invalid Entry Amok dupe face save = C:\Documents and Settings\All Users\Application Data\creativechicamokdupe\exit acid.exe (in key SOFTWARE\Microsoft\Windows\CurrentVersion\Run). Removing it.
Tue Aug 15 08:27:28 2006 => ERROR!!! Invalid Entry PcSync = C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (in key SOFTWARE\Microsoft\Windows\CurrentVersion\Run). Removing it.
Tue Aug 15 08:27:28 2006 => ERROR!!! Invalid Entry Default Iso = C:\DOCUME~1\Noel\APPLIC~1\GPLJUN~1\The Grey.exe (in key SOFTWARE\Microsoft\Windows\CurrentVersion\Run). Removing it.

Tue Aug 15 08:27:28 2006 => Scanne HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

Tue Aug 15 08:27:28 2006 => Scanne HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx

Tue Aug 15 08:27:28 2006 => Scanne HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices

Tue Aug 15 08:27:29 2006 => Scanne HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Setup

Tue Aug 15 08:27:29 2006 => Scanne HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Tue Aug 15 08:27:29 2006 => Scanne Fichier C:\WINDOWS\System32\CTFMON.EXE

Tue Aug 15 08:27:29 2006 => Scanne HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

Tue Aug 15 08:27:29 2006 => Scanne HKCR\txtfile\shell\open\command

Tue Aug 15 08:27:29 2006 => Scanne HKCR\comfile\shell\open\command

Tue Aug 15 08:27:29 2006 => Scanne HKCR\exefile\shell\open\command

Tue Aug 15 08:27:29 2006 => Scanne HKCR\dllfile\shell\open\command

Tue Aug 15 08:27:30 2006 => Scanne HKCR\batfile\shell\open\command

Tue Aug 15 08:27:30 2006 => Scanne HKCR\piffile\shell\open\command

Tue Aug 15 08:27:30 2006 => Scanne HKCR\scrfile\shell\open\command

Tue Aug 15 08:27:30 2006 => Scanne HKCR\scrfile\shell\config\command

Tue Aug 15 08:27:30 2006 => Scanne HKCR\regfile\shell\open\command

Tue Aug 15 08:27:30 2006 => Scanne HKCR\htmlfile\shell\open\command

Tue Aug 15 08:27:30 2006 => Scanne HKCR\htafile\shell\open\command

Tue Aug 15 08:27:30 2006 => Scanne HKCR\jsfile\shell\open\command
Tue Aug 15 08:27:30 2006 => Scanne Fichier C:\WINDOWS\System32\WScript.exe

Tue Aug 15 08:27:30 2006 => Scanne HKCR\jsefile\shell\open\command
Tue Aug 15 08:27:30 2006 => Scanne Fichier C:\WINDOWS\System32\WScript.exe

Tue Aug 15 08:27:30 2006 => Scanne HKCR\vbsfile\shell\open\command
Tue Aug 15 08:27:30 2006 => Scanne Fichier C:\WINDOWS\System32\WScript.exe

Tue Aug 15 08:27:30 2006 => Scanne HKCR\vbefile\shell\open\command
Tue Aug 15 08:27:30 2006 => Scanne Fichier C:\WINDOWS\System32\WScript.exe

Tue Aug 15 08:27:30 2006 => Scanne HKCR\wshfile\shell\open\command
Tue Aug 15 08:27:30 2006 => Scanne Fichier C:\WINDOWS\System32\WScript.exe

Tue Aug 15 08:27:30 2006 => Scanne HKCR\wsffile\shell\open\command
Tue Aug 15 08:27:30 2006 => Scanne Fichier C:\WINDOWS\System32\WScript.exe

Tue Aug 15 08:27:30 2006 => ***** Scanne des Répertoires de démarrage *****

Tue Aug 15 08:27:30 2006 => ***** Scanne C:\Documents and Settings\Noel\Menu Démarrer\Programmes\Démarrage des Répertoires *****
Tue Aug 15 08:27:30 2006 => Scanne du Répertoire: C:\Documents and Settings\Noel\Menu Démarrer\Programmes\Démarrage\*.*
Tue Aug 15 08:27:30 2006 => Scanne Fichier C:\Documents and Settings\Noel\Menu Démarrer\Programmes\Démarrage\desktop.ini [**]
Tue Aug 15 08:27:30 2006 => Scanne Fichier C:\Documents and Settings\Noel\Menu Démarrer\Programmes\Démarrage\Mozilla Thunderbird.lnk

Tue Aug 15 08:27:30 2006 => ***** Scanne C:\Documents and Settings\Noel\Bureau des Répertoires *****
Tue Aug 15 08:27:30 2006 => Scanne du Répertoire: C:\Documents and Settings\Noel\Bureau\*.*

Tue Aug 15 08:27:35 2006 => ***** Scanne C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage des Répertoires *****
Tue Aug 15 08:27:35 2006 => Scanne du Répertoire: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\*.*

Tue Aug 15 08:27:35 2006 => ***** Scanne des Services *****
Tue Aug 15 08:27:35 2006 => Scanne HKLM\SYSTEM\CurrentControlSet\Services
Tue Aug 15 08:27:35 2006 => ERROR!!! Invalid Entry "c:\eZpublish\apache\apache.exe" –ntservice. Removing SYSTEM\CurrentControlSet\Services\Apache…
Tue Aug 15 08:27:41 2006 => ERROR!!! Invalid Entry c:\eZpublish\mysql\bin\mysqld-nt.exe MySQL. Removing SYSTEM\CurrentControlSet\Services\MySQL…
Tue Aug 15 08:27:48 2006 => ERROR!!! Invalid Entry "C:\Program Files\RealVNC\VNC4\WinVNC4.exe" -service. Removing SYSTEM\CurrentControlSet\Services\WinVNC4…

Tue Aug 15 08:27:49 2006 => Scanne HKLM\SYSTEM\CurrentControlSet\Services\VxD

Tue Aug 15 08:27:49 2006 => ***** Scan Important Des Fichiers Systèmes *****

Tue Aug 15 08:27:52 2006 => ***** Scanne le registre et les fichiers système pour Adware/Spyware *****
Tue Aug 15 08:27:52 2006 => Loading Spyware Signatures from new External Database (Size: 161867).
Tue Aug 15 08:28:01 2006 => Indexed Spyware Databases Successfully Created…

Tue Aug 15 08:29:16 2006 => System found infected with troj/taladra-f BackDoor ({e7bc34a3-ba86-11cf-84b1-cbc2da68bf6c})! Action taken: Entries Removed.
Tue Aug 15 08:29:16 2006 => Objet "troj/taladra-f BackDoor" trouvé dans fichier système! Action faite: Entries Removed.

Tue Aug 15 08:29:35 2006 => Offending Folder found: C:\Documents and Settings\Noel\Mes documents\250-backup-etc\webmin\sentry
Tue Aug 15 08:29:35 2006 => Deltree of Folder C:\Documents and Settings\Noel\Mes documents\250-backup-etc\webmin\sentry…
Tue Aug 15 08:29:35 2006 => Objet "ipinsight Spyware/Adware" trouvé dans fichier système! Action faite: Entries Removed.

Tue Aug 15 08:29:39 2006 => Offending file found: C:\DOCUME~1\Noel\MESDOC~1\cerberus\CERBER~1\display.php
Tue Aug 15 08:29:39 2006 => System found infected with xrenoder Spyware/Adware (display.php)! Action taken: Entries Removed.
Tue Aug 15 08:29:39 2006 => Objet "xrenoder Spyware/Adware" trouvé dans fichier système! Action faite: Entries Removed.

Tue Aug 15 08:29:51 2006 => Offending file found: C:\DOCUME~1\Noel\MESDOC~1\easyphp\cgi-bin\shopcms\TEMPLA~1\BOTTOM~1.HTM
Tue Aug 15 08:29:51 2006 => System found infected with whenu.sidefinder Spyware/Adware (bottom.html)! Action taken: Entries Removed.
Tue Aug 15 08:29:51 2006 => Objet "whenu.sidefinder Spyware/Adware" trouvé dans fichier système! Action faite: Entries Removed.

Tue Aug 15 08:29:52 2006 => Offending Folder found: C:\Documents and Settings\Noel\Mes documents\easyphp\phpmyadmin\libraries\dbi
Tue Aug 15 08:29:52 2006 => Deltree of Folder C:\Documents and Settings\Noel\Mes documents\easyphp\phpmyadmin\libraries\dbi…
Tue Aug 15 08:29:52 2006 => Objet "toolbar Spyware/Adware" trouvé dans fichier système! Action faite: Entries Removed.

Tue Aug 15 08:29:55 2006 => Offending file found: C:\DOCUME~1\Noel\MESDOC~1\helpd\GEDEON~1.0\html\CATEGO~1.HTM
Tue Aug 15 08:29:55 2006 => System found infected with whenu.desktop toolbar Spyware/Adware (categories.html)! Action taken: Entries Removed.
Tue Aug 15 08:29:55 2006 => Objet "whenu.desktop toolbar Spyware/Adware" trouvé dans fichier système! Action faite: Entries Removed.

Tue Aug 15 08:30:03 2006 => Offending Folder found: C:\Documents and Settings\Noel\Mes documents\pebuilder\plugins\xppe\plugin\aida
Tue Aug 15 08:30:03 2006 => Deltree of Folder C:\Documents and Settings\Noel\Mes documents\pebuilder\plugins\xppe\plugin\aida…
Tue Aug 15 08:30:03 2006 => Objet "purityscan Spyware/Adware" trouvé dans fichier système! Action faite: Entries Removed.

Tue Aug 15 08:30:03 2006 => Offending file found: C:\DOCUME~1\Noel\MESDOC~1\PEBUIL~1\plugins\xppe\plugin\gna\redirect.dll
Tue Aug 15 08:30:03 2006 => System found infected with dynamic desktop media Spyware/Adware (redirect.dll)! Action taken: Entries Removed.
Tue Aug 15 08:30:03 2006 => Objet "dynamic desktop media Spyware/Adware" trouvé dans fichier système! Action faite: Entries Removed.

Tue Aug 15 08:30:14 2006 => Offending file found: C:\DOCUME~1\ALLUSE~1\APPLIC~1\webroot\SPYSWE~1\install.dat
Tue Aug 15 08:30:14 2006 => System found infected with zlob Trojan-Downloader (install.dat)! Action taken: Entries Removed.
Tue Aug 15 08:30:14 2006 => Objet "zlob Trojan-Downloader" trouvé dans fichier système! Action faite: Entries Removed.

Tue Aug 15 08:30:21 2006 => Checking CLSID Reference Entries…
Tue Aug 15 08:30:22 2006 => Entrée "HKCR\Alg.AlgSetup" réfère à objet invalide "{27D0BCCC-344D-4287-AF37-0C72C161C14C}". Action faite: Entries Removed.

Tue Aug 15 08:30:22 2006 => Entrée "HKCR\Class" réfère à objet invalide "{AA8A5B6C-DA1E-4926-8E69-8221F609DF4E}". Action faite: Entries Removed.

Tue Aug 15 08:30:22 2006 => Entrée "HKCR\ComPlusMetaData.MsCorHost" réfère à objet invalide "{727CDF4F-3BA0-11D3-8738-00C04F79ED0D}". Action faite: Entries Removed.

Tue Aug 15 08:30:22 2006 => Entrée "HKCR\ComPlusMetaData.MsCorHost.2" réfère à objet invalide "{727CDF4F-3BA0-11D3-8738-00C04F79ED0D}". Action faite: Entries Removed.

Tue Aug 15 08:30:24 2006 => Entrée "HKCR\Plenoptic.Plenoptic" réfère à objet invalide "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action faite: Entries Removed.

Tue Aug 15 08:30:24 2006 => Entrée "HKCR\RTCCore.RTCClient" réfère à objet invalide "{7a42ea29-a2b7-40c4-b091-f6f024aa89be}". Action faite: Entries Removed.

Tue Aug 15 08:30:25 2006 => Entrée "HKCR\SymWriter.pdb" réfère à objet invalide "{520DC67A-752E-11D3-8D56-00C04F680B2B}". Action faite: Entries Removed.

Tue Aug 15 08:30:25 2006 => Entrée "HKCR\warez.DocHostUIHandler" réfère à objet invalide "{3F2BBC05-40DF-11D2-9455-00104BC936FF}". Action faite: Entries Removed.

Tue Aug 15 08:30:25 2006 => Entrée "HKCR\WMPPublsihCntr.WMPPublsihCntr" réfère à objet invalide "{939438A9-CF0F-44d8-9140-599736F0D3A2}". Action faite: Entries Removed.

Tue Aug 15 08:30:25 2006 => Checking Module Usage Entries…
Tue Aug 15 08:30:25 2006 => Entrée "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" réfère à objet invalide "C:\WINDOWS\Downloaded Program Files\SpSubRx.exe". Action faite: Entries Removed.

Tue Aug 15 08:30:25 2006 => Entrée "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" réfère à objet invalide "C:\WINDOWS\Downloaded Program Files\xscan53.ocx". Action faite: Entries Removed.

Tue Aug 15 08:30:26 2006 => Checking User Trusted External App Entries…
Tue Aug 15 08:30:26 2006 => Entrée "HKCU\Software\Netscape\Netscape Navigator\User Trusted External Applications" réfère à objet invalide ""C:\Program Files\Java\jre1.5.0_04\bin\javaws.exe"". Action faite: Entries Removed.

Tue Aug 15 08:30:26 2006 => Checking Shared DLL Entries…
Tue Aug 15 08:30:27 2006 => Entrée "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" réfère à objet invalide "C:\Program Files\Opera\program\plugins\\NPSWF32.dll". Action faite: Entries Removed.

Tue Aug 15 08:30:27 2006 => Entrée "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" réfère à objet invalide "C:\Program Files\Ahead\CoverDesigner\covered-deu.nls". Action faite: Entries Removed.

Tue Aug 15 08:30:27 2006 => Entrée "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" réfère à objet invalide "C:\Program Files\Ahead\CoverDesigner\covered-jpn.nls". Action faite: Entries Removed.

Tue Aug 15 08:30:27 2006 => Entrée "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" réfère à objet invalide "C:\Program Files\Ahead\Nero BackItUp\BackItUp-Deu.nls". Action faite: Entries Removed.

Tue Aug 15 08:30:27 2006 => Entrée "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" réfère à objet invalide "C:\Program Files\Ahead\Nero StartSmart\NeroStartSmart_deu.chm". Action faite: Entries Removed.

Tue Aug 15 08:30:27 2006 => Entrée "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" réfère à objet invalide "C:\Program Files\Ahead\Nero StartSmart\NeroStartSmart_jpn.chm". Action faite: Entries Removed.

Tue Aug 15 08:30:27 2006 => Entrée "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" réfère à objet invalide "C:\Program Files\Ahead\Nero BackItUp\BackItUp-Jpn.nls". Action faite: Entries Removed.

Tue Aug 15 08:30:28 2006 => Entrée "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" réfère à objet invalide "C:\WINDOWS\Downloaded Program Files\xscan53.ocx". Action faite: Entries Removed.

Tue Aug 15 08:30:28 2006 => Entrée "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" réfère à objet invalide "C:\WINDOWS\Downloaded Program Files\SpSubRx.exe". Action faite: Entries Removed.

Tue Aug 15 08:30:28 2006 => Checking App Path Entries…
Tue Aug 15 08:30:28 2006 => Entrée "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\banxafe Wallet" réfère à objet invalide "C:\banxafe\banxafe Wallet". Action faite: Entries Removed.

Tue Aug 15 08:30:28 2006 => Entrée "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\C-ZAM PC COM Driver" réfère à objet invalide "C:\Program Files\CZAMPC COM\C-ZAM PC COM Driver". Action faite: Entries Removed.

Tue Aug 15 08:30:28 2006 => Entrée "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\chime.exe" réfère à objet invalide "C:\Program Files\Internet Explorer\Plugins\chime.exe". Action faite: Entries Removed.

Tue Aug 15 08:30:29 2006 => Entrée "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\DigitalEar.exe" réfère à objet invalide "C:\Program Files\Digital Ear\DigitalEar.exe". Action faite: Entries Removed.

Tue Aug 15 08:30:29 2006 => Entrée "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\isobuster.exe" réfère à objet invalide "C:\Program Files\Smart Projects\IsoBuster\IsoBuster.exe". Action faite: Entries Removed.

Tue Aug 15 08:30:29 2006 => Entrée "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\SUDOKU.exe" réfère à objet invalide "C:\Program Files\SUDOKU\SUDOKU.exe". Action faite: Entries Removed.

Tue Aug 15 08:30:29 2006 => Entrée "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\Super Sudoku.exe" réfère à objet invalide "C:\Program Files\Super Logiciels\Super Sudoku\Super Sudoku.exe". Action faite: Entries Removed.

Tue Aug 15 08:30:29 2006 => Entrée "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\YourApp.exe" réfère à objet invalide "C:\Program Files\ICSI\Multi-Card Reader & Flash Disk\YourApp.exe". Action faite: Entries Removed.

Tue Aug 15 08:30:30 2006 => Checking Installer Entries…
Tue Aug 15 08:30:31 2006 => Entrée "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" réfère à objet invalide "C:\Program Files\QuickTime\QTComponents\". Action faite: Entries Removed.

Tue Aug 15 08:30:36 2006 => Checking Shared Tools Entries…
Tue Aug 15 08:30:36 2006 => Checking File Extension Entries…
Tue Aug 15 08:30:36 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".0". Action faite: Entries Removed.

Tue Aug 15 08:30:36 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".001". Action faite: Entries Removed.

Tue Aug 15 08:30:36 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".004". Action faite: Entries Removed.

Tue Aug 15 08:30:36 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".1". Action faite: Entries Removed.

Tue Aug 15 08:30:36 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".3". Action faite: Entries Removed.

Tue Aug 15 08:30:36 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".3gp". Action faite: Entries Removed.

Tue Aug 15 08:30:36 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".57". Action faite: Entries Removed.

Tue Aug 15 08:30:36 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".ac3". Action faite: Entries Removed.

Tue Aug 15 08:30:36 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".adm". Action faite: Entries Removed.

Tue Aug 15 08:30:36 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".aff". Action faite: Entries Removed.

Tue Aug 15 08:30:36 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".AllowAuth". Action faite: Entries Removed.

Tue Aug 15 08:30:36 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".AllowFTP". Action faite: Entries Removed.

Tue Aug 15 08:30:36 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".AllowRadius". Action faite: Entries Removed.

Tue Aug 15 08:30:36 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".AllowSMB". Action faite: Entries Removed.

Tue Aug 15 08:30:36 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".AllowSSH". Action faite: Entries Removed.

Tue Aug 15 08:30:36 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".amr". Action faite: Entries Removed.

Tue Aug 15 08:30:36 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".atrpms". Action faite: Entries Removed.

Tue Aug 15 08:30:36 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".attrs". Action faite: Entries Removed.

Tue Aug 15 08:30:36 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".awb". Action faite: Entries Removed.

Tue Aug 15 08:30:36 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".ax". Action faite: Entries Removed.

Tue Aug 15 08:30:36 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".bak". Action faite: Entries Removed.

Tue Aug 15 08:30:36 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".bak1". Action faite: Entries Removed.

Tue Aug 15 08:30:36 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".BAS". Action faite: Entries Removed.

Tue Aug 15 08:30:36 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".bloat". Action faite: Entries Removed.

Tue Aug 15 08:30:36 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".bootscreen". Action faite: Entries Removed.

Tue Aug 15 08:30:36 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".BUP". Action faite: Entries Removed.

Tue Aug 15 08:30:36 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".bz2". Action faite: Entries Removed.

Tue Aug 15 08:30:36 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".cdb". Action faite: Entries Removed.

Tue Aug 15 08:30:36 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".cnt". Action faite: Entries Removed.

Tue Aug 15 08:30:36 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".connect". Action faite: Entries Removed.

Tue Aug 15 08:30:37 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".cue". Action faite: Entries Removed.

Tue Aug 15 08:30:37 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".dal". Action faite: Entries Removed.

Tue Aug 15 08:30:37 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".deb". Action faite: Entries Removed.

Tue Aug 15 08:30:37 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".Debian". Action faite: Entries Removed.

Tue Aug 15 08:30:37 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".df2mrtg". Action faite: Entries Removed.

Tue Aug 15 08:30:37 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".dk". Action faite: Entries Removed.

Tue Aug 15 08:30:37 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".dual". Action faite: Entries Removed.

Tue Aug 15 08:30:37 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".ebm". Action faite: Entries Removed.

Tue Aug 15 08:30:37 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".egg". Action faite: Entries Removed.

Tue Aug 15 08:30:37 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".epim". Action faite: Entries Removed.

Tue Aug 15 08:30:37 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".example". Action faite: Entries Removed.

Tue Aug 15 08:30:37 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".fdp". Action faite: Entries Removed.

Tue Aug 15 08:30:37 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".frf". Action faite: Entries Removed.

Tue Aug 15 08:30:37 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".fwstat". Action faite: Entries Removed.

Tue Aug 15 08:30:37 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".help". Action faite: Entries Removed.

Tue Aug 15 08:30:37 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".htaccess". Action faite: Entries Removed.

Tue Aug 15 08:30:37 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".htpasswd". Action faite: Entries Removed.

Tue Aug 15 08:30:37 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".i386". Action faite: Entries Removed.

Tue Aug 15 08:30:37 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".idx". Action faite: Entries Removed.

Tue Aug 15 08:30:37 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".in". Action faite: Entries Removed.

Tue Aug 15 08:30:37 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".ini-dist". Action faite: Entries Removed.

Tue Aug 15 08:30:37 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".ini-recommended". Action faite: Entries Removed.

Tue Aug 15 08:30:37 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".ipk". Action faite: Entries Removed.

Tue Aug 15 08:30:37 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".ipm". Action faite: Entries Removed.

Tue Aug 15 08:30:37 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".iptables". Action faite: Entries Removed.

Tue Aug 15 08:30:37 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".jffs2". Action faite: Entries Removed.

Tue Aug 15 08:30:37 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".jsc". Action faite: Entries Removed.

Tue Aug 15 08:30:37 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".lang". Action faite: Entries Removed.

Tue Aug 15 08:30:37 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".ldb". Action faite: Entries Removed.

Tue Aug 15 08:30:37 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".License". Action faite: Entries Removed.

Tue Aug 15 08:30:37 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".list". Action faite: Entries Removed.

Tue Aug 15 08:30:37 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".lng". Action faite: Entries Removed.

Tue Aug 15 08:30:37 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".load". Action faite: Entries Removed.

Tue Aug 15 08:30:37 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".map". Action faite: Entries Removed.

Tue Aug 15 08:30:37 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".mcf". Action faite: Entries Removed.

Tue Aug 15 08:30:37 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".mms". Action faite: Entries Removed.

Tue Aug 15 08:30:37 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".mo". Action faite: Entries Removed.

Tue Aug 15 08:30:37 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".multi". Action faite: Entries Removed.

Tue Aug 15 08:30:38 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".nat". Action faite: Entries Removed.

Tue Aug 15 08:30:38 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".networks". Action faite: Entries Removed.

Tue Aug 15 08:30:38 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".nh". Action faite: Entries Removed.

Tue Aug 15 08:30:38 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".nim". Action faite: Entries Removed.

Tue Aug 15 08:30:38 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".npl". Action faite: Entries Removed.

Tue Aug 15 08:30:38 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".obm". Action faite: Entries Removed.

Tue Aug 15 08:30:38 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".ocs". Action faite: Entries Removed.

Tue Aug 15 08:30:38 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".old". Action faite: Entries Removed.

Tue Aug 15 08:30:38 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".original". Action faite: Entries Removed.

Tue Aug 15 08:30:38 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".otb". Action faite: Entries Removed.

Tue Aug 15 08:30:38 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".ozf2". Action faite: Entries Removed.

Tue Aug 15 08:30:38 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".pal". Action faite: Entries Removed.

Tue Aug 15 08:30:38 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".part". Action faite: Entries Removed.

Tue Aug 15 08:30:38 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".password". Action faite: Entries Removed.

Tue Aug 15 08:30:38 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".patch". Action faite: Entries Removed.

Tue Aug 15 08:30:38 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".PLT". Action faite: Entries Removed.

Tue Aug 15 08:30:38 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".pod". Action faite: Entries Removed.

Tue Aug 15 08:30:38 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".ptv". Action faite: Entries Removed.

Tue Aug 15 08:30:38 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".r00". Action faite: Entries Removed.

Tue Aug 15 08:30:38 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".r01". Action faite: Entries Removed.

Tue Aug 15 08:30:38 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".rar". Action faite: Entries Removed.

Tue Aug 15 08:30:38 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".rdf". Action faite: Entries Removed.

Tue Aug 15 08:30:38 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".README". Action faite: Entries Removed.

Tue Aug 15 08:30:38 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".rpm". Action faite: Entries Removed.

Tue Aug 15 08:30:38 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".RTC". Action faite: Entries Removed.

Tue Aug 15 08:30:38 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".rules". Action faite: Entries Removed.

Tue Aug 15 08:30:38 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".sample". Action faite: Entries Removed.

Tue Aug 15 08:30:38 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".scm". Action faite: Entries Removed.

Tue Aug 15 08:30:38 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".setlanip". Action faite: Entries Removed.

Tue Aug 15 08:30:38 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".sfv". Action faite: Entries Removed.

Tue Aug 15 08:30:38 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".sh". Action faite: Entries Removed.

Tue Aug 15 08:30:38 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".sid". Action faite: Entries Removed.

Tue Aug 15 08:30:38 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".spec". Action faite: Entries Removed.

Tue Aug 15 08:30:38 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".svgz". Action faite: Entries Removed.

Tue Aug 15 08:30:38 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".template". Action faite: Entries Removed.

Tue Aug 15 08:30:38 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".tmp". Action faite: Entries Removed.

Tue Aug 15 08:30:38 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".trx". Action faite: Entries Removed.

Tue Aug 15 08:30:38 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".ulist". Action faite: Entries Removed.

Tue Aug 15 08:30:39 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".ulist2". Action faite: Entries Removed.

Tue Aug 15 08:30:39 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".userrun". Action faite: Entries Removed.

Tue Aug 15 08:30:39 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".wbm". Action faite: Entries Removed.

Tue Aug 15 08:30:39 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".wbmp". Action faite: Entries Removed.

Tue Aug 15 08:30:39 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide ".xpi". Action faite: Entries Removed.

Tue Aug 15 08:30:39 2006 => Entrée "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" réfère à objet invalide "OpenWithList". Action faite: Entries Removed.

Tue Aug 15 08:30:39 2006 => Checking Application Cache Entries…
Tue Aug 15 08:30:39 2006 => Entrée "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" réfère à objet invalide "Carnet de cotes_is1". Action faite: Entries Removed.

Tue Aug 15 08:30:39 2006 => Entrée "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" réfère à objet invalide "CD Jaquette". Action faite: Entries Removed.

Tue Aug 15 08:30:39 2006 => Entrée "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" réfère à objet invalide "Elecard MPEG-2 Decoder&Streaming; Pack 3.1.60209". Action faite: Entries Removed.

Tue Aug 15 08:30:39 2006 => Entrée "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" réfère à objet invalide "Elecard MPEG-2 Encoder Std 4.0". Action faite: Entries Removed.

Tue Aug 15 08:30:39 2006 => Entrée "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" réfère à objet invalide "InstallShield_{4E5E22C2-1386-47AE-8EDE-32DDCDCD6653}". Action faite: Entries Removed.

Tue Aug 15 08:30:39 2006 => Entrée "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" réfère à objet invalide "InstallShield_{5A4AFC3E-4973-46A1-92D6-3A1C5E52948A}". Action faite: Entries Removed.

Tue Aug 15 08:30:39 2006 => Entrée "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" réfère à objet invalide "Mozilla Firefox (1.0.4)". Action faite: Entries Removed.

Tue Aug 15 08:30:39 2006 => Entrée "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" réfère à objet invalide "Mozilla Firefox (1.0.6)". Action faite: Entries Removed.

Tue Aug 15 08:30:39 2006 => Entrée "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" réfère à objet invalide "Mozilla Firefox (1.0.7)". Action faite: Entries Removed.

Tue Aug 15 08:30:39 2006 => Entrée "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" réfère à objet invalide "Mozilla Firefox (1.5)". Action faite: Entries Removed.

Tue Aug 15 08:30:39 2006 => Entrée "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" réfère à objet invalide "Mozilla Firefox (1.5.0.1)". Action faite: Entries Removed.

Tue Aug 15 08:30:39 2006 => Entrée "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" réfère à objet invalide "Mozilla Firefox (1.5.0.2)". Action faite: Entries Removed.

Tue Aug 15 08:30:39 2006 => Entrée "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" réfère à objet invalide "Mozilla Firefox (1.5.0.3)". Action faite: Entries Removed.

Tue Aug 15 08:30:39 2006 => Entrée "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" réfère à objet invalide "Mozilla Firefox (1.5.0.4)". Action faite: Entries Removed.

Tue Aug 15 08:30:39 2006 => Entrée "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" réfère à objet invalide "Mozilla Thunderbird (1.0.2)". Action faite: Entries Removed.

Tue Aug 15 08:30:39 2006 => Entrée "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" réfère à objet invalide "Opera". Action faite: Entries Removed.

Tue Aug 15 08:30:39 2006 => Entrée "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" réfère à objet invalide "PE Builder_is1". Action faite: Entries Removed.

Tue Aug 15 08:30:39 2006 => Entrée "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" réfère à objet invalide "SmartWhois". Action faite: Entries Removed.

Tue Aug 15 08:30:39 2006 => Entrée "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" réfère à objet invalide "SQL Uniform". Action faite: Entries Removed.

Tue Aug 15 08:30:39 2006 => Entrée "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" réfère à objet invalide "VideoReDo-Plus_is1". Action faite: Entries Removed.

Tue Aug 15 08:30:39 2006 => Entrée "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" réfère à objet invalide "{131DFF78-5A6A-4F84-A848-058B93DAE706}". Action faite: Entries Removed.

Tue Aug 15 08:30:39 2006 => Entrée "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" réfère à objet invalide "{2B257128-0B59-4A88-AFDF-BE12E5F5B9A0}". Action faite: Entries Removed.

Tue Aug 15 08:30:39 2006 => Entrée "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" réfère à objet invalide "{2B257128-0B59-4A88-AFDF-BE12E5F5B9A1}". Action faite: Entries Removed.

Tue Aug 15 08:30:39 2006 => Entrée "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" réfère à objet invalide "{3248F0A8-6813-11D6-A77B-00B0D0150040}". Action faite: Entries Removed.

Tue Aug 15 08:30:39 2006 => Entrée "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" réfère à objet invalide "{3869903C-0EF4-48D9-A12F-145AD549BA12}". Action faite: Entries Removed.

Tue Aug 15 08:30:39 2006 => Entrée "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" réfère à objet invalide "{3DE5E7D4-7B88-403C-A3FD-2017A8240C5B}". Action faite: Entries Removed.

Tue Aug 15 08:30:39 2006 => Entrée "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" réfère à objet invalide "{44CFED0B-BF92-455B-94D3-FA967A81712E}". Action faite: Entries Removed.

Tue Aug 15 08:30:39 2006 => Entrée "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" réfère à objet invalide "{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}". Action faite: Entries Removed.

Tue Aug 15 08:30:39 2006 => Entrée "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" réfère à objet invalide "{7D6D2D15-3C83-4124-90A8-27CB8A972AAA}". Action faite: Entries Removed.

Tue Aug 15 08:30:39 2006 => Entrée "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" réfère à objet invalide "{AC76BA86-0000-7EC8-7489-000000000702}". Action faite: Entries Removed.

Tue Aug 15 08:30:39 2006 => Entrée "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" réfère à objet invalide "{AC76BA86-0000-7EC8-7489-000000000703}". Action faite: Entries Removed.

Tue Aug 15 08:30:39 2006 => Entrée "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" réfère à objet invalide "{AC76BA86-0000-7EC8-7489-000000000704}". Action faite: Entries Removed.

Tue Aug 15 08:30:39 2006 => Entrée "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" réfère à objet invalide "{B6F867E8-F092-4C5E-7D72-AC7057DBEF45}". Action faite: Entries Removed.

Tue Aug 15 08:30:39 2006 => Entrée "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" réfère à objet invalide "{DDB043A6-85F1-4B6D-85BE-D83DFB12F5C1}". Action faite: Entries Removed.

Tue Aug 15 08:30:39 2006 => Entrée "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" réfère à objet invalide "{E2C356F6-84B5-4CCB-8FED-12E0F1C2E97B}". Action faite: Entries Removed.


Tue Aug 15 08:30:39 2006 => ***** Scan Des la Base de Registre *****

Tue Aug 15 08:30:39 2006 => Scanne HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad

Tue Aug 15 08:30:40 2006 => Scan

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI