1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Solved Laptop infected or not?

Discussion in 'Malware and Virus Removal Archive' started by MuadDib, 2011/09/07.

Page 2 of 2
  1. 2011/09/09
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Please download ComboFix from [color= "Red"]Here[/color] or [color= "#FF0000"]Here[/color] to your Desktop.

    [color= "Blue"]**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**[/color]
    1. Please, never rename Combofix unless instructed.
    2. Close any open browsers.
    3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".
      • Click on [color= "Red"]this link[/color] to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
      NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
      • Close any open browsers.
      • [color= "Red"]WARNING:[/color] Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    4. Double click on combofix.exe & follow the prompts.
    5. When finished, it will produce a report for you.
    6. Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG users: ComboFix will not run until AVG is uninstalled as a protective measure against the anti-virus. This is because AVG "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results ". Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first.
    Use AppRemover to uninstall it: http://www.appremover.com/
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion ", restart computer to fix the issue.



    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try one of the following:

    1. Run Combofix from Safe Mode.

    2. Delete Combofix file, download fresh one, but rename combofix.exe to yourname.exe BEFORE saving it to your desktop.
    Do NOT run it yet.

    Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

    There are 4 different versions. If one of them won't run then download and try to run the other one.

    Vista and Win7 users need to right click Rkill and choose Run as Administrator

    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    Rkill.com
    Rkill.scr
    Rkill.exe

    • Double-click on the Rkill desktop icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    If normal mode still doesn't work, run BOTH tools from safe mode.

    In case #2, please post BOTH logs, rKill and Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
     
    broni,
    #21
  2. 2011/09/10
    MuadDib

    MuadDib Inactive Thread Starter

    Joined:
    2011/09/07
    Messages:
    29
    Likes Received:
    0
    ComboFix 11-09-10.01 - XXX YYY 10.09.2011 11:55:53.1.2 - x86
    Microsoft Windows XP Professionnel 5.1.2600.3.1252.41.1036.18.3326.2515 [GMT 2:00]
    Lancé depuis: c:\download\WindowsBBS\ComboFix\ComboFix.exe
    AV: Protection antivirus et antispyware McAfee *Disabled/Updated* {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
    * Un nouveau point de restauration a été créé
    .
    .
    (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\documents and settings\Administrateur\Local Settings\Application Data\ApplicationHistory
    c:\documents and settings\Administrateur\Local Settings\Application Data\ApplicationHistory\AddACLEntry.exe.9c9f8e51.ini
    c:\documents and settings\Administrateur\Local Settings\Application Data\ApplicationHistory\AutoUpdate.exe.8c5af742.ini.inuse
    c:\documents and settings\Administrateur\Local Settings\Application Data\ApplicationHistory\MsiExec.exe.8cb23528.ini.inuse
    c:\documents and settings\Administrateur\Local Settings\Application Data\ApplicationHistory\ngen.exe.2c05686e.ini
    c:\documents and settings\Administrateur\Local Settings\Application Data\ApplicationHistory\SL34.tmp.57a113aa.ini
    c:\documents and settings\Administrateur\Local Settings\Application Data\ApplicationHistory\upek.exe.51b7d8ad.ini
    c:\documents and settings\XXX YYY\Local Settings\Application Data\ApplicationHistory
    c:\documents and settings\XXX YYY\Local Settings\Application Data\ApplicationHistory\AddACLEntry.exe.9c9f8e51.ini
    c:\documents and settings\XXX YYY\Local Settings\Application Data\ApplicationHistory\AutoUpdate.exe.8c5af742.ini.inuse
    c:\documents and settings\XXX YYY\Local Settings\Application Data\ApplicationHistory\MsiExec.exe.8cb23528.ini.inuse
    c:\documents and settings\XXX YYY\Local Settings\Application Data\ApplicationHistory\ngen.exe.2c05686e.ini
    c:\documents and settings\XXX YYY\Local Settings\Application Data\ApplicationHistory\SL1121.tmp.9dbbc1a3.ini
    c:\documents and settings\XXX YYY\Local Settings\Application Data\ApplicationHistory\SL34.tmp.57a113aa.ini
    c:\documents and settings\XXX YYY\Local Settings\Application Data\ApplicationHistory\SL8B.tmp.292a898e.ini
    c:\documents and settings\XXX YYY\Local Settings\Application Data\ApplicationHistory\upek.exe.51b7d8ad.ini
    c:\documents and settings\XXX YYY\Mes documents\~WRL0003.tmp
    c:\documents and settings\XXX YYY\WINDOWS
    c:\documents and settings\XXX YYY\Local Settings\Application Data\ApplicationHistory
    c:\documents and settings\XXX YYY\Local Settings\Application Data\ApplicationHistory\AddACLEntry.exe.9c9f8e51.ini
    c:\documents and settings\XXX YYY\Local Settings\Application Data\ApplicationHistory\AutoUpdate.exe.8c5af742.ini.inuse
    c:\documents and settings\XXX YYY\Local Settings\Application Data\ApplicationHistory\MsiExec.exe.8cb23528.ini.inuse
    c:\documents and settings\XXX YYY\Local Settings\Application Data\ApplicationHistory\ngen.exe.2c05686e.ini
    c:\documents and settings\XXX YYY\Local Settings\Application Data\ApplicationHistory\SL34.tmp.57a113aa.ini
    c:\documents and settings\XXX YYY\Local Settings\Application Data\ApplicationHistory\upek.exe.51b7d8ad.ini
    c:\progra~1\FICHIE~1\{30B36~1
    c:\progra~1\FICHIE~1\{A0B36~1
    c:\progra~1\FICHIE~1\{A0B36~2
    c:\program files\WinWare
    c:\program files\WinWare\DATEN\BANKARCH.PX
    c:\program files\WinWare\DATEN\BANKARCH.VAL
    c:\program files\WinWare\DATEN\BANKARCH.X02
    c:\program files\WinWare\DATEN\BANKARCH.Y02
    c:\program files\WinWare\DATEN\BEMERKG.DB
    c:\program files\WinWare\DATEN\BEMERKG.PX
    c:\program files\WinWare\DATEN\BEMERKG.XG0
    c:\program files\WinWare\DATEN\BEMERKG.YG0
    c:\program files\WinWare\DATEN\DATEN.INI
    c:\program files\WinWare\DATEN\DGRUPPEN.PX
    c:\program files\WinWare\DATEN\DGRUPPEN.VAL
    c:\program files\WinWare\DATEN\ETIKETT.PX
    c:\program files\WinWare\DATEN\ETIKETT.VAL
    c:\program files\WinWare\DATEN\Event.Log
    c:\program files\WinWare\DATEN\FAKT.REG
    c:\program files\WinWare\DATEN\FIBU.REG
    c:\program files\WinWare\DATEN\FINAMT.DB
    c:\program files\WinWare\DATEN\FINAMT.PX
    c:\program files\WinWare\DATEN\FINAMT.VAL
    c:\program files\WinWare\DATEN\FONT.PX
    c:\program files\WinWare\DATEN\FONT.VAL
    c:\program files\WinWare\DATEN\FORMAT.PX
    c:\program files\WinWare\DATEN\FORMAT.VAL
    c:\program files\WinWare\DATEN\Intra.DB
    c:\program files\WinWare\DATEN\Intra.PX
    c:\program files\WinWare\DATEN\Intra.VAL
    c:\program files\WinWare\DATEN\INWAREN.DB
    c:\program files\WinWare\DATEN\INWAREN.PX
    c:\program files\WinWare\DATEN\INWAREN.X03
    c:\program files\WinWare\DATEN\INWAREN.Y03
    c:\program files\WinWare\DATEN\Key.DB
    c:\program files\WinWare\DATEN\Key.PX
    c:\program files\WinWare\DATEN\LOHN.REG
    c:\program files\WinWare\DATEN\MAPKIT.REG
    c:\program files\WinWare\DATEN\MEINHEIT.PX
    c:\program files\WinWare\DATEN\MEINHEIT.VAL
    c:\program files\WinWare\DATEN\MEINHEIT.X02
    c:\program files\WinWare\DATEN\MEINHEIT.X07
    c:\program files\WinWare\DATEN\MEINHEIT.Y02
    c:\program files\WinWare\DATEN\MEINHEIT.Y07
    c:\program files\WinWare\DATEN\MESSAGE.DB
    c:\program files\WinWare\DATEN\MESSAGE.PX
    c:\program files\WinWare\DATEN\MEX1BP6\200601\BUCH.DB
    c:\program files\WinWare\DATEN\MEX1BP6\200601\BUCH.PX
    c:\program files\WinWare\DATEN\MEX1BP6\200601\BUCH.VAL
    c:\program files\WinWare\DATEN\MEX1BP6\200601\BUCH.XG0
    c:\program files\WinWare\DATEN\MEX1BP6\200601\BUCH.YG0
    c:\program files\WinWare\DATEN\MEX1BP6\200601\GVORFALL.DB
    c:\program files\WinWare\DATEN\MEX1BP6\200601\GVORFALL.PX
    c:\program files\WinWare\DATEN\MEX1BP6\200601\GVORFALL.VAL
    c:\program files\WinWare\DATEN\MEX1BP6\200601\GVORFALL.XG0
    c:\program files\WinWare\DATEN\MEX1BP6\200601\GVORFALL.YG0
    c:\program files\WinWare\DATEN\MEX1BP6\200601\JAHR.INI
    c:\program files\WinWare\DATEN\MEX1BP6\200601\JBUDGET.DB
    c:\program files\WinWare\DATEN\MEX1BP6\200601\JBUDGET.PX
    c:\program files\WinWare\DATEN\MEX1BP6\200601\JBUDGET.VAL
    c:\program files\WinWare\DATEN\MEX1BP6\200601\JTEXT.DB
    c:\program files\WinWare\DATEN\MEX1BP6\200601\JTEXT.MB
    c:\program files\WinWare\DATEN\MEX1BP6\200601\JTEXT.PX
    c:\program files\WinWare\DATEN\MEX1BP6\200601\KAUSZUG.DB
    c:\program files\WinWare\DATEN\MEX1BP6\200601\KAUSZUG.PX
    c:\program files\WinWare\DATEN\MEX1BP6\200601\KAUSZUG.VAL
    c:\program files\WinWare\DATEN\MEX1BP6\200601\KAUSZUG.XG0
    c:\program files\WinWare\DATEN\MEX1BP6\200601\KAUSZUG.YG0
    c:\program files\WinWare\DATEN\MEX1BP6\200601\Key.DB
    c:\program files\WinWare\DATEN\MEX1BP6\200601\Key.PX
    c:\program files\WinWare\DATEN\MEX1BP6\200601\KONTEN.DB
    c:\program files\WinWare\DATEN\MEX1BP6\200601\KONTEN.PX
    c:\program files\WinWare\DATEN\MEX1BP6\200601\KONTEN.VAL
    c:\program files\WinWare\DATEN\MEX1BP6\200601\KONTEN.X22
    c:\program files\WinWare\DATEN\MEX1BP6\200601\KONTEN.XG0
    c:\program files\WinWare\DATEN\MEX1BP6\200601\KONTEN.XG1
    c:\program files\WinWare\DATEN\MEX1BP6\200601\KONTEN.Y22
    c:\program files\WinWare\DATEN\MEX1BP6\200601\KONTEN.YG0
    c:\program files\WinWare\DATEN\MEX1BP6\200601\KONTEN.YG1
    c:\program files\WinWare\DATEN\MEX1BP6\200601\Korrekt.DB
    c:\program files\WinWare\DATEN\MEX1BP6\200601\Korrekt.PX
    c:\program files\WinWare\DATEN\MEX1BP6\200601\Kosten.DB
    c:\program files\WinWare\DATEN\MEX1BP6\200601\Kosten.PX
    c:\program files\WinWare\DATEN\MEX1BP6\200601\Kosten.VAL
    c:\program files\WinWare\DATEN\MEX1BP6\200601\Kosten.XG0
    c:\program files\WinWare\DATEN\MEX1BP6\200601\Kosten.XG1
    c:\program files\WinWare\DATEN\MEX1BP6\200601\Kosten.YG0
    c:\program files\WinWare\DATEN\MEX1BP6\200601\Kosten.YG1
    c:\program files\WinWare\DATEN\MEX1BP6\200601\Kschema.DB
    c:\program files\WinWare\DATEN\MEX1BP6\200601\Kschema.PX
    c:\program files\WinWare\DATEN\MEX1BP6\200601\Kschema.VAL
    c:\program files\WinWare\DATEN\MEX1BP6\200601\Kschemap.DB
    c:\program files\WinWare\DATEN\MEX1BP6\200601\Kschemap.PX
    c:\program files\WinWare\DATEN\MEX1BP6\200601\Kschemap.VAL
    c:\program files\WinWare\DATEN\MEX1BP6\200601\NUMKREIS.DB
    c:\program files\WinWare\DATEN\MEX1BP6\200601\NUMKREIS.PX
    c:\program files\WinWare\DATEN\MEX1BP6\200601\NUMKREIS.VAL
    c:\program files\WinWare\DATEN\MEX1BP6\200601\NUMKREIS.XG0
    c:\program files\WinWare\DATEN\MEX1BP6\200601\NUMKREIS.YG0
    c:\program files\WinWare\DATEN\MEX1BP6\200601\SALDO.DB
    c:\program files\WinWare\DATEN\MEX1BP6\200601\SALDO.PX
    c:\program files\WinWare\DATEN\MEX1BP6\200601\SALDO.VAL
    c:\program files\WinWare\DATEN\MEX1BP6\200601\SEITEN.DB
    c:\program files\WinWare\DATEN\MEX1BP6\200601\SEITEN.PX
    c:\program files\WinWare\DATEN\MEX1BP6\200601\SUCHTXT.DB
    c:\program files\WinWare\DATEN\MEX1BP6\200601\SUCHTXT.PX
    c:\program files\WinWare\DATEN\MEX1BP6\200601\SUCHTXT.VAL
    c:\program files\WinWare\DATEN\MEX1BP6\200601\SUCHTXT.XG0
    c:\program files\WinWare\DATEN\MEX1BP6\200601\SUCHTXT.YG0
    c:\program files\WinWare\DATEN\MEX1BP6\200601\SUCHTXTD.DB
    c:\program files\WinWare\DATEN\MEX1BP6\200601\SUCHTXTD.PX
    c:\program files\WinWare\DATEN\MEX1BP6\200601\SUCHTXTD.VAL
    c:\program files\WinWare\DATEN\MEX1BP6\200601\SUCHTXTD.X01
    c:\program files\WinWare\DATEN\MEX1BP6\200601\SUCHTXTD.Y01
    c:\program files\WinWare\DATEN\MEX1BP6\200601\USER74.DAU
    c:\program files\WinWare\DATEN\MEX1BP6\ADRESS.DB
    c:\program files\WinWare\DATEN\MEX1BP6\ADRESS.PX
    c:\program files\WinWare\DATEN\MEX1BP6\ADRESS.VAL
    c:\program files\WinWare\DATEN\MEX1BP6\ADRESS.XG0
    c:\program files\WinWare\DATEN\MEX1BP6\ADRESS.XG1
    c:\program files\WinWare\DATEN\MEX1BP6\ADRESS.XG2
    c:\program files\WinWare\DATEN\MEX1BP6\ADRESS.YG0
    c:\program files\WinWare\DATEN\MEX1BP6\ADRESS.YG1
    c:\program files\WinWare\DATEN\MEX1BP6\ADRESS.YG2
    c:\program files\WinWare\DATEN\MEX1BP6\Archiv03.DB
    c:\program files\WinWare\DATEN\MEX1BP6\Archiv03.PX
    c:\program files\WinWare\DATEN\MEX1BP6\Archiv04.DB
    c:\program files\WinWare\DATEN\MEX1BP6\Archiv04.PX
    c:\program files\WinWare\DATEN\MEX1BP6\Archiv05.DB
    c:\program files\WinWare\DATEN\MEX1BP6\Archiv05.PX
    c:\program files\WinWare\DATEN\MEX1BP6\Archiv06.DB
    c:\program files\WinWare\DATEN\MEX1BP6\Archiv06.PX
    c:\program files\WinWare\DATEN\MEX1BP6\BANK.DB
    c:\program files\WinWare\DATEN\MEX1BP6\BANK.PX
    c:\program files\WinWare\DATEN\MEX1BP6\BANK.VAL
    c:\program files\WinWare\DATEN\MEX1BP6\BANK.X02
    c:\program files\WinWare\DATEN\MEX1BP6\BANK.X0C
    c:\program files\WinWare\DATEN\MEX1BP6\BANK.Y02
    c:\program files\WinWare\DATEN\MEX1BP6\BANK.Y0C
    c:\program files\WinWare\DATEN\MEX1BP6\BANKVERB.DB
    c:\program files\WinWare\DATEN\MEX1BP6\BANKVERB.PX
    c:\program files\WinWare\DATEN\MEX1BP6\BANKVERB.VAL
    c:\program files\WinWare\DATEN\MEX1BP6\BANKVERB.X07
    c:\program files\WinWare\DATEN\MEX1BP6\BANKVERB.X0B
    c:\program files\WinWare\DATEN\MEX1BP6\BANKVERB.X0C
    c:\program files\WinWare\DATEN\MEX1BP6\BANKVERB.XG0
    c:\program files\WinWare\DATEN\MEX1BP6\BANKVERB.Y07
    c:\program files\WinWare\DATEN\MEX1BP6\BANKVERB.Y0B
    c:\program files\WinWare\DATEN\MEX1BP6\BANKVERB.Y0C
    c:\program files\WinWare\DATEN\MEX1BP6\BANKVERB.YG0
    c:\program files\WinWare\DATEN\MEX1BP6\BILD.DB
    c:\program files\WinWare\DATEN\MEX1BP6\BILD.MB
    c:\program files\WinWare\DATEN\MEX1BP6\BILD.PX
    c:\program files\WinWare\DATEN\MEX1BP6\BUCHTEXT.DB
    c:\program files\WinWare\DATEN\MEX1BP6\BUCHTEXT.PX
    c:\program files\WinWare\DATEN\MEX1BP6\DBPASS.DAT
    c:\program files\WinWare\DATEN\MEX1BP6\FILTER.DB
    c:\program files\WinWare\DATEN\MEX1BP6\FILTER.MB
    c:\program files\WinWare\DATEN\MEX1BP6\FILTER.PX
    c:\program files\WinWare\DATEN\MEX1BP6\GRUPPEN.DB
    c:\program files\WinWare\DATEN\MEX1BP6\GRUPPEN.PX
    c:\program files\WinWare\DATEN\MEX1BP6\GRUPPEN.VAL
    c:\program files\WinWare\DATEN\MEX1BP6\GRUPPEN.X05
    c:\program files\WinWare\DATEN\MEX1BP6\GRUPPEN.XG0
    c:\program files\WinWare\DATEN\MEX1BP6\GRUPPEN.Y05
    c:\program files\WinWare\DATEN\MEX1BP6\GRUPPEN.YG0
    c:\program files\WinWare\DATEN\MEX1BP6\KASSBANK.DB
    c:\program files\WinWare\DATEN\MEX1BP6\KASSBANK.PX
    c:\program files\WinWare\DATEN\MEX1BP6\KASSBANK.VAL
    c:\program files\WinWare\DATEN\MEX1BP6\KEY.DB
    c:\program files\WinWare\DATEN\MEX1BP6\KEY.PX
    c:\program files\WinWare\DATEN\MEX1BP6\KSTELL.DB
    c:\program files\WinWare\DATEN\MEX1BP6\KSTELL.PX
    c:\program files\WinWare\DATEN\MEX1BP6\KSTELL.VAL
    c:\program files\WinWare\DATEN\MEX1BP6\KSTELL.X06
    c:\program files\WinWare\DATEN\MEX1BP6\KSTELL.Y06
    c:\program files\WinWare\DATEN\MEX1BP6\KUNDEN.DB
    c:\program files\WinWare\DATEN\MEX1BP6\KUNDEN.PX
    c:\program files\WinWare\DATEN\MEX1BP6\KUNDEN.VAL
    c:\program files\WinWare\DATEN\MEX1BP6\KUNDEN.X11
    c:\program files\WinWare\DATEN\MEX1BP6\KUNDEN.X17
    c:\program files\WinWare\DATEN\MEX1BP6\KUNDEN.Y11
    c:\program files\WinWare\DATEN\MEX1BP6\KUNDEN.Y17
    c:\program files\WinWare\DATEN\MEX1BP6\LIEFER.DB
    c:\program files\WinWare\DATEN\MEX1BP6\LIEFER.PX
    c:\program files\WinWare\DATEN\MEX1BP6\LIEFER.VAL
    c:\program files\WinWare\DATEN\MEX1BP6\LIEFER.X11
    c:\program files\WinWare\DATEN\MEX1BP6\LIEFER.X17
    c:\program files\WinWare\DATEN\MEX1BP6\LIEFER.Y11
    c:\program files\WinWare\DATEN\MEX1BP6\LIEFER.Y17
    c:\program files\WinWare\DATEN\MEX1BP6\LINK.DB
    c:\program files\WinWare\DATEN\MEX1BP6\LINK.PX
    c:\program files\WinWare\DATEN\MEX1BP6\LINK.XG0
    c:\program files\WinWare\DATEN\MEX1BP6\LINK.YG0
    c:\program files\WinWare\DATEN\MEX1BP6\Mahn.ini
    c:\program files\WinWare\DATEN\MEX1BP6\MAHNB.DB
    c:\program files\WinWare\DATEN\MEX1BP6\MAHNB.PX
    c:\program files\WinWare\DATEN\MEX1BP6\MAHNP.DB
    c:\program files\WinWare\DATEN\MEX1BP6\MAHNP.PX
    c:\program files\WinWare\DATEN\MEX1BP6\MAHNP.XG0
    c:\program files\WinWare\DATEN\MEX1BP6\MAHNP.YG0
    c:\program files\WinWare\DATEN\MEX1BP6\Mandant.ini
    c:\program files\WinWare\DATEN\MEX1BP6\MaskEdit.DB
    c:\program files\WinWare\DATEN\MEX1BP6\MaskEdit.PX
    c:\program files\WinWare\DATEN\MEX1BP6\MITARBW.DB
    c:\program files\WinWare\DATEN\MEX1BP6\MITARBW.PX
    c:\program files\WinWare\DATEN\MEX1BP6\MITARBW.VAL
    c:\program files\WinWare\DATEN\MEX1BP6\MWST2006.DAT
    c:\program files\WinWare\DATEN\MEX1BP6\NOTIZ.DB
    c:\program files\WinWare\DATEN\MEX1BP6\NOTIZ.MB
    c:\program files\WinWare\DATEN\MEX1BP6\NOTIZ.PX
    c:\program files\WinWare\DATEN\MEX1BP6\NOTIZ.VAL
    c:\program files\WinWare\DATEN\MEX1BP6\NOTIZ.XG0
    c:\program files\WinWare\DATEN\MEX1BP6\NOTIZ.XG1
    c:\program files\WinWare\DATEN\MEX1BP6\NOTIZ.YG0
    c:\program files\WinWare\DATEN\MEX1BP6\NOTIZ.YG1
    c:\program files\WinWare\DATEN\MEX1BP6\OPOS.DB
    c:\program files\WinWare\DATEN\MEX1BP6\OPOS.PX
    c:\program files\WinWare\DATEN\MEX1BP6\OPOS.VAL
    c:\program files\WinWare\DATEN\MEX1BP6\OPOS.X15
    c:\program files\WinWare\DATEN\MEX1BP6\OPOS.X1F
    c:\program files\WinWare\DATEN\MEX1BP6\OPOS.X27
    c:\program files\WinWare\DATEN\MEX1BP6\OPOS.XG0
    c:\program files\WinWare\DATEN\MEX1BP6\OPOS.XG1
    c:\program files\WinWare\DATEN\MEX1BP6\OPOS.Y15
    c:\program files\WinWare\DATEN\MEX1BP6\OPOS.Y1F
    c:\program files\WinWare\DATEN\MEX1BP6\OPOS.Y27
    c:\program files\WinWare\DATEN\MEX1BP6\OPOS.YG0
    c:\program files\WinWare\DATEN\MEX1BP6\OPOS.YG1
    c:\program files\WinWare\DATEN\MEX1BP6\PME.KPL
    c:\program files\WinWare\DATEN\MEX1BP6\STAPEL.DB
    c:\program files\WinWare\DATEN\MEX1BP6\STAPEL.PX
    c:\program files\WinWare\DATEN\MEX1BP6\STAPEL.VAL
    c:\program files\WinWare\DATEN\MEX1BP6\STAPELP.DB
    c:\program files\WinWare\DATEN\MEX1BP6\STAPELP.PX
    c:\program files\WinWare\DATEN\MEX1BP6\STAPELP.VAL
    c:\program files\WinWare\DATEN\MEX1BP6\STEXT.MB
    c:\program files\WinWare\DATEN\MEX1BP6\TEXT.DB
    c:\program files\WinWare\DATEN\MEX1BP6\TEXT.MB
    c:\program files\WinWare\DATEN\MEX1BP6\TEXT.PX
    c:\program files\WinWare\DATEN\MEX1BP6\USDETAIL.DB
    c:\program files\WinWare\DATEN\MEX1BP6\USDETAIL.PX
    c:\program files\WinWare\DATEN\MEX1BP6\USDETAIL.VAL
    c:\program files\WinWare\DATEN\MEX1BP6\USTSCHL.DB
    c:\program files\WinWare\DATEN\MEX1BP6\USTSCHL.PX
    c:\program files\WinWare\DATEN\MEX1BP6\USTSCHL.VAL
    c:\program files\WinWare\DATEN\MEX1BP6\WAEHR.DB
    c:\program files\WinWare\DATEN\MEX1BP6\WAEHR.PX
    c:\program files\WinWare\DATEN\MEX1BP6\WAEHR.VAL
    c:\program files\WinWare\DATEN\MEX1BP6\WAEHRP.DB
    c:\program files\WinWare\DATEN\MEX1BP6\WAEHRP.PX
    c:\program files\WinWare\DATEN\MEX1BP6\WAEHRP.VAL
    c:\program files\WinWare\DATEN\MEX1BP6\ZAHLBED.DB
    c:\program files\WinWare\DATEN\MEX1BP6\ZAHLBED.PX
    c:\program files\WinWare\DATEN\MEX1BP6\ZAHLBED.VAL
    c:\program files\WinWare\DATEN\MEX1BP6\ZMODUL.DB
    c:\program files\WinWare\DATEN\MEX1BP6\ZMODUL.PX
    c:\program files\WinWare\DATEN\MEX1BP6\ZMODUL.VAL
    c:\program files\WinWare\DATEN\MEX1BP6\ZMODULP.DB
    c:\program files\WinWare\DATEN\MEX1BP6\ZMODULP.PX
    c:\program files\WinWare\DATEN\MEX1BP6\ZMODULP.VAL
    c:\program files\WinWare\DATEN\MEX1P25\200601\BUCH.DB
    c:\program files\WinWare\DATEN\MEX1P25\200601\BUCH.PX
    c:\program files\WinWare\DATEN\MEX1P25\200601\BUCH.VAL
    c:\program files\WinWare\DATEN\MEX1P25\200601\BUCH.XG0
    c:\program files\WinWare\DATEN\MEX1P25\200601\BUCH.YG0
    c:\program files\WinWare\DATEN\MEX1P25\200601\EBX.DB
    c:\program files\WinWare\DATEN\MEX1P25\200601\EBX.PX
    c:\program files\WinWare\DATEN\MEX1P25\200601\GVORFALL.DB
    c:\program files\WinWare\DATEN\MEX1P25\200601\GVORFALL.PX
    c:\program files\WinWare\DATEN\MEX1P25\200601\GVORFALL.VAL
    c:\program files\WinWare\DATEN\MEX1P25\200601\GVORFALL.XG0
    c:\program files\WinWare\DATEN\MEX1P25\200601\GVORFALL.YG0
    c:\program files\WinWare\DATEN\MEX1P25\200601\JAHR.INI
    c:\program files\WinWare\DATEN\MEX1P25\200601\JBUDGET.DB
    c:\program files\WinWare\DATEN\MEX1P25\200601\JBUDGET.PX
    c:\program files\WinWare\DATEN\MEX1P25\200601\JBUDGET.VAL
    c:\program files\WinWare\DATEN\MEX1P25\200601\JTEXT.DB
    c:\program files\WinWare\DATEN\MEX1P25\200601\JTEXT.MB
    c:\program files\WinWare\DATEN\MEX1P25\200601\JTEXT.PX
    c:\program files\WinWare\DATEN\MEX1P25\200601\KAUSZUG.DB
    c:\program files\WinWare\DATEN\MEX1P25\200601\KAUSZUG.PX
    c:\program files\WinWare\DATEN\MEX1P25\200601\KAUSZUG.VAL
    c:\program files\WinWare\DATEN\MEX1P25\200601\KAUSZUG.XG0
    c:\program files\WinWare\DATEN\MEX1P25\200601\KAUSZUG.YG0
    c:\program files\WinWare\DATEN\MEX1P25\200601\Key.DB
    c:\program files\WinWare\DATEN\MEX1P25\200601\Key.PX
    c:\program files\WinWare\DATEN\MEX1P25\200601\KONTEN.DB
    c:\program files\WinWare\DATEN\MEX1P25\200601\KONTEN.PX
    c:\program files\WinWare\DATEN\MEX1P25\200601\KONTEN.VAL
    c:\program files\WinWare\DATEN\MEX1P25\200601\KONTEN.X22
    c:\program files\WinWare\DATEN\MEX1P25\200601\KONTEN.XG0
    c:\program files\WinWare\DATEN\MEX1P25\200601\KONTEN.Y22
    c:\program files\WinWare\DATEN\MEX1P25\200601\KONTEN.YG0
    c:\program files\WinWare\DATEN\MEX1P25\200601\Korrekt.DB
    c:\program files\WinWare\DATEN\MEX1P25\200601\Korrekt.PX
    c:\program files\WinWare\DATEN\MEX1P25\200601\Kosten.DB
    c:\program files\WinWare\DATEN\MEX1P25\200601\Kosten.PX
    c:\program files\WinWare\DATEN\MEX1P25\200601\Kosten.VAL
    c:\program files\WinWare\DATEN\MEX1P25\200601\Kosten.XG0
    c:\program files\WinWare\DATEN\MEX1P25\200601\Kosten.XG1
    c:\program files\WinWare\DATEN\MEX1P25\200601\Kosten.YG0
    c:\program files\WinWare\DATEN\MEX1P25\200601\Kosten.YG1
    c:\program files\WinWare\DATEN\MEX1P25\200601\Kschema.DB
    c:\program files\WinWare\DATEN\MEX1P25\200601\Kschema.PX
    c:\program files\WinWare\DATEN\MEX1P25\200601\Kschema.VAL
    c:\program files\WinWare\DATEN\MEX1P25\200601\Kschemap.DB
    c:\program files\WinWare\DATEN\MEX1P25\200601\Kschemap.PX
    c:\program files\WinWare\DATEN\MEX1P25\200601\Kschemap.VAL
    c:\program files\WinWare\DATEN\MEX1P25\200601\NUMKREIS.DB
    c:\program files\WinWare\DATEN\MEX1P25\200601\NUMKREIS.PX
    c:\program files\WinWare\DATEN\MEX1P25\200601\NUMKREIS.VAL
    c:\program files\WinWare\DATEN\MEX1P25\200601\NUMKREIS.XG0
    c:\program files\WinWare\DATEN\MEX1P25\200601\NUMKREIS.YG0
    c:\program files\WinWare\DATEN\MEX1P25\200601\SALDO.DB
    c:\program files\WinWare\DATEN\MEX1P25\200601\SALDO.PX
    c:\program files\WinWare\DATEN\MEX1P25\200601\SALDO.VAL
    c:\program files\WinWare\DATEN\MEX1P25\200601\SEITEN.DB
    c:\program files\WinWare\DATEN\MEX1P25\200601\SEITEN.PX
    c:\program files\WinWare\DATEN\MEX1P25\200601\SUCHTXT.DB
    c:\program files\WinWare\DATEN\MEX1P25\200601\SUCHTXT.PX
    c:\program files\WinWare\DATEN\MEX1P25\200601\SUCHTXT.VAL
    c:\program files\WinWare\DATEN\MEX1P25\200601\SUCHTXT.XG0
    c:\program files\WinWare\DATEN\MEX1P25\200601\SUCHTXT.YG0
    c:\program files\WinWare\DATEN\MEX1P25\200601\SUCHTXTD.DB
    c:\program files\WinWare\DATEN\MEX1P25\200601\SUCHTXTD.PX
    c:\program files\WinWare\DATEN\MEX1P25\200601\SUCHTXTD.VAL
    c:\program files\WinWare\DATEN\MEX1P25\200601\SUCHTXTD.X01
    c:\program files\WinWare\DATEN\MEX1P25\200601\SUCHTXTD.Y01
    c:\program files\WinWare\DATEN\MEX1P25\200601\USER74.DAU
    c:\program files\WinWare\DATEN\MEX1P25\ADRESS.DB
    c:\program files\WinWare\DATEN\MEX1P25\ADRESS.PX
    c:\program files\WinWare\DATEN\MEX1P25\ADRESS.VAL
    c:\program files\WinWare\DATEN\MEX1P25\ADRESS.XG0
    c:\program files\WinWare\DATEN\MEX1P25\ADRESS.XG1
    c:\program files\WinWare\DATEN\MEX1P25\ADRESS.XG2
    c:\program files\WinWare\DATEN\MEX1P25\ADRESS.YG0
    c:\program files\WinWare\DATEN\MEX1P25\ADRESS.YG1
    c:\program files\WinWare\DATEN\MEX1P25\ADRESS.YG2
    c:\program files\WinWare\DATEN\MEX1P25\Archiv03.DB
    c:\program files\WinWare\DATEN\MEX1P25\Archiv03.PX
    c:\program files\WinWare\DATEN\MEX1P25\Archiv04.DB
    c:\program files\WinWare\DATEN\MEX1P25\Archiv04.PX
    c:\program files\WinWare\DATEN\MEX1P25\Archiv05.DB
    c:\program files\WinWare\DATEN\MEX1P25\Archiv05.PX
    c:\program files\WinWare\DATEN\MEX1P25\Archiv06.DB
    c:\program files\WinWare\DATEN\MEX1P25\Archiv06.PX
    c:\program files\WinWare\DATEN\MEX1P25\BANK.DB
    c:\program files\WinWare\DATEN\MEX1P25\BANK.PX
    c:\program files\WinWare\DATEN\MEX1P25\BANK.VAL
    c:\program files\WinWare\DATEN\MEX1P25\BANK.X02
    c:\program files\WinWare\DATEN\MEX1P25\BANK.X0C
    c:\program files\WinWare\DATEN\MEX1P25\BANK.Y02
    c:\program files\WinWare\DATEN\MEX1P25\BANK.Y0C
    c:\program files\WinWare\DATEN\MEX1P25\BANKVERB.DB
    c:\program files\WinWare\DATEN\MEX1P25\BANKVERB.PX
    c:\program files\WinWare\DATEN\MEX1P25\BANKVERB.VAL
    c:\program files\WinWare\DATEN\MEX1P25\BANKVERB.X07
    c:\program files\WinWare\DATEN\MEX1P25\BANKVERB.X0B
    c:\program files\WinWare\DATEN\MEX1P25\BANKVERB.X0C
    c:\program files\WinWare\DATEN\MEX1P25\BANKVERB.XG0
    c:\program files\WinWare\DATEN\MEX1P25\BANKVERB.Y07
    c:\program files\WinWare\DATEN\MEX1P25\BANKVERB.Y0B
    c:\program files\WinWare\DATEN\MEX1P25\BANKVERB.Y0C
    c:\program files\WinWare\DATEN\MEX1P25\BANKVERB.YG0
    c:\program files\WinWare\DATEN\MEX1P25\BILD.DB
    c:\program files\WinWare\DATEN\MEX1P25\BILD.MB
    c:\program files\WinWare\DATEN\MEX1P25\BILD.PX
    c:\program files\WinWare\DATEN\MEX1P25\BUCHTEXT.DB
    c:\program files\WinWare\DATEN\MEX1P25\BUCHTEXT.PX
    c:\program files\WinWare\DATEN\MEX1P25\DBPASS.DAT
    c:\program files\WinWare\DATEN\MEX1P25\FILTER.DB
    c:\program files\WinWare\DATEN\MEX1P25\FILTER.MB
    c:\program files\WinWare\DATEN\MEX1P25\FILTER.PX
    c:\program files\WinWare\DATEN\MEX1P25\GRUPPEN.DB
    c:\program files\WinWare\DATEN\MEX1P25\GRUPPEN.PX
    c:\program files\WinWare\DATEN\MEX1P25\GRUPPEN.VAL
    c:\program files\WinWare\DATEN\MEX1P25\GRUPPEN.X05
    c:\program files\WinWare\DATEN\MEX1P25\GRUPPEN.XG0
    c:\program files\WinWare\DATEN\MEX1P25\GRUPPEN.Y05
    c:\program files\WinWare\DATEN\MEX1P25\GRUPPEN.YG0
    c:\program files\WinWare\DATEN\MEX1P25\KASSBANK.DB
    c:\program files\WinWare\DATEN\MEX1P25\KASSBANK.PX
    c:\program files\WinWare\DATEN\MEX1P25\KASSBANK.VAL
    c:\program files\WinWare\DATEN\MEX1P25\KEY.DB
    c:\program files\WinWare\DATEN\MEX1P25\KEY.PX
    c:\program files\WinWare\DATEN\MEX1P25\KSTELL.DB
    c:\program files\WinWare\DATEN\MEX1P25\KSTELL.PX
    c:\program files\WinWare\DATEN\MEX1P25\KSTELL.VAL
    c:\program files\WinWare\DATEN\MEX1P25\KSTELL.X06
    c:\program files\WinWare\DATEN\MEX1P25\KSTELL.Y06
    c:\program files\WinWare\DATEN\MEX1P25\KUNDEN.DB
    c:\program files\WinWare\DATEN\MEX1P25\KUNDEN.PX
    c:\program files\WinWare\DATEN\MEX1P25\KUNDEN.VAL
    c:\program files\WinWare\DATEN\MEX1P25\KUNDEN.X11
    c:\program files\WinWare\DATEN\MEX1P25\KUNDEN.X17
    c:\program files\WinWare\DATEN\MEX1P25\KUNDEN.Y11
    c:\program files\WinWare\DATEN\MEX1P25\KUNDEN.Y17
    c:\program files\WinWare\DATEN\MEX1P25\LIEFER.DB
    c:\program files\WinWare\DATEN\MEX1P25\LIEFER.PX
    c:\program files\WinWare\DATEN\MEX1P25\LIEFER.VAL
    c:\program files\WinWare\DATEN\MEX1P25\LIEFER.X11
    c:\program files\WinWare\DATEN\MEX1P25\LIEFER.X17
    c:\program files\WinWare\DATEN\MEX1P25\LIEFER.Y11
    c:\program files\WinWare\DATEN\MEX1P25\LIEFER.Y17
    c:\program files\WinWare\DATEN\MEX1P25\LINK.DB
    c:\program files\WinWare\DATEN\MEX1P25\LINK.PX
    c:\program files\WinWare\DATEN\MEX1P25\LINK.XG0
    c:\program files\WinWare\DATEN\MEX1P25\LINK.YG0
    c:\program files\WinWare\DATEN\MEX1P25\Mahn.ini
    c:\program files\WinWare\DATEN\MEX1P25\MAHNB.DB
    c:\program files\WinWare\DATEN\MEX1P25\MAHNB.PX
    c:\program files\WinWare\DATEN\MEX1P25\MAHNP.DB
    c:\program files\WinWare\DATEN\MEX1P25\MAHNP.PX
    c:\program files\WinWare\DATEN\MEX1P25\MAHNP.XG0
    c:\program files\WinWare\DATEN\MEX1P25\MAHNP.YG0
    c:\program files\WinWare\DATEN\MEX1P25\Mandant.ini
    c:\program files\WinWare\DATEN\MEX1P25\MaskEdit.DB
    c:\program files\WinWare\DATEN\MEX1P25\MaskEdit.PX
    c:\program files\WinWare\DATEN\MEX1P25\MITARBW.DB
    c:\program files\WinWare\DATEN\MEX1P25\MITARBW.PX
    c:\program files\WinWare\DATEN\MEX1P25\MITARBW.VAL
    c:\program files\WinWare\DATEN\MEX1P25\MWST2006.DAT
    c:\program files\WinWare\DATEN\MEX1P25\NOTIZ.DB
    c:\program files\WinWare\DATEN\MEX1P25\NOTIZ.MB
    c:\program files\WinWare\DATEN\MEX1P25\NOTIZ.PX
    c:\program files\WinWare\DATEN\MEX1P25\NOTIZ.VAL
    c:\program files\WinWare\DATEN\MEX1P25\NOTIZ.XG0
    c:\program files\WinWare\DATEN\MEX1P25\NOTIZ.XG1
    c:\program files\WinWare\DATEN\MEX1P25\NOTIZ.YG0
    c:\program files\WinWare\DATEN\MEX1P25\NOTIZ.YG1
    c:\program files\WinWare\DATEN\MEX1P25\OPOS.DB
    c:\program files\WinWare\DATEN\MEX1P25\OPOS.PX
    c:\program files\WinWare\DATEN\MEX1P25\OPOS.VAL
    c:\program files\WinWare\DATEN\MEX1P25\OPOS.X15
    c:\program files\WinWare\DATEN\MEX1P25\OPOS.X1F
    c:\program files\WinWare\DATEN\MEX1P25\OPOS.X27
    c:\program files\WinWare\DATEN\MEX1P25\OPOS.XG0
    c:\program files\WinWare\DATEN\MEX1P25\OPOS.XG1
    c:\program files\WinWare\DATEN\MEX1P25\OPOS.Y15
    c:\program files\WinWare\DATEN\MEX1P25\OPOS.Y1F
    c:\program files\WinWare\DATEN\MEX1P25\OPOS.Y27
    c:\program files\WinWare\DATEN\MEX1P25\OPOS.YG0
    c:\program files\WinWare\DATEN\MEX1P25\OPOS.YG1
    c:\program files\WinWare\DATEN\MEX1P25\PME.~KP
    c:\program files\WinWare\DATEN\MEX1P25\PME.KPL
    c:\program files\WinWare\DATEN\MEX1P25\STAPEL.DB
    c:\program files\WinWare\DATEN\MEX1P25\STAPEL.PX
    c:\program files\WinWare\DATEN\MEX1P25\STAPEL.VAL
    c:\program files\WinWare\DATEN\MEX1P25\STAPELP.DB
    c:\program files\WinWare\DATEN\MEX1P25\STAPELP.PX
    c:\program files\WinWare\DATEN\MEX1P25\STAPELP.VAL
    c:\program files\WinWare\DATEN\MEX1P25\STEXT.MB
    c:\program files\WinWare\DATEN\MEX1P25\TEXT.DB
    c:\program files\WinWare\DATEN\MEX1P25\TEXT.MB
    c:\program files\WinWare\DATEN\MEX1P25\TEXT.PX
    c:\program files\WinWare\DATEN\MEX1P25\USDETAIL.DB
    c:\program files\WinWare\DATEN\MEX1P25\USDETAIL.PX
    c:\program files\WinWare\DATEN\MEX1P25\USDETAIL.VAL
    c:\program files\WinWare\DATEN\MEX1P25\USTSCHL.DB
    c:\program files\WinWare\DATEN\MEX1P25\USTSCHL.PX
    c:\program files\WinWare\DATEN\MEX1P25\USTSCHL.VAL
    c:\program files\WinWare\DATEN\MEX1P25\WAEHR.DB
    c:\program files\WinWare\DATEN\MEX1P25\WAEHR.PX
    c:\program files\WinWare\DATEN\MEX1P25\WAEHR.VAL
    c:\program files\WinWare\DATEN\MEX1P25\WAEHRP.DB
    c:\program files\WinWare\DATEN\MEX1P25\WAEHRP.PX
    c:\program files\WinWare\DATEN\MEX1P25\WAEHRP.VAL
    c:\program files\WinWare\DATEN\MEX1P25\ZAHLBED.DB
    c:\program files\WinWare\DATEN\MEX1P25\ZAHLBED.PX
    c:\program files\WinWare\DATEN\MEX1P25\ZAHLBED.VAL
    c:\program files\WinWare\DATEN\MEX1P25\ZMODUL.DB
    c:\program files\WinWare\DATEN\MEX1P25\ZMODUL.PX
    c:\program files\WinWare\DATEN\MEX1P25\ZMODUL.VAL
    c:\program files\WinWare\DATEN\MEX1P25\ZMODULP.DB
    c:\program files\WinWare\DATEN\MEX1P25\ZMODULP.PX
    c:\program files\WinWare\DATEN\MEX1P25\ZMODULP.VAL
    c:\program files\WinWare\DATEN\MEX3\200401\BUCH.DB
    c:\program files\WinWare\DATEN\MEX3\200401\BUCH.PX
    c:\program files\WinWare\DATEN\MEX3\200401\BUCH.VAL
    c:\program files\WinWare\DATEN\MEX3\200401\BUCH.XG0
    c:\program files\WinWare\DATEN\MEX3\200401\BUCH.YG0
    c:\program files\WinWare\DATEN\MEX3\200401\GVORFALL.DB
    c:\program files\WinWare\DATEN\MEX3\200401\GVORFALL.PX
    c:\program files\WinWare\DATEN\MEX3\200401\GVORFALL.VAL
    c:\program files\WinWare\DATEN\MEX3\200401\GVORFALL.XG0
    c:\program files\WinWare\DATEN\MEX3\200401\GVORFALL.YG0
    c:\program files\WinWare\DATEN\MEX3\200401\JAHR.INI
    c:\program files\WinWare\DATEN\MEX3\200401\JBUDGET.DB
    c:\program files\WinWare\DATEN\MEX3\200401\JBUDGET.PX
    c:\program files\WinWare\DATEN\MEX3\200401\JBUDGET.VAL
    c:\program files\WinWare\DATEN\MEX3\200401\JTEXT.DB
    c:\program files\WinWare\DATEN\MEX3\200401\JTEXT.MB
    c:\program files\WinWare\DATEN\MEX3\200401\JTEXT.PX
    c:\program files\WinWare\DATEN\MEX3\200401\KAUSZUG.DB
    c:\program files\WinWare\DATEN\MEX3\200401\KAUSZUG.PX
    c:\program files\WinWare\DATEN\MEX3\200401\KAUSZUG.VAL
    c:\program files\WinWare\DATEN\MEX3\200401\KAUSZUG.XG0
    c:\program files\WinWare\DATEN\MEX3\200401\KAUSZUG.YG0
    c:\program files\WinWare\DATEN\MEX3\200401\Key.DB
    c:\program files\WinWare\DATEN\MEX3\200401\Key.PX
    c:\program files\WinWare\DATEN\MEX3\200401\KONTEN.DB
    c:\program files\WinWare\DATEN\MEX3\200401\KONTEN.PX
    c:\program files\WinWare\DATEN\MEX3\200401\KONTEN.VAL
    c:\program files\WinWare\DATEN\MEX3\200401\KONTEN.X22
    c:\program files\WinWare\DATEN\MEX3\200401\KONTEN.XG0
    c:\program files\WinWare\DATEN\MEX3\200401\KONTEN.Y22
    c:\program files\WinWare\DATEN\MEX3\200401\KONTEN.YG0
    c:\program files\WinWare\DATEN\MEX3\200401\Korrekt.DB
    c:\program files\WinWare\DATEN\MEX3\200401\Korrekt.PX
    c:\program files\WinWare\DATEN\MEX3\200401\Kosten.DB
    c:\program files\WinWare\DATEN\MEX3\200401\Kosten.PX
    c:\program files\WinWare\DATEN\MEX3\200401\Kosten.VAL
    c:\program files\WinWare\DATEN\MEX3\200401\Kosten.XG0
    c:\program files\WinWare\DATEN\MEX3\200401\Kosten.XG1
    c:\program files\WinWare\DATEN\MEX3\200401\Kosten.YG0
    c:\program files\WinWare\DATEN\MEX3\200401\Kosten.YG1
    c:\program files\WinWare\DATEN\MEX3\200401\Kschema.DB
    c:\program files\WinWare\DATEN\MEX3\200401\Kschema.PX
    c:\program files\WinWare\DATEN\MEX3\200401\Kschema.VAL
    c:\program files\WinWare\DATEN\MEX3\200401\Kschemap.DB
    c:\program files\WinWare\DATEN\MEX3\200401\Kschemap.PX
    c:\program files\WinWare\DATEN\MEX3\200401\Kschemap.VAL
    c:\program files\WinWare\DATEN\MEX3\200401\NUMKREIS.DB
    c:\program files\WinWare\DATEN\MEX3\200401\NUMKREIS.PX
    c:\program files\WinWare\DATEN\MEX3\200401\NUMKREIS.VAL
    c:\program files\WinWare\DATEN\MEX3\200401\NUMKREIS.XG0
    c:\program files\WinWare\DATEN\MEX3\200401\NUMKREIS.YG0
    c:\program files\WinWare\DATEN\MEX3\200401\SALDO.DB
    c:\program files\WinWare\DATEN\MEX3\200401\SALDO.PX
    c:\program files\WinWare\DATEN\MEX3\200401\SALDO.VAL
    c:\program files\WinWare\DATEN\MEX3\200401\SEITEN.DB
    c:\program files\WinWare\DATEN\MEX3\200401\SEITEN.PX
    c:\program files\WinWare\DATEN\MEX3\200401\SUCHTXT.DB
    c:\program files\WinWare\DATEN\MEX3\200401\SUCHTXT.PX
    c:\program files\WinWare\DATEN\MEX3\200401\SUCHTXT.VAL
    c:\program files\WinWare\DATEN\MEX3\200401\SUCHTXT.XG0
    c:\program files\WinWare\DATEN\MEX3\200401\SUCHTXT.YG0
    c:\program files\WinWare\DATEN\MEX3\200401\SUCHTXTD.DB
    c:\program files\WinWare\DATEN\MEX3\200401\SUCHTXTD.PX
    c:\program files\WinWare\DATEN\MEX3\200401\SUCHTXTD.VAL
    c:\program files\WinWare\DATEN\MEX3\200401\SUCHTXTD.X01
    c:\program files\WinWare\DATEN\MEX3\200401\SUCHTXTD.Y01
    c:\program files\WinWare\DATEN\MEX3\200401\USER74.DAU
    c:\program files\WinWare\DATEN\MEX3\Adress.DB
    c:\program files\WinWare\DATEN\MEX3\Adress.PX
    c:\program files\WinWare\DATEN\MEX3\Adress.VAL
    c:\program files\WinWare\DATEN\MEX3\Adress.XG0
    c:\program files\WinWare\DATEN\MEX3\Adress.XG1
    c:\program files\WinWare\DATEN\MEX3\Adress.XG2
    c:\program files\WinWare\DATEN\MEX3\Adress.YG0
    c:\program files\WinWare\DATEN\MEX3\Adress.YG1
    c:\program files\WinWare\DATEN\MEX3\Adress.YG2
    c:\program files\WinWare\DATEN\MEX3\Archiv03.DB
    c:\program files\WinWare\DATEN\MEX3\Archiv03.PX
    c:\program files\WinWare\DATEN\MEX3\Archiv04.DB
    c:\program files\WinWare\DATEN\MEX3\Archiv04.PX
    c:\program files\WinWare\DATEN\MEX3\Archiv05.DB
    c:\program files\WinWare\DATEN\MEX3\Archiv05.PX
    c:\program files\WinWare\DATEN\MEX3\Archiv06.DB
    c:\program files\WinWare\DATEN\MEX3\Archiv06.PX
    c:\program files\WinWare\DATEN\MEX3\BANK.DB
    c:\program files\WinWare\DATEN\MEX3\BANK.PX
    c:\program files\WinWare\DATEN\MEX3\BANK.VAL
    c:\program files\WinWare\DATEN\MEX3\BANK.X02
    c:\program files\WinWare\DATEN\MEX3\BANK.X0C
    c:\program files\WinWare\DATEN\MEX3\BANK.Y02
    c:\program files\WinWare\DATEN\MEX3\BANK.Y0C
    c:\program files\WinWare\DATEN\MEX3\BANKVERB.DB
    c:\program files\WinWare\DATEN\MEX3\BANKVERB.PX
    c:\program files\WinWare\DATEN\MEX3\BankVerb.VAL
    c:\program files\WinWare\DATEN\MEX3\BANKVERB.X07
    c:\program files\WinWare\DATEN\MEX3\BANKVERB.X0B
    c:\program files\WinWare\DATEN\MEX3\BANKVERB.X0C
    c:\program files\WinWare\DATEN\MEX3\BANKVERB.XG0
    c:\program files\WinWare\DATEN\MEX3\BANKVERB.Y07
    c:\program files\WinWare\DATEN\MEX3\BANKVERB.Y0B
    c:\program files\WinWare\DATEN\MEX3\BANKVERB.Y0C
    c:\program files\WinWare\DATEN\MEX3\BANKVERB.YG0
    c:\program files\WinWare\DATEN\MEX3\BILD.DB
    c:\program files\WinWare\DATEN\MEX3\BILD.MB
    c:\program files\WinWare\DATEN\MEX3\BILD.PX
    c:\program files\WinWare\DATEN\MEX3\BUCHTEXT.DB
    c:\program files\WinWare\DATEN\MEX3\BUCHTEXT.PX
    c:\program files\WinWare\DATEN\MEX3\DBPASS.DAT
    c:\program files\WinWare\DATEN\MEX3\FILTER.DB
    c:\program files\WinWare\DATEN\MEX3\FILTER.MB
    c:\program files\WinWare\DATEN\MEX3\FILTER.PX
    c:\program files\WinWare\DATEN\MEX3\GRUPPEN.DB
    c:\program files\WinWare\DATEN\MEX3\GRUPPEN.PX
    c:\program files\WinWare\DATEN\MEX3\GRUPPEN.VAL
    c:\program files\WinWare\DATEN\MEX3\GRUPPEN.X05
    c:\program files\WinWare\DATEN\MEX3\GRUPPEN.XG0
    c:\program files\WinWare\DATEN\MEX3\GRUPPEN.Y05
    c:\program files\WinWare\DATEN\MEX3\GRUPPEN.YG0
    c:\program files\WinWare\DATEN\MEX3\KAEFER.KPL
    c:\program files\WinWare\DATEN\MEX3\Kassbank.DB
    c:\program files\WinWare\DATEN\MEX3\Kassbank.PX
    c:\program files\WinWare\DATEN\MEX3\Kassbank.VAL
    c:\program files\WinWare\DATEN\MEX3\Key.DB
    c:\program files\WinWare\DATEN\MEX3\Key.PX
    c:\program files\WinWare\DATEN\MEX3\KSTELL.DB
    c:\program files\WinWare\DATEN\MEX3\KSTELL.PX
    c:\program files\WinWare\DATEN\MEX3\KSTELL.VAL
    c:\program files\WinWare\DATEN\MEX3\KSTELL.X06
    c:\program files\WinWare\DATEN\MEX3\KSTELL.Y06
    c:\program files\WinWare\DATEN\MEX3\Kunden.DB
    c:\program files\WinWare\DATEN\MEX3\Kunden.PX
    c:\program files\WinWare\DATEN\MEX3\Kunden.VAL
    c:\program files\WinWare\DATEN\MEX3\Kunden.X11
    c:\program files\WinWare\DATEN\MEX3\Kunden.X17
    c:\program files\WinWare\DATEN\MEX3\Kunden.Y11
    c:\program files\WinWare\DATEN\MEX3\Kunden.Y17
    c:\program files\WinWare\DATEN\MEX3\Liefer.DB
    c:\program files\WinWare\DATEN\MEX3\Liefer.PX
    c:\program files\WinWare\DATEN\MEX3\Liefer.VAL
    c:\program files\WinWare\DATEN\MEX3\Liefer.X11
    c:\program files\WinWare\DATEN\MEX3\Liefer.X17
    c:\program files\WinWare\DATEN\MEX3\Liefer.Y11
    c:\program files\WinWare\DATEN\MEX3\Liefer.Y17
    c:\program files\WinWare\DATEN\MEX3\LINK.DB
    c:\program files\WinWare\DATEN\MEX3\LINK.PX
    c:\program files\WinWare\DATEN\MEX3\LINK.XG0
    c:\program files\WinWare\DATEN\MEX3\LINK.YG0
    c:\program files\WinWare\DATEN\MEX3\Mahn.ini
    c:\program files\WinWare\DATEN\MEX3\MAHNB.DB
    c:\program files\WinWare\DATEN\MEX3\MAHNB.PX
    c:\program files\WinWare\DATEN\MEX3\MAHNP.DB
    c:\program files\WinWare\DATEN\MEX3\MAHNP.PX
    c:\program files\WinWare\DATEN\MEX3\MAHNP.XG0
    c:\program files\WinWare\DATEN\MEX3\MAHNP.YG0
    c:\program files\WinWare\DATEN\MEX3\Mandant.ini
    c:\program files\WinWare\DATEN\MEX3\MaskEdit.DB
    c:\program files\WinWare\DATEN\MEX3\MaskEdit.PX
    c:\program files\WinWare\DATEN\MEX3\MITARBW.DB
    c:\program files\WinWare\DATEN\MEX3\MITARBW.PX
    c:\program files\WinWare\DATEN\MEX3\MITARBW.VAL
    c:\program files\WinWare\DATEN\MEX3\NOTIZ.DB
    c:\program files\WinWare\DATEN\MEX3\NOTIZ.MB
    c:\program files\WinWare\DATEN\MEX3\NOTIZ.PX
    c:\program files\WinWare\DATEN\MEX3\NOTIZ.VAL
    c:\program files\WinWare\DATEN\MEX3\NOTIZ.XG0
    c:\program files\WinWare\DATEN\MEX3\NOTIZ.XG1
    c:\program files\WinWare\DATEN\MEX3\NOTIZ.YG0
    c:\program files\WinWare\DATEN\MEX3\NOTIZ.YG1
    c:\program files\WinWare\DATEN\MEX3\OPOS.DB
    c:\program files\WinWare\DATEN\MEX3\OPOS.PX
    c:\program files\WinWare\DATEN\MEX3\OPOS.VAL
    c:\program files\WinWare\DATEN\MEX3\OPOS.X15
    c:\program files\WinWare\DATEN\MEX3\OPOS.X1F
    c:\program files\WinWare\DATEN\MEX3\OPOS.X27
    c:\program files\WinWare\DATEN\MEX3\OPOS.XG0
    c:\program files\WinWare\DATEN\MEX3\OPOS.XG1
    c:\program files\WinWare\DATEN\MEX3\OPOS.Y15
    c:\program files\WinWare\DATEN\MEX3\OPOS.Y1F
    c:\program files\WinWare\DATEN\MEX3\OPOS.Y27
    c:\program files\WinWare\DATEN\MEX3\OPOS.YG0
    c:\program files\WinWare\DATEN\MEX3\OPOS.YG1
    c:\program files\WinWare\DATEN\MEX3\PME.~KP
    c:\program files\WinWare\DATEN\MEX3\PME.KPL
    c:\program files\WinWare\DATEN\MEX3\STAPEL.DB
    c:\program files\WinWare\DATEN\MEX3\STAPEL.PX
    c:\program files\WinWare\DATEN\MEX3\STAPEL.VAL
    c:\program files\WinWare\DATEN\MEX3\STAPELP.DB
    c:\program files\WinWare\DATEN\MEX3\STAPELP.PX
    c:\program files\WinWare\DATEN\MEX3\STAPELP.VAL
    c:\program files\WinWare\DATEN\MEX3\STEXT.MB
    c:\program files\WinWare\DATEN\MEX3\TEXT.DB
    c:\program files\WinWare\DATEN\MEX3\TEXT.MB
    c:\program files\WinWare\DATEN\MEX3\TEXT.PX
    c:\program files\WinWare\DATEN\MEX3\Update7.txt
    c:\program files\WinWare\DATEN\MEX3\USDETAIL.DB
    c:\program files\WinWare\DATEN\MEX3\USDETAIL.PX
    c:\program files\WinWare\DATEN\MEX3\USDETAIL.VAL
    c:\program files\WinWare\DATEN\MEX3\USER74.DAU
    c:\program files\WinWare\DATEN\MEX3\USTSCHL.DB
    c:\program files\WinWare\DATEN\MEX3\USTSCHL.PX
    c:\program files\WinWare\DATEN\MEX3\USTSCHL.VAL
    c:\program files\WinWare\DATEN\MEX3\WAEHR.DB
    c:\program files\WinWare\DATEN\MEX3\WAEHR.PX
    c:\program files\WinWare\DATEN\MEX3\WAEHR.VAL
    c:\program files\WinWare\DATEN\MEX3\WAEHRP.DB
    c:\program files\WinWare\DATEN\MEX3\WAEHRP.PX
    c:\program files\WinWare\DATEN\MEX3\WAEHRP.VAL
    c:\program files\WinWare\DATEN\MEX3\ZAHLBED.DB
    c:\program files\WinWare\DATEN\MEX3\ZAHLBED.PX
    c:\program files\WinWare\DATEN\MEX3\ZAHLBED.VAL
    c:\program files\WinWare\DATEN\MEX3\ZMODUL.DB
    c:\program files\WinWare\DATEN\MEX3\ZMODUL.PX
    c:\program files\WinWare\DATEN\MEX3\ZMODUL.VAL
    c:\program files\WinWare\DATEN\MEX3\Zmodulp.DB
    c:\program files\WinWare\DATEN\MEX3\Zmodulp.PX
    c:\program files\WinWare\DATEN\MEX3\Zmodulp.VAL
    c:\program files\WinWare\DATEN\MEXAMEN\200601\BUCH.DB
    c:\program files\WinWare\DATEN\MEXAMEN\200601\BUCH.PX
    c:\program files\WinWare\DATEN\MEXAMEN\200601\BUCH.VAL
    c:\program files\WinWare\DATEN\MEXAMEN\200601\BUCH.XG0
    c:\program files\WinWare\DATEN\MEXAMEN\200601\BUCH.YG0
    c:\program files\WinWare\DATEN\MEXAMEN\200601\EBX.DB
    c:\program files\WinWare\DATEN\MEXAMEN\200601\EBX.PX
    c:\program files\WinWare\DATEN\MEXAMEN\200601\GVORFALL.DB
    c:\program files\WinWare\DATEN\MEXAMEN\200601\GVORFALL.PX
    c:\program files\WinWare\DATEN\MEXAMEN\200601\GVORFALL.VAL
    c:\program files\WinWare\DATEN\MEXAMEN\200601\GVORFALL.XG0
    c:\program files\WinWare\DATEN\MEXAMEN\200601\GVORFALL.YG0
    c:\program files\WinWare\DATEN\MEXAMEN\200601\JAHR.INI
    c:\program files\WinWare\DATEN\MEXAMEN\200601\JBUDGET.DB
    c:\program files\WinWare\DATEN\MEXAMEN\200601\JBUDGET.PX
    c:\program files\WinWare\DATEN\MEXAMEN\200601\JBUDGET.VAL
    c:\program files\WinWare\DATEN\MEXAMEN\200601\JTEXT.DB
    c:\program files\WinWare\DATEN\MEXAMEN\200601\JTEXT.MB
    c:\program files\WinWare\DATEN\MEXAMEN\200601\JTEXT.PX
    c:\program files\WinWare\DATEN\MEXAMEN\200601\KAUSZUG.DB
    c:\program files\WinWare\DATEN\MEXAMEN\200601\KAUSZUG.PX
    c:\program files\WinWare\DATEN\MEXAMEN\200601\KAUSZUG.VAL
    c:\program files\WinWare\DATEN\MEXAMEN\200601\KAUSZUG.XG0
    c:\program files\WinWare\DATEN\MEXAMEN\200601\KAUSZUG.YG0
    c:\program files\WinWare\DATEN\MEXAMEN\200601\Key.DB
    c:\program files\WinWare\DATEN\MEXAMEN\200601\Key.PX
    c:\program files\WinWare\DATEN\MEXAMEN\200601\KONTEN.DB
    c:\program files\WinWare\DATEN\MEXAMEN\200601\KONTEN.PX
    c:\program files\WinWare\DATEN\MEXAMEN\200601\KONTEN.VAL
    c:\program files\WinWare\DATEN\MEXAMEN\200601\KONTEN.X22
    c:\program files\WinWare\DATEN\MEXAMEN\200601\KONTEN.XG0
    c:\program files\WinWare\DATEN\MEXAMEN\200601\KONTEN.Y22
    c:\program files\WinWare\DATEN\MEXAMEN\200601\KONTEN.YG0
    c:\program files\WinWare\DATEN\MEXAMEN\200601\Korrekt.DB
    c:\program files\WinWare\DATEN\MEXAMEN\200601\Korrekt.PX
    c:\program files\WinWare\DATEN\MEXAMEN\200601\Kosten.DB
    c:\program files\WinWare\DATEN\MEXAMEN\200601\Kosten.PX
    c:\program files\WinWare\DATEN\MEXAMEN\200601\Kosten.VAL
    c:\program files\WinWare\DATEN\MEXAMEN\200601\Kosten.XG0
    c:\program files\WinWare\DATEN\MEXAMEN\200601\Kosten.XG1
    c:\program files\WinWare\DATEN\MEXAMEN\200601\Kosten.YG0
    c:\program files\WinWare\DATEN\MEXAMEN\200601\Kosten.YG1
    c:\program files\WinWare\DATEN\MEXAMEN\200601\Kschema.DB
    c:\program files\WinWare\DATEN\MEXAMEN\200601\Kschema.PX
    c:\program files\WinWare\DATEN\MEXAMEN\200601\Kschema.VAL
    c:\program files\WinWare\DATEN\MEXAMEN\200601\Kschemap.DB
    c:\program files\WinWare\DATEN\MEXAMEN\200601\Kschemap.PX
    c:\program files\WinWare\DATEN\MEXAMEN\200601\Kschemap.VAL
    c:\program files\WinWare\DATEN\MEXAMEN\200601\NUMKREIS.DB
    c:\program files\WinWare\DATEN\MEXAMEN\200601\NUMKREIS.PX
    c:\program files\WinWare\DATEN\MEXAMEN\200601\NUMKREIS.VAL
    c:\program files\WinWare\DATEN\MEXAMEN\200601\NUMKREIS.XG0
    c:\program files\WinWare\DATEN\MEXAMEN\200601\NUMKREIS.YG0
    c:\program files\WinWare\DATEN\MEXAMEN\200601\SALDO.DB
    c:\program files\WinWare\DATEN\MEXAMEN\200601\SALDO.PX
    c:\program files\WinWare\DATEN\MEXAMEN\200601\SALDO.VAL
    c:\program files\WinWare\DATEN\MEXAMEN\200601\SEITEN.DB
    c:\program files\WinWare\DATEN\MEXAMEN\200601\SEITEN.PX
    c:\program files\WinWare\DATEN\MEXAMEN\200601\SUCHTXT.DB
    c:\program files\WinWare\DATEN\MEXAMEN\200601\SUCHTXT.PX
    c:\program files\WinWare\DATEN\MEXAMEN\200601\SUCHTXT.VAL
    c:\program files\WinWare\DATEN\MEXAMEN\200601\SUCHTXT.XG0
    c:\program files\WinWare\DATEN\MEXAMEN\200601\SUCHTXT.YG0
    c:\program files\WinWare\DATEN\MEXAMEN\200601\SUCHTXTD.DB
    c:\program files\WinWare\DATEN\MEXAMEN\200601\SUCHTXTD.PX
    c:\program files\WinWare\DATEN\MEXAMEN\200601\SUCHTXTD.VAL
    c:\program files\WinWare\DATEN\MEXAMEN\200601\SUCHTXTD.X01
    c:\program files\WinWare\DATEN\MEXAMEN\200601\SUCHTXTD.Y01
    c:\program files\WinWare\DATEN\MEXAMEN\200601\USER74.DAU
    c:\program files\WinWare\DATEN\MEXAMEN\ADRESS.DB
    c:\program files\WinWare\DATEN\MEXAMEN\ADRESS.PX
    c:\program files\WinWare\DATEN\MEXAMEN\ADRESS.VAL
    c:\program files\WinWare\DATEN\MEXAMEN\ADRESS.XG0
    c:\program files\WinWare\DATEN\MEXAMEN\ADRESS.XG1
    c:\program files\WinWare\DATEN\MEXAMEN\ADRESS.XG2
    c:\program files\WinWare\DATEN\MEXAMEN\ADRESS.YG0
    c:\program files\WinWare\DATEN\MEXAMEN\ADRESS.YG1
    c:\program files\WinWare\DATEN\MEXAMEN\ADRESS.YG2
    c:\program files\WinWare\DATEN\MEXAMEN\Archiv03.DB
    c:\program files\WinWare\DATEN\MEXAMEN\Archiv03.PX
    c:\program files\WinWare\DATEN\MEXAMEN\Archiv04.DB
    c:\program files\WinWare\DATEN\MEXAMEN\Archiv04.PX
    c:\program files\WinWare\DATEN\MEXAMEN\Archiv05.DB
    c:\program files\WinWare\DATEN\MEXAMEN\Archiv05.PX
    c:\program files\WinWare\DATEN\MEXAMEN\Archiv06.DB
    c:\program files\WinWare\DATEN\MEXAMEN\Archiv06.PX
    c:\program files\WinWare\DATEN\MEXAMEN\BANK.DB
    c:\program files\WinWare\DATEN\MEXAMEN\BANK.PX
    c:\program files\WinWare\DATEN\MEXAMEN\BANK.VAL
    c:\program files\WinWare\DATEN\MEXAMEN\BANK.X02
    c:\program files\WinWare\DATEN\MEXAMEN\BANK.X0C
    c:\program files\WinWare\DATEN\MEXAMEN\BANK.Y02
    c:\program files\WinWare\DATEN\MEXAMEN\BANK.Y0C
    c:\program files\WinWare\DATEN\MEXAMEN\BANKVERB.DB
    c:\program files\WinWare\DATEN\MEXAMEN\BANKVERB.PX
    c:\program files\WinWare\DATEN\MEXAMEN\BANKVERB.VAL
    c:\program files\WinWare\DATEN\MEXAMEN\BANKVERB.X07
    c:\program files\WinWare\DATEN\MEXAMEN\BANKVERB.X0B
    c:\program files\WinWare\DATEN\MEXAMEN\BANKVERB.X0C
    c:\program files\WinWare\DATEN\MEXAMEN\BANKVERB.XG0
    c:\program files\WinWare\DATEN\MEXAMEN\BANKVERB.Y07
    c:\program files\WinWare\DATEN\MEXAMEN\BANKVERB.Y0B
    c:\program files\WinWare\DATEN\MEXAMEN\BANKVERB.Y0C
    c:\program files\WinWare\DATEN\MEXAMEN\BANKVERB.YG0
    c:\program files\WinWare\DATEN\MEXAMEN\BILD.DB
    c:\program files\WinWare\DATEN\MEXAMEN\BILD.MB
    c:\program files\WinWare\DATEN\MEXAMEN\BILD.PX
    c:\program files\WinWare\DATEN\MEXAMEN\BUCHTEXT.DB
    c:\program files\WinWare\DATEN\MEXAMEN\BUCHTEXT.PX
    c:\program files\WinWare\DATEN\MEXAMEN\DBPASS.DAT
    c:\program files\WinWare\DATEN\MEXAMEN\FILTER.DB
    c:\program files\WinWare\DATEN\MEXAMEN\FILTER.MB
    c:\program files\WinWare\DATEN\MEXAMEN\FILTER.PX
    c:\program files\WinWare\DATEN\MEXAMEN\GRUPPEN.DB
    c:\program files\WinWare\DATEN\MEXAMEN\GRUPPEN.PX
    c:\program files\WinWare\DATEN\MEXAMEN\GRUPPEN.VAL
    c:\program files\WinWare\DATEN\MEXAMEN\GRUPPEN.X05
    c:\program files\WinWare\DATEN\MEXAMEN\GRUPPEN.XG0
    c:\program files\WinWare\DATEN\MEXAMEN\GRUPPEN.Y05
    c:\program files\WinWare\DATEN\MEXAMEN\GRUPPEN.YG0
    c:\program files\WinWare\DATEN\MEXAMEN\KASSBANK.DB
    c:\program files\WinWare\DATEN\MEXAMEN\KASSBANK.PX
    c:\program files\WinWare\DATEN\MEXAMEN\KASSBANK.VAL
    c:\program files\WinWare\DATEN\MEXAMEN\KEY.DB
    c:\program files\WinWare\DATEN\MEXAMEN\KEY.PX
    c:\program files\WinWare\DATEN\MEXAMEN\KSTELL.DB
    c:\program files\WinWare\DATEN\MEXAMEN\KSTELL.PX
    c:\program files\WinWare\DATEN\MEXAMEN\KSTELL.VAL
    c:\program files\WinWare\DATEN\MEXAMEN\KSTELL.X06
    c:\program files\WinWare\DATEN\MEXAMEN\KSTELL.Y06
    c:\program files\WinWare\DATEN\MEXAMEN\KUNDEN.DB
    c:\program files\WinWare\DATEN\MEXAMEN\KUNDEN.PX
    c:\program files\WinWare\DATEN\MEXAMEN\KUNDEN.VAL
    c:\program files\WinWare\DATEN\MEXAMEN\KUNDEN.X11
    c:\program files\WinWare\DATEN\MEXAMEN\KUNDEN.X17
    c:\program files\WinWare\DATEN\MEXAMEN\KUNDEN.Y11
    c:\program files\WinWare\DATEN\MEXAMEN\KUNDEN.Y17
    c:\program files\WinWare\DATEN\MEXAMEN\LIEFER.DB
    c:\program files\WinWare\DATEN\MEXAMEN\LIEFER.PX
    c:\program files\WinWare\DATEN\MEXAMEN\LIEFER.VAL
    c:\program files\WinWare\DATEN\MEXAMEN\LIEFER.X11
    c:\program files\WinWare\DATEN\MEXAMEN\LIEFER.X17
    c:\program files\WinWare\DATEN\MEXAMEN\LIEFER.Y11
    c:\program files\WinWare\DATEN\MEXAMEN\LIEFER.Y17
    c:\program files\WinWare\DATEN\MEXAMEN\LINK.DB
    c:\program files\WinWare\DATEN\MEXAMEN\LINK.PX
    c:\program files\WinWare\DATEN\MEXAMEN\LINK.XG0
    c:\program files\WinWare\DATEN\MEXAMEN\LINK.YG0
    c:\program files\WinWare\DATEN\MEXAMEN\Mahn.ini
    c:\program files\WinWare\DATEN\MEXAMEN\MAHNB.DB
    c:\program files\WinWare\DATEN\MEXAMEN\MAHNB.PX
    c:\program files\WinWare\DATEN\MEXAMEN\MAHNP.DB
    c:\program files\WinWare\DATEN\MEXAMEN\MAHNP.PX
    c:\program files\WinWare\DATEN\MEXAMEN\MAHNP.XG0
    c:\program files\WinWare\DATEN\MEXAMEN\MAHNP.YG0
    c:\program files\WinWare\DATEN\MEXAMEN\Mandant.ini
    c:\program files\WinWare\DATEN\MEXAMEN\MaskEdit.DB
    c:\program files\WinWare\DATEN\MEXAMEN\MaskEdit.PX
    c:\program files\WinWare\DATEN\MEXAMEN\MITARBW.DB
    c:\program files\WinWare\DATEN\MEXAMEN\MITARBW.PX
    c:\program files\WinWare\DATEN\MEXAMEN\MITARBW.VAL
    c:\program files\WinWare\DATEN\MEXAMEN\MWST2006.DAT
    c:\program files\WinWare\DATEN\MEXAMEN\NOTIZ.DB
    c:\program files\WinWare\DATEN\MEXAMEN\NOTIZ.MB
    c:\program files\WinWare\DATEN\MEXAMEN\NOTIZ.PX
    c:\program files\WinWare\DATEN\MEXAMEN\NOTIZ.VAL
    c:\program files\WinWare\DATEN\MEXAMEN\NOTIZ.XG0
    c:\program files\WinWare\DATEN\MEXAMEN\NOTIZ.XG1
    c:\program files\WinWare\DATEN\MEXAMEN\NOTIZ.YG0
    c:\program files\WinWare\DATEN\MEXAMEN\NOTIZ.YG1
    c:\program files\WinWare\DATEN\MEXAMEN\OPOS.DB
    c:\program files\WinWare\DATEN\MEXAMEN\OPOS.PX
    c:\program files\WinWare\DATEN\MEXAMEN\OPOS.VAL
    c:\program files\WinWare\DATEN\MEXAMEN\OPOS.X15
    c:\program files\WinWare\DATEN\MEXAMEN\OPOS.X1F
    c:\program files\WinWare\DATEN\MEXAMEN\OPOS.X27
    c:\program files\WinWare\DATEN\MEXAMEN\OPOS.XG0
    c:\program files\WinWare\DATEN\MEXAMEN\OPOS.XG1
    c:\program files\WinWare\DATEN\MEXAMEN\OPOS.Y15
    c:\program files\WinWare\DATEN\MEXAMEN\OPOS.Y1F
    c:\program files\WinWare\DATEN\MEXAMEN\OPOS.Y27
    c:\program files\WinWare\DATEN\MEXAMEN\OPOS.YG0
    c:\program files\WinWare\DATEN\MEXAMEN\OPOS.YG1
    c:\program files\WinWare\DATEN\MEXAMEN\PME.~KP
    c:\program files\WinWare\DATEN\MEXAMEN\PME.KPL
    c:\program files\WinWare\DATEN\MEXAMEN\STAPEL.DB
    c:\program files\WinWare\DATEN\MEXAMEN\STAPEL.PX
    c:\program files\WinWare\DATEN\MEXAMEN\STAPEL.VAL
    c:\program files\WinWare\DATEN\MEXAMEN\STAPELP.DB
    c:\program files\WinWare\DATEN\MEXAMEN\STAPELP.PX
    c:\program files\WinWare\DATEN\MEXAMEN\STAPELP.VAL
    c:\program files\WinWare\DATEN\MEXAMEN\STEXT.MB
    c:\program files\WinWare\DATEN\MEXAMEN\TEXT.DB
    c:\program files\WinWare\DATEN\MEXAMEN\TEXT.MB
    c:\program files\WinWare\DATEN\MEXAMEN\TEXT.PX
    c:\program files\WinWare\DATEN\MEXAMEN\USDETAIL.DB
    c:\program files\WinWare\DATEN\MEXAMEN\USDETAIL.PX
    c:\program files\WinWare\DATEN\MEXAMEN\USDETAIL.VAL
    c:\program files\WinWare\DATEN\MEXAMEN\USER74.DAU
    c:\program files\WinWare\DATEN\MEXAMEN\USTSCHL.DB
    c:\program files\WinWare\DATEN\MEXAMEN\USTSCHL.PX
    c:\program files\WinWare\DATEN\MEXAMEN\USTSCHL.VAL
    c:\program files\WinWare\DATEN\MEXAMEN\WAEHR.DB
    c:\program files\WinWare\DATEN\MEXAMEN\WAEHR.PX
    c:\program files\WinWare\DATEN\MEXAMEN\WAEHR.VAL
    c:\program files\WinWare\DATEN\MEXAMEN\WAEHRP.DB
    c:\program files\WinWare\DATEN\MEXAMEN\WAEHRP.PX
    c:\program files\WinWare\DATEN\MEXAMEN\WAEHRP.VAL
    c:\program files\WinWare\DATEN\MEXAMEN\ZAHLBED.DB
    c:\program files\WinWare\DATEN\MEXAMEN\ZAHLBED.PX
    c:\program files\WinWare\DATEN\MEXAMEN\ZAHLBED.VAL
    c:\program files\WinWare\DATEN\MEXAMEN\ZMODUL.DB
    c:\program files\WinWare\DATEN\MEXAMEN\ZMODUL.PX
    c:\program files\WinWare\DATEN\MEXAMEN\ZMODUL.VAL
    c:\program files\WinWare\DATEN\MEXAMEN\ZMODULP.DB
    c:\program files\WinWare\DATEN\MEXAMEN\ZMODULP.PX
    c:\program files\WinWare\DATEN\MEXAMEN\ZMODULP.VAL
    c:\program files\WinWare\DATEN\MEXSUPP\200401\BUCH.DB
    c:\program files\WinWare\DATEN\MEXSUPP\200401\BUCH.PX
    c:\program files\WinWare\DATEN\MEXSUPP\200401\BUCH.VAL
    c:\program files\WinWare\DATEN\MEXSUPP\200401\BUCH.XG0
    c:\program files\WinWare\DATEN\MEXSUPP\200401\BUCH.YG0
    c:\program files\WinWare\DATEN\MEXSUPP\200401\GVORFALL.DB
    c:\program files\WinWare\DATEN\MEXSUPP\200401\GVORFALL.PX
    c:\program files\WinWare\DATEN\MEXSUPP\200401\GVORFALL.VAL
    c:\program files\WinWare\DATEN\MEXSUPP\200401\GVORFALL.XG0
    c:\program files\WinWare\DATEN\MEXSUPP\200401\GVORFALL.YG0
    c:\program files\WinWare\DATEN\MEXSUPP\200401\JAHR.INI
    c:\program files\WinWare\DATEN\MEXSUPP\200401\JBUDGET.DB
    c:\program files\WinWare\DATEN\MEXSUPP\200401\JBUDGET.PX
    c:\program files\WinWare\DATEN\MEXSUPP\200401\JBUDGET.VAL
    c:\program files\WinWare\DATEN\MEXSUPP\200401\JTEXT.DB
    c:\program files\WinWare\DATEN\MEXSUPP\200401\JTEXT.MB
    c:\program files\WinWare\DATEN\MEXSUPP\200401\JTEXT.PX
    c:\program files\WinWare\DATEN\MEXSUPP\200401\KAUSZUG.DB
    c:\program files\WinWare\DATEN\MEXSUPP\200401\KAUSZUG.PX
    c:\program files\WinWare\DATEN\MEXSUPP\200401\KAUSZUG.VAL
    c:\program files\WinWare\DATEN\MEXSUPP\200401\KAUSZUG.XG0
    c:\program files\WinWare\DATEN\MEXSUPP\200401\KAUSZUG.YG0
    c:\program files\WinWare\DATEN\MEXSUPP\200401\Key.DB
    c:\program files\WinWare\DATEN\MEXSUPP\200401\Key.PX
    c:\program files\WinWare\DATEN\MEXSUPP\200401\KONTEN.DB
    c:\program files\WinWare\DATEN\MEXSUPP\200401\KONTEN.PX
    c:\program files\WinWare\DATEN\MEXSUPP\200401\KONTEN.VAL
    c:\program files\WinWare\DATEN\MEXSUPP\200401\KONTEN.X22
    c:\program files\WinWare\DATEN\MEXSUPP\200401\KONTEN.XG0
    c:\program files\WinWare\DATEN\MEXSUPP\200401\KONTEN.Y22
    c:\program files\WinWare\DATEN\MEXSUPP\200401\KONTEN.YG0
    c:\program files\WinWare\DATEN\MEXSUPP\200401\Korrekt.DB
    c:\program files\WinWare\DATEN\MEXSUPP\200401\Korrekt.PX
    c:\program files\WinWare\DATEN\MEXSUPP\200401\Kosten.DB
    c:\program files\WinWare\DATEN\MEXSUPP\200401\Kosten.PX
    c:\program files\WinWare\DATEN\MEXSUPP\200401\Kosten.VAL
    c:\program files\WinWare\DATEN\MEXSUPP\200401\Kosten.XG0
    c:\program files\WinWare\DATEN\MEXSUPP\200401\Kosten.XG1
    c:\program files\WinWare\DATEN\MEXSUPP\200401\Kosten.YG0
    c:\program files\WinWare\DATEN\MEXSUPP\200401\Kosten.YG1
    c:\program files\WinWare\DATEN\MEXSUPP\200401\Kschema.DB
    c:\program files\WinWare\DATEN\MEXSUPP\200401\Kschema.PX
    c:\program files\WinWare\DATEN\MEXSUPP\200401\Kschema.VAL
    c:\program files\WinWare\DATEN\MEXSUPP\200401\Kschemap.DB
    c:\program files\WinWare\DATEN\MEXSUPP\200401\Kschemap.PX
    c:\program files\WinWare\DATEN\MEXSUPP\200401\Kschemap.VAL
    c:\program files\WinWare\DATEN\MEXSUPP\200401\NUMKREIS.DB
    c:\program files\WinWare\DATEN\MEXSUPP\200401\NUMKREIS.PX
    c:\program files\WinWare\DATEN\MEXSUPP\200401\NUMKREIS.VAL
    c:\program files\WinWare\DATEN\MEXSUPP\200401\NUMKREIS.XG0
    c:\program files\WinWare\DATEN\MEXSUPP\200401\NUMKREIS.YG0
    c:\program files\WinWare\DATEN\MEXSUPP\200401\SALDO.DB
    c:\program files\WinWare\DATEN\MEXSUPP\200401\SALDO.PX
    c:\program files\WinWare\DATEN\MEXSUPP\200401\SALDO.VAL
    c:\program files\WinWare\DATEN\MEXSUPP\200401\SEITEN.DB
    c:\program files\WinWare\DATEN\MEXSUPP\200401\SEITEN.PX
    c:\program files\WinWare\DATEN\MEXSUPP\200401\SUCHTXT.DB
    c:\program files\WinWare\DATEN\MEXSUPP\200401\SUCHTXT.PX
    c:\program files\WinWare\DATEN\MEXSUPP\200401\SUCHTXT.VAL
    c:\program files\WinWare\DATEN\MEXSUPP\200401\SUCHTXT.XG0
    c:\program files\WinWare\DATEN\MEXSUPP\200401\SUCHTXT.YG0
    c:\program files\WinWare\DATEN\MEXSUPP\200401\SUCHTXTD.DB
    c:\program files\WinWare\DATEN\MEXSUPP\200401\SUCHTXTD.PX
    c:\program files\WinWare\DATEN\MEXSUPP\200401\SUCHTXTD.VAL
    c:\program files\WinWare\DATEN\MEXSUPP\200401\SUCHTXTD.X01
    c:\program files\WinWare\DATEN\MEXSUPP\200401\SUCHTXTD.Y01
    c:\program files\WinWare\DATEN\MEXSUPP\200401\USER74.DAU
    c:\program files\WinWare\DATEN\MEXSUPP\Adress.DB
    c:\program files\WinWare\DATEN\MEXSUPP\Adress.PX
    c:\program files\WinWare\DATEN\MEXSUPP\Adress.VAL
    c:\program files\WinWare\DATEN\MEXSUPP\Adress.XG0
    c:\program files\WinWare\DATEN\MEXSUPP\Adress.XG1
    c:\program files\WinWare\DATEN\MEXSUPP\Adress.XG2
    c:\program files\WinWare\DATEN\MEXSUPP\Adress.YG0
    c:\program files\WinWare\DATEN\MEXSUPP\Adress.YG1
    c:\program files\WinWare\DATEN\MEXSUPP\Adress.YG2
    c:\program files\WinWare\DATEN\MEXSUPP\Archiv03.DB
    c:\program files\WinWare\DATEN\MEXSUPP\Archiv03.PX
    c:\program files\WinWare\DATEN\MEXSUPP\Archiv04.DB
    c:\program files\WinWare\DATEN\MEXSUPP\Archiv04.PX
    c:\program files\WinWare\DATEN\MEXSUPP\Archiv05.DB
    c:\program files\WinWare\DATEN\MEXSUPP\Archiv05.PX
    c:\program files\WinWare\DATEN\MEXSUPP\Archiv06.DB
    c:\program files\WinWare\DATEN\MEXSUPP\Archiv06.PX
    c:\program files\WinWare\DATEN\MEXSUPP\BANK.DB
    c:\program files\WinWare\DATEN\MEXSUPP\BANK.PX
    c:\program files\WinWare\DATEN\MEXSUPP\BANK.VAL
    c:\program files\WinWare\DATEN\MEXSUPP\BANK.X02
    c:\program files\WinWare\DATEN\MEXSUPP\BANK.X0C
    c:\program files\WinWare\DATEN\MEXSUPP\BANK.Y02
    c:\program files\WinWare\DATEN\MEXSUPP\BANK.Y0C
    c:\program files\WinWare\DATEN\MEXSUPP\BANKVERB.DB
    c:\program files\WinWare\DATEN\MEXSUPP\BANKVERB.PX
    c:\program files\WinWare\DATEN\MEXSUPP\BankVerb.VAL
    c:\program files\WinWare\DATEN\MEXSUPP\BANKVERB.X07
    c:\program files\WinWare\DATEN\MEXSUPP\BANKVERB.X0B
    c:\program files\WinWare\DATEN\MEXSUPP\BANKVERB.X0C
    c:\program files\WinWare\DATEN\MEXSUPP\BANKVERB.XG0
    c:\program files\WinWare\DATEN\MEXSUPP\BANKVERB.Y07
    c:\program files\WinWare\DATEN\MEXSUPP\BANKVERB.Y0B
    c:\program files\WinWare\DATEN\MEXSUPP\BANKVERB.Y0C
    c:\program files\WinWare\DATEN\MEXSUPP\BANKVERB.YG0
    c:\program files\WinWare\DATEN\MEXSUPP\BILD.DB
    c:\program files\WinWare\DATEN\MEXSUPP\BILD.MB
    c:\program files\WinWare\DATEN\MEXSUPP\BILD.PX
    c:\program files\WinWare\DATEN\MEXSUPP\BUCHTEXT.DB
    c:\program files\WinWare\DATEN\MEXSUPP\BUCHTEXT.PX
    c:\program files\WinWare\DATEN\MEXSUPP\DBPASS.DAT
     
    MuadDib,
    #22


  3. to hide this advert.

  4. 2011/09/10
    MuadDib

    MuadDib Inactive Thread Starter

    Joined:
    2011/09/07
    Messages:
    29
    Likes Received:
    0
    c:\program files\WinWare\DATEN\MEXSUPP\FILTER.DB
    c:\program files\WinWare\DATEN\MEXSUPP\FILTER.MB
    c:\program files\WinWare\DATEN\MEXSUPP\FILTER.PX
    c:\program files\WinWare\DATEN\MEXSUPP\GRUPPEN.DB
    c:\program files\WinWare\DATEN\MEXSUPP\GRUPPEN.PX
    c:\program files\WinWare\DATEN\MEXSUPP\GRUPPEN.VAL
    c:\program files\WinWare\DATEN\MEXSUPP\GRUPPEN.X05
    c:\program files\WinWare\DATEN\MEXSUPP\GRUPPEN.XG0
    c:\program files\WinWare\DATEN\MEXSUPP\GRUPPEN.Y05
    c:\program files\WinWare\DATEN\MEXSUPP\GRUPPEN.YG0
    c:\program files\WinWare\DATEN\MEXSUPP\KAEFER.KPL
    c:\program files\WinWare\DATEN\MEXSUPP\Kassbank.DB
    c:\program files\WinWare\DATEN\MEXSUPP\Kassbank.PX
    c:\program files\WinWare\DATEN\MEXSUPP\Kassbank.VAL
    c:\program files\WinWare\DATEN\MEXSUPP\Key.DB
    c:\program files\WinWare\DATEN\MEXSUPP\Key.PX
    c:\program files\WinWare\DATEN\MEXSUPP\KSTELL.DB
    c:\program files\WinWare\DATEN\MEXSUPP\KSTELL.PX
    c:\program files\WinWare\DATEN\MEXSUPP\KSTELL.VAL
    c:\program files\WinWare\DATEN\MEXSUPP\KSTELL.X06
    c:\program files\WinWare\DATEN\MEXSUPP\KSTELL.Y06
    c:\program files\WinWare\DATEN\MEXSUPP\KUNDEN.DB
    c:\program files\WinWare\DATEN\MEXSUPP\KUNDEN.PX
    c:\program files\WinWare\DATEN\MEXSUPP\KUNDEN.VAL
    c:\program files\WinWare\DATEN\MEXSUPP\KUNDEN.X11
    c:\program files\WinWare\DATEN\MEXSUPP\KUNDEN.X17
    c:\program files\WinWare\DATEN\MEXSUPP\KUNDEN.Y11
    c:\program files\WinWare\DATEN\MEXSUPP\KUNDEN.Y17
    c:\program files\WinWare\DATEN\MEXSUPP\LIEFER.DB
    c:\program files\WinWare\DATEN\MEXSUPP\LIEFER.PX
    c:\program files\WinWare\DATEN\MEXSUPP\LIEFER.VAL
    c:\program files\WinWare\DATEN\MEXSUPP\LIEFER.X11
    c:\program files\WinWare\DATEN\MEXSUPP\LIEFER.X17
    c:\program files\WinWare\DATEN\MEXSUPP\LIEFER.Y11
    c:\program files\WinWare\DATEN\MEXSUPP\LIEFER.Y17
    c:\program files\WinWare\DATEN\MEXSUPP\LINK.DB
    c:\program files\WinWare\DATEN\MEXSUPP\LINK.PX
    c:\program files\WinWare\DATEN\MEXSUPP\LINK.XG0
    c:\program files\WinWare\DATEN\MEXSUPP\LINK.YG0
    c:\program files\WinWare\DATEN\MEXSUPP\Mahn.ini
    c:\program files\WinWare\DATEN\MEXSUPP\MAHNB.DB
    c:\program files\WinWare\DATEN\MEXSUPP\MAHNB.PX
    c:\program files\WinWare\DATEN\MEXSUPP\MAHNP.DB
    c:\program files\WinWare\DATEN\MEXSUPP\MAHNP.PX
    c:\program files\WinWare\DATEN\MEXSUPP\MAHNP.XG0
    c:\program files\WinWare\DATEN\MEXSUPP\MAHNP.YG0
    c:\program files\WinWare\DATEN\MEXSUPP\Mandant.ini
    c:\program files\WinWare\DATEN\MEXSUPP\MaskEdit.DB
    c:\program files\WinWare\DATEN\MEXSUPP\MaskEdit.PX
    c:\program files\WinWare\DATEN\MEXSUPP\MITARBW.DB
    c:\program files\WinWare\DATEN\MEXSUPP\MITARBW.PX
    c:\program files\WinWare\DATEN\MEXSUPP\MITARBW.VAL
    c:\program files\WinWare\DATEN\MEXSUPP\NOTIZ.DB
    c:\program files\WinWare\DATEN\MEXSUPP\NOTIZ.MB
    c:\program files\WinWare\DATEN\MEXSUPP\NOTIZ.PX
    c:\program files\WinWare\DATEN\MEXSUPP\NOTIZ.VAL
    c:\program files\WinWare\DATEN\MEXSUPP\NOTIZ.XG0
    c:\program files\WinWare\DATEN\MEXSUPP\NOTIZ.XG1
    c:\program files\WinWare\DATEN\MEXSUPP\NOTIZ.YG0
    c:\program files\WinWare\DATEN\MEXSUPP\NOTIZ.YG1
    c:\program files\WinWare\DATEN\MEXSUPP\OPOS.DB
    c:\program files\WinWare\DATEN\MEXSUPP\OPOS.PX
    c:\program files\WinWare\DATEN\MEXSUPP\OPOS.VAL
    c:\program files\WinWare\DATEN\MEXSUPP\OPOS.X15
    c:\program files\WinWare\DATEN\MEXSUPP\OPOS.X1F
    c:\program files\WinWare\DATEN\MEXSUPP\OPOS.X27
    c:\program files\WinWare\DATEN\MEXSUPP\OPOS.XG0
    c:\program files\WinWare\DATEN\MEXSUPP\OPOS.XG1
    c:\program files\WinWare\DATEN\MEXSUPP\OPOS.Y15
    c:\program files\WinWare\DATEN\MEXSUPP\OPOS.Y1F
    c:\program files\WinWare\DATEN\MEXSUPP\OPOS.Y27
    c:\program files\WinWare\DATEN\MEXSUPP\OPOS.YG0
    c:\program files\WinWare\DATEN\MEXSUPP\OPOS.YG1
    c:\program files\WinWare\DATEN\MEXSUPP\PME.~KP
    c:\program files\WinWare\DATEN\MEXSUPP\PME.KPL
    c:\program files\WinWare\DATEN\MEXSUPP\STAPEL.DB
    c:\program files\WinWare\DATEN\MEXSUPP\STAPEL.PX
    c:\program files\WinWare\DATEN\MEXSUPP\STAPEL.VAL
    c:\program files\WinWare\DATEN\MEXSUPP\STAPELP.DB
    c:\program files\WinWare\DATEN\MEXSUPP\STAPELP.PX
    c:\program files\WinWare\DATEN\MEXSUPP\STAPELP.VAL
    c:\program files\WinWare\DATEN\MEXSUPP\STEXT.MB
    c:\program files\WinWare\DATEN\MEXSUPP\TEXT.DB
    c:\program files\WinWare\DATEN\MEXSUPP\TEXT.MB
    c:\program files\WinWare\DATEN\MEXSUPP\TEXT.PX
    c:\program files\WinWare\DATEN\MEXSUPP\Update7.txt
    c:\program files\WinWare\DATEN\MEXSUPP\USDETAIL.DB
    c:\program files\WinWare\DATEN\MEXSUPP\USDETAIL.PX
    c:\program files\WinWare\DATEN\MEXSUPP\USDETAIL.VAL
    c:\program files\WinWare\DATEN\MEXSUPP\USER74.DAU
    c:\program files\WinWare\DATEN\MEXSUPP\USTSCHL.DB
    c:\program files\WinWare\DATEN\MEXSUPP\USTSCHL.PX
    c:\program files\WinWare\DATEN\MEXSUPP\USTSCHL.VAL
    c:\program files\WinWare\DATEN\MEXSUPP\WAEHR.DB
    c:\program files\WinWare\DATEN\MEXSUPP\WAEHR.PX
    c:\program files\WinWare\DATEN\MEXSUPP\WAEHR.VAL
    c:\program files\WinWare\DATEN\MEXSUPP\WAEHRP.DB
    c:\program files\WinWare\DATEN\MEXSUPP\WAEHRP.PX
    c:\program files\WinWare\DATEN\MEXSUPP\WAEHRP.VAL
    c:\program files\WinWare\DATEN\MEXSUPP\ZAHLBED.DB
    c:\program files\WinWare\DATEN\MEXSUPP\ZAHLBED.PX
    c:\program files\WinWare\DATEN\MEXSUPP\ZAHLBED.VAL
    c:\program files\WinWare\DATEN\MEXSUPP\ZMODUL.DB
    c:\program files\WinWare\DATEN\MEXSUPP\ZMODUL.PX
    c:\program files\WinWare\DATEN\MEXSUPP\ZMODUL.VAL
    c:\program files\WinWare\DATEN\MEXSUPP\Zmodulp.DB
    c:\program files\WinWare\DATEN\MEXSUPP\Zmodulp.PX
    c:\program files\WinWare\DATEN\MEXSUPP\Zmodulp.VAL
    c:\program files\WinWare\DATEN\MREPET1\200601\BUCH.DB
    c:\program files\WinWare\DATEN\MREPET1\200601\BUCH.PX
    c:\program files\WinWare\DATEN\MREPET1\200601\BUCH.VAL
    c:\program files\WinWare\DATEN\MREPET1\200601\BUCH.XG0
    c:\program files\WinWare\DATEN\MREPET1\200601\BUCH.YG0
    c:\program files\WinWare\DATEN\MREPET1\200601\GVORFALL.DB
    c:\program files\WinWare\DATEN\MREPET1\200601\GVORFALL.PX
    c:\program files\WinWare\DATEN\MREPET1\200601\GVORFALL.VAL
    c:\program files\WinWare\DATEN\MREPET1\200601\GVORFALL.XG0
    c:\program files\WinWare\DATEN\MREPET1\200601\GVORFALL.YG0
    c:\program files\WinWare\DATEN\MREPET1\200601\JAHR.INI
    c:\program files\WinWare\DATEN\MREPET1\200601\JBUDGET.DB
    c:\program files\WinWare\DATEN\MREPET1\200601\JBUDGET.PX
    c:\program files\WinWare\DATEN\MREPET1\200601\JBUDGET.VAL
    c:\program files\WinWare\DATEN\MREPET1\200601\JTEXT.DB
    c:\program files\WinWare\DATEN\MREPET1\200601\JTEXT.MB
    c:\program files\WinWare\DATEN\MREPET1\200601\JTEXT.PX
    c:\program files\WinWare\DATEN\MREPET1\200601\KAUSZUG.DB
    c:\program files\WinWare\DATEN\MREPET1\200601\KAUSZUG.PX
    c:\program files\WinWare\DATEN\MREPET1\200601\KAUSZUG.VAL
    c:\program files\WinWare\DATEN\MREPET1\200601\KAUSZUG.XG0
    c:\program files\WinWare\DATEN\MREPET1\200601\KAUSZUG.YG0
    c:\program files\WinWare\DATEN\MREPET1\200601\Key.DB
    c:\program files\WinWare\DATEN\MREPET1\200601\Key.PX
    c:\program files\WinWare\DATEN\MREPET1\200601\KONTEN.DB
    c:\program files\WinWare\DATEN\MREPET1\200601\KONTEN.PX
    c:\program files\WinWare\DATEN\MREPET1\200601\KONTEN.VAL
    c:\program files\WinWare\DATEN\MREPET1\200601\KONTEN.X22
    c:\program files\WinWare\DATEN\MREPET1\200601\KONTEN.XG0
    c:\program files\WinWare\DATEN\MREPET1\200601\KONTEN.Y22
    c:\program files\WinWare\DATEN\MREPET1\200601\KONTEN.YG0
    c:\program files\WinWare\DATEN\MREPET1\200601\Korrekt.DB
    c:\program files\WinWare\DATEN\MREPET1\200601\Korrekt.PX
    c:\program files\WinWare\DATEN\MREPET1\200601\Kosten.DB
    c:\program files\WinWare\DATEN\MREPET1\200601\Kosten.PX
    c:\program files\WinWare\DATEN\MREPET1\200601\Kosten.VAL
    c:\program files\WinWare\DATEN\MREPET1\200601\Kosten.XG0
    c:\program files\WinWare\DATEN\MREPET1\200601\Kosten.XG1
    c:\program files\WinWare\DATEN\MREPET1\200601\Kosten.YG0
    c:\program files\WinWare\DATEN\MREPET1\200601\Kosten.YG1
    c:\program files\WinWare\DATEN\MREPET1\200601\Kschema.DB
    c:\program files\WinWare\DATEN\MREPET1\200601\Kschema.PX
    c:\program files\WinWare\DATEN\MREPET1\200601\Kschema.VAL
    c:\program files\WinWare\DATEN\MREPET1\200601\Kschemap.DB
    c:\program files\WinWare\DATEN\MREPET1\200601\Kschemap.PX
    c:\program files\WinWare\DATEN\MREPET1\200601\Kschemap.VAL
    c:\program files\WinWare\DATEN\MREPET1\200601\NUMKREIS.DB
    c:\program files\WinWare\DATEN\MREPET1\200601\NUMKREIS.PX
    c:\program files\WinWare\DATEN\MREPET1\200601\NUMKREIS.VAL
    c:\program files\WinWare\DATEN\MREPET1\200601\NUMKREIS.XG0
    c:\program files\WinWare\DATEN\MREPET1\200601\NUMKREIS.YG0
    c:\program files\WinWare\DATEN\MREPET1\200601\SALDO.DB
    c:\program files\WinWare\DATEN\MREPET1\200601\SALDO.PX
    c:\program files\WinWare\DATEN\MREPET1\200601\SALDO.VAL
    c:\program files\WinWare\DATEN\MREPET1\200601\SEITEN.DB
    c:\program files\WinWare\DATEN\MREPET1\200601\SEITEN.PX
    c:\program files\WinWare\DATEN\MREPET1\200601\SUCHTXT.DB
    c:\program files\WinWare\DATEN\MREPET1\200601\SUCHTXT.PX
    c:\program files\WinWare\DATEN\MREPET1\200601\SUCHTXT.VAL
    c:\program files\WinWare\DATEN\MREPET1\200601\SUCHTXT.XG0
    c:\program files\WinWare\DATEN\MREPET1\200601\SUCHTXT.YG0
    c:\program files\WinWare\DATEN\MREPET1\200601\SUCHTXTD.DB
    c:\program files\WinWare\DATEN\MREPET1\200601\SUCHTXTD.PX
    c:\program files\WinWare\DATEN\MREPET1\200601\SUCHTXTD.VAL
    c:\program files\WinWare\DATEN\MREPET1\200601\SUCHTXTD.X01
    c:\program files\WinWare\DATEN\MREPET1\200601\SUCHTXTD.Y01
    c:\program files\WinWare\DATEN\MREPET1\200601\USER74.DAU
    c:\program files\WinWare\DATEN\MREPET1\ADRESS.DB
    c:\program files\WinWare\DATEN\MREPET1\ADRESS.PX
    c:\program files\WinWare\DATEN\MREPET1\ADRESS.VAL
    c:\program files\WinWare\DATEN\MREPET1\ADRESS.XG0
    c:\program files\WinWare\DATEN\MREPET1\ADRESS.XG1
    c:\program files\WinWare\DATEN\MREPET1\ADRESS.XG2
    c:\program files\WinWare\DATEN\MREPET1\ADRESS.YG0
    c:\program files\WinWare\DATEN\MREPET1\ADRESS.YG1
    c:\program files\WinWare\DATEN\MREPET1\ADRESS.YG2
    c:\program files\WinWare\DATEN\MREPET1\Archiv03.DB
    c:\program files\WinWare\DATEN\MREPET1\Archiv03.PX
    c:\program files\WinWare\DATEN\MREPET1\Archiv04.DB
    c:\program files\WinWare\DATEN\MREPET1\Archiv04.PX
    c:\program files\WinWare\DATEN\MREPET1\Archiv05.DB
    c:\program files\WinWare\DATEN\MREPET1\Archiv05.PX
    c:\program files\WinWare\DATEN\MREPET1\Archiv06.DB
    c:\program files\WinWare\DATEN\MREPET1\Archiv06.PX
    c:\program files\WinWare\DATEN\MREPET1\BANK.DB
    c:\program files\WinWare\DATEN\MREPET1\BANK.PX
    c:\program files\WinWare\DATEN\MREPET1\BANK.VAL
    c:\program files\WinWare\DATEN\MREPET1\BANK.X02
    c:\program files\WinWare\DATEN\MREPET1\BANK.X0C
    c:\program files\WinWare\DATEN\MREPET1\BANK.Y02
    c:\program files\WinWare\DATEN\MREPET1\BANK.Y0C
    c:\program files\WinWare\DATEN\MREPET1\BANKVERB.DB
    c:\program files\WinWare\DATEN\MREPET1\BANKVERB.PX
    c:\program files\WinWare\DATEN\MREPET1\BANKVERB.VAL
    c:\program files\WinWare\DATEN\MREPET1\BANKVERB.X07
    c:\program files\WinWare\DATEN\MREPET1\BANKVERB.X0B
    c:\program files\WinWare\DATEN\MREPET1\BANKVERB.X0C
    c:\program files\WinWare\DATEN\MREPET1\BANKVERB.XG0
    c:\program files\WinWare\DATEN\MREPET1\BANKVERB.Y07
    c:\program files\WinWare\DATEN\MREPET1\BANKVERB.Y0B
    c:\program files\WinWare\DATEN\MREPET1\BANKVERB.Y0C
    c:\program files\WinWare\DATEN\MREPET1\BANKVERB.YG0
    c:\program files\WinWare\DATEN\MREPET1\BILD.DB
    c:\program files\WinWare\DATEN\MREPET1\BILD.MB
    c:\program files\WinWare\DATEN\MREPET1\BILD.PX
    c:\program files\WinWare\DATEN\MREPET1\BUCHTEXT.DB
    c:\program files\WinWare\DATEN\MREPET1\BUCHTEXT.PX
    c:\program files\WinWare\DATEN\MREPET1\DBPASS.DAT
    c:\program files\WinWare\DATEN\MREPET1\FILTER.DB
    c:\program files\WinWare\DATEN\MREPET1\FILTER.MB
    c:\program files\WinWare\DATEN\MREPET1\FILTER.PX
    c:\program files\WinWare\DATEN\MREPET1\GRUPPEN.DB
    c:\program files\WinWare\DATEN\MREPET1\GRUPPEN.PX
    c:\program files\WinWare\DATEN\MREPET1\GRUPPEN.VAL
    c:\program files\WinWare\DATEN\MREPET1\GRUPPEN.X05
    c:\program files\WinWare\DATEN\MREPET1\GRUPPEN.XG0
    c:\program files\WinWare\DATEN\MREPET1\GRUPPEN.Y05
    c:\program files\WinWare\DATEN\MREPET1\GRUPPEN.YG0
    c:\program files\WinWare\DATEN\MREPET1\KASSBANK.DB
    c:\program files\WinWare\DATEN\MREPET1\KASSBANK.PX
    c:\program files\WinWare\DATEN\MREPET1\KASSBANK.VAL
    c:\program files\WinWare\DATEN\MREPET1\KEY.DB
    c:\program files\WinWare\DATEN\MREPET1\KEY.PX
    c:\program files\WinWare\DATEN\MREPET1\KSTELL.DB
    c:\program files\WinWare\DATEN\MREPET1\KSTELL.PX
    c:\program files\WinWare\DATEN\MREPET1\KSTELL.VAL
    c:\program files\WinWare\DATEN\MREPET1\KSTELL.X06
    c:\program files\WinWare\DATEN\MREPET1\KSTELL.Y06
    c:\program files\WinWare\DATEN\MREPET1\KUNDEN.DB
    c:\program files\WinWare\DATEN\MREPET1\KUNDEN.PX
    c:\program files\WinWare\DATEN\MREPET1\KUNDEN.VAL
    c:\program files\WinWare\DATEN\MREPET1\KUNDEN.X11
    c:\program files\WinWare\DATEN\MREPET1\KUNDEN.X17
    c:\program files\WinWare\DATEN\MREPET1\KUNDEN.Y11
    c:\program files\WinWare\DATEN\MREPET1\KUNDEN.Y17
    c:\program files\WinWare\DATEN\MREPET1\LIEFER.DB
    c:\program files\WinWare\DATEN\MREPET1\LIEFER.PX
    c:\program files\WinWare\DATEN\MREPET1\LIEFER.VAL
    c:\program files\WinWare\DATEN\MREPET1\LIEFER.X11
    c:\program files\WinWare\DATEN\MREPET1\LIEFER.X17
    c:\program files\WinWare\DATEN\MREPET1\LIEFER.Y11
    c:\program files\WinWare\DATEN\MREPET1\LIEFER.Y17
    c:\program files\WinWare\DATEN\MREPET1\LINK.DB
    c:\program files\WinWare\DATEN\MREPET1\LINK.PX
    c:\program files\WinWare\DATEN\MREPET1\LINK.XG0
    c:\program files\WinWare\DATEN\MREPET1\LINK.YG0
    c:\program files\WinWare\DATEN\MREPET1\Mahn.ini
    c:\program files\WinWare\DATEN\MREPET1\MAHNB.DB
    c:\program files\WinWare\DATEN\MREPET1\MAHNB.PX
    c:\program files\WinWare\DATEN\MREPET1\MAHNP.DB
    c:\program files\WinWare\DATEN\MREPET1\MAHNP.PX
    c:\program files\WinWare\DATEN\MREPET1\MAHNP.XG0
    c:\program files\WinWare\DATEN\MREPET1\MAHNP.YG0
    c:\program files\WinWare\DATEN\MREPET1\Mandant.ini
    c:\program files\WinWare\DATEN\MREPET1\MaskEdit.DB
    c:\program files\WinWare\DATEN\MREPET1\MaskEdit.PX
    c:\program files\WinWare\DATEN\MREPET1\MITARBW.DB
    c:\program files\WinWare\DATEN\MREPET1\MITARBW.PX
    c:\program files\WinWare\DATEN\MREPET1\MITARBW.VAL
    c:\program files\WinWare\DATEN\MREPET1\MWST2006.DAT
    c:\program files\WinWare\DATEN\MREPET1\NOTIZ.DB
    c:\program files\WinWare\DATEN\MREPET1\NOTIZ.MB
    c:\program files\WinWare\DATEN\MREPET1\NOTIZ.PX
    c:\program files\WinWare\DATEN\MREPET1\NOTIZ.VAL
    c:\program files\WinWare\DATEN\MREPET1\NOTIZ.XG0
    c:\program files\WinWare\DATEN\MREPET1\NOTIZ.XG1
    c:\program files\WinWare\DATEN\MREPET1\NOTIZ.YG0
    c:\program files\WinWare\DATEN\MREPET1\NOTIZ.YG1
    c:\program files\WinWare\DATEN\MREPET1\OPOS.DB
    c:\program files\WinWare\DATEN\MREPET1\OPOS.PX
    c:\program files\WinWare\DATEN\MREPET1\OPOS.VAL
    c:\program files\WinWare\DATEN\MREPET1\OPOS.X15
    c:\program files\WinWare\DATEN\MREPET1\OPOS.X1F
    c:\program files\WinWare\DATEN\MREPET1\OPOS.X27
    c:\program files\WinWare\DATEN\MREPET1\OPOS.XG0
    c:\program files\WinWare\DATEN\MREPET1\OPOS.XG1
    c:\program files\WinWare\DATEN\MREPET1\OPOS.Y15
    c:\program files\WinWare\DATEN\MREPET1\OPOS.Y1F
    c:\program files\WinWare\DATEN\MREPET1\OPOS.Y27
    c:\program files\WinWare\DATEN\MREPET1\OPOS.YG0
    c:\program files\WinWare\DATEN\MREPET1\OPOS.YG1
    c:\program files\WinWare\DATEN\MREPET1\PME.KPL
    c:\program files\WinWare\DATEN\MREPET1\STAPEL.DB
    c:\program files\WinWare\DATEN\MREPET1\STAPEL.PX
    c:\program files\WinWare\DATEN\MREPET1\STAPEL.VAL
    c:\program files\WinWare\DATEN\MREPET1\STAPELP.DB
    c:\program files\WinWare\DATEN\MREPET1\STAPELP.PX
    c:\program files\WinWare\DATEN\MREPET1\STAPELP.VAL
    c:\program files\WinWare\DATEN\MREPET1\STEXT.MB
    c:\program files\WinWare\DATEN\MREPET1\TEXT.DB
    c:\program files\WinWare\DATEN\MREPET1\TEXT.MB
    c:\program files\WinWare\DATEN\MREPET1\TEXT.PX
    c:\program files\WinWare\DATEN\MREPET1\USDETAIL.DB
    c:\program files\WinWare\DATEN\MREPET1\USDETAIL.PX
    c:\program files\WinWare\DATEN\MREPET1\USDETAIL.VAL
    c:\program files\WinWare\DATEN\MREPET1\USTSCHL.DB
    c:\program files\WinWare\DATEN\MREPET1\USTSCHL.PX
    c:\program files\WinWare\DATEN\MREPET1\USTSCHL.VAL
    c:\program files\WinWare\DATEN\MREPET1\WAEHR.DB
    c:\program files\WinWare\DATEN\MREPET1\WAEHR.PX
    c:\program files\WinWare\DATEN\MREPET1\WAEHR.VAL
    c:\program files\WinWare\DATEN\MREPET1\WAEHRP.DB
    c:\program files\WinWare\DATEN\MREPET1\WAEHRP.PX
    c:\program files\WinWare\DATEN\MREPET1\WAEHRP.VAL
    c:\program files\WinWare\DATEN\MREPET1\ZAHLBED.DB
    c:\program files\WinWare\DATEN\MREPET1\ZAHLBED.PX
    c:\program files\WinWare\DATEN\MREPET1\ZAHLBED.VAL
    c:\program files\WinWare\DATEN\MREPET1\ZMODUL.DB
    c:\program files\WinWare\DATEN\MREPET1\ZMODUL.PX
    c:\program files\WinWare\DATEN\MREPET1\ZMODUL.VAL
    c:\program files\WinWare\DATEN\MREPET1\ZMODULP.DB
    c:\program files\WinWare\DATEN\MREPET1\ZMODULP.PX
    c:\program files\WinWare\DATEN\MREPET1\ZMODULP.VAL
    c:\program files\WinWare\DATEN\MREPET2\200601\BUCH.DB
    c:\program files\WinWare\DATEN\MREPET2\200601\BUCH.PX
    c:\program files\WinWare\DATEN\MREPET2\200601\BUCH.VAL
    c:\program files\WinWare\DATEN\MREPET2\200601\BUCH.XG0
    c:\program files\WinWare\DATEN\MREPET2\200601\BUCH.YG0
    c:\program files\WinWare\DATEN\MREPET2\200601\EBX.DB
    c:\program files\WinWare\DATEN\MREPET2\200601\EBX.PX
    c:\program files\WinWare\DATEN\MREPET2\200601\GVORFALL.DB
    c:\program files\WinWare\DATEN\MREPET2\200601\GVORFALL.PX
    c:\program files\WinWare\DATEN\MREPET2\200601\GVORFALL.VAL
    c:\program files\WinWare\DATEN\MREPET2\200601\GVORFALL.XG0
    c:\program files\WinWare\DATEN\MREPET2\200601\GVORFALL.YG0
    c:\program files\WinWare\DATEN\MREPET2\200601\JAHR.INI
    c:\program files\WinWare\DATEN\MREPET2\200601\JBUDGET.DB
    c:\program files\WinWare\DATEN\MREPET2\200601\JBUDGET.PX
    c:\program files\WinWare\DATEN\MREPET2\200601\JBUDGET.VAL
    c:\program files\WinWare\DATEN\MREPET2\200601\JTEXT.DB
    c:\program files\WinWare\DATEN\MREPET2\200601\JTEXT.MB
    c:\program files\WinWare\DATEN\MREPET2\200601\JTEXT.PX
    c:\program files\WinWare\DATEN\MREPET2\200601\KAUSZUG.DB
    c:\program files\WinWare\DATEN\MREPET2\200601\KAUSZUG.PX
    c:\program files\WinWare\DATEN\MREPET2\200601\KAUSZUG.VAL
    c:\program files\WinWare\DATEN\MREPET2\200601\KAUSZUG.XG0
    c:\program files\WinWare\DATEN\MREPET2\200601\KAUSZUG.YG0
    c:\program files\WinWare\DATEN\MREPET2\200601\Key.DB
    c:\program files\WinWare\DATEN\MREPET2\200601\Key.PX
    c:\program files\WinWare\DATEN\MREPET2\200601\KONTEN.DB
    c:\program files\WinWare\DATEN\MREPET2\200601\KONTEN.PX
    c:\program files\WinWare\DATEN\MREPET2\200601\KONTEN.VAL
    c:\program files\WinWare\DATEN\MREPET2\200601\KONTEN.X22
    c:\program files\WinWare\DATEN\MREPET2\200601\KONTEN.XG0
    c:\program files\WinWare\DATEN\MREPET2\200601\KONTEN.Y22
    c:\program files\WinWare\DATEN\MREPET2\200601\KONTEN.YG0
    c:\program files\WinWare\DATEN\MREPET2\200601\Korrekt.DB
    c:\program files\WinWare\DATEN\MREPET2\200601\Korrekt.PX
    c:\program files\WinWare\DATEN\MREPET2\200601\Kosten.DB
    c:\program files\WinWare\DATEN\MREPET2\200601\Kosten.PX
    c:\program files\WinWare\DATEN\MREPET2\200601\Kosten.VAL
    c:\program files\WinWare\DATEN\MREPET2\200601\Kosten.XG0
    c:\program files\WinWare\DATEN\MREPET2\200601\Kosten.XG1
    c:\program files\WinWare\DATEN\MREPET2\200601\Kosten.YG0
    c:\program files\WinWare\DATEN\MREPET2\200601\Kosten.YG1
    c:\program files\WinWare\DATEN\MREPET2\200601\Kschema.DB
    c:\program files\WinWare\DATEN\MREPET2\200601\Kschema.PX
    c:\program files\WinWare\DATEN\MREPET2\200601\Kschema.VAL
    c:\program files\WinWare\DATEN\MREPET2\200601\Kschemap.DB
    c:\program files\WinWare\DATEN\MREPET2\200601\Kschemap.PX
    c:\program files\WinWare\DATEN\MREPET2\200601\Kschemap.VAL
    c:\program files\WinWare\DATEN\MREPET2\200601\NUMKREIS.DB
    c:\program files\WinWare\DATEN\MREPET2\200601\NUMKREIS.PX
    c:\program files\WinWare\DATEN\MREPET2\200601\NUMKREIS.VAL
    c:\program files\WinWare\DATEN\MREPET2\200601\NUMKREIS.XG0
    c:\program files\WinWare\DATEN\MREPET2\200601\NUMKREIS.YG0
    c:\program files\WinWare\DATEN\MREPET2\200601\SALDO.DB
    c:\program files\WinWare\DATEN\MREPET2\200601\SALDO.PX
    c:\program files\WinWare\DATEN\MREPET2\200601\SALDO.VAL
    c:\program files\WinWare\DATEN\MREPET2\200601\SEITEN.DB
    c:\program files\WinWare\DATEN\MREPET2\200601\SEITEN.PX
    c:\program files\WinWare\DATEN\MREPET2\200601\SUCHTXT.DB
    c:\program files\WinWare\DATEN\MREPET2\200601\SUCHTXT.PX
    c:\program files\WinWare\DATEN\MREPET2\200601\SUCHTXT.VAL
    c:\program files\WinWare\DATEN\MREPET2\200601\SUCHTXT.XG0
    c:\program files\WinWare\DATEN\MREPET2\200601\SUCHTXT.YG0
    c:\program files\WinWare\DATEN\MREPET2\200601\SUCHTXTD.DB
    c:\program files\WinWare\DATEN\MREPET2\200601\SUCHTXTD.PX
    c:\program files\WinWare\DATEN\MREPET2\200601\SUCHTXTD.VAL
    c:\program files\WinWare\DATEN\MREPET2\200601\SUCHTXTD.X01
    c:\program files\WinWare\DATEN\MREPET2\200601\SUCHTXTD.Y01
    c:\program files\WinWare\DATEN\MREPET2\200601\USER74.DAU
    c:\program files\WinWare\DATEN\MREPET2\ADRESS.DB
    c:\program files\WinWare\DATEN\MREPET2\ADRESS.PX
    c:\program files\WinWare\DATEN\MREPET2\ADRESS.VAL
    c:\program files\WinWare\DATEN\MREPET2\ADRESS.XG0
    c:\program files\WinWare\DATEN\MREPET2\ADRESS.XG1
    c:\program files\WinWare\DATEN\MREPET2\ADRESS.XG2
    c:\program files\WinWare\DATEN\MREPET2\ADRESS.YG0
    c:\program files\WinWare\DATEN\MREPET2\ADRESS.YG1
    c:\program files\WinWare\DATEN\MREPET2\ADRESS.YG2
    c:\program files\WinWare\DATEN\MREPET2\Archiv03.DB
    c:\program files\WinWare\DATEN\MREPET2\Archiv03.PX
    c:\program files\WinWare\DATEN\MREPET2\Archiv04.DB
    c:\program files\WinWare\DATEN\MREPET2\Archiv04.PX
    c:\program files\WinWare\DATEN\MREPET2\Archiv05.DB
    c:\program files\WinWare\DATEN\MREPET2\Archiv05.PX
    c:\program files\WinWare\DATEN\MREPET2\Archiv06.DB
    c:\program files\WinWare\DATEN\MREPET2\Archiv06.PX
    c:\program files\WinWare\DATEN\MREPET2\BANK.DB
    c:\program files\WinWare\DATEN\MREPET2\BANK.PX
    c:\program files\WinWare\DATEN\MREPET2\BANK.VAL
    c:\program files\WinWare\DATEN\MREPET2\BANK.X02
    c:\program files\WinWare\DATEN\MREPET2\BANK.X0C
    c:\program files\WinWare\DATEN\MREPET2\BANK.Y02
    c:\program files\WinWare\DATEN\MREPET2\BANK.Y0C
    c:\program files\WinWare\DATEN\MREPET2\BANKVERB.DB
    c:\program files\WinWare\DATEN\MREPET2\BANKVERB.PX
    c:\program files\WinWare\DATEN\MREPET2\BANKVERB.VAL
    c:\program files\WinWare\DATEN\MREPET2\BANKVERB.X07
    c:\program files\WinWare\DATEN\MREPET2\BANKVERB.X0B
    c:\program files\WinWare\DATEN\MREPET2\BANKVERB.X0C
    c:\program files\WinWare\DATEN\MREPET2\BANKVERB.XG0
    c:\program files\WinWare\DATEN\MREPET2\BANKVERB.Y07
    c:\program files\WinWare\DATEN\MREPET2\BANKVERB.Y0B
    c:\program files\WinWare\DATEN\MREPET2\BANKVERB.Y0C
    c:\program files\WinWare\DATEN\MREPET2\BANKVERB.YG0
    c:\program files\WinWare\DATEN\MREPET2\BILD.DB
    c:\program files\WinWare\DATEN\MREPET2\BILD.MB
    c:\program files\WinWare\DATEN\MREPET2\BILD.PX
    c:\program files\WinWare\DATEN\MREPET2\BUCHTEXT.DB
    c:\program files\WinWare\DATEN\MREPET2\BUCHTEXT.PX
    c:\program files\WinWare\DATEN\MREPET2\DBPASS.DAT
    c:\program files\WinWare\DATEN\MREPET2\FILTER.DB
    c:\program files\WinWare\DATEN\MREPET2\FILTER.MB
    c:\program files\WinWare\DATEN\MREPET2\FILTER.PX
    c:\program files\WinWare\DATEN\MREPET2\GRUPPEN.DB
    c:\program files\WinWare\DATEN\MREPET2\GRUPPEN.PX
    c:\program files\WinWare\DATEN\MREPET2\GRUPPEN.VAL
    c:\program files\WinWare\DATEN\MREPET2\GRUPPEN.X05
    c:\program files\WinWare\DATEN\MREPET2\GRUPPEN.XG0
    c:\program files\WinWare\DATEN\MREPET2\GRUPPEN.Y05
    c:\program files\WinWare\DATEN\MREPET2\GRUPPEN.YG0
    c:\program files\WinWare\DATEN\MREPET2\KASSBANK.DB
    c:\program files\WinWare\DATEN\MREPET2\KASSBANK.PX
    c:\program files\WinWare\DATEN\MREPET2\KASSBANK.VAL
    c:\program files\WinWare\DATEN\MREPET2\KEY.DB
    c:\program files\WinWare\DATEN\MREPET2\KEY.PX
    c:\program files\WinWare\DATEN\MREPET2\KSTELL.DB
    c:\program files\WinWare\DATEN\MREPET2\KSTELL.PX
    c:\program files\WinWare\DATEN\MREPET2\KSTELL.VAL
    c:\program files\WinWare\DATEN\MREPET2\KSTELL.X06
    c:\program files\WinWare\DATEN\MREPET2\KSTELL.Y06
    c:\program files\WinWare\DATEN\MREPET2\KUNDEN.DB
    c:\program files\WinWare\DATEN\MREPET2\KUNDEN.PX
    c:\program files\WinWare\DATEN\MREPET2\KUNDEN.VAL
    c:\program files\WinWare\DATEN\MREPET2\KUNDEN.X11
    c:\program files\WinWare\DATEN\MREPET2\KUNDEN.X17
    c:\program files\WinWare\DATEN\MREPET2\KUNDEN.Y11
    c:\program files\WinWare\DATEN\MREPET2\KUNDEN.Y17
    c:\program files\WinWare\DATEN\MREPET2\LIEFER.DB
    c:\program files\WinWare\DATEN\MREPET2\LIEFER.PX
    c:\program files\WinWare\DATEN\MREPET2\LIEFER.VAL
    c:\program files\WinWare\DATEN\MREPET2\LIEFER.X11
    c:\program files\WinWare\DATEN\MREPET2\LIEFER.X17
    c:\program files\WinWare\DATEN\MREPET2\LIEFER.Y11
    c:\program files\WinWare\DATEN\MREPET2\LIEFER.Y17
    c:\program files\WinWare\DATEN\MREPET2\LINK.DB
    c:\program files\WinWare\DATEN\MREPET2\LINK.PX
    c:\program files\WinWare\DATEN\MREPET2\LINK.XG0
    c:\program files\WinWare\DATEN\MREPET2\LINK.YG0
    c:\program files\WinWare\DATEN\MREPET2\Mahn.ini
    c:\program files\WinWare\DATEN\MREPET2\MAHNB.DB
    c:\program files\WinWare\DATEN\MREPET2\MAHNB.PX
    c:\program files\WinWare\DATEN\MREPET2\MAHNP.DB
    c:\program files\WinWare\DATEN\MREPET2\MAHNP.PX
    c:\program files\WinWare\DATEN\MREPET2\MAHNP.XG0
    c:\program files\WinWare\DATEN\MREPET2\MAHNP.YG0
    c:\program files\WinWare\DATEN\MREPET2\Mandant.ini
    c:\program files\WinWare\DATEN\MREPET2\MaskEdit.DB
    c:\program files\WinWare\DATEN\MREPET2\MaskEdit.PX
    c:\program files\WinWare\DATEN\MREPET2\MITARBW.DB
    c:\program files\WinWare\DATEN\MREPET2\MITARBW.PX
    c:\program files\WinWare\DATEN\MREPET2\MITARBW.VAL
    c:\program files\WinWare\DATEN\MREPET2\MWST2006.DAT
    c:\program files\WinWare\DATEN\MREPET2\NOTIZ.DB
    c:\program files\WinWare\DATEN\MREPET2\NOTIZ.MB
    c:\program files\WinWare\DATEN\MREPET2\NOTIZ.PX
    c:\program files\WinWare\DATEN\MREPET2\NOTIZ.VAL
    c:\program files\WinWare\DATEN\MREPET2\NOTIZ.XG0
    c:\program files\WinWare\DATEN\MREPET2\NOTIZ.XG1
    c:\program files\WinWare\DATEN\MREPET2\NOTIZ.YG0
    c:\program files\WinWare\DATEN\MREPET2\NOTIZ.YG1
    c:\program files\WinWare\DATEN\MREPET2\OPOS.DB
    c:\program files\WinWare\DATEN\MREPET2\OPOS.PX
    c:\program files\WinWare\DATEN\MREPET2\OPOS.VAL
    c:\program files\WinWare\DATEN\MREPET2\OPOS.X15
    c:\program files\WinWare\DATEN\MREPET2\OPOS.X1F
    c:\program files\WinWare\DATEN\MREPET2\OPOS.X27
    c:\program files\WinWare\DATEN\MREPET2\OPOS.XG0
    c:\program files\WinWare\DATEN\MREPET2\OPOS.XG1
    c:\program files\WinWare\DATEN\MREPET2\OPOS.Y15
    c:\program files\WinWare\DATEN\MREPET2\OPOS.Y1F
    c:\program files\WinWare\DATEN\MREPET2\OPOS.Y27
    c:\program files\WinWare\DATEN\MREPET2\OPOS.YG0
    c:\program files\WinWare\DATEN\MREPET2\OPOS.YG1
    c:\program files\WinWare\DATEN\MREPET2\PME.~KP
    c:\program files\WinWare\DATEN\MREPET2\PME.KPL
    c:\program files\WinWare\DATEN\MREPET2\STAPEL.DB
    c:\program files\WinWare\DATEN\MREPET2\STAPEL.PX
    c:\program files\WinWare\DATEN\MREPET2\STAPEL.VAL
    c:\program files\WinWare\DATEN\MREPET2\STAPELP.DB
    c:\program files\WinWare\DATEN\MREPET2\STAPELP.PX
    c:\program files\WinWare\DATEN\MREPET2\STAPELP.VAL
    c:\program files\WinWare\DATEN\MREPET2\STEXT.MB
    c:\program files\WinWare\DATEN\MREPET2\TEXT.DB
    c:\program files\WinWare\DATEN\MREPET2\TEXT.MB
    c:\program files\WinWare\DATEN\MREPET2\TEXT.PX
    c:\program files\WinWare\DATEN\MREPET2\USDETAIL.DB
    c:\program files\WinWare\DATEN\MREPET2\USDETAIL.PX
    c:\program files\WinWare\DATEN\MREPET2\USDETAIL.VAL
    c:\program files\WinWare\DATEN\MREPET2\USER74.DAU
    c:\program files\WinWare\DATEN\MREPET2\USTSCHL.DB
    c:\program files\WinWare\DATEN\MREPET2\USTSCHL.PX
    c:\program files\WinWare\DATEN\MREPET2\USTSCHL.VAL
    c:\program files\WinWare\DATEN\MREPET2\WAEHR.DB
    c:\program files\WinWare\DATEN\MREPET2\WAEHR.PX
    c:\program files\WinWare\DATEN\MREPET2\WAEHR.VAL
    c:\program files\WinWare\DATEN\MREPET2\WAEHRP.DB
    c:\program files\WinWare\DATEN\MREPET2\WAEHRP.PX
    c:\program files\WinWare\DATEN\MREPET2\WAEHRP.VAL
    c:\program files\WinWare\DATEN\MREPET2\ZAHLBED.DB
    c:\program files\WinWare\DATEN\MREPET2\ZAHLBED.PX
    c:\program files\WinWare\DATEN\MREPET2\ZAHLBED.VAL
    c:\program files\WinWare\DATEN\MREPET2\ZMODUL.DB
    c:\program files\WinWare\DATEN\MREPET2\ZMODUL.PX
    c:\program files\WinWare\DATEN\MREPET2\ZMODUL.VAL
    c:\program files\WinWare\DATEN\MREPET2\ZMODULP.DB
    c:\program files\WinWare\DATEN\MREPET2\ZMODULP.PX
    c:\program files\WinWare\DATEN\MREPET2\ZMODULP.VAL
    c:\program files\WinWare\DATEN\MVORLAGE\ABZUEGE.X0D
    c:\program files\WinWare\DATEN\MVORLAGE\ABZUEGE.X0E
    c:\program files\WinWare\DATEN\MVORLAGE\ABZUEGE.X0F
    c:\program files\WinWare\DATEN\MVORLAGE\ABZUEGE.Y0D
    c:\program files\WinWare\DATEN\MVORLAGE\ABZUEGE.Y0E
    c:\program files\WinWare\DATEN\MVORLAGE\ABZUEGE.Y0F
    c:\program files\WinWare\DATEN\MVORLAGE\Artlink.DB
    c:\program files\WinWare\DATEN\MVORLAGE\Artlink.PX
    c:\program files\WinWare\DATEN\MVORLAGE\Artlink.XG0
    c:\program files\WinWare\DATEN\MVORLAGE\Artlink.XG1
    c:\program files\WinWare\DATEN\MVORLAGE\Artlink.YG0
    c:\program files\WinWare\DATEN\MVORLAGE\Artlink.YG1
    c:\program files\WinWare\DATEN\MVORLAGE\Bestell.DB
    c:\program files\WinWare\DATEN\MVORLAGE\Bestell.MB
    c:\program files\WinWare\DATEN\MVORLAGE\Bestell.PX
    c:\program files\WinWare\DATEN\MVORLAGE\Bestell.VAL
    c:\program files\WinWare\DATEN\MVORLAGE\BestellD.DB
    c:\program files\WinWare\DATEN\MVORLAGE\BestellD.PX
    c:\program files\WinWare\DATEN\MVORLAGE\BestellD.VAL
    c:\program files\WinWare\DATEN\MVORLAGE\DNARTIK.DB
    c:\program files\WinWare\DATEN\MVORLAGE\DNARTIK.PX
    c:\program files\WinWare\DATEN\MVORLAGE\DNARTIK.VAL
    c:\program files\WinWare\DATEN\MVORLAGE\DNARTIK.XG0
    c:\program files\WinWare\DATEN\MVORLAGE\DNARTIK.XG1
    c:\program files\WinWare\DATEN\MVORLAGE\DNARTIK.XG2
    c:\program files\WinWare\DATEN\MVORLAGE\DNARTIK.YG0
    c:\program files\WinWare\DATEN\MVORLAGE\DNARTIK.YG1
    c:\program files\WinWare\DATEN\MVORLAGE\DNARTIK.YG2
    c:\program files\WinWare\DATEN\MVORLAGE\DNDIMTXT.DB
    c:\program files\WinWare\DATEN\MVORLAGE\DNDIMTXT.PX
    c:\program files\WinWare\DATEN\MVORLAGE\DNDIMTXT.VAL
    c:\program files\WinWare\DATEN\MVORLAGE\DNGrafik.DB
    c:\program files\WinWare\DATEN\MVORLAGE\DNGrafik.PX
    c:\program files\WinWare\DATEN\MVORLAGE\DNRABGR.DB
    c:\program files\WinWare\DATEN\MVORLAGE\DNRABGR.PX
    c:\program files\WinWare\DATEN\MVORLAGE\DNRABGR.VAL
    c:\program files\WinWare\DATEN\MVORLAGE\DNTEXT.DB
    c:\program files\WinWare\DATEN\MVORLAGE\DNTEXT.MB
    c:\program files\WinWare\DATEN\MVORLAGE\DNTEXT.PX
    c:\program files\WinWare\DATEN\MVORLAGE\DNTEXT.VAL
    c:\program files\WinWare\DATEN\MVORLAGE\DNWARGR.DB
    c:\program files\WinWare\DATEN\MVORLAGE\DNWARGR.PX
    c:\program files\WinWare\DATEN\MVORLAGE\DNWARGR.X03
    c:\program files\WinWare\DATEN\MVORLAGE\DNWARGR.Y03
    c:\program files\WinWare\DATEN\MVORLAGE\DNZUABS.DB
    c:\program files\WinWare\DATEN\MVORLAGE\DNZUABS.PX
    c:\program files\WinWare\DATEN\MVORLAGE\DNZUABS.VAL
    c:\program files\WinWare\DATEN\MVORLAGE\DNZUABS.XG0
    c:\program files\WinWare\DATEN\MVORLAGE\DNZUABS.YG0
    c:\program files\WinWare\DATEN\MVORLAGE\ShopArt.DB
    c:\program files\WinWare\DATEN\MVORLAGE\ShopArt.PX
    c:\program files\WinWare\DATEN\MVORLAGE\ShopArt.VAL
    c:\program files\WinWare\DATEN\MVORLAGE\ShopKund.DB
    c:\program files\WinWare\DATEN\MVORLAGE\ShopKund.PX
    c:\program files\WinWare\DATEN\MVORLAGE\ShopKund.VAL
    c:\program files\WinWare\DATEN\MWPME\Adress.DB
    c:\program files\WinWare\DATEN\MWPME\Adress.PX
    c:\program files\WinWare\DATEN\MWPME\Adress.VAL
    c:\program files\WinWare\DATEN\MWPME\Adress.XG0
    c:\program files\WinWare\DATEN\MWPME\Adress.XG1
    c:\program files\WinWare\DATEN\MWPME\Adress.XG2
    c:\program files\WinWare\DATEN\MWPME\Adress.YG0
    c:\program files\WinWare\DATEN\MWPME\Adress.YG1
    c:\program files\WinWare\DATEN\MWPME\Adress.YG2
    c:\program files\WinWare\DATEN\MWPME\Agshop.DB
    c:\program files\WinWare\DATEN\MWPME\Agshop.PX
    c:\program files\WinWare\DATEN\MWPME\Archiv03.DB
    c:\program files\WinWare\DATEN\MWPME\Archiv03.PX
    c:\program files\WinWare\DATEN\MWPME\Archiv04.DB
    c:\program files\WinWare\DATEN\MWPME\Archiv04.PX
    c:\program files\WinWare\DATEN\MWPME\Archiv05.DB
    c:\program files\WinWare\DATEN\MWPME\Archiv05.PX
    c:\program files\WinWare\DATEN\MWPME\Archiv06.DB
    c:\program files\WinWare\DATEN\MWPME\Archiv06.PX
    c:\program files\WinWare\DATEN\MWPME\Arkalk.DB
    c:\program files\WinWare\DATEN\MWPME\Arkalk.PX
    c:\program files\WinWare\DATEN\MWPME\Arkalk.VAL
    c:\program files\WinWare\DATEN\MWPME\ARPREIS.DB
    c:\program files\WinWare\DATEN\MWPME\ARPREIS.PX
    c:\program files\WinWare\DATEN\MWPME\ARPREIS.VAL
    c:\program files\WinWare\DATEN\MWPME\ARPREIS.XG0
    c:\program files\WinWare\DATEN\MWPME\ARPREIS.YG0
    c:\program files\WinWare\DATEN\MWPME\Arshop.DB
    c:\program files\WinWare\DATEN\MWPME\Arshop.PX
    c:\program files\WinWare\DATEN\MWPME\ART.DB
    c:\program files\WinWare\DATEN\MWPME\ART.PX
    c:\program files\WinWare\DATEN\MWPME\ART.VAL
    c:\program files\WinWare\DATEN\MWPME\ART.X02
    c:\program files\WinWare\DATEN\MWPME\ART.X06
    c:\program files\WinWare\DATEN\MWPME\ART.X10
    c:\program files\WinWare\DATEN\MWPME\ART.X18
    c:\program files\WinWare\DATEN\MWPME\ART.X19
    c:\program files\WinWare\DATEN\MWPME\ART.Y02
    c:\program files\WinWare\DATEN\MWPME\ART.Y06
    c:\program files\WinWare\DATEN\MWPME\ART.Y10
    c:\program files\WinWare\DATEN\MWPME\ART.Y18
    c:\program files\WinWare\DATEN\MWPME\ART.Y19
    c:\program files\WinWare\DATEN\MWPME\ARTALTER.DB
    c:\program files\WinWare\DATEN\MWPME\ARTALTER.PX
    c:\program files\WinWare\DATEN\MWPME\ARTBEZ.DB
    c:\program files\WinWare\DATEN\MWPME\ARTBEZ.MB
    c:\program files\WinWare\DATEN\MWPME\ARTBEZ.PX
    c:\program files\WinWare\DATEN\MWPME\Artlief.DB
    c:\program files\WinWare\DATEN\MWPME\Artlief.PX
    c:\program files\WinWare\DATEN\MWPME\Artlief.VAL
    c:\program files\WinWare\DATEN\MWPME\ARTSET.DB
    c:\program files\WinWare\DATEN\MWPME\ARTSET.MB
    c:\program files\WinWare\DATEN\MWPME\ARTSET.PX
    c:\program files\WinWare\DATEN\MWPME\ARTSET.VAL
    c:\program files\WinWare\DATEN\MWPME\ARTSET.X04
    c:\program files\WinWare\DATEN\MWPME\ARTSET.Y04
    c:\program files\WinWare\DATEN\MWPME\ArtVari.DB
    c:\program files\WinWare\DATEN\MWPME\ArtVari.PX
    c:\program files\WinWare\DATEN\MWPME\ArtVari.XG0
    c:\program files\WinWare\DATEN\MWPME\ArtVari.YG0
    c:\program files\WinWare\DATEN\MWPME\BANK.DB
    c:\program files\WinWare\DATEN\MWPME\BANK.PX
    c:\program files\WinWare\DATEN\MWPME\BANK.VAL
    c:\program files\WinWare\DATEN\MWPME\BANK.X02
    c:\program files\WinWare\DATEN\MWPME\BANK.X0C
    c:\program files\WinWare\DATEN\MWPME\BANK.Y02
    c:\program files\WinWare\DATEN\MWPME\BANK.Y0C
    c:\program files\WinWare\DATEN\MWPME\BANKVERB.DB
    c:\program files\WinWare\DATEN\MWPME\BANKVERB.PX
    c:\program files\WinWare\DATEN\MWPME\BankVerb.VAL
    c:\program files\WinWare\DATEN\MWPME\BANKVERB.X07
    c:\program files\WinWare\DATEN\MWPME\BANKVERB.X0B
    c:\program files\WinWare\DATEN\MWPME\BANKVERB.X0C
    c:\program files\WinWare\DATEN\MWPME\BANKVERB.XG0
    c:\program files\WinWare\DATEN\MWPME\BANKVERB.Y07
    c:\program files\WinWare\DATEN\MWPME\BANKVERB.Y0B
    c:\program files\WinWare\DATEN\MWPME\BANKVERB.Y0C
    c:\program files\WinWare\DATEN\MWPME\BANKVERB.YG0
    c:\program files\WinWare\DATEN\MWPME\BELEG.DB
    c:\program files\WinWare\DATEN\MWPME\BELEG.PX
    c:\program files\WinWare\DATEN\MWPME\BELEG.VAL
    c:\program files\WinWare\DATEN\MWPME\BELEG.XG0
    c:\program files\WinWare\DATEN\MWPME\BELEG.XG1
    c:\program files\WinWare\DATEN\MWPME\BELEG.YG0
    c:\program files\WinWare\DATEN\MWPME\BELEG.YG1
    c:\program files\WinWare\DATEN\MWPME\BELEGP.DB
    c:\program files\WinWare\DATEN\MWPME\BELEGP.PX
    c:\program files\WinWare\DATEN\MWPME\BELEGP.VAL
    c:\program files\WinWare\DATEN\MWPME\BELEGP.X27
    c:\program files\WinWare\DATEN\MWPME\BELEGP.X28
    c:\program files\WinWare\DATEN\MWPME\BELEGP.XG0
    c:\program files\WinWare\DATEN\MWPME\BELEGP.XG1
    c:\program files\WinWare\DATEN\MWPME\BELEGP.XG2
    c:\program files\WinWare\DATEN\MWPME\BELEGP.XG3
    c:\program files\WinWare\DATEN\MWPME\BELEGP.Y27
    c:\program files\WinWare\DATEN\MWPME\BELEGP.Y28
    c:\program files\WinWare\DATEN\MWPME\BELEGP.YG0
    c:\program files\WinWare\DATEN\MWPME\BELEGP.YG1
    c:\program files\WinWare\DATEN\MWPME\BELEGP.YG2
    c:\program files\WinWare\DATEN\MWPME\BELEGP.YG3
    c:\program files\WinWare\DATEN\MWPME\BILD.DB
    c:\program files\WinWare\DATEN\MWPME\BILD.MB
    c:\program files\WinWare\DATEN\MWPME\BILD.PX
    c:\program files\WinWare\DATEN\MWPME\Budget.DB
    c:\program files\WinWare\DATEN\MWPME\Budget.PX
    c:\program files\WinWare\DATEN\MWPME\Budget.VAL
    c:\program files\WinWare\DATEN\MWPME\Dasi\Vers70.lzx
    c:\program files\WinWare\DATEN\MWPME\EKRABGRU.DB
    c:\program files\WinWare\DATEN\MWPME\EKRABGRU.PX
    c:\program files\WinWare\DATEN\MWPME\EKRABGRU.VAL
    c:\program files\WinWare\DATEN\MWPME\EkStafPr.DB
    c:\program files\WinWare\DATEN\MWPME\EkStafPr.PX
    c:\program files\WinWare\DATEN\MWPME\EkStafPr.VAL
    c:\program files\WinWare\DATEN\MWPME\FILTER.DB
    c:\program files\WinWare\DATEN\MWPME\FILTER.MB
    c:\program files\WinWare\DATEN\MWPME\FILTER.PX
    c:\program files\WinWare\DATEN\MWPME\GRUPPEN.DB
    c:\program files\WinWare\DATEN\MWPME\GRUPPEN.PX
    c:\program files\WinWare\DATEN\MWPME\GRUPPEN.VAL
    c:\program files\WinWare\DATEN\MWPME\GRUPPEN.X05
    c:\program files\WinWare\DATEN\MWPME\GRUPPEN.XG0
    c:\program files\WinWare\DATEN\MWPME\GRUPPEN.Y05
    c:\program files\WinWare\DATEN\MWPME\GRUPPEN.YG0
    c:\program files\WinWare\DATEN\MWPME\Interess.DB
    c:\program files\WinWare\DATEN\MWPME\Interess.PX
    c:\program files\WinWare\DATEN\MWPME\Interess.VAL
    c:\program files\WinWare\DATEN\MWPME\Interess.X17
    c:\program files\WinWare\DATEN\MWPME\Interess.Y17
    c:\program files\WinWare\DATEN\MWPME\InvBasis.DB
    c:\program files\WinWare\DATEN\MWPME\InvBasis.PX
    c:\program files\WinWare\DATEN\MWPME\InvBasis.VAL
    c:\program files\WinWare\DATEN\MWPME\inven.DB
    c:\program files\WinWare\DATEN\MWPME\inven.PX
    c:\program files\WinWare\DATEN\MWPME\inven.VAL
    c:\program files\WinWare\DATEN\MWPME\inven.XG0
    c:\program files\WinWare\DATEN\MWPME\inven.YG0
    c:\program files\WinWare\DATEN\MWPME\Kalkulat.DB
    c:\program files\WinWare\DATEN\MWPME\Kalkulat.PX
    c:\program files\WinWare\DATEN\MWPME\Kalkulat.VAL
    c:\program files\WinWare\DATEN\MWPME\Kassbank.DB
    c:\program files\WinWare\DATEN\MWPME\Kassbank.PX
    c:\program files\WinWare\DATEN\MWPME\Kassbank.VAL
    c:\program files\WinWare\DATEN\MWPME\KASSE.DB
    c:\program files\WinWare\DATEN\MWPME\KASSE.PX
    c:\program files\WinWare\DATEN\MWPME\KASSE.VAL
    c:\program files\WinWare\DATEN\MWPME\KasseBar.DB
    c:\program files\WinWare\DATEN\MWPME\KasseBar.PX
    c:\program files\WinWare\DATEN\MWPME\KasseBar.VAL
    c:\program files\WinWare\DATEN\MWPME\KasseEnd.DB
    c:\program files\WinWare\DATEN\MWPME\KasseEnd.PX
    c:\program files\WinWare\DATEN\MWPME\KasseEnd.VAL
    c:\program files\WinWare\DATEN\MWPME\KassFilbest.db
    c:\program files\WinWare\DATEN\MWPME\KassFilbest.px
    c:\program files\WinWare\DATEN\MWPME\KassFiliale.db
    c:\program files\WinWare\DATEN\MWPME\KassFiliale.px
    c:\program files\WinWare\DATEN\MWPME\KASZAHL.DB
    c:\program files\WinWare\DATEN\MWPME\KASZAHL.PX
    c:\program files\WinWare\DATEN\MWPME\Key.DB
    c:\program files\WinWare\DATEN\MWPME\Key.PX
    c:\program files\WinWare\DATEN\MWPME\KSTELL.DB
    c:\program files\WinWare\DATEN\MWPME\KSTELL.PX
    c:\program files\WinWare\DATEN\MWPME\KSTELL.VAL
    c:\program files\WinWare\DATEN\MWPME\KSTELL.X06
    c:\program files\WinWare\DATEN\MWPME\KSTELL.Y06
    c:\program files\WinWare\DATEN\MWPME\Kunden.DB
    c:\program files\WinWare\DATEN\MWPME\Kunden.PX
    c:\program files\WinWare\DATEN\MWPME\Kunden.VAL
    c:\program files\WinWare\DATEN\MWPME\Kunden.X11
    c:\program files\WinWare\DATEN\MWPME\Kunden.X17
    c:\program files\WinWare\DATEN\MWPME\Kunden.Y11
    c:\program files\WinWare\DATEN\MWPME\Kunden.Y17
    c:\program files\WinWare\DATEN\MWPME\LAGER.DB
    c:\program files\WinWare\DATEN\MWPME\LAGER.PX
    c:\program files\WinWare\DATEN\MWPME\LAGER.VAL
    c:\program files\WinWare\DATEN\MWPME\LagerLnk.DB
    c:\program files\WinWare\DATEN\MWPME\LagerLnk.PX
    c:\program files\WinWare\DATEN\MWPME\LagerLnk.VAL
    c:\program files\WinWare\DATEN\MWPME\LagerLnk.XG0
    c:\program files\WinWare\DATEN\MWPME\LagerLnk.YG0
    c:\program files\WinWare\DATEN\MWPME\LAGERORT.DB
    c:\program files\WinWare\DATEN\MWPME\LAGERORT.PX
    c:\program files\WinWare\DATEN\MWPME\LagerP.DB
    c:\program files\WinWare\DATEN\MWPME\LagerP.PX
    c:\program files\WinWare\DATEN\MWPME\LagerP.VAL
    c:\program files\WinWare\DATEN\MWPME\LagerP.XG0
    c:\program files\WinWare\DATEN\MWPME\LagerP.XG1
    c:\program files\WinWare\DATEN\MWPME\LagerP.XG2
    c:\program files\WinWare\DATEN\MWPME\LagerP.YG0
    c:\program files\WinWare\DATEN\MWPME\LagerP.YG1
    c:\program files\WinWare\DATEN\MWPME\LagerP.YG2
    c:\program files\WinWare\DATEN\MWPME\LagerSum.DB
    c:\program files\WinWare\DATEN\MWPME\LagerSum.PX
    c:\program files\WinWare\DATEN\MWPME\LagerSum.VAL
    c:\program files\WinWare\DATEN\MWPME\Liefer.DB
    c:\program files\WinWare\DATEN\MWPME\Liefer.PX
    c:\program files\WinWare\DATEN\MWPME\Liefer.VAL
    c:\program files\WinWare\DATEN\MWPME\Liefer.X11
    c:\program files\WinWare\DATEN\MWPME\Liefer.X17
    c:\program files\WinWare\DATEN\MWPME\Liefer.Y11
    c:\program files\WinWare\DATEN\MWPME\Liefer.Y17
    c:\program files\WinWare\DATEN\MWPME\LINK.DB
    c:\program files\WinWare\DATEN\MWPME\LINK.PX
    c:\program files\WinWare\DATEN\MWPME\LINK.XG0
    c:\program files\WinWare\DATEN\MWPME\LINK.YG0
    c:\program files\WinWare\DATEN\MWPME\MAHNB.DB
    c:\program files\WinWare\DATEN\MWPME\MAHNB.PX
    c:\program files\WinWare\DATEN\MWPME\MAHNP.DB
    c:\program files\WinWare\DATEN\MWPME\MAHNP.PX
    c:\program files\WinWare\DATEN\MWPME\MAHNP.XG0
    c:\program files\WinWare\DATEN\MWPME\MAHNP.YG0
    c:\program files\WinWare\DATEN\MWPME\MaskEdit.DB
    c:\program files\WinWare\DATEN\MWPME\MaskEdit.PX
    c:\program files\WinWare\DATEN\MWPME\MENGRABP.DB
    c:\program files\WinWare\DATEN\MWPME\MENGRABP.PX
    c:\program files\WinWare\DATEN\MWPME\MENGRABP.VAL
    c:\program files\WinWare\DATEN\MWPME\MENGUM.DB
    c:\program files\WinWare\DATEN\MWPME\MENGUM.PX
    c:\program files\WinWare\DATEN\MWPME\MENGUM.VAL
    c:\program files\WinWare\DATEN\MWPME\Merkmal.DB
    c:\program files\WinWare\DATEN\MWPME\Merkmal.PX
    c:\program files\WinWare\DATEN\MWPME\Merkmal.XG0
    c:\program files\WinWare\DATEN\MWPME\Merkmal.YG0
    c:\program files\WinWare\DATEN\MWPME\MERKMALD.DB
    c:\program files\WinWare\DATEN\MWPME\MERKMALD.PX
    c:\program files\WinWare\DATEN\MWPME\MERKMALD.VAL
    c:\program files\WinWare\DATEN\MWPME\MERKMALD.XG0
    c:\program files\WinWare\DATEN\MWPME\MERKMALD.YG0
    c:\program files\WinWare\DATEN\MWPME\MITARBW.DB
    c:\program files\WinWare\DATEN\MWPME\MITARBW.PX
    c:\program files\WinWare\DATEN\MWPME\MITARBW.VAL
    c:\program files\WinWare\DATEN\MWPME\NOTIZ.DB
    c:\program files\WinWare\DATEN\MWPME\NOTIZ.MB
    c:\program files\WinWare\DATEN\MWPME\NOTIZ.PX
    c:\program files\WinWare\DATEN\MWPME\NOTIZ.VAL
    c:\program files\WinWare\DATEN\MWPME\NOTIZ.XG0
    c:\program files\WinWare\DATEN\MWPME\NOTIZ.XG1
    c:\program files\WinWare\DATEN\MWPME\NOTIZ.YG0
    c:\program files\WinWare\DATEN\MWPME\NOTIZ.YG1
    c:\program files\WinWare\DATEN\MWPME\OPOS.DB
    c:\program files\WinWare\DATEN\MWPME\OPOS.PX
    c:\program files\WinWare\DATEN\MWPME\OPOS.VAL
    c:\program files\WinWare\DATEN\MWPME\OPOS.X15
    c:\program files\WinWare\DATEN\MWPME\OPOS.X1F
    c:\program files\WinWare\DATEN\MWPME\OPOS.X27
    c:\program files\WinWare\DATEN\MWPME\OPOS.XG0
    c:\program files\WinWare\DATEN\MWPME\OPOS.XG1
    c:\program files\WinWare\DATEN\MWPME\OPOS.Y15
    c:\program files\WinWare\DATEN\MWPME\OPOS.Y1F
    c:\program files\WinWare\DATEN\MWPME\OPOS.Y27
    c:\program files\WinWare\DATEN\MWPME\OPOS.YG0
    c:\program files\WinWare\DATEN\MWPME\OPOS.YG1
    c:\program files\WinWare\DATEN\MWPME\Paket.DB
    c:\program files\WinWare\DATEN\MWPME\Paket.PX
    c:\program files\WinWare\DATEN\MWPME\PCKASSE.DB
    c:\program files\WinWare\DATEN\MWPME\PCKASSE.MB
    c:\program files\WinWare\DATEN\MWPME\PCKASSE.PX
    c:\program files\WinWare\DATEN\MWPME\PCKASSE.VAL
    c:\program files\WinWare\DATEN\MWPME\Phone.DB
    c:\program files\WinWare\DATEN\MWPME\Phone.PX
    c:\program files\WinWare\DATEN\MWPME\Phone.X02
    c:\program files\WinWare\DATEN\MWPME\Phone.XG0
    c:\program files\WinWare\DATEN\MWPME\Phone.Y02
    c:\program files\WinWare\DATEN\MWPME\Phone.YG0
    c:\program files\WinWare\DATEN\MWPME\Prov.DB
    c:\program files\WinWare\DATEN\MWPME\Prov.PX
    c:\program files\WinWare\DATEN\MWPME\Prov.XG0
    c:\program files\WinWare\DATEN\MWPME\Prov.YG0
    c:\program files\WinWare\DATEN\MWPME\ProvAbr.DB
    c:\program files\WinWare\DATEN\MWPME\ProvAbr.PX
    c:\program files\WinWare\DATEN\MWPME\ProvAbr.XG0
    c:\program files\WinWare\DATEN\MWPME\ProvAbr.XG1
    c:\program files\WinWare\DATEN\MWPME\ProvAbr.XG2
    c:\program files\WinWare\DATEN\MWPME\ProvAbr.YG0
    c:\program files\WinWare\DATEN\MWPME\ProvAbr.YG1
    c:\program files\WinWare\DATEN\MWPME\ProvAbr.YG2
    c:\program files\WinWare\DATEN\MWPME\RABGRUP.DB
    c:\program files\WinWare\DATEN\MWPME\RABGRUP.PX
    c:\program files\WinWare\DATEN\MWPME\RABGRUP.VAL
    c:\program files\WinWare\DATEN\MWPME\Serie.DB
    c:\program files\WinWare\DATEN\MWPME\Serie.PX
    c:\program files\WinWare\DATEN\MWPME\Serie.VAL
    c:\program files\WinWare\DATEN\MWPME\Serie.X04
    c:\program files\WinWare\DATEN\MWPME\Serie.XG0
    c:\program files\WinWare\DATEN\MWPME\Serie.Y04
    c:\program files\WinWare\DATEN\MWPME\Serie.YG0
    c:\program files\WinWare\DATEN\MWPME\STAPELP.DB
    c:\program files\WinWare\DATEN\MWPME\STAPELP.PX
    c:\program files\WinWare\DATEN\MWPME\STAPELP.VAL
    c:\program files\WinWare\DATEN\MWPME\STATIDET.DB
    c:\program files\WinWare\DATEN\MWPME\STATIDET.PX
    c:\program files\WinWare\DATEN\MWPME\STATIDET.XG0
    c:\program files\WinWare\DATEN\MWPME\STATIDET.YG0
    c:\program files\WinWare\DATEN\MWPME\StatiSum.DB
    c:\program files\WinWare\DATEN\MWPME\StatiSum.PX
    c:\program files\WinWare\DATEN\MWPME\StatiSum.XG0
    c:\program files\WinWare\DATEN\MWPME\StatiSum.YG0
    c:\program files\WinWare\DATEN\MWPME\STEXT.MB
    c:\program files\WinWare\DATEN\MWPME\TEXT.DB
    c:\program files\WinWare\DATEN\MWPME\TEXT.MB
    c:\program files\WinWare\DATEN\MWPME\TEXT.PX
    c:\program files\WinWare\DATEN\MWPME\Update7.txt
    c:\program files\WinWare\DATEN\MWPME\USDETAIL.PX
    c:\program files\WinWare\DATEN\MWPME\USDETAIL.VAL
    c:\program files\WinWare\DATEN\MWPME\USTSCHL.PX
    c:\program files\WinWare\DATEN\MWPME\USTSCHL.VAL
    c:\program files\WinWare\DATEN\MWPME\Vertrag.DB
    c:\program files\WinWare\DATEN\MWPME\Vertrag.PX
    c:\program files\WinWare\DATEN\MWPME\Vertrag.VAL
    c:\program files\WinWare\DATEN\MWPME\Vertrag.X03
    c:\program files\WinWare\DATEN\MWPME\Vertrag.X04
    c:\program files\WinWare\DATEN\MWPME\Vertrag.Y03
    c:\program files\WinWare\DATEN\MWPME\Vertrag.Y04
    c:\program files\WinWare\DATEN\MWPME\VertragL.DB
    c:\program files\WinWare\DATEN\MWPME\VertragL.PX
    c:\program files\WinWare\DATEN\MWPME\VertragL.XG0
    c:\program files\WinWare\DATEN\MWPME\VertragL.YG0
    c:\program files\WinWare\DATEN\MWPME\VortragP.DB
    c:\program files\WinWare\DATEN\MWPME\VortragP.PX
    c:\program files\WinWare\DATEN\MWPME\VortragP.VAL
    c:\program files\WinWare\DATEN\MWPME\VortragP.XG0
    c:\program files\WinWare\DATEN\MWPME\VortragP.YG0
    c:\program files\WinWare\DATEN\MWPME\WAEHR.PX
    c:\program files\WinWare\DATEN\MWPME\WAEHR.VAL
    c:\program files\WinWare\DATEN\MWPME\WAEHRP.PX
    c:\program files\WinWare\DATEN\MWPME\WAEHRP.VAL
    c:\program files\WinWare\DATEN\MWPME\WRECH.DB
    c:\program files\WinWare\DATEN\MWPME\WRECH.PX
    c:\program files\WinWare\DATEN\MWPME\WRECH.VAL
    c:\program files\WinWare\DATEN\MWPME\WRECH.X02
    c:\program files\WinWare\DATEN\MWPME\WRECH.X05
    c:\program files\WinWare\DATEN\MWPME\WRECH.X06
    c:\program files\WinWare\DATEN\MWPME\WRECH.Y02
    c:\program files\WinWare\DATEN\MWPME\WRECH.Y05
    c:\program files\WinWare\DATEN\MWPME\WRECH.Y06
    c:\program files\WinWare\DATEN\MWPME\ZAHLART.DB
    c:\program files\WinWare\DATEN\MWPME\ZAHLART.PX
    c:\program files\WinWare\DATEN\MWPME\ZAHLART.VAL
    c:\program files\WinWare\DATEN\MWPME\ZAHLBED.DB
    c:\program files\WinWare\DATEN\MWPME\ZAHLBED.PX
    c:\program files\WinWare\DATEN\MWPME\ZAHLBED.VAL
    c:\program files\WinWare\DATEN\MWPME\ZAHLUNG.DB
    c:\program files\WinWare\DATEN\MWPME\ZAHLUNG.PX
    c:\program files\WinWare\DATEN\MWPME\ZAHLUNG.VAL
    c:\program files\WinWare\DATEN\MWPME\ZAHLUNG.X1A
    c:\program files\WinWare\DATEN\MWPME\ZAHLUNG.XG0
    c:\program files\WinWare\DATEN\MWPME\ZAHLUNG.XG1
    c:\program files\WinWare\DATEN\MWPME\ZAHLUNG.Y1A
    c:\program files\WinWare\DATEN\MWPME\ZAHLUNG.YG0
    c:\program files\WinWare\DATEN\MWPME\ZAHLUNG.YG1
    c:\program files\WinWare\DATEN\MWPME\ZMODUL.DB
    c:\program files\WinWare\DATEN\MWPME\ZMODUL.PX
    c:\program files\WinWare\DATEN\MWPME\ZMODUL.VAL
    c:\program files\WinWare\DATEN\MWPME\Zmodulp.DB
    c:\program files\WinWare\DATEN\MWPME\Zmodulp.PX
    c:\program files\WinWare\DATEN\MWPME\Zmodulp.VAL
    c:\program files\WinWare\DATEN\OPOS.REG
    c:\program files\WinWare\DATEN\PASSWORT.DB
    c:\program files\WinWare\DATEN\PASSWORT.MB
    c:\program files\WinWare\DATEN\PASSWORT.PX
    c:\program files\WinWare\DATEN\PASSWORT.VAL
    c:\program files\WinWare\DATEN\PCKASSE.REG
    c:\program files\WinWare\DATEN\PDOXUSRS.NET
    c:\program files\WinWare\DATEN\PLZ.PX
    c:\program files\WinWare\DATEN\PLZ.XG0
    c:\program files\WinWare\DATEN\PLZ.YG0
    c:\program files\WinWare\DATEN\USER.DAU
    c:\program files\WinWare\DATEN\VERTRIEB.REG
    c:\windows\bwUnin-7.2.0.137-8876480SL.exe
    c:\windows\bwUnin-8.1.1.50-8876480SL.exe
    c:\windows\ehome\medctrro.exe
    c:\windows\iun6002.exe
    c:\windows\setupapi.log
    c:\windows\system32\Cache
    c:\windows\system32\TZLog.log
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    -------\Legacy_CLIENT_IP-IPX
    -------\Legacy_NPF
    -------\Service_Client IP-IPX
    .
    .
    ((((((((((((((((((((((((((((( Fichiers créés du 2011-08-10 au 2011-09-10 ))))))))))))))))))))))))))))))))))))
    .
    .
    2011-09-07 21:20 . 2011-09-08 19:26 -------- d-----w- c:\program files\Torpig Removal Tool
    2011-09-07 20:14 . 2011-09-07 20:14 -------- d-----w- c:\documents and settings\XXX YYY\Application Data\Malwarebytes
    2011-09-07 20:13 . 2011-07-08 05:55 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2011-09-07 20:13 . 2011-09-07 20:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2011-09-07 20:13 . 2011-09-07 20:14 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2011-09-07 20:13 . 2011-07-08 05:55 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-09-07 19:15 . 2011-09-07 19:15 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools
    2011-09-07 16:03 . 2011-09-07 16:03 -------- d-----w- c:\program files\Fichiers communs\Wise Installation Wizard
    2011-08-24 05:42 . 2011-03-13 09:42 24376 ----a-w- c:\program files\Mozilla Firefox\distribution\bundles\{D19CA586-DD6C-4a0a-96F8-14644F340D60}\components\scriptff.dll
    2011-08-21 07:17 . 2011-09-07 15:49 134104 ----a-w- c:\program files\Mozilla Firefox\components\browsercomps.dll
    2011-08-21 07:17 . 2011-09-07 15:49 89048 ----a-w- c:\program files\Mozilla Firefox\libEGL.dll
    2011-08-21 07:17 . 2011-09-07 15:49 478168 ----a-w- c:\program files\Mozilla Firefox\libGLESv2.dll
    2011-08-21 07:17 . 2011-09-07 15:49 15832 ----a-w- c:\program files\Mozilla Firefox\mozalloc.dll
    2011-08-21 07:17 . 2011-09-07 15:49 1846232 ----a-w- c:\program files\Mozilla Firefox\mozjs.dll
    2011-08-21 07:17 . 2011-09-07 15:49 785368 ----a-w- c:\program files\Mozilla Firefox\mozsqlite3.dll
    2011-08-21 07:17 . 2011-08-12 03:15 2106216 ----a-w- c:\program files\Mozilla Firefox\D3DCompiler_43.dll
    2011-08-21 07:17 . 2011-08-12 03:15 1998168 ----a-w- c:\program files\Mozilla Firefox\d3dx9_43.dll
    2011-08-17 19:18 . 2011-08-17 19:18 -------- d-----w- c:\documents and settings\XXX YYY\Application Data\ICAClient
    2011-08-17 19:16 . 2011-08-17 19:16 -------- d-----w- c:\program files\Citrix
    2011-08-14 07:12 . 2011-08-14 07:12 -------- d-----w- c:\program files\Safer Networking
    .
    .
    .
    (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2011-09-03 10:17 . 2004-08-19 12:03 606208 ----a-w- c:\windows\system32\crypt32.dll
    2011-07-15 13:29 . 2006-10-05 18:17 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
    2011-07-08 14:02 . 2004-08-19 12:03 10496 ----a-w- c:\windows\system32\drivers\ndistapi.sys
    2011-06-24 14:10 . 2004-08-19 12:14 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys
    2011-06-23 18:31 . 2004-08-19 12:03 916480 ----a-w- c:\windows\system32\wininet.dll
    2011-06-23 18:31 . 2004-08-19 12:03 43520 ----a-w- c:\windows\system32\licmgr10.dll
    2011-06-23 18:31 . 2004-08-19 12:03 1469440 ------w- c:\windows\system32\inetcpl.cpl
    2011-06-23 12:05 . 2004-08-19 12:03 385024 ----a-w- c:\windows\system32\html.iec
    2011-06-20 17:44 . 2004-08-19 12:03 293888 ----a-w- c:\windows\system32\winsrv.dll
    2008-08-16 15:42 . 2008-08-16 15:42 13112 ----a-w- c:\program files\mozilla firefox\plugins\cgpcfg.dll
    2008-08-16 15:42 . 2008-08-16 15:42 70456 ----a-w- c:\program files\mozilla firefox\plugins\CgpCore.dll
    2008-08-16 15:42 . 2008-08-16 15:42 91448 ----a-w- c:\program files\mozilla firefox\plugins\confmgr.dll
    2008-08-16 15:42 . 2008-08-16 15:42 20800 ----a-w- c:\program files\mozilla firefox\plugins\ctxlogging.dll
    2008-08-16 15:43 . 2008-08-16 15:43 206136 ----a-w- c:\program files\mozilla firefox\plugins\ctxmui.dll
    2008-08-16 15:42 . 2008-08-16 15:42 31032 ----a-w- c:\program files\mozilla firefox\plugins\icafile.dll
    2008-08-16 15:42 . 2008-08-16 15:42 40248 ----a-w- c:\program files\mozilla firefox\plugins\icalogon.dll
    2008-05-21 06:41 . 2008-05-21 06:41 479232 ----a-w- c:\program files\mozilla firefox\plugins\msvcm80.dll
    2008-05-21 06:41 . 2008-05-21 06:41 548864 ----a-w- c:\program files\mozilla firefox\plugins\msvcp80.dll
    2008-05-21 06:41 . 2008-05-21 06:41 626688 ----a-w- c:\program files\mozilla firefox\plugins\msvcr80.dll
    2008-06-05 11:58 . 2008-06-05 11:58 648504 ----a-w- c:\program files\mozilla firefox\plugins\sslsdk_b.dll
    2008-08-16 15:42 . 2008-08-16 15:42 23864 ----a-w- c:\program files\mozilla firefox\plugins\TcpPServ.dll
    2011-09-07 15:49 . 2011-08-21 07:17 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
    2011-04-14 12:01 . 2011-01-11 19:30 24376 ----a-w- c:\program files\mozilla firefox\components\Scriptff.dll
    .
    .
    ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
    REGEDIT4
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "MyTomTomSA.exe "= "c:\program files\MyTomTom 3\MyTomTomSA.exe" [2011-06-30 399320]
    "WMPNSCFG "= "c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-03 204288]
    "swg "= "c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-27 68856]
    "ctfmon.exe "= "c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
    .
     
    MuadDib,
    #23
  5. 2011/09/10
    MuadDib

    MuadDib Inactive Thread Starter

    Joined:
    2011/09/07
    Messages:
    29
    Likes Received:
    0
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Apoint "= "c:\program files\Apoint\Apoint.exe" [2005-10-07 176128]
    "NvCplDaemon "= "c:\windows\system32\NvCpl.dll" [2007-11-17 8495104]
    "nwiz "= "nwiz.exe" [2007-11-17 1626112]
    "NVHotkey "= "nvHotkey.dll" [2007-11-17 86016]
    "Dell QuickSet "= "c:\program files\Dell\QuickSet\Quickset.exe" [2007-07-20 1228800]
    "Logitech Hardware Abstraction Layer "= "KHALMNPR.EXE" [2005-03-10 28160]
    "NvMediaCenter "= "c:\windows\system32\NvMcTray.dll" [2007-11-17 81920]
    "IntelZeroConfig "= "c:\program files\Intel\WiFi\bin\ZCfgSvc.exe" [2008-08-20 1368064]
    "IntelWireless "= "c:\program files\Fichiers communs\Intel\WirelessCommon\iFrmewrk.exe" [2008-08-20 1191936]
    "BluetoothAuthenticationAgent "= "bthprops.cpl" [2008-04-14 110592]
    "SigmatelSysTrayApp "= "c:\program files\SigmaTel\C-Major Audio\WDM\stsystra.exe" [2007-05-10 405504]
    "SonicWALLNetExtender "= "c:\program files\SonicWALL\SSL-VPN\NetExtender\NEGui.exe" [2010-03-15 1103744]
    "AdobeAAMUpdater-1.0 "= "c:\program files\Fichiers communs\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]
    "SwitchBoard "= "c:\program files\Fichiers communs\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
    "AdobeCS5ServiceManager "= "c:\program files\Fichiers communs\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-07-22 402432]
    "Zune Launcher "= "c:\program files\Zune\ZuneLauncher.exe" [2010-09-24 159472]
    "mcui_exe "= "c:\program files\McAfee.com\Agent\mcagent.exe" [2011-07-13 1312384]
    "Adobe ARM "= "c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
    .
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE "= "c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
    .
    c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
    Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2005-11-18 1724416]
    Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2007-1-5 438272]
    McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
    .
    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{56F9679E-7826-4C84-81F3-532071A8BCC5} "= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
    @=" "
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
    @=" "
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
    @= "Driver "
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
    @= "Service "
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
    "DisableMonitoring "=dword:00000001
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\Network Diagnostic\\xpnetdiag.exe "=
    "c:\\Program Files\\Adobe\\Adobe Version Cue CS2\\bin\\VersionCueCS2.exe "=
    "c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe "=
    "c:\\WINDOWS\\system32\\msiexec.exe "=
    "c:\\Program Files\\Hewlett-Packard\\hp deskjet 460 series\\Toolbox\\HPWRTBX.exe "=
    "c:\\Program Files\\Real\\RealPlayer\\realplay.exe "=
    "c:\\Program Files\\TrackMania United\\TmUnited.exe "=
    "c:\\Program Files\\eclipse\\eclipse.exe "=
    "c:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe "=
    "c:\\Program Files\\mIRC\\mirc.exe "=
    "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE "=
    "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE "=
    "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE "=
    "c:\\Program Files\\Mozilla Firefox\\firefox.exe "=
    "c:\\Program Files\\Java\\jre1.6.0_07\\bin\\javaw.exe "=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
    "c:\\Program Files\\Java\\jdk1.6.0_07\\jre\\bin\\java.exe "=
    "c:\\Program Files\\Messenger\\msmsgs.exe "=
    "c:\\WINDOWS\\system32\\sessmgr.exe "=
    "c:\\WINDOWS\\pchealth\\helpctr\\binaries\\helpctr.exe "=
    "c:\\Program Files\\Skype\\Phone\\Skype.exe "=
    "c:\\Program Files\\Fichiers communs\\McAfee\\McSvcHost\\McSvHost.exe "=
    "c:\\Program Files\\Free Music Zilla\\FMZilla.exe "=
    "c:\\Program Files\\TrackMania Nations ESWC\\TmNationsESWC.exe "=
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "7195:TCP "= 7195:TCP:*:Disabled:eMule (TCP)
    "9961:UDP "= 9961:UDP:*:Disabled:eMule (UDP)
    "3389:TCP "= 3389:TCP:Remote Desktop
    "65533:TCP "= 65533:TCP:*:Disabled:Services
    "52344:TCP "= 52344:TCP:*:Disabled:Services
    .
    R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [27.11.2006 21:49 691696]
    R1 mfetdi2k;McAfee Inc. mfetdi2k;c:\windows\system32\drivers\mfetdi2k.sys [11.01.2011 21:30 89368]
    R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [29.04.2009 19:37 210216]
    R2 McNaiAnn;McAfee VirusScan Announcer; "c:\program files\Fichiers communs\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc [11.01.2011 21:29 214904]
    R2 mfefire;McAfee Firewall Core Service;c:\program files\Fichiers communs\McAfee\SystemCore\mfefire.exe [11.01.2011 21:30 159832]
    R2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [11.01.2011 21:30 148520]
    R3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [11.01.2011 21:30 337912]
    R3 mfendiskmp;mfendiskmp;c:\windows\system32\drivers\mfendisk.sys [11.01.2011 21:30 83688]
    R3 NxDrv;SonicWALL NetExtender Adapter;c:\windows\system32\drivers\NxDrv.sys [21.10.2009 20:27 22600]
    S2 DellBIOS;DellBIOS;\??\c:\windows\DellBIOS.Sys --> c:\windows\DellBIOS.Sys [?]
    S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [13.11.2009 19:42 135664]
    S3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [11.01.2011 21:30 57432]
    S3 gupdatem;Service Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [13.11.2009 19:42 135664]
    S3 LocalTimeService;LocalTimeService;c:\documents and settings\XXX YYY\Mes documents\Visual Studio 2008\Projects\LocalTimeWCF\LocalTimeWindowsService\bin\Debug\LocalTimeWindowsService.exe [10.03.2010 20:50 6656]
    S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [15.01.2010 14:49 227232]
    S3 mfendisk;McAfee Core NDIS Intermediate Filter;c:\windows\system32\drivers\mfendisk.sys [11.01.2011 21:30 83688]
    S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [11.01.2011 21:30 85984]
    S3 PD100VID;Video Blaster WebCam 5 (WDM);c:\windows\system32\drivers\PD100Vid.sys [26.10.2006 21:54 374200]
    S3 SwitchBoard;SwitchBoard;c:\program files\Fichiers communs\Adobe\SwitchBoard\SwitchBoard.exe [19.02.2010 13:37 517096]
    S3 WMZuneComm;Zune Windows Mobile Connectivity Service;c:\program files\Zune\WMZuneComm.exe [24.09.2010 14:19 268528]
    S3 xcpip;Pilote du protocole TCP/IP;c:\windows\system32\drivers\xcpip.sys --> c:\windows\system32\drivers\xcpip.sys [?]
    S3 xpsec;Pilote IPSEC;c:\windows\system32\drivers\xpsec.sys --> c:\windows\system32\drivers\xpsec.sys [?]
    S4 CalculatriceService;CalculatriceService;c:\documents and settings\XXX YYY\Mes documents\Visual Studio 2008\Projects\CalculatriceWCF\CalculatriceWindowsService\bin\Debug\CalculatriceWindowsService.exe [03.03.2010 21:17 6656]
    S4 CalculatriceWindowsService;CalculatriceWindowsService;c:\documents and settings\XXX YYY\Mes documents\Visual Studio 2008\Projects\CorrigeExCalculatrice\CalculatriceWindowsService\bin\Debug\CalculatriceWindowsService.exe [10.03.2010 15:55 6656]
    .
    --- Autres Services/Pilotes en mémoire ---
    .
    *Deregistered* - mfeavfk01
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
    .
    Contenu du dossier 'Tâches planifiées'
    .
    2011-09-09 c:\windows\Tasks\AdobeAAMUpdater-1.0-LATITUDED820-XXX YYY.job
    - c:\program files\Fichiers communs\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [2010-08-11 01:44]
    .
    2011-08-21 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2006-10-10 15:13]
    .
    2011-09-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2009-11-13 17:42]
    .
    2011-09-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2009-11-13 17:42]
    .
    2011-02-06 c:\windows\Tasks\off.job
    - c:\tmp\off.cmd [2011-02-06 20:58]
    .
    2011-09-09 c:\windows\Tasks\User_Feed_Synchronization-{1121D7E9-8F0A-4CEF-9A8B-D47BD6EA589B}.job
    - c:\windows\system32\msfeedssync.exe [2006-10-17 02:31]
    .
    .
    ------- Examen supplémentaire -------
    .
    uStart Page = hxxp://www.google.ch/
    uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
    uInternet Connection Wizard,ShellNext = hxxp://www.google.ch/ig/dell?hl=fr&client=dell-row-rel&channel=ch&ibd=0061005
    uInternet Settings,ProxyServer = proxy.heig-vd.ch:8080
    uSearchAssistant = hxxp://www.google.com/ie
    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
    IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
    LSP: %SystemRoot%\system32\nutafun4.dll
    Trusted Zone: hcisolutions.ch\msslvpn
    Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
    FF - ProfilePath - c:\documents and settings\XXX YYY\Application Data\Mozilla\Firefox\Profiles\igot3ps1.default\
    FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
    FF - prefs.js: network.proxy.ftp - localhost
    FF - prefs.js: network.proxy.ftp_port - 8800
    FF - prefs.js: network.proxy.gopher - localhost
    FF - prefs.js: network.proxy.gopher_port - 8800
    FF - prefs.js: network.proxy.http - localhost
    FF - prefs.js: network.proxy.http_port - 8800
    FF - prefs.js: network.proxy.socks - localhost
    FF - prefs.js: network.proxy.socks_port - 8800
    FF - prefs.js: network.proxy.ssl - localhost
    FF - prefs.js: network.proxy.ssl_port - 8800
    FF - prefs.js: network.proxy.type - 0
    .
    - - - - ORPHELINS SUPPRIMES - - - -
    .
    WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
    HKLM-Run-NWEReboot - (no file)
    SafeBoot-WudfPf
    SafeBoot-WudfRd
    AddRemove-ADIBOUd'CHOU V.1.00 on C - c:\coktel\adiboudchou\Uninst.exe
    AddRemove-Creative Video Blaster WebCam 5 - c:\windows\CtDrvIns.exe -uninstall USB\VID_041E&PID_400C&MI_00 -plugin PD100Pin.dll
    AddRemove-HijackThis - c:\download\HiJackThis\HijackThis.exe
    AddRemove-MiniStumbler - c:\program files\MiniStumbler\uninst.exe
    .
    .
    .
    **************************************************************************
    .
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2011-09-10 12:11
    Windows 5.1.2600 Service Pack 3 NTFS
    .
    Recherche de processus cachés ...
    .
    Recherche d'éléments en démarrage automatique cachés ...
    .
    Recherche de fichiers cachés ...
    .
    Scan terminé avec succès
    Fichiers cachés: 0
    .
    **************************************************************************
    .
    --------------------- CLES DE REGISTRE BLOQUEES ---------------------
    .
    [HKEY_LOCAL_MACHINE\software\Intel\Wireless\Folders\0*& 2*]
    "Path "= "c:\\WINDOWS\\system32\\config\\systemprofile\\Application Data\\Intel\\Wireless\\ "
    .
    [HKEY_LOCAL_MACHINE\software\Intel\Wireless\Folders\À*& 2*]
    "Path "= "c:\\WINDOWS\\system32\\config\\systemprofile\\Application Data\\Intel\\Wireless\\ "
    .
    [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•9~*]
    "C040110900063D11C8EF10054038389C "= "C?\\WINDOWS\\system32\\FM20ENU.DLL "
    .
    --------------------- DLLs chargées dans les processus actifs ---------------------
    .
    - - - - - - - > 'winlogon.exe'(2028)
    c:\windows\system32\IWPDGINA.DLL
    c:\program files\Intel\WiFi\bin\LangResources\FRA\SsoGnFRA.dll
    .
    - - - - - - - > 'explorer.exe'(5876)
    c:\program files\McAfee\SiteAdvisor\saHook.dll
    c:\program files\Logitech\SetPoint\lgscroll.dll
    c:\program files\Windows Desktop Search\deskbar.dll
    c:\program files\Windows Desktop Search\fr-fr\dbres.dll.mui
    c:\program files\Windows Desktop Search\dbres.dll
    c:\program files\Windows Desktop Search\wordwheel.dll
    c:\program files\Windows Desktop Search\fr-fr\msnlExtRes.dll.mui
    c:\program files\Windows Desktop Search\msnlExtRes.dll
    c:\windows\system32\ieframe.dll
    c:\windows\system32\webcheck.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    c:\windows\system32\eappprxy.dll
    c:\windows\system32\netprovcredman.dll
    .
    ------------------------ Autres processus actifs ------------------------
    .
    c:\program files\Intel\WiFi\bin\S24EvMon.exe
    c:\program files\Intel\WiFi\bin\EvtEng.exe
    c:\program files\Java\jre6\bin\jqs.exe
    c:\program files\Dell\QuickSet\NICCONFIGSVC.exe
    c:\windows\system32\nvsvc32.exe
    c:\program files\Fichiers communs\Intel\WirelessCommon\RegSrvc.exe
    c:\program files\SonicWALL\SSL-VPN\NetExtender\NEService.exe
    c:\program files\Intel\WiFi\bin\WLKeeper.exe
    c:\windows\system32\SearchIndexer.exe
    c:\windows\system32\ZuneBusEnum.exe
    c:\program files\Fichiers communs\McAfee\SystemCore\mcshield.exe
    c:\program files\Windows Media Player\WMPNetwk.exe
    c:\windows\system32\SearchProtocolHost.exe
    c:\windows\system32\wbem\wmiapsrv.exe
    c:\progra~1\mcafee.com\agent\mcagent.exe
    c:\program files\Apoint\HidFind.exe
    c:\program files\Apoint\Apntex.exe
    c:\windows\system32\rundll32.exe
    c:\windows\system32\RUNDLL32.EXE
    c:\windows\system32\rundll32.exe
    c:\windows\system32\wbem\unsecapp.exe
    c:\program files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
    c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
    c:\program files\Fichiers communs\Logitech\KHAL\KHALMNPR.EXE
    c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
    c:\program files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe
    c:\program files\Toshiba\Bluetooth Toshiba Stack\tosBtProc.exe
    c:\progra~1\mcafee\VIRUSS~1\mcvsshld.exe
    c:\progra~1\mcafee\VIRUSS~1\mcvsmap.exe
    c:\windows\system32\SearchFilterHost.exe
    .
    **************************************************************************
    .
    Heure de fin: 2011-09-10 12:27:29 - La machine a redémarré
    ComboFix-quarantined-files.txt 2011-09-10 10:26
    .
    Avant-CF: 22'114'963'456 octets libres
    Après-CF: 23'935'856'640 octets libres
    .
    WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT= "Microsoft Windows Recovery Console" /cmdcons
    UnsupportedDebug= "do not select this" /debug
    multi(0)disk(0)rdisk(0)partition(2)\WINDOWS= "Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect
    [spybotsd]
    timeout.old=30
    .
    - - End Of File - - B1F800F85DCF4DD914ADBD22E07003CC

    Here's the log of ComboFix...
    I just want to add that I also uninstall uTorrent that finally I didn't use
     
    MuadDib,
    #24
  6. 2011/09/10
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    1. Please open Notepad
    • Click Start , then Run
    • Type notepad .exe in the Run Box
    • Click OK
    Windows Vista/7 users: click Start, in "Start search" type notepad and press Enter.

    2. Now copy/paste the entire content of the codebox below into the Notepad window:

    Code:
    File::
c:\windows\system32\drivers\xpsec.sys
c:\windows\system32\drivers\xcpip.sys
c:\windows\Tasks\off.job
c:\tmp\off.cmd

DDS::
uInternet Settings,ProxyServer = proxy.heig-vd.ch:8080
Trusted Zone: hcisolutions.ch\msslvpn

Driver::
xcpip
xpsec

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
 "DisableMonitoring "=dword:00000000

FireFox::
FF - ProfilePath - c:\documents and settings\XXX YYY\Application Data\Mozilla\Firefox\Profiles\igot3ps1.default\
FF - prefs.js: network.proxy.ftp - localhost
FF - prefs.js: network.proxy.ftp_port - 8800
FF - prefs.js: network.proxy.gopher - localhost
FF - prefs.js: network.proxy.gopher_port - 8800
FF - prefs.js: network.proxy.http - localhost
FF - prefs.js: network.proxy.http_port - 8800
FF - prefs.js: network.proxy.socks - localhost
FF - prefs.js: network.proxy.socks_port - 8800
FF - prefs.js: network.proxy.ssl - localhost
FF - prefs.js: network.proxy.ssl_port - 8800
FF - prefs.js: network.proxy.type - 0

RegNull::
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\User Data\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•9~*]

    3. Save the above as CFScript.txt

    4. Close/disable all anti virus and anti malware programs again, so they do not interfere with the running of ComboFix.

    5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

    [​IMG]


    6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
    • Combofix.txt
     
    broni,
    #25
  7. 2011/09/10
    MuadDib

    MuadDib Inactive Thread Starter

    Joined:
    2011/09/07
    Messages:
    29
    Likes Received:
    0
    Hi,

    Laptop seems to run faster today... Here's the log of ComboFix

    ComboFix 11-09-10.03 - XXX YYY 10.09.2011 21:27:58.2.2 - x86
    Microsoft Windows XP Professionnel 5.1.2600.3.1252.41.1036.18.3326.2463 [GMT 2:00]
    Lancé depuis: c:\download\WindowsBBS\ComboFix\ComboFix.exe
    Commutateurs utilisés :: c:\download\WindowsBBS\ComboFix\CFScript.txt
    AV: Protection antivirus et antispyware McAfee *Disabled/Updated* {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
    .
    FILE ::
    "c:\tmp\off.cmd "
    "c:\windows\system32\drivers\xcpip.sys "
    "c:\windows\system32\drivers\xpsec.sys "
    "c:\windows\Tasks\off.job "
    .
    .
    (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\tmp\off.cmd
    c:\windows\Tasks\off.job
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    -------\Service_xcpip
    -------\Service_xpsec
    .
    .
    ((((((((((((((((((((((((((((( Fichiers créés du 2011-08-10 au 2011-09-10 ))))))))))))))))))))))))))))))))))))
    .
    .
    2011-09-07 21:20 . 2011-09-08 19:26 -------- d-----w- c:\program files\Torpig Removal Tool
    2011-09-07 20:14 . 2011-09-07 20:14 -------- d-----w- c:\documents and settings\XXX YYY\Application Data\Malwarebytes
    2011-09-07 20:13 . 2011-07-08 05:55 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2011-09-07 20:13 . 2011-09-07 20:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2011-09-07 20:13 . 2011-09-07 20:14 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2011-09-07 20:13 . 2011-07-08 05:55 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-09-07 19:15 . 2011-09-07 19:15 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools
    2011-09-07 16:03 . 2011-09-07 16:03 -------- d-----w- c:\program files\Fichiers communs\Wise Installation Wizard
    2011-08-24 05:42 . 2011-03-13 09:42 24376 ----a-w- c:\program files\Mozilla Firefox\distribution\bundles\{D19CA586-DD6C-4a0a-96F8-14644F340D60}\components\scriptff.dll
    2011-08-21 07:17 . 2011-09-07 15:49 134104 ----a-w- c:\program files\Mozilla Firefox\components\browsercomps.dll
    2011-08-21 07:17 . 2011-09-07 15:49 89048 ----a-w- c:\program files\Mozilla Firefox\libEGL.dll
    2011-08-21 07:17 . 2011-09-07 15:49 478168 ----a-w- c:\program files\Mozilla Firefox\libGLESv2.dll
    2011-08-21 07:17 . 2011-09-07 15:49 15832 ----a-w- c:\program files\Mozilla Firefox\mozalloc.dll
    2011-08-21 07:17 . 2011-09-07 15:49 1846232 ----a-w- c:\program files\Mozilla Firefox\mozjs.dll
    2011-08-21 07:17 . 2011-09-07 15:49 785368 ----a-w- c:\program files\Mozilla Firefox\mozsqlite3.dll
    2011-08-21 07:17 . 2011-08-12 03:15 2106216 ----a-w- c:\program files\Mozilla Firefox\D3DCompiler_43.dll
    2011-08-21 07:17 . 2011-08-12 03:15 1998168 ----a-w- c:\program files\Mozilla Firefox\d3dx9_43.dll
    2011-08-17 19:18 . 2011-08-17 19:18 -------- d-----w- c:\documents and settings\XXX YYY\Application Data\ICAClient
    2011-08-17 19:16 . 2011-08-17 19:16 -------- d-----w- c:\program files\Citrix
    2011-08-14 07:12 . 2011-08-14 07:12 -------- d-----w- c:\program files\Safer Networking
    .
    .
    .
    (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2011-09-03 10:17 . 2004-08-19 12:03 606208 ----a-w- c:\windows\system32\crypt32.dll
    2011-07-15 13:29 . 2006-10-05 18:17 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
    2011-07-08 14:02 . 2004-08-19 12:03 10496 ----a-w- c:\windows\system32\drivers\ndistapi.sys
    2011-06-24 14:10 . 2004-08-19 12:14 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys
    2011-06-23 18:31 . 2004-08-19 12:03 916480 ----a-w- c:\windows\system32\wininet.dll
    2011-06-23 18:31 . 2004-08-19 12:03 43520 ----a-w- c:\windows\system32\licmgr10.dll
    2011-06-23 18:31 . 2004-08-19 12:03 1469440 ------w- c:\windows\system32\inetcpl.cpl
    2011-06-23 12:05 . 2004-08-19 12:03 385024 ----a-w- c:\windows\system32\html.iec
    2011-06-20 17:44 . 2004-08-19 12:03 293888 ----a-w- c:\windows\system32\winsrv.dll
    2008-08-16 15:42 . 2008-08-16 15:42 13112 ----a-w- c:\program files\mozilla firefox\plugins\cgpcfg.dll
    2008-08-16 15:42 . 2008-08-16 15:42 70456 ----a-w- c:\program files\mozilla firefox\plugins\CgpCore.dll
    2008-08-16 15:42 . 2008-08-16 15:42 91448 ----a-w- c:\program files\mozilla firefox\plugins\confmgr.dll
    2008-08-16 15:42 . 2008-08-16 15:42 20800 ----a-w- c:\program files\mozilla firefox\plugins\ctxlogging.dll
    2008-08-16 15:43 . 2008-08-16 15:43 206136 ----a-w- c:\program files\mozilla firefox\plugins\ctxmui.dll
    2008-08-16 15:42 . 2008-08-16 15:42 31032 ----a-w- c:\program files\mozilla firefox\plugins\icafile.dll
    2008-08-16 15:42 . 2008-08-16 15:42 40248 ----a-w- c:\program files\mozilla firefox\plugins\icalogon.dll
    2008-05-21 06:41 . 2008-05-21 06:41 479232 ----a-w- c:\program files\mozilla firefox\plugins\msvcm80.dll
    2008-05-21 06:41 . 2008-05-21 06:41 548864 ----a-w- c:\program files\mozilla firefox\plugins\msvcp80.dll
    2008-05-21 06:41 . 2008-05-21 06:41 626688 ----a-w- c:\program files\mozilla firefox\plugins\msvcr80.dll
    2008-06-05 11:58 . 2008-06-05 11:58 648504 ----a-w- c:\program files\mozilla firefox\plugins\sslsdk_b.dll
    2008-08-16 15:42 . 2008-08-16 15:42 23864 ----a-w- c:\program files\mozilla firefox\plugins\TcpPServ.dll
    2011-09-07 15:49 . 2011-08-21 07:17 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
    2011-04-14 12:01 . 2011-01-11 19:30 24376 ----a-w- c:\program files\mozilla firefox\components\Scriptff.dll
    .
    .
    ((((((((((((((((((((((((((((( SnapShot@2011-09-10_10.11.57 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2011-09-10 19:43 . 2011-09-10 19:43 16384 c:\windows\Temp\Perflib_Perfdata_744.dat
    - 2011-09-10 10:09 . 2011-09-10 10:09 16384 c:\windows\Temp\Perflib_Perfdata_744.dat
    + 2006-10-12 16:08 . 2011-09-10 19:50 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
    - 2006-10-12 16:08 . 2011-09-10 09:49 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
    + 2006-10-12 16:08 . 2011-09-10 19:50 32768 c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat
    - 2006-10-12 16:08 . 2011-09-10 09:49 32768 c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat
    + 2011-09-10 19:50 . 2011-09-10 19:50 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
    .
    ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
    REGEDIT4
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "MyTomTomSA.exe "= "c:\program files\MyTomTom 3\MyTomTomSA.exe" [2011-06-30 399320]
    "WMPNSCFG "= "c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-03 204288]
    "swg "= "c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-27 68856]
    "ctfmon.exe "= "c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Apoint "= "c:\program files\Apoint\Apoint.exe" [2005-10-07 176128]
    "NvCplDaemon "= "c:\windows\system32\NvCpl.dll" [2007-11-17 8495104]
    "nwiz "= "nwiz.exe" [2007-11-17 1626112]
    "NVHotkey "= "nvHotkey.dll" [2007-11-17 86016]
    "Dell QuickSet "= "c:\program files\Dell\QuickSet\Quickset.exe" [2007-07-20 1228800]
    "Logitech Hardware Abstraction Layer "= "KHALMNPR.EXE" [2005-03-10 28160]
    "NvMediaCenter "= "c:\windows\system32\NvMcTray.dll" [2007-11-17 81920]
    "IntelZeroConfig "= "c:\program files\Intel\WiFi\bin\ZCfgSvc.exe" [2008-08-20 1368064]
    "IntelWireless "= "c:\program files\Fichiers communs\Intel\WirelessCommon\iFrmewrk.exe" [2008-08-20 1191936]
    "BluetoothAuthenticationAgent "= "bthprops.cpl" [2008-04-14 110592]
    "SigmatelSysTrayApp "= "c:\program files\SigmaTel\C-Major Audio\WDM\stsystra.exe" [2007-05-10 405504]
    "SonicWALLNetExtender "= "c:\program files\SonicWALL\SSL-VPN\NetExtender\NEGui.exe" [2010-03-15 1103744]
    "AdobeAAMUpdater-1.0 "= "c:\program files\Fichiers communs\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]
    "SwitchBoard "= "c:\program files\Fichiers communs\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
    "AdobeCS5ServiceManager "= "c:\program files\Fichiers communs\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-07-22 402432]
    "Zune Launcher "= "c:\program files\Zune\ZuneLauncher.exe" [2010-09-24 159472]
    "mcui_exe "= "c:\program files\McAfee.com\Agent\mcagent.exe" [2011-07-13 1312384]
    "Adobe ARM "= "c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
    .
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE "= "c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
    .
    c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
    Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2005-11-18 1724416]
    Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2007-1-5 438272]
    McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
    .
    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{56F9679E-7826-4C84-81F3-532071A8BCC5} "= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
    @=" "
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
    @=" "
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
    @= "Driver "
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
    @= "Service "
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
    "DisableMonitoring "=dword:00000001
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\Network Diagnostic\\xpnetdiag.exe "=
    "c:\\Program Files\\Adobe\\Adobe Version Cue CS2\\bin\\VersionCueCS2.exe "=
    "c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe "=
    "c:\\WINDOWS\\system32\\msiexec.exe "=
    "c:\\Program Files\\Hewlett-Packard\\hp deskjet 460 series\\Toolbox\\HPWRTBX.exe "=
    "c:\\Program Files\\Real\\RealPlayer\\realplay.exe "=
    "c:\\Program Files\\TrackMania United\\TmUnited.exe "=
    "c:\\Program Files\\eclipse\\eclipse.exe "=
    "c:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe "=
    "c:\\Program Files\\mIRC\\mirc.exe "=
    "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE "=
    "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE "=
    "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE "=
    "c:\\Program Files\\Mozilla Firefox\\firefox.exe "=
    "c:\\Program Files\\Java\\jre1.6.0_07\\bin\\javaw.exe "=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
    "c:\\Program Files\\Java\\jdk1.6.0_07\\jre\\bin\\java.exe "=
    "c:\\Program Files\\Messenger\\msmsgs.exe "=
    "c:\\WINDOWS\\system32\\sessmgr.exe "=
    "c:\\WINDOWS\\pchealth\\helpctr\\binaries\\helpctr.exe "=
    "c:\\Program Files\\Skype\\Phone\\Skype.exe "=
    "c:\\Program Files\\Fichiers communs\\McAfee\\McSvcHost\\McSvHost.exe "=
    "c:\\Program Files\\Free Music Zilla\\FMZilla.exe "=
    "c:\\Program Files\\TrackMania Nations ESWC\\TmNationsESWC.exe "=
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "7195:TCP "= 7195:TCP:*:Disabled:eMule (TCP)
    "9961:UDP "= 9961:UDP:*:Disabled:eMule (UDP)
    "3389:TCP "= 3389:TCP:Remote Desktop
    "65533:TCP "= 65533:TCP:*:Disabled:Services
    "52344:TCP "= 52344:TCP:*:Disabled:Services
    .
    R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [27.11.2006 21:49 691696]
    R1 mfetdi2k;McAfee Inc. mfetdi2k;c:\windows\system32\drivers\mfetdi2k.sys [11.01.2011 21:30 89368]
    R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [29.04.2009 19:37 210216]
    R2 McNaiAnn;McAfee VirusScan Announcer; "c:\program files\Fichiers communs\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc [11.01.2011 21:29 214904]
    R2 mfefire;McAfee Firewall Core Service;c:\program files\Fichiers communs\McAfee\SystemCore\mfefire.exe [11.01.2011 21:30 159832]
    R2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [11.01.2011 21:30 148520]
    R3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [11.01.2011 21:30 337912]
    R3 mfendiskmp;mfendiskmp;c:\windows\system32\drivers\mfendisk.sys [11.01.2011 21:30 83688]
    R3 NxDrv;SonicWALL NetExtender Adapter;c:\windows\system32\drivers\NxDrv.sys [21.10.2009 20:27 22600]
    S2 DellBIOS;DellBIOS;\??\c:\windows\DellBIOS.Sys --> c:\windows\DellBIOS.Sys [?]
    S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [13.11.2009 19:42 135664]
    S3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [11.01.2011 21:30 57432]
    S3 gupdatem;Service Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [13.11.2009 19:42 135664]
    S3 LocalTimeService;LocalTimeService;c:\documents and settings\XXX YYY\Mes documents\Visual Studio 2008\Projects\LocalTimeWCF\LocalTimeWindowsService\bin\Debug\LocalTimeWindowsService.exe [10.03.2010 20:50 6656]
    S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [15.01.2010 14:49 227232]
    S3 mfendisk;McAfee Core NDIS Intermediate Filter;c:\windows\system32\drivers\mfendisk.sys [11.01.2011 21:30 83688]
    S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [11.01.2011 21:30 85984]
    S3 PD100VID;Video Blaster WebCam 5 (WDM);c:\windows\system32\drivers\PD100Vid.sys [26.10.2006 21:54 374200]
    S3 SwitchBoard;SwitchBoard;c:\program files\Fichiers communs\Adobe\SwitchBoard\SwitchBoard.exe [19.02.2010 13:37 517096]
    S3 WMZuneComm;Zune Windows Mobile Connectivity Service;c:\program files\Zune\WMZuneComm.exe [24.09.2010 14:19 268528]
    S4 CalculatriceService;CalculatriceService;c:\documents and settings\XXX YYY\Mes documents\Visual Studio 2008\Projects\CalculatriceWCF\CalculatriceWindowsService\bin\Debug\CalculatriceWindowsService.exe [03.03.2010 21:17 6656]
    S4 CalculatriceWindowsService;CalculatriceWindowsService;c:\documents and settings\XXX YYY\Mes documents\Visual Studio 2008\Projects\CorrigeExCalculatrice\CalculatriceWindowsService\bin\Debug\CalculatriceWindowsService.exe [10.03.2010 15:55 6656]
    .
    --- Autres Services/Pilotes en mémoire ---
    .
    *Deregistered* - mfeavfk01
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
    .
    Contenu du dossier 'Tâches planifiées'
    .
    2011-09-09 c:\windows\Tasks\AdobeAAMUpdater-1.0-LATITUDED820-XXX YYY.job
    - c:\program files\Fichiers communs\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [2010-08-11 01:44]
    .
    2011-08-21 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2006-10-10 15:13]
    .
    2011-09-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2009-11-13 17:42]
    .
    2011-09-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2009-11-13 17:42]
    .
    2011-09-09 c:\windows\Tasks\User_Feed_Synchronization-{1121D7E9-8F0A-4CEF-9A8B-D47BD6EA589B}.job
    - c:\windows\system32\msfeedssync.exe [2006-10-17 02:31]
    .
    .
    ------- Examen supplémentaire -------
    .
    uStart Page = hxxp://www.google.ch/
    uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
    uInternet Connection Wizard,ShellNext = hxxp://www.google.ch/ig/dell?hl=fr&client=dell-row-rel&channel=ch&ibd=0061005
    uSearchAssistant = hxxp://www.google.com/ie
    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
    IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
    LSP: %SystemRoot%\system32\nutafun4.dll
    TCP: DhcpNameServer = 83.219.127.194 83.219.127.226
    Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
    FF - ProfilePath - c:\documents and settings\XXX YYY\Application Data\Mozilla\Firefox\Profiles\igot3ps1.default\
    FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
    FF - prefs.js: network.proxy.ftp - localhost
    FF - prefs.js: network.proxy.ftp_port - 8800
    FF - prefs.js: network.proxy.gopher - localhost
    FF - prefs.js: network.proxy.gopher_port - 8800
    FF - prefs.js: network.proxy.http - localhost
    FF - prefs.js: network.proxy.http_port - 8800
    FF - prefs.js: network.proxy.socks - localhost
    FF - prefs.js: network.proxy.socks_port - 8800
    FF - prefs.js: network.proxy.ssl - localhost
    FF - prefs.js: network.proxy.ssl_port - 8800
    FF - prefs.js: network.proxy.type - 0
    .
    .
    **************************************************************************
    .
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2011-09-10 21:46
    Windows 5.1.2600 Service Pack 3 NTFS
    .
    Recherche de processus cachés ...
    .
    Recherche d'éléments en démarrage automatique cachés ...
    .
    Recherche de fichiers cachés ...
    .
    Scan terminé avec succès
    Fichiers cachés: 0
    .
    **************************************************************************
    .
    --------------------- CLES DE REGISTRE BLOQUEES ---------------------
    .
    [HKEY_LOCAL_MACHINE\software\Intel\Wireless\Folders\0*& 2*]
    "Path "= "c:\\WINDOWS\\system32\\config\\systemprofile\\Application Data\\Intel\\Wireless\\ "
    .
    [HKEY_LOCAL_MACHINE\software\Intel\Wireless\Folders\À*& 2*]
    "Path "= "c:\\WINDOWS\\system32\\config\\systemprofile\\Application Data\\Intel\\Wireless\\ "
    .
    [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•9~*]
    "C040110900063D11C8EF10054038389C "= "C?\\WINDOWS\\system32\\FM20ENU.DLL "
    .
    --------------------- DLLs chargées dans les processus actifs ---------------------
    .
    - - - - - - - > 'winlogon.exe'(2028)
    c:\windows\system32\IWPDGINA.DLL
    c:\program files\Intel\WiFi\bin\LangResources\FRA\SsoGnFRA.dll
    .
    - - - - - - - > 'explorer.exe'(5264)
    c:\program files\McAfee\SiteAdvisor\saHook.dll
    c:\program files\Logitech\SetPoint\lgscroll.dll
    c:\program files\Windows Desktop Search\deskbar.dll
    c:\program files\Windows Desktop Search\fr-fr\dbres.dll.mui
    c:\program files\Windows Desktop Search\dbres.dll
    c:\program files\Windows Desktop Search\wordwheel.dll
    c:\program files\Windows Desktop Search\fr-fr\msnlExtRes.dll.mui
    c:\program files\Windows Desktop Search\msnlExtRes.dll
    c:\windows\system32\ieframe.dll
    c:\windows\system32\webcheck.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    c:\windows\system32\eappprxy.dll
    c:\windows\system32\netprovcredman.dll
    .
    ------------------------ Autres processus actifs ------------------------
    .
    c:\program files\Intel\WiFi\bin\S24EvMon.exe
    c:\program files\Intel\WiFi\bin\EvtEng.exe
    c:\program files\Java\jre6\bin\jqs.exe
    c:\program files\Dell\QuickSet\NICCONFIGSVC.exe
    c:\windows\system32\nvsvc32.exe
    c:\program files\Fichiers communs\Intel\WirelessCommon\RegSrvc.exe
    c:\program files\SonicWALL\SSL-VPN\NetExtender\NEService.exe
    c:\program files\Intel\WiFi\bin\WLKeeper.exe
    c:\windows\system32\SearchIndexer.exe
    c:\windows\system32\ZuneBusEnum.exe
    c:\program files\Fichiers communs\McAfee\SystemCore\mcshield.exe
    c:\program files\Windows Media Player\WMPNetwk.exe
    c:\windows\system32\wbem\wmiapsrv.exe
    c:\windows\system32\rundll32.exe
    c:\progra~1\mcafee.com\agent\mcagent.exe
    c:\windows\system32\RUNDLL32.EXE
    c:\program files\Apoint\HidFind.exe
    c:\program files\Apoint\Apntex.exe
    c:\windows\system32\rundll32.exe
    c:\windows\system32\wbem\unsecapp.exe
    c:\program files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
    c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
    c:\program files\Fichiers communs\Logitech\KHAL\KHALMNPR.EXE
    c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
    c:\program files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe
    c:\program files\Toshiba\Bluetooth Toshiba Stack\tosBtProc.exe
    c:\windows\system32\SearchProtocolHost.exe
    c:\windows\system32\SearchFilterHost.exe
    .
    **************************************************************************
    .
    Heure de fin: 2011-09-10 22:00:20 - La machine a redémarré
    ComboFix-quarantined-files.txt 2011-09-10 19:59
    ComboFix2.txt 2011-09-10 10:27
    .
    Avant-CF: 23'897'612'288 octets libres
    Après-CF: 23'719'030'784 octets libres
    .
    - - End Of File - - E838152C44019F5B8486B1096DE06E17
     
    MuadDib,
    #26
  8. 2011/09/10
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Good news :)

    Download OTL to your Desktop.

    • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
    • Click the Scan All Users checkbox.
    • Under the Custom Scan box paste this in:


    netsvcs
    drivers32
    %SYSTEMDRIVE%\*.*
    %systemroot%\Fonts\*.com
    %systemroot%\Fonts\*.dll
    %systemroot%\Fonts\*.ini
    %systemroot%\Fonts\*.ini2
    %systemroot%\Fonts\*.exe
    %systemroot%\system32\spool\prtprocs\w32x86\*.*
    %systemroot%\REPAIR\*.bak1
    %systemroot%\REPAIR\*.ini
    %systemroot%\system32\*.jpg
    %systemroot%\*.jpg
    %systemroot%\*.png
    %systemroot%\*.scr
    %systemroot%\*._sy
    %APPDATA%\Adobe\Update\*.*
    %ALLUSERSPROFILE%\Favorites\*.*
    %APPDATA%\Microsoft\*.*
    %PROGRAMFILES%\*.*
    %APPDATA%\Update\*.*
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT
    %systemroot%\System32\config\*.sav
    %PROGRAMFILES%\bak. /s
    %systemroot%\system32\bak. /s
    %ALLUSERSPROFILE%\Start Menu\*.lnk /x
    %systemroot%\system32\config\systemprofile\*.dat /x
    %systemroot%\*.config
    %systemroot%\system32\*.db
    %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
    %USERPROFILE%\Desktop\*.exe
    %PROGRAMFILES%\Common Files\*.*
    %systemroot%\*.src
    %systemroot%\install\*.*
    %systemroot%\system32\DLL\*.*
    %systemroot%\system32\HelpFiles\*.*
    %systemroot%\system32\rundll\*.*
    %systemroot%\winn32\*.*
    %systemroot%\Java\*.*
    %systemroot%\system32\test\*.*
    %systemroot%\system32\Rundll32\*.*
    %systemroot%\AppPatch\Custom\*.*
    %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
    %PROGRAMFILES%\PC-Doctor\Downloads\*.*
    %PROGRAMFILES%\Internet Explorer\*.tmp
    %PROGRAMFILES%\Internet Explorer\*.dat
    %USERPROFILE%\My Documents\*.exe
    %USERPROFILE%\*.exe
    %systemroot%\ADDINS\*.*
    %systemroot%\assembly\*.bak2
    %systemroot%\Config\*.*
    %systemroot%\REPAIR\*.bak2
    %systemroot%\SECURITY\Database\*.sdb /x
    %systemroot%\SYSTEM\*.bak2
    %systemroot%\Web\*.bak2
    %systemroot%\Driver Cache\*.*
    %PROGRAMFILES%\Mozilla Firefox\0*.exe
    %ProgramFiles%\Microsoft Common\*.*
    %ProgramFiles%\TinyProxy.
    %USERPROFILE%\Favorites\*.url /x
    %systemroot%\system32\*.bk
    %systemroot%\*.te
    %systemroot%\system32\system32\*.*
    %ALLUSERSPROFILE%\*.dat /x
    %systemroot%\system32\drivers\*.rmv
    dir /b "%systemroot%\system32\*.exe" | find /i " " /c
    dir /b "%systemroot%\*.exe" | find /i " " /c
    %PROGRAMFILES%\Microsoft\*.*
    %systemroot%\System32\Wbem\proquota.exe
    %PROGRAMFILES%\Mozilla Firefox\*.dat
    %USERPROFILE%\Cookies\*.txt /x
    %SystemRoot%\system32\fonts\*.*
    %systemroot%\system32\winlog\*.*
    %systemroot%\system32\Language\*.*
    %systemroot%\system32\Settings\*.*
    %systemroot%\system32\*.quo
    %SYSTEMROOT%\AppPatch\*.exe
    %SYSTEMROOT%\inf\*.exe
    %SYSTEMROOT%\Installer\*.exe
    %systemroot%\system32\config\*.bak2
    %systemroot%\system32\Computers\*.*
    %SystemRoot%\system32\Sound\*.*
    %SystemRoot%\system32\SpecialImg\*.*
    %SystemRoot%\system32\code\*.*
    %SystemRoot%\system32\draft\*.*
    %SystemRoot%\system32\MSSSys\*.*
    %ProgramFiles%\Javascript\*.*
    %systemroot%\pchealth\helpctr\System\*.exe /s
    %systemroot%\Web\*.exe
    %systemroot%\system32\msn\*.*
    %systemroot%\system32\*.tro
    %AppData%\Microsoft\Installer\msupdates\*.*
    %ProgramFiles%\Messenger\*.*
    %systemroot%\system32\systhem32\*.*
    %systemroot%\system\*.exe
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
    /md5start
    /md5stop


    • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
    • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.
     
    broni,
    #27
  9. 2011/09/11
    MuadDib

    MuadDib Inactive Thread Starter

    Joined:
    2011/09/07
    Messages:
    29
    Likes Received:
    0
    Here's the 1st log file (OTL.txt - part 1/2):
    OTL logfile created on: 11.09.2011 11:29:01 - Run 1
    OTL by OldTimer - Version 3.2.27.0 Folder = C:\Download\WindowsBBS\OldTimer
    Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
    Internet Explorer (Version = 8.0.6001.18702)
    Locale: 0000100C | Country: Suisse | Language: FRS | Date Format: dd.MM.yyyy

    3.25 Gb Total Physical Memory | 2.47 Gb Available Physical Memory | 76.06% Memory free
    4.59 Gb Paging File | 3.77 Gb Available in Paging File | 82.23% Paging File free
    Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
    Drive C: | 93.06 Gb Total Space | 22.11 Gb Free Space | 23.76% Space Free | Partition Type: NTFS

    Computer Name: LATITUDED820 | User Name: XXX YYY | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: All users | Quick Scan
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Processes (SafeList) ==========

    PRC - [2011.09.11 11:25:35 | 000,581,120 | ---- | M] (OldTimer Tools) -- C:\Download\WindowsBBS\OldTimer\OTL.exe
    PRC - [2011.07.13 09:58:00 | 001,312,384 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee.com\Agent\mcagent.exe
    PRC - [2011.06.30 14:04:38 | 000,399,320 | ---- | M] (TomTom) -- C:\Program Files\MyTomTom 3\MyTomTomSA.exe
    PRC - [2011.03.13 11:45:14 | 000,148,520 | ---- | M] (McAfee, Inc.) -- C:\WINDOWS\system32\mfevtps.exe
    PRC - [2011.03.13 11:41:50 | 000,159,832 | ---- | M] (McAfee, Inc.) -- C:\Program Files\Fichiers communs\McAfee\SystemCore\mfefire.exe
    PRC - [2011.03.13 11:41:36 | 000,165,000 | ---- | M] (McAfee, Inc.) -- C:\Program Files\Fichiers communs\McAfee\SystemCore\mcshield.exe
    PRC - [2011.02.07 16:42:10 | 000,477,560 | ---- | M] (McAfee, Inc.) -- C:\Program Files\Fichiers communs\McAfee\MSC\McUICnt.exe
    PRC - [2011.01.27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) -- C:\Program Files\Fichiers communs\McAfee\McSvcHost\McSvHost.exe
    PRC - [2010.12.14 07:31:12 | 000,184,552 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\MSM\McSmtFwk.exe
    PRC - [2010.09.24 14:19:08 | 000,159,472 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Zune\ZuneLauncher.exe
    PRC - [2010.09.24 14:19:08 | 000,057,072 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\ZuneBusEnum.exe
    PRC - [2010.03.16 01:26:30 | 000,313,216 | ---- | M] (SonicWALL Inc.) -- C:\Program Files\SonicWALL\SSL-VPN\NetExtender\NEService.exe
    PRC - [2010.03.16 01:26:28 | 001,103,744 | ---- | M] (SonicWALL Inc.) -- C:\Program Files\SonicWALL\SSL-VPN\NetExtender\NEGui.exe
    PRC - [2010.01.15 14:49:20 | 000,255,536 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
    PRC - [2009.02.11 11:06:36 | 000,210,216 | ---- | M] () -- C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
    PRC - [2008.08.20 17:38:30 | 000,860,160 | ---- | M] (Intel(R) Corporation) -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe
    PRC - [2008.08.20 17:28:34 | 000,348,160 | ---- | M] (Intel(R) Corporation) -- C:\Program Files\Intel\WiFi\bin\WLKEEPER.exe
    PRC - [2008.08.20 17:27:36 | 001,368,064 | ---- | M] (Intel(R) Corporation) -- C:\Program Files\Intel\WiFi\bin\ZCfgSvc.exe
    PRC - [2008.08.20 17:18:34 | 000,905,216 | ---- | M] (Intel(R) Corporation) -- C:\Program Files\Intel\WiFi\bin\S24EvMon.exe
    PRC - [2008.08.20 17:09:12 | 001,191,936 | ---- | M] (Intel(R) Corporation) -- C:\Program Files\Fichiers communs\Intel\WirelessCommon\iFrmewrk.exe
    PRC - [2008.08.20 17:08:02 | 000,466,944 | ---- | M] (Intel(R) Corporation) -- C:\Program Files\Fichiers communs\Intel\WirelessCommon\RegSrvc.exe
    PRC - [2008.04.14 04:34:03 | 001,037,824 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
    PRC - [2007.07.20 17:55:46 | 001,228,800 | ---- | M] (Dell Inc.) -- C:\Program Files\Dell\QuickSet\quickset.exe
    PRC - [2007.07.20 17:53:52 | 000,475,136 | ---- | M] (Dell Inc.) -- C:\Program Files\Dell\QuickSet\NicConfigSvc.exe
    PRC - [2007.05.10 11:22:32 | 000,405,504 | ---- | M] (SigmaTel, Inc.) -- C:\Program Files\Sigmatel\C-Major Audio\WDM\stsystra.exe
    PRC - [2006.02.07 00:00:20 | 000,311,296 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosOBEX.exe
    PRC - [2005.12.05 00:50:00 | 002,134,016 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtProc.exe
    PRC - [2005.12.03 03:23:08 | 000,217,088 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHSP.exe
    PRC - [2005.11.18 18:46:00 | 001,724,416 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
    PRC - [2005.10.07 20:13:38 | 000,176,128 | R--- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\Apoint\Apoint.exe
    PRC - [2005.08.17 10:59:34 | 000,290,816 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
    PRC - [2005.08.16 23:11:28 | 000,065,536 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
    PRC - [2005.07.27 22:41:08 | 000,045,056 | R--- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\Apoint\ApntEx.exe
    PRC - [2005.03.31 18:11:38 | 000,438,272 | ---- | M] (Logitech Inc.) -- C:\Program Files\Logitech\SetPoint\SetPoint.exe
    PRC - [2005.03.10 14:01:10 | 000,028,160 | ---- | M] (Logitech Inc.) -- C:\Program Files\Fichiers communs\Logitech\KHAL\KHALMNPR.EXE
    PRC - [2004.06.29 05:56:12 | 000,045,056 | R--- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\Apoint\hidfind.exe


    ========== Modules (No Company Name) ==========

    MOD - [2011.06.30 14:04:42 | 000,183,256 | ---- | M] () -- C:\Program Files\MyTomTom 3\TomTomSupporterProxy.dll
    MOD - [2011.06.30 14:04:40 | 000,060,888 | ---- | M] () -- C:\Program Files\MyTomTom 3\TomTomSupporterBase.dll
    MOD - [2011.06.30 14:04:32 | 000,039,424 | ---- | M] () -- C:\Program Files\MyTomTom 3\TomTomPackage.dll
    MOD - [2011.06.30 14:04:30 | 007,964,160 | ---- | M] () -- C:\Program Files\MyTomTom 3\QtGui4.dll
    MOD - [2011.06.30 14:04:30 | 002,648,064 | ---- | M] () -- C:\Program Files\MyTomTom 3\QtXmlPatterns4.dll
    MOD - [2011.06.30 14:04:30 | 002,302,464 | ---- | M] () -- C:\Program Files\MyTomTom 3\QtCore4.dll
    MOD - [2011.06.30 14:04:30 | 000,980,480 | ---- | M] () -- C:\Program Files\MyTomTom 3\QtNetwork4.dll
    MOD - [2011.06.30 14:04:30 | 000,357,888 | ---- | M] () -- C:\Program Files\MyTomTom 3\QtXml4.dll
    MOD - [2011.06.06 12:55:32 | 000,301,056 | ---- | M] () -- C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.FRA
    MOD - [2009.02.13 12:45:02 | 000,664,080 | ---- | M] () -- C:\Program Files\McAfee\SiteAdvisor\sacore.dll
    MOD - [2009.02.13 12:45:02 | 000,311,312 | ---- | M] () -- C:\Program Files\McAfee\SiteAdvisor\saset.dll
    MOD - [2009.02.13 12:44:56 | 000,071,696 | ---- | M] () -- c:\Program Files\McAfee\SiteAdvisor\mcfrmwk.dll
    MOD - [2009.02.13 12:44:52 | 000,207,376 | ---- | M] () -- c:\Program Files\McAfee\SiteAdvisor\cntscan.dll
    MOD - [2009.02.13 12:44:52 | 000,117,264 | ---- | M] () -- c:\Program Files\McAfee\SiteAdvisor\apengine.dll
    MOD - [2009.02.11 11:06:42 | 000,365,216 | ---- | M] () -- c:\Program Files\McAfee\SiteAdvisor\saupkeep.dll
    MOD - [2009.02.11 11:06:38 | 000,014,032 | ---- | M] () -- C:\Program Files\McAfee\SiteAdvisor\sahook.dll
    MOD - [2009.02.11 11:06:36 | 000,210,216 | ---- | M] () -- C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
    MOD - [2009.02.11 11:06:36 | 000,056,752 | ---- | M] () -- c:\Program Files\McAfee\SiteAdvisor\McSACorePS.dll
    MOD - [2008.08.20 17:10:50 | 000,200,704 | ---- | M] () -- C:\Program Files\Intel\WiFi\bin\iWMSProv.dll
    MOD - [2007.07.20 17:56:14 | 000,098,304 | ---- | M] () -- C:\Program Files\Dell\QuickSet\dadkeyb.dll
    MOD - [2005.09.15 20:38:18 | 000,065,536 | ---- | M] () -- C:\WINDOWS\system32\epdfmon.dll
    MOD - [2005.07.22 22:30:20 | 000,065,536 | ---- | M] () -- C:\WINDOWS\system32\TosCommAPI.dll
    MOD - [2004.10.14 11:18:24 | 000,040,960 | ---- | M] () -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtAfh.dll
    MOD - [2004.10.01 15:13:24 | 000,045,056 | ---- | M] () -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtLoad.dll
    MOD - [2004.07.20 18:04:02 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\TosBtHcrpAPI.dll


    ========== Win32 Services (SafeList) ==========

    SRV - [2011.06.23 15:22:58 | 000,361,712 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfee\VirusScan\mcods.exe -- (McODS)
    SRV - [2011.03.13 11:45:14 | 000,148,520 | ---- | M] (McAfee, Inc.) [Unknown | Running] -- C:\WINDOWS\system32\mfevtps.exe -- (mfevtp)
    SRV - [2011.03.13 11:41:50 | 000,159,832 | ---- | M] () [Unknown | Running] -- C:\Program Files\Fichiers communs\McAfee\SystemCore\\mfefire.exe -- (mfefire)
    SRV - [2011.03.13 11:41:36 | 000,165,000 | ---- | M] () [Unknown | Running] -- C:\Program Files\Fichiers communs\McAfee\SystemCore\\mcshield.exe -- (McShield)
    SRV - [2011.01.27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Fichiers communs\McAfee\McSvcHost\McSvHost.exe -- (McProxy)
    SRV - [2011.01.27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Fichiers communs\McAfee\McSvcHost\McSvHost.exe -- (McNASvc)
    SRV - [2011.01.27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Fichiers communs\McAfee\McSvcHost\McSvHost.exe -- (McNaiAnn)
    SRV - [2011.01.27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Fichiers communs\McAfee\McSvcHost\McSvHost.exe -- (mcmscsvc)
    SRV - [2010.09.24 14:19:16 | 000,444,656 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\system32\ZuneWlanCfgSvc.exe -- (ZuneWlanCfgSvc)
    SRV - [2010.09.24 14:19:16 | 000,268,528 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- c:\Program Files\Zune\WMZuneComm.exe -- (WMZuneComm)
    SRV - [2010.09.24 14:19:08 | 006,351,600 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- c:\Program Files\Zune\ZuneNss.exe -- (ZuneNetworkSvc)
    SRV - [2010.09.24 14:19:08 | 000,057,072 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\ZuneBusEnum.exe -- (ZuneBusEnum)
    SRV - [2010.03.16 01:26:30 | 000,313,216 | ---- | M] (SonicWALL Inc.) [Auto | Running] -- C:\Program Files\SonicWALL\SSL-VPN\NetExtender\NEService.exe -- (SONICWALL_NetExtender)
    SRV - [2010.03.10 22:27:10 | 000,006,656 | ---- | M] () [On_Demand | Stopped] -- C:\Documents and Settings\XXX YYY\Mes documents\Visual Studio 2008\Projects\LocalTimeWCF\LocalTimeWindowsService\bin\Debug\LocalTimeWindowsService.exe -- (LocalTimeService)
    SRV - [2010.03.10 20:21:01 | 000,006,656 | ---- | M] () [Disabled | Stopped] -- C:\Documents and Settings\XXX YYY\Mes documents\Visual Studio 2008\Projects\CalculatriceWCF\CalculatriceWindowsService\bin\Debug\CalculatriceWindowsService.exe -- (CalculatriceService)
    SRV - [2010.03.10 20:05:00 | 000,006,656 | ---- | M] () [Disabled | Stopped] -- C:\Documents and Settings\XXX YYY\Mes documents\Visual Studio 2008\Projects\CorrigeExCalculatrice\CalculatriceWindowsService\bin\Debug\CalculatriceWindowsService.exe -- (CalculatriceWindowsService)
    SRV - [2010.02.19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files\Fichiers communs\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
    SRV - [2010.01.15 14:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService)
    SRV - [2009.02.11 11:06:36 | 000,210,216 | ---- | M] () [Auto | Running] -- C:\Program Files\McAfee\SiteAdvisor\McSACore.exe -- (McAfee SiteAdvisor Service)
    SRV - [2008.11.04 01:06:28 | 000,441,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv)
    SRV - [2008.08.20 17:38:30 | 000,860,160 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe -- (EvtEng)
    SRV - [2008.08.20 17:28:34 | 000,348,160 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Intel\WiFi\bin\WLKEEPER.exe -- (WLANKEEPER) Intel(R)
    SRV - [2008.08.20 17:18:34 | 000,905,216 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Intel\WiFi\bin\S24EvMon.exe -- (S24EventMonitor)
    SRV - [2008.08.20 17:08:02 | 000,466,944 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Fichiers communs\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc)
    SRV - [2008.04.14 04:34:07 | 000,015,872 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\inetsrv\inetinfo.exe -- (W3SVC)
    SRV - [2008.04.14 04:34:07 | 000,015,872 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\inetsrv\inetinfo.exe -- (SMTPSVC) Simple Mail Transfer Protocol (SMTP)
    SRV - [2008.04.14 04:34:07 | 000,015,872 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\inetsrv\inetinfo.exe -- (IISADMIN)
    SRV - [2007.07.20 17:53:52 | 000,475,136 | ---- | M] (Dell Inc.) [Auto | Running] -- C:\Program Files\Dell\QuickSet\NicConfigSvc.exe -- (NICCONFIGSVC)
    SRV - [2007.02.19 20:32:26 | 000,072,704 | ---- | M] (Adobe Systems) [On_Demand | Stopped] -- C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe -- (Adobe LM Service)
    SRV - [2006.10.26 14:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
    SRV - [2006.06.12 11:01:14 | 000,180,224 | ---- | M] () [Auto | Stopped] -- C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe -- (tcsd_win32.exe)
    SRV - [2006.03.23 18:48:44 | 000,073,728 | ---- | M] (Hewlett-Packard Company) [On_Demand | Stopped] -- C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe -- (LightScribeService)
    SRV - [2005.08.30 18:36:00 | 000,188,416 | ---- | M] (Cambridge Silicon Radio) [Disabled | Stopped] -- C:\Program Files\BlueTooth\HidSwitchService\HidSw.exe -- (Bluetooth Hid Switch Service)
    SRV - [2005.04.06 17:53:02 | 000,163,840 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe -- (Adobe Version Cue CS2)


    ========== Driver Services (SafeList) ==========

    DRV - [2011.03.13 11:20:10 | 000,459,728 | ---- | M] (McAfee, Inc.) [Kernel | Unknown | Running] -- C:\WINDOWS\system32\drivers\mfehidk.sys -- (mfehidk)
    DRV - [2011.03.13 11:20:10 | 000,337,912 | ---- | M] (McAfee, Inc.) [Kernel | Unknown | Running] -- C:\WINDOWS\system32\drivers\mfefirek.sys -- (mfefirek)
    DRV - [2011.03.13 11:20:10 | 000,179,248 | ---- | M] (McAfee, Inc.) [Kernel | Unknown | Running] -- C:\WINDOWS\system32\drivers\mfeavfk.sys -- (mfeavfk)
    DRV - [2011.03.13 11:20:10 | 000,118,784 | ---- | M] (McAfee, Inc.) [Kernel | Unknown | Running] -- C:\WINDOWS\system32\drivers\mfeapfk.sys -- (mfeapfk)
    DRV - [2011.03.13 11:20:10 | 000,089,368 | ---- | M] (McAfee, Inc.) [Kernel | Unknown | Running] -- C:\WINDOWS\system32\drivers\mfetdi2k.sys -- (mfetdi2k)
    DRV - [2011.03.13 11:20:10 | 000,085,984 | ---- | M] (McAfee, Inc.) [Kernel | Unknown | Stopped] -- C:\WINDOWS\system32\drivers\mferkdet.sys -- (mferkdet)
    DRV - [2011.03.13 11:20:10 | 000,083,688 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mfendisk.sys -- (mfendiskmp)
    DRV - [2011.03.13 11:20:10 | 000,083,688 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mfendisk.sys -- (mfendisk)
    DRV - [2011.03.13 11:20:10 | 000,059,288 | ---- | M] (McAfee, Inc.) [Kernel | Unknown | Running] -- C:\WINDOWS\system32\drivers\mfebopk.sys -- (mfebopk)
    DRV - [2011.03.13 11:20:10 | 000,057,432 | ---- | M] (McAfee, Inc.) [Kernel | Unknown | Stopped] -- C:\WINDOWS\system32\drivers\cfwids.sys -- (cfwids)
    DRV - [2010.07.15 15:18:22 | 000,120,136 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\Mpfp.sys -- (MPFP)
    DRV - [2010.02.17 17:19:26 | 000,691,696 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd)
    DRV - [2009.10.21 20:27:36 | 000,022,600 | ---- | M] (SonicWALL Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NxDrv.sys -- (NxDrv)
    DRV - [2008.08.29 00:34:30 | 003,632,384 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NETw5x32.sys -- (NETw5x32) Intel(R)
    DRV - [2008.08.26 10:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\pccsmcfd.sys -- (pccsmcfd)
    DRV - [2008.08.04 12:32:26 | 000,011,904 | ---- | M] (Intel Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\s24trans.sys -- (s24trans)
    DRV - [2008.04.13 20:53:09 | 000,040,320 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmnt.sys -- (nm)
    DRV - [2007.09.26 07:01:32 | 002,236,032 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\NETw4x32.sys -- (NETw4x32) Pilote de carte Intel(R)
    DRV - [2007.05.10 11:24:34 | 001,222,840 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\sthda.sys -- (STHDA)
    DRV - [2007.01.16 11:22:00 | 000,031,744 | ---- | M] (CSR, plc) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\csrbcxp.sys -- (CSRBC)
    DRV - [2006.11.02 08:00:08 | 000,039,368 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\winusb.sys -- (WinUSB)
    DRV - [2006.06.14 11:53:00 | 000,029,184 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\usbccid.sys -- (USBCCID)
    DRV - [2006.06.13 13:29:28 | 000,047,488 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\tosporte.sys -- (tosporte)
    DRV - [2006.06.13 12:22:58 | 000,111,232 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\TosRfbd.sys -- (Tosrfbd)
    DRV - [2006.06.09 22:40:00 | 000,040,192 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\tosrfusb.sys -- (Tosrfusb)
    DRV - [2006.05.29 14:11:20 | 000,060,672 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\TosRfhid.sys -- (Tosrfhid)
    DRV - [2006.03.26 14:22:14 | 000,051,200 | ---- | M] (Protection Technology (StarForce)) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\sfdrv01.sys -- (sfdrv01) StarForce Protection Environment Driver (version 1.x)
    DRV - [2006.03.24 18:27:01 | 000,050,176 | ---- | M] (Protection Technology (StarForce)) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\sfsync04.sys -- (sfsync04) StarForce Protection Synchronization Driver (version 4.x)
    DRV - [2006.03.16 11:45:12 | 000,037,632 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\tosrfbnp.sys -- (Tosrfbnp)
    DRV - [2006.03.15 11:52:40 | 000,052,864 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\TosRfSnd.sys -- (TosRfSnd) Bluetooth Audio Device (WDM)
    DRV - [2006.03.13 11:38:23 | 000,006,656 | ---- | M] (Protection Technology (StarForce)) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\sfhlp02.sys -- (sfhlp02) StarForce Protection Helper Driver (version 2.x)
    DRV - [2005.12.05 07:55:30 | 001,428,096 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\w39n51.sys -- (w39n51) Intel(R)
    DRV - [2005.11.10 17:25:14 | 000,142,720 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\b57xp32.sys -- (b57w2k)
    DRV - [2005.11.03 16:40:07 | 000,063,488 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\sfvfs02.sys -- (sfvfs02) StarForce Protection VFS Driver (version 2.x)
    DRV - [2005.09.29 02:57:18 | 000,113,847 | R--- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Apfiltr.sys -- (ApfiltrService)
    DRV - [2005.08.12 18:50:46 | 000,016,128 | ---- | M] (Dell Inc) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\APPDRV.SYS -- (APPDRV)
    DRV - [2005.08.01 22:45:08 | 000,064,896 | ---- | M] (TOSHIBA Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\tosrfcom.sys -- (Tosrfcom)
    DRV - [2005.07.12 00:58:56 | 000,003,712 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\toshidpt.sys -- (toshidpt)
    DRV - [2005.03.10 14:09:02 | 000,024,704 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LHidKE.Sys -- (LHidKe)
    DRV - [2005.03.10 14:08:56 | 000,069,504 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LMouKE.Sys -- (LMouKE)
    DRV - [2005.03.10 14:08:34 | 000,036,480 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LHidUsbK.sys -- (LHidUsbK)
    DRV - [2005.01.06 20:42:42 | 000,018,612 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\tosrfnds.sys -- (tosrfnds)
    DRV - [2003.12.22 03:28:10 | 000,025,244 | ---- | M] (Adaptec) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\ASPI32.SYS -- (ASPI32)
    DRV - [2002.06.04 14:51:18 | 000,374,200 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\PD100Vid.sys -- (PD100VID) Video Blaster WebCam 5 (WDM)
    DRV - [2001.10.16 14:21:56 | 000,013,780 | ---- | M] (Padus, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\pfc.sys -- (pfc)
    DRV - [2001.08.17 21:53:42 | 000,004,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\loop.sys -- (msloop)


    ========== Standard Registry (SafeList) ==========


    ========== Internet Explorer ==========

    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.ch/ig/dell?hl=fr&client=dell-row-rel&channel=ch&ibd=0061005
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = www.google.ch/ig/dell?hl=fr&client=dell-row-rel&channel=ch&ibd=0061005


    IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.ch/ig/dell?hl=fr&client=dell-row-rel&channel=ch&ibd=0061005
    IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
    IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = proxy.heig-vd.ch:8080

    IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.ch/ig/dell?hl=fr&client=dell-row-rel&channel=ch&ibd=0061005
    IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
    IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = proxy.heig-vd.ch:8080



    IE - HKU\S-1-5-21-128965477-3582981272-972063890-1005\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
    IE - HKU\S-1-5-21-128965477-3582981272-972063890-1005\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
    IE - HKU\S-1-5-21-128965477-3582981272-972063890-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ch/
    IE - HKU\S-1-5-21-128965477-3582981272-972063890-1005\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
    IE - HKU\S-1-5-21-128965477-3582981272-972063890-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    ========== FireFox ==========


    FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
    FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: File not found
    FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
    FF - HKLM\Software\MozillaPlugins\@mcafee.com/MSC,version=10: c:\progra~1\mcafee\msc\npmcsn~1.dll ()
    FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.11.2571: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
    FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.2.2629: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
    FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.1739: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
    FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
    FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
    FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
    FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.4: C:\Program Files\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)
    FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
    FF - HKCU\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()

    FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor [2011.08.22 21:09:22 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.09.07 17:49:18 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.08.21 09:17:10 | 000,000,000 | ---D | M]

    [2008.10.15 19:35:39 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\XXX YYY\Application Data\Mozilla\Extensions
    [2011.09.08 21:26:17 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\XXX YYY\Application Data\Mozilla\Firefox\Profiles\igot3ps1.default\extensions
    [2010.05.08 08:22:23 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\XXX YYY\Application Data\Mozilla\Firefox\Profiles\igot3ps1.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
    [2011.08.22 21:11:13 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Documents and Settings\XXX YYY\Application Data\Mozilla\Firefox\Profiles\igot3ps1.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
    [2011.08.12 10:09:10 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Documents and Settings\XXX YYY\Application Data\Mozilla\Firefox\Profiles\igot3ps1.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
    [2011.09.08 21:26:17 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Documents and Settings\XXX YYY\Application Data\Mozilla\Firefox\Profiles\igot3ps1.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
    [2010.04.08 14:31:21 | 000,000,000 | ---D | M] (NetExtender Launcher) -- C:\Documents and Settings\XXX YYY\Application Data\Mozilla\Firefox\Profiles\igot3ps1.default\extensions\npNELaunch@sonicwall.com
    [2011.09.07 17:49:35 | 000,000,000 | ---D | M] (Zotero) -- C:\Documents and Settings\XXX YYY\Application Data\Mozilla\Firefox\Profiles\igot3ps1.default\extensions\zotero@chnm.gmu.edu
    [2011.08.21 09:17:14 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
    [2011.08.20 22:41:09 | 000,000,000 | ---D | M] (Click to call with Skype) -- C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
    [2010.07.11 10:08:32 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
    [2011.09.07 17:49:17 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
    [2011.04.14 14:01:38 | 000,024,376 | ---- | M] (McAfee, Inc.) -- C:\Program Files\mozilla firefox\components\Scriptff.dll
    [2008.08.16 17:42:02 | 000,070,456 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files\mozilla firefox\plugins\CgpCore.dll
    [2008.08.16 17:42:12 | 000,091,448 | ---- | M] () -- C:\Program Files\mozilla firefox\plugins\confmgr.dll
    [2008.08.16 17:42:08 | 000,020,800 | ---- | M] () -- C:\Program Files\mozilla firefox\plugins\ctxlogging.dll
    [2008.05.21 08:41:08 | 000,479,232 | ---- | M] (Microsoft Corporation) -- C:\Program Files\mozilla firefox\plugins\msvcm80.dll
    [2008.05.21 08:41:08 | 000,548,864 | ---- | M] (Microsoft Corporation) -- C:\Program Files\mozilla firefox\plugins\msvcp80.dll
    [2008.05.21 08:41:08 | 000,626,688 | ---- | M] (Microsoft Corporation) -- C:\Program Files\mozilla firefox\plugins\msvcr80.dll
    [2010.04.12 17:29:19 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
    [2008.08.16 17:44:46 | 000,427,312 | ---- | M] () -- C:\Program Files\mozilla firefox\plugins\npicaN.dll
    [2008.08.16 17:42:04 | 000,023,864 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files\mozilla firefox\plugins\TcpPServ.dll
    [2011.08.12 06:52:47 | 000,001,516 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazon-france.xml
    [2011.08.12 06:14:12 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
    [2011.08.12 06:52:48 | 000,001,822 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\cnrtl-tlfi-fr.xml
    [2011.08.12 06:52:48 | 000,001,154 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-france.xml
    [2011.08.12 06:52:48 | 000,001,426 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-fr.xml
    [2011.08.12 06:52:48 | 000,000,956 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-france.xml

    O1 HOSTS File: ([2011.09.10 21:45:51 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
    O1 - Hosts: 127.0.0.1 localhost
    O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
    O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
    O2 - BHO: (del.icio.us Toolbar Helper) - {7AA07AE6-01EF-44EC-93CA-9D7CD41CCDB6} - C:\Program Files\del.icio.us\Internet Explorer Buttons\dlcsIE.dll (del.icio.us, a Yahoo! Company)
    O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Fichiers communs\McAfee\SystemCore\ScriptSn.20110824074234.dll (McAfee, Inc.)
    O2 - BHO: (Programme d'aide de l'Assistant de connexion Windows Live) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
    O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Program Files\Google\GoogleToolbar4.dll (Google Inc.)
    O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
    O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll ()
    O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll ()
    O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar4.dll (Google Inc.)
    O3 - HKLM\..\Toolbar: (del.icio.us) - {981FE6A8-260C-4930-960F-C3BC82746CB0} - C:\Program Files\del.icio.us\Internet Explorer Buttons\dlcsIE.dll (del.icio.us, a Yahoo! Company)
    O3 - HKU\S-1-5-21-128965477-3582981272-972063890-1005\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar4.dll (Google Inc.)
    O3 - HKU\S-1-5-21-128965477-3582981272-972063890-1005\..\Toolbar\WebBrowser: (del.icio.us) - {981FE6A8-260C-4930-960F-C3BC82746CB0} - C:\Program Files\del.icio.us\Internet Explorer Buttons\dlcsIE.dll (del.icio.us, a Yahoo! Company)
    O4 - HKLM..\Run: [Adobe ARM] C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
    O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Fichiers communs\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
    O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files\Fichiers communs\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
    O4 - HKLM..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd.)
    O4 - HKLM..\Run: [BluetoothAuthenticationAgent] C:\WINDOWS\System32\bthprops.cpl (Microsoft Corporation)
    O4 - HKLM..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe (Dell Inc.)
    O4 - HKLM..\Run: [IntelWireless] C:\Program Files\Fichiers communs\Intel\WirelessCommon\iFrmewrk.exe (Intel(R) Corporation)
    O4 - HKLM..\Run: [IntelZeroConfig] C:\Program Files\Intel\WiFi\bin\ZCfgSvc.exe (Intel(R) Corporation)
    O4 - HKLM..\Run: [Logitech Hardware Abstraction Layer] C:\WINDOWS\KHALMNPR.Exe (Logitech Inc.)
    O4 - HKLM..\Run: [mcui_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
    O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
    O4 - HKLM..\Run: [NVHotkey] C:\WINDOWS\System32\nvhotkey.dll (NVIDIA Corporation)
    O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
    O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
    O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\Program Files\Sigmatel\C-Major Audio\WDM\stsystra.exe (SigmaTel, Inc.)
    O4 - HKLM..\Run: [SonicWALLNetExtender] C:\Program Files\SonicWALL\SSL-VPN\NetExtender\NEGui.exe (SonicWALL Inc.)
    O4 - HKLM..\Run: [SwitchBoard] C:\Program Files\Fichiers communs\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
    O4 - HKLM..\Run: [Zune Launcher] c:\Program Files\Zune\ZuneLauncher.exe (Microsoft Corporation)
    O4 - HKU\S-1-5-21-128965477-3582981272-972063890-1005..\Run: [MyTomTomSA.exe] C:\Program Files\MyTomTom 3\MyTomTomSA.exe (TomTom)
    O4 - Startup: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Bluetooth Manager.lnk = C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe (TOSHIBA CORPORATION.)
    O4 - Startup: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe (Logitech Inc.)
    O4 - Startup: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
    O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
    O7 - HKU\S-1-5-21-128965477-3582981272-972063890-1005\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-21-128965477-3582981272-972063890-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O7 - HKU\S-1-5-21-128965477-3582981272-972063890-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O7 - HKU\S-1-5-21-128965477-3582981272-972063890-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O9 - Extra Button: Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
    O9 - Extra 'Tools' menuitem : Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
    O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
    O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - File not found
    O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - File not found
    O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} http://support.euro.dell.com/systemprofiler/SysPro.CAB (SysProWmi Class)
    O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} Reg Error: Key error. (Windows Genuine Advantage Validation Tool)
    O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
    O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} http://office.microsoft.com/officeupdate/content/opuc3.cab (Office Update Installation Engine)
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
    O16 - DPF: {A73BAEFA-EE65-494D-BEDB-DD3E5A34FA98} http://www.extrafilm.ch/ImageUploader4.cab (Image Uploader)
    O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} https://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx (Get_ActiveX Control)
    O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
    O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} http://asp06.photoprintit.de/microsite/1443/defaults/activex/IPSUploader.cab (IPSUploader Control)
    O16 - DPF: {EDFCB7CB-942C-4822-AF14-F0B687409848} http://www.photoservice.com/telechargement/ImageUploader4.cab (Image Uploader Control)
    O16 - DPF: Microsoft XML Parser for Java file:///C:/WINDOWS/Java/classes/xmldso.cab (Reg Error: Key error.)
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 83.219.127.194 83.219.127.226
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D02B1F5C-1746-4517-89BB-56EFC60BB715}: DhcpNameServer = 83.219.127.194 83.219.127.226
    O18 - Protocol\Handler\bwfile-8876480 {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll (Logitech Inc.)
    O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
    O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
    O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
    O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
    O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
    O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
    O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
    O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
    O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Fichiers communs\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
    O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll ()
    O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
    O18 - Protocol\Filter\application/x-mfe-ipt {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\McAfee\MSC\McSnIePl.dll (McAfee, Inc.)
    O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
    O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
    O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
    O20 - HKLM Winlogon: GinaDLL - (IWPDGINA.DLL) - C:\WINDOWS\System32\IWPDGINA.dll (Intel(R) Corporation)
    O24 - Desktop Components:0 (Ma page d'accueil) - About:Home
    O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
    O32 - HKLM CDRom: AutoRun - 1
    O32 - AutoRun File - [2004.08.19 14:18:18 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
    O34 - HKLM BootExecute: (autocheck autochk *) - File not found
    O35 - HKLM\..comfile [open] -- "%1" %*
    O35 - HKLM\..exefile [open] -- "%1" %*
    O35 - HKU\S-1-5-21-128965477-3582981272-972063890-1005..exefile [open] -- "%1" %*
    O37 - HKLM\...com [@ = ComFile] -- "%1" %*
    O37 - HKLM\...exe [@ = exefile] -- "%1" %*
    O37 - HKU\S-1-5-21-128965477-3582981272-972063890-1005\...exe [@ = exefile] -- "%1" %*

    NetSvcs: 6to4 - File not found
    NetSvcs: Ias - File not found
    NetSvcs: Iprip - File not found
    NetSvcs: NWCWorkstation - File not found
    NetSvcs: Nwsapagent - File not found
    NetSvcs: WmdmPmSp - File not found

    Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
    Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
    Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
    Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
    Drivers32: MSVideo - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
    Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
    Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
    Drivers32: vidc.DIVX - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)
    Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
    Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
    Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
    Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
    Drivers32: vidc.XVID - C:\WINDOWS\System32\xvidvfw.dll ()
    Drivers32: vidc.yv12 - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)

    CREATERESTOREPOINT
    Restore point Set: OTL Restore Point
     
    MuadDib,
    #28
  10. 2011/09/11
    MuadDib

    MuadDib Inactive Thread Starter

    Joined:
    2011/09/07
    Messages:
    29
    Likes Received:
    0
    (OTL.txt - part 2/2):
    ========== Files/Folders - Created Within 30 Days ==========

    [2011.09.10 22:58:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Démarrer\Programmes\McAfee
    [2011.09.10 11:49:54 | 000,000,000 | RHSD | C] -- C:\cmdcons
    [2011.09.10 11:44:45 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
    [2011.09.10 11:44:45 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
    [2011.09.10 11:44:45 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
    [2011.09.10 11:44:45 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
    [2011.09.10 11:44:26 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
    [2011.09.10 11:44:21 | 000,000,000 | ---D | C] -- C:\Qoobox
    [2011.09.07 23:20:45 | 000,000,000 | ---D | C] -- C:\Program Files\Torpig Removal Tool
    [2011.09.07 22:14:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\XXX YYY\Application Data\Malwarebytes
    [2011.09.07 22:14:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Malwarebytes' Anti-Malware
    [2011.09.07 22:13:58 | 000,041,272 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
    [2011.09.07 22:13:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    [2011.09.07 22:13:44 | 000,022,712 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
    [2011.09.07 22:13:44 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
    [2011.09.07 21:15:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\PC Tools
    [2011.09.07 18:03:05 | 000,000,000 | ---D | C] -- C:\Program Files\Fichiers communs\Wise Installation Wizard
    [2011.08.20 22:40:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Skype
    [2011.08.17 21:18:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\XXX YYY\Application Data\ICAClient
    [2011.08.17 21:16:36 | 000,000,000 | ---D | C] -- C:\Program Files\Citrix
    [2011.08.14 09:12:55 | 000,000,000 | ---D | C] -- C:\Program Files\Safer Networking
    [1996.11.13 04:25:44 | 000,018,944 | ---- | C] ( ) -- C:\WINDOWS\System32\implode.dll
    [2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
    [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

    ========== Files - Modified Within 30 Days ==========

    [2011.09.11 11:23:12 | 000,000,438 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{1121D7E9-8F0A-4CEF-9A8B-D47BD6EA589B}.job
    [2011.09.11 11:23:11 | 000,001,070 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
    [2011.09.11 11:20:38 | 000,002,641 | ---- | M] () -- C:\Documents and Settings\XXX YYY\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Outlook 2007.lnk
    [2011.09.11 11:20:00 | 000,098,867 | ---- | M] () -- C:\WINDOWS\System32\nvModes.001
    [2011.09.10 22:58:31 | 000,001,595 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\McAfee AntiVirus Plus.lnk
    [2011.09.10 22:12:02 | 000,001,066 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
    [2011.09.10 22:11:31 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
    [2011.09.10 22:11:26 | 3487,686,656 | -HS- | M] () -- C:\hiberfil.sys
    [2011.09.10 21:45:51 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
    [2011.09.10 21:44:45 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
    [2011.09.10 11:50:00 | 000,000,356 | RHS- | M] () -- C:\boot.ini
    [2011.09.09 02:00:01 | 000,000,366 | ---- | M] () -- C:\WINDOWS\tasks\AdobeAAMUpdater-1.0-LATITUDED820-XXX YYY.job
    [2011.09.07 22:14:00 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\Malwarebytes' Anti-Malware.lnk
    [2011.09.07 21:15:22 | 000,512,992 | ---- | M] () -- C:\Documents and Settings\XXX YYY\Bureau\sdasetup_revwire207.exe
    [2011.09.07 17:35:21 | 000,600,754 | ---- | M] () -- C:\WINDOWS\System32\perfh00C.dat
    [2011.09.07 17:35:20 | 000,503,452 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
    [2011.09.07 17:35:20 | 000,120,178 | ---- | M] () -- C:\WINDOWS\System32\perfc00C.dat
    [2011.09.07 17:35:20 | 000,095,298 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
    [2011.09.05 21:36:32 | 000,002,265 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\Skype.lnk
    [2011.09.04 16:24:57 | 000,098,867 | ---- | M] () -- C:\WINDOWS\System32\nvModes.dat
    [2011.08.31 20:35:12 | 000,001,770 | -H-- | M] () -- C:\Documents and Settings\XXX YYY\Mes documents\Default.rdp
    [2011.08.28 21:03:42 | 000,054,156 | -H-- | M] () -- C:\WINDOWS\QTFont.qfn
    [2011.08.26 13:27:34 | 000,002,593 | ---- | M] () -- C:\Documents and Settings\XXX YYY\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Word 2007.lnk
    [2011.08.24 21:33:05 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
    [2011.08.21 20:23:02 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
    [2011.08.21 09:17:23 | 000,000,742 | ---- | M] () -- C:\Documents and Settings\XXX YYY\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
    [2011.08.21 09:17:23 | 000,000,724 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\Mozilla Firefox.lnk
    [2011.08.14 22:01:26 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
    [2011.08.14 09:45:46 | 000,000,246 | ---- | M] () -- C:\Boot.bak
    [2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
    [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

    ========== Files Created - No Company Name ==========

    [2011.09.10 11:50:00 | 000,000,246 | ---- | C] () -- C:\Boot.bak
    [2011.09.10 11:49:58 | 000,263,488 | RHS- | C] () -- C:\cmldr
    [2011.09.10 11:44:45 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
    [2011.09.10 11:44:45 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
    [2011.09.10 11:44:45 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
    [2011.09.10 11:44:45 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
    [2011.09.10 11:44:45 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
    [2011.09.07 22:14:00 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Bureau\Malwarebytes' Anti-Malware.lnk
    [2011.09.07 21:15:33 | 000,512,992 | ---- | C] () -- C:\Documents and Settings\XXX YYY\Bureau\sdasetup_revwire207.exe
    [2011.09.07 17:51:46 | 3487,686,656 | -HS- | C] () -- C:\hiberfil.sys
    [2011.08.21 09:17:23 | 000,000,730 | ---- | C] () -- C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Mozilla Firefox.lnk
    [2011.08.20 22:40:26 | 000,002,265 | ---- | C] () -- C:\Documents and Settings\All Users\Bureau\Skype.lnk
    [2011.03.18 23:31:25 | 000,038,412 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat
    [2011.02.20 00:31:00 | 000,014,082 | -HS- | C] () -- C:\Documents and Settings\XXX YYY\Local Settings\Application Data\i258bi41o6f8c31hv73s74rec05dk42
    [2011.02.20 00:31:00 | 000,014,082 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\i258bi41o6f8c31hv73s74rec05dk42
    [2010.11.21 11:50:47 | 000,000,062 | ---- | C] () -- C:\WINDOWS\FTHPS.INI
    [2010.11.09 00:40:02 | 000,038,498 | ---- | C] () -- C:\Documents and Settings\XXX YYY\Application Data\Valeurs séparées par une virgule (DOS).ADR
    [2010.11.09 00:39:04 | 000,038,505 | ---- | C] () -- C:\Documents and Settings\XXX YYY\Application Data\Valeurs séparées par une tabulation (Windows).ADR
    [2010.11.09 00:37:13 | 000,038,502 | ---- | C] () -- C:\Documents and Settings\XXX YYY\Application Data\Valeurs séparées par une virgule (Windows).ADR
    [2010.10.23 15:16:29 | 000,000,132 | ---- | C] () -- C:\Documents and Settings\XXX YYY\Application Data\Adobe PNG Format CS5 Prefs
    [2010.09.24 22:33:59 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
    [2010.05.09 08:35:31 | 000,000,040 | ---- | C] () -- C:\WINDOWS\NAVIGMA.INI
    [2010.05.02 13:04:54 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
    [2010.03.10 22:19:27 | 000,001,655 | ---- | C] () -- C:\Documents and Settings\XXX YYY\Application Data\SvcTraceViewer.exe.settings
    [2010.03.03 19:36:29 | 000,024,340 | ---- | C] () -- C:\WINDOWS\System32\smtpctrs.ini
    [2010.03.03 19:36:28 | 000,001,106 | ---- | C] () -- C:\WINDOWS\System32\ntfsdrct.ini
    [2010.03.03 19:36:05 | 000,060,366 | ---- | C] () -- C:\WINDOWS\System32\w3ctrs.ini
    [2010.03.03 19:36:05 | 000,015,286 | ---- | C] () -- C:\WINDOWS\System32\axperf.ini
    [2010.03.03 19:36:04 | 000,017,538 | ---- | C] () -- C:\WINDOWS\System32\infoctrs.ini
    [2010.02.05 21:51:19 | 000,001,556 | ---- | C] () -- C:\Program Files\VaudTax2009.lnk
    [2009.08.03 15:07:42 | 000,403,816 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll
    [2009.08.03 15:07:42 | 000,230,768 | ---- | C] () -- C:\WINDOWS\System32\OGAEXEC.exe
    [2009.07.10 11:18:07 | 000,284,160 | ---- | C] () -- C:\WINDOWS\unin040c.exe
    [2009.01.30 14:33:18 | 000,765,952 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
    [2009.01.30 14:33:18 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
    [2008.11.06 18:37:32 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
    [2008.11.06 18:33:02 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\DivXWMPExtType.dll
    [2008.10.27 21:48:24 | 000,376,832 | ---- | C] () -- C:\WINDOWS\System32\AegisI5Installer.exe
    [2008.05.27 18:06:32 | 000,101,168 | ---- | C] () -- C:\Documents and Settings\XXX YYY\Application Data\debuggee.mdmp
    [2008.05.26 22:23:32 | 000,016,698 | ---- | C] () -- C:\WINDOWS\System32\gthrctr.ini
    [2008.05.26 22:23:30 | 000,021,596 | ---- | C] () -- C:\WINDOWS\System32\idxcntrs.ini
    [2008.05.26 22:23:28 | 000,016,036 | ---- | C] () -- C:\WINDOWS\System32\gsrvctr.ini
    [2008.05.26 21:59:42 | 000,018,904 | ---- | C] () -- C:\WINDOWS\System32\structuredqueryschematrivial.bin
    [2008.05.26 21:59:40 | 000,106,605 | ---- | C] () -- C:\WINDOWS\System32\structuredqueryschema.bin
    [2008.02.10 21:34:04 | 000,000,099 | ---- | C] () -- C:\WINDOWS\WirelessFTP.INI
    [2008.01.11 10:52:37 | 000,000,206 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI
    [2007.10.19 12:39:09 | 000,002,954 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
    [2007.08.10 10:37:45 | 000,000,120 | ---- | C] () -- C:\WINDOWS\Sansa Media Converter.INI
    [2007.06.29 21:40:54 | 000,001,156 | ---- | C] () -- C:\WINDOWS\mozver.dat
    [2007.06.15 08:41:25 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
    [2007.05.28 10:52:56 | 000,013,083 | ---- | C] () -- C:\WINDOWS\System32\SpoonUninstall-dBpoweramp Music Converter.dat
    [2007.05.28 10:30:16 | 004,131,192 | ---- | C] () -- C:\WINDOWS\System32\SpoonUninstall.exe
    [2007.05.21 20:04:28 | 000,006,550 | ---- | C] () -- C:\WINDOWS\jautoexp.dat
    [2007.05.04 14:14:20 | 000,102,400 | R--- | C] () -- C:\WINDOWS\scrub2k.exe
    [2007.05.04 14:14:20 | 000,000,443 | R--- | C] () -- C:\WINDOWS\hpw0460k.ini
    [2007.05.04 13:55:25 | 000,000,195 | ---- | C] () -- C:\WINDOWS\hpdj460.ini
    [2007.05.04 13:55:08 | 000,001,445 | ---- | C] () -- C:\WINDOWS\mariner.ini
    [2007.03.17 11:30:51 | 000,001,547 | ---- | C] () -- C:\WINDOWS\db_main.ini
    [2007.01.19 19:11:47 | 000,000,085 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\.zreglib
    [2006.12.24 12:29:27 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Progs_.ini
    [2006.12.09 17:21:59 | 000,016,384 | ---- | C] () -- C:\WINDOWS\System32\FileOps.exe
    [2006.11.17 20:07:44 | 000,086,734 | ---- | C] () -- C:\WINDOWS\System32\advpack.dll.bav
    [2006.10.26 21:54:09 | 000,308,736 | ---- | C] () -- C:\WINDOWS\System32\FpxLib.dll
    [2006.10.26 21:54:09 | 000,091,136 | ---- | C] () -- C:\WINDOWS\System32\JpegLib.dll
    [2006.10.26 21:54:09 | 000,013,927 | ---- | C] () -- C:\WINDOWS\Twacker.ini
    [2006.10.23 10:44:43 | 000,000,520 | ---- | C] () -- C:\WINDOWS\ODBC.INI
    [2006.10.13 13:56:47 | 000,000,000 | ---- | C] () -- C:\WINDOWS\tosOBEX.INI
    [2006.10.13 13:52:04 | 000,090,112 | ---- | C] () -- C:\Documents and Settings\XXX YYY\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2006.10.13 13:15:01 | 000,000,847 | ---- | C] () -- C:\WINDOWS\wincmd.ini
    [2006.10.12 18:16:59 | 000,000,136 | ---- | C] () -- C:\Documents and Settings\XXX YYY\Local Settings\Application Data\fusioncache.dat
    [2006.10.05 20:50:53 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
    [2006.10.05 20:47:04 | 000,000,175 | ---- | C] () -- C:\WINDOWS\wininit.ini
    [2006.10.05 20:22:53 | 000,098,867 | ---- | C] () -- C:\WINDOWS\System32\nvModes.dat
    [2006.10.05 20:19:16 | 000,000,256 | -H-- | C] () -- C:\WINDOWS\SYSREF87.BIN
    [2006.10.05 20:19:10 | 000,049,152 | ---- | C] () -- C:\WINDOWS\setpwrcg.exe
    [2006.10.05 20:18:34 | 001,703,936 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
    [2006.10.05 20:18:34 | 001,626,112 | ---- | C] () -- C:\WINDOWS\System32\nwiz.exe
    [2006.10.05 20:18:34 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
    [2006.10.05 20:18:34 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
    [2006.10.05 20:18:32 | 001,474,560 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
    [2006.10.05 20:18:32 | 001,339,392 | ---- | C] () -- C:\WINDOWS\System32\nvdspsch.exe
    [2006.10.05 20:18:32 | 000,442,368 | ---- | C] () -- C:\WINDOWS\System32\nvappbar.exe
    [2006.10.05 20:18:30 | 000,425,984 | ---- | C] () -- C:\WINDOWS\System32\keystone.exe
    [2006.10.05 20:18:28 | 000,000,535 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
    [2006.06.12 11:01:18 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\TspPopup_RUS.dll
    [2006.06.12 11:01:18 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\TspPopup_ITA.dll
    [2006.06.12 11:01:18 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\TspPopup_FRA.dll
    [2006.06.12 11:01:18 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\TspPopup_ESN.dll
    [2006.06.12 11:01:18 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\TspPopup_ENU.dll
    [2006.06.12 11:01:18 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\TspPopup_DEU.dll
    [2006.06.12 11:01:18 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\TspPopup_CHS.dll
    [2006.06.12 11:01:16 | 000,348,160 | ---- | C] () -- C:\WINDOWS\System32\Tsp.dll
    [2006.05.16 13:33:06 | 000,004,096 | ---- | C] () -- C:\WINDOWS\System32\detoured.dll
    [2005.09.15 20:39:48 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\epdfmonu.dll
    [2005.09.15 20:38:18 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\epdfmon.dll
    [2005.09.01 22:44:00 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\TosBtAcc.dll
    [2005.07.22 22:30:20 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\TosCommAPI.dll
    [2004.08.19 14:27:50 | 000,000,821 | ---- | C] () -- C:\WINDOWS\orun32.ini
    [2004.08.19 14:22:58 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
    [2004.08.19 14:15:31 | 000,021,892 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
    [2004.08.19 14:14:48 | 000,003,712 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
    [2004.08.19 14:10:38 | 000,004,205 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
    [2004.08.19 14:09:56 | 003,545,944 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
    [2004.08.19 14:03:59 | 000,600,754 | ---- | C] () -- C:\WINDOWS\System32\perfh00C.dat
    [2004.08.19 14:03:59 | 000,322,810 | ---- | C] () -- C:\WINDOWS\System32\perfi00C.dat
    [2004.08.19 14:03:59 | 000,120,178 | ---- | C] () -- C:\WINDOWS\System32\perfc00C.dat
    [2004.08.19 14:03:59 | 000,034,108 | ---- | C] () -- C:\WINDOWS\System32\perfd00C.dat
    [2004.08.19 14:03:45 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
    [2004.08.19 14:03:43 | 000,503,452 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
    [2004.08.19 14:03:43 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
    [2004.08.19 14:03:43 | 000,095,298 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
    [2004.08.19 14:03:43 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
    [2004.08.19 14:03:42 | 000,004,627 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
    [2004.08.19 14:03:41 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
    [2004.08.19 14:03:39 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
    [2004.08.19 14:03:34 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
    [2004.08.19 14:03:34 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
    [2004.08.19 14:03:27 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
    [2004.08.19 14:03:17 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
    [2004.07.20 18:04:02 | 000,094,208 | ---- | C] () -- C:\WINDOWS\System32\TosBtHcrpAPI.dll
    [2004.03.30 09:15:02 | 000,051,200 | ---- | C] () -- C:\WINDOWS\System32\ThriXXX010205PNG.dll
    [2004.03.30 09:15:01 | 000,056,832 | ---- | C] () -- C:\WINDOWS\System32\ThriXXX015003JP2.dll
    [2004.03.30 09:15:01 | 000,023,040 | ---- | C] () -- C:\WINDOWS\System32\ThriXXX010104Z.dll
    [2004.01.15 15:43:28 | 000,114,688 | ---- | C] () -- C:\WINDOWS\System32\TBTMonUI.dll
    [2003.12.22 03:28:10 | 000,157,184 | ---- | C] () -- C:\WINDOWS\System32\UNRAR.DLL
    [2003.12.22 03:28:10 | 000,151,552 | ---- | C] () -- C:\WINDOWS\System32\OggDS.dll
    [2003.12.22 03:28:10 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\RegNandub.exe
    [2003.12.22 03:28:08 | 000,454,656 | ---- | C] () -- C:\WINDOWS\System32\vorbisenc.dll
    [2003.05.23 12:08:52 | 000,107,008 | ---- | C] () -- C:\WINDOWS\System32\VORBIS.DLL
    [2003.05.23 12:08:52 | 000,020,992 | ---- | C] () -- C:\WINDOWS\System32\OGG.DLL
    [2000.09.13 19:15:38 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\pagesync.dll
    [1997.01.12 08:15:18 | 000,007,168 | ---- | C] () -- C:\WINDOWS\System32\dtctrace.dll

    ========== LOP Check ==========

    [2008.12.08 20:43:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\2DBoy
    [2011.03.04 11:56:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Cisco Systems
    [2010.02.17 17:18:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\DAEMON Tools Lite
    [2007.01.19 19:12:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Elaborate Bytes
    [2011.03.13 00:19:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Installations
    [2008.07.18 13:59:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
    [2008.01.19 11:39:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Nokia
    [2010.09.15 22:09:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\NokiaInstallerCache
    [2007.05.12 10:15:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PC Suite
    [2007.02.19 20:10:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\QubeSoft
    [2010.08.11 11:32:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\regid.1986-12.com.adobe
    [2007.07.22 14:35:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
    [2007.08.28 15:05:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TrackMania United
    [2006.10.05 20:41:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Wave Systems Corp
    [2010.01.23 16:46:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\XXX YYY\Application Data\ArchiFacile
    [2008.06.12 21:21:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\XXX YYY\Application Data\Axialis
    [2011.08.11 14:00:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\XXX YYY\Application Data\Camfrog
    [2010.02.17 20:58:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\XXX YYY\Application Data\DAEMON Tools Lite
    [2010.06.25 13:54:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\XXX YYY\Application Data\DarkBls
    [2006.10.13 18:12:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\XXX YYY\Application Data\DataLayer
    [2007.05.28 10:33:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\XXX YYY\Application Data\dBpoweramp
    [2009.11.12 17:55:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\XXX YYY\Application Data\DeepBurner
    [2007.01.19 19:09:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\XXX YYY\Application Data\Elaborate Bytes
    [2008.10.30 20:05:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\XXX YYY\Application Data\flightgear.org
    [2009.09.18 17:38:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\XXX YYY\Application Data\FMZilla
    [2010.05.29 10:35:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\XXX YYY\Application Data\GetRight
    [2011.08.17 21:18:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\XXX YYY\Application Data\ICAClient
    [2006.10.13 13:47:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\XXX YYY\Application Data\Leadertech
    [2008.11.06 21:06:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\XXX YYY\Application Data\LEGO Company
    [2008.10.13 21:07:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\XXX YYY\Application Data\Liquid Technologies Ltd
    [2009.09.25 17:56:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\XXX YYY\Application Data\msat
    [2008.07.18 13:59:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\XXX YYY\Application Data\NCH Swift Sound
    [2011.03.13 00:15:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\XXX YYY\Application Data\Nokia
    [2010.11.08 20:13:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\XXX YYY\Application Data\Nokia Ovi Suite
    [2010.03.22 22:42:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\XXX YYY\Application Data\NUnit
    [2009.03.05 18:56:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\XXX YYY\Application Data\OneSwarm
    [2007.03.05 19:31:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\XXX YYY\Application Data\Opera
    [2008.01.07 19:45:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\XXX YYY\Application Data\PC Suite
    [2007.03.09 12:07:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\XXX YYY\Application Data\Pegasys Inc
    [2007.05.21 20:12:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\XXX YYY\Application Data\Rational
    [2010.05.29 10:32:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\XXX YYY\Application Data\RayV
    [2008.01.07 20:43:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\XXX YYY\Application Data\ROUTE 66 Sync
    [2009.07.29 11:11:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\XXX YYY\Application Data\SanDisk
    [2010.08.11 14:33:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\XXX YYY\Application Data\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
    [2010.02.05 21:16:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\XXX YYY\Application Data\Subversion
    [2008.10.29 22:46:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\XXX YYY\Application Data\Toshiba
    [2006.10.20 17:44:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\XXX YYY\Application Data\Wave Systems Corp
    [2009.09.12 13:15:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\XXX YYY\Application Data\Windows Desktop Search
    [2009.11.22 17:23:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\XXX YYY\Application Data\Windows Search
    [2011.08.19 21:32:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\SACore
    [2011.02.20 01:25:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Application Data\SACore
    [2011.09.11 11:23:12 | 000,000,438 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{1121D7E9-8F0A-4CEF-9A8B-D47BD6EA589B}.job

    ========== Purity Check ==========



    ========== Custom Scans ==========


    < %SYSTEMDRIVE%\*.* >
    [2007.07.21 18:04:52 | 000,000,174 | ---- | M] () -- C:\AKVIS.log
    [2004.08.19 14:18:18 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
    [2010.11.01 19:42:59 | 000,018,320 | ---- | M] () -- C:\bar.emf
    [2011.08.14 09:45:46 | 000,000,246 | ---- | M] () -- C:\Boot.bak
    [2011.09.10 11:50:00 | 000,000,356 | RHS- | M] () -- C:\boot.ini
    [2004.08.05 13:00:00 | 000,004,952 | RHS- | M] () -- C:\Bootfont.bin
    [2004.08.03 23:00:08 | 000,263,488 | RHS- | M] () -- C:\cmldr
    [2011.09.10 22:00:21 | 000,021,157 | ---- | M] () -- C:\ComboFix.txt
    [2004.08.19 14:18:18 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
    [2006.10.05 20:19:52 | 000,004,814 | RH-- | M] () -- C:\dell.sdr
    [2007.08.12 10:20:08 | 000,000,000 | ---- | M] () -- C:\DTSHDSpOut.txt
    [2011.09.10 22:11:26 | 3487,686,656 | -HS- | M] () -- C:\hiberfil.sys
    [2006.10.13 13:54:28 | 000,004,128 | ---- | M] () -- C:\INFCACHE.1
    [2004.08.19 14:18:18 | 000,000,000 | -H-- | M] () -- C:\IO.SYS
    [2004.08.19 14:18:18 | 000,000,000 | -H-- | M] () -- C:\MSDOS.SYS
    [2004.08.05 13:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
    [2008.09.05 10:10:10 | 000,252,240 | RHS- | M] () -- C:\ntldr
    [2011.09.10 22:11:23 | 1610,612,736 | -HS- | M] () -- C:\pagefile.sys
    [2007.03.14 21:27:35 | 000,000,000 | ---- | M] () -- C:\prompt
    [2007.03.08 22:05:05 | 000,000,268 | -H-- | M] () -- C:\sqmdata00.sqm
    [2007.03.08 22:05:05 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt00.sqm
    [2010.06.17 21:45:58 | 000,008,225 | ---- | M] () -- C:\WirelessDiagLog.csv

    < %systemroot%\Fonts\*.com >
    [2006.04.18 16:39:28 | 000,026,040 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
    [2006.06.29 15:53:56 | 000,026,489 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
    [2006.04.18 16:39:28 | 000,029,779 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
    [2006.06.29 15:58:52 | 000,030,808 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

    < %systemroot%\Fonts\*.dll >

    < %systemroot%\Fonts\*.ini >
    [2004.08.19 14:17:42 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini

    < %systemroot%\Fonts\*.ini2 >

    < %systemroot%\Fonts\*.exe >

    < %systemroot%\system32\spool\prtprocs\w32x86\*.* >
    [2008.07.06 14:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
    [2005.05.10 16:14:32 | 000,067,072 | ---- | M] (Hewlett-Packard Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\hpzpp3xt.dll
    [2005.05.10 16:14:32 | 000,067,072 | ---- | M] (Hewlett-Packard Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\hpzpp3xt.dll.1
    [2006.04.03 18:08:54 | 000,067,072 | ---- | M] (Hewlett-Packard Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\hpzpp3y2.dll
    [2007.04.09 13:23:54 | 000,028,552 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll
    [2006.10.26 19:56:12 | 000,033,104 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\msonpppr.dll
    [2008.07.06 12:50:03 | 000,597,504 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

    < %systemroot%\REPAIR\*.bak1 >

    < %systemroot%\REPAIR\*.ini >

    < %systemroot%\system32\*.jpg >

    < %systemroot%\*.jpg >

    < %systemroot%\*.png >

    < %systemroot%\*.scr >

    < %systemroot%\*._sy >

    < %APPDATA%\Adobe\Update\*.* >

    < %ALLUSERSPROFILE%\Favorites\*.* >

    < %APPDATA%\Microsoft\*.* >

    < %PROGRAMFILES%\*.* >
    [2010.02.05 21:51:19 | 000,001,556 | ---- | M] () -- C:\Program Files\VaudTax2009.lnk

    < %APPDATA%\Update\*.* >

    < %systemroot%\*. /mp /s >

    < %systemroot%\System32\config\*.sav >
    [2004.08.19 14:09:26 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav
    [2004.08.19 14:09:26 | 000,663,552 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav
    [2004.08.19 14:09:26 | 000,417,792 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav

    < %PROGRAMFILES%\bak. /s >

    < %systemroot%\system32\bak. /s >

    < %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

    < %systemroot%\system32\config\systemprofile\*.dat /x >

    < %systemroot%\*.config >

    < %systemroot%\system32\*.db >

    < %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
    [2004.08.19 14:24:10 | 000,000,079 | ---- | M] () -- C:\Documents and Settings\XXX YYY\Application Data\Microsoft\Internet Explorer\Quick Launch\Bureau.scf
    [2006.10.12 18:17:11 | 000,000,107 | -HS- | M] () -- C:\Documents and Settings\XXX YYY\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini

    < %USERPROFILE%\Desktop\*.exe >

    < %PROGRAMFILES%\Common Files\*.* >

    < %systemroot%\*.src >
    [2009.06.21 22:52:19 | 000,007,313 | ---- | M] () -- C:\WINDOWS\Default.src
    [2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

    < %systemroot%\install\*.* >

    < %systemroot%\system32\DLL\*.* >

    < %systemroot%\system32\HelpFiles\*.* >

    < %systemroot%\system32\rundll\*.* >

    < %systemroot%\winn32\*.* >

    < %systemroot%\Java\*.* >

    < %systemroot%\system32\test\*.* >

    < %systemroot%\system32\Rundll32\*.* >

    < %systemroot%\AppPatch\Custom\*.* >

    < %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

    < %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

    < %PROGRAMFILES%\Internet Explorer\*.tmp >

    < %PROGRAMFILES%\Internet Explorer\*.dat >

    < %USERPROFILE%\My Documents\*.exe >

    < %USERPROFILE%\*.exe >

    < %systemroot%\ADDINS\*.* >
    [2004.08.05 13:00:00 | 000,000,817 | ---- | M] () -- C:\WINDOWS\ADDINS\fxsext.ecf

    < %systemroot%\assembly\*.bak2 >

    < %systemroot%\Config\*.* >

    < %systemroot%\REPAIR\*.bak2 >

    < %systemroot%\SECURITY\Database\*.sdb /x >

    < %systemroot%\SYSTEM\*.bak2 >

    < %systemroot%\Web\*.bak2 >

    < %systemroot%\Driver Cache\*.* >

    < %PROGRAMFILES%\Mozilla Firefox\0*.exe >

    < %ProgramFiles%\Microsoft Common\*.* >

    < %ProgramFiles%\TinyProxy. >

    < %USERPROFILE%\Favorites\*.url /x >

    < %systemroot%\system32\*.bk >

    < %systemroot%\*.te >

    < %systemroot%\system32\system32\*.* >

    < %ALLUSERSPROFILE%\*.dat /x >

    < %systemroot%\system32\drivers\*.rmv >

    < dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

    < dir /b "%systemroot%\*.exe" | find /i " " /c >

    < %PROGRAMFILES%\Microsoft\*.* >

    < %systemroot%\System32\Wbem\proquota.exe >

    < %PROGRAMFILES%\Mozilla Firefox\*.dat >

    < %USERPROFILE%\Cookies\*.txt /x >
    [2011.09.11 11:28:51 | 001,114,112 | ---- | M] () -- C:\Documents and Settings\XXX YYY\Cookies\index.dat

    < %SystemRoot%\system32\fonts\*.* >

    < %systemroot%\system32\winlog\*.* >

    < %systemroot%\system32\Language\*.* >

    < %systemroot%\system32\Settings\*.* >

    < %systemroot%\system32\*.quo >

    < %SYSTEMROOT%\AppPatch\*.exe >

    < %SYSTEMROOT%\inf\*.exe >
    [2007.06.29 11:59:14 | 000,318,976 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\inf\unregmp2.exe

    < %SYSTEMROOT%\Installer\*.exe >
    [2007.09.11 11:54:00 | 000,600,328 | ---- | M] (Intel Corporation) -- C:\WINDOWS\Installer\iProInst.exe
    [33 C:\WINDOWS\Installer\*.tmp files -> C:\WINDOWS\Installer\*.tmp -> ]

    < %systemroot%\system32\config\*.bak2 >

    < %systemroot%\system32\Computers\*.* >

    < %SystemRoot%\system32\Sound\*.* >

    < %SystemRoot%\system32\SpecialImg\*.* >

    < %SystemRoot%\system32\code\*.* >

    < %SystemRoot%\system32\draft\*.* >

    < %SystemRoot%\system32\MSSSys\*.* >

    < %ProgramFiles%\Javascript\*.* >

    < %systemroot%\pchealth\helpctr\System\*.exe /s >

    < %systemroot%\Web\*.exe >

    < %systemroot%\system32\msn\*.* >

    < %systemroot%\system32\*.tro >

    < %AppData%\Microsoft\Installer\msupdates\*.* >

    < %ProgramFiles%\Messenger\*.* >
    [2008.04.14 04:33:22 | 000,033,792 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\custsat.dll
    [2004.08.04 02:07:10 | 000,004,821 | ---- | M] () -- C:\Program Files\Messenger\logowin.gif
    [2004.08.04 02:07:10 | 000,007,047 | ---- | M] () -- C:\Program Files\Messenger\lvback.gif
    [2008.05.02 16:01:52 | 000,083,968 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgsc.dll
    [2008.04.13 19:30:28 | 000,180,224 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgslang.dll
    [2008.04.14 04:34:13 | 001,695,232 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe
    [2004.08.04 02:07:10 | 000,002,882 | ---- | M] () -- C:\Program Files\Messenger\newalert.wav
    [2004.08.04 02:07:10 | 000,006,156 | ---- | M] () -- C:\Program Files\Messenger\newemail.wav
    [2004.08.04 02:07:10 | 000,006,160 | ---- | M] () -- C:\Program Files\Messenger\online.wav
    [2004.08.04 02:07:10 | 000,004,454 | ---- | M] () -- C:\Program Files\Messenger\type.wav
    [2004.08.04 02:07:10 | 000,127,843 | ---- | M] () -- C:\Program Files\Messenger\xpmsgr.chm

    < %systemroot%\system32\systhem32\*.* >

    < %systemroot%\system\*.exe >
    [2003.12.22 03:28:10 | 000,004,672 | ---- | M] (Adaptec) -- C:\WINDOWS\system\WOWPOST.EXE

    < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

    < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >


    ========== Alternate Data Streams ==========

    @Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:456A69E6
    @Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:1940DBE8

    < End of report >
     
    MuadDib,
    #29
  11. 2011/09/11
    MuadDib

    MuadDib Inactive Thread Starter

    Joined:
    2011/09/07
    Messages:
    29
    Likes Received:
    0
    OTL Extras logfile created on: 11.09.2011 11:29:01 - Run 1
    OTL by OldTimer - Version 3.2.27.0 Folder = C:\Download\WindowsBBS\OldTimer
    Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
    Internet Explorer (Version = 8.0.6001.18702)
    Locale: 0000100C | Country: Suisse | Language: FRS | Date Format: dd.MM.yyyy

    3.25 Gb Total Physical Memory | 2.47 Gb Available Physical Memory | 76.06% Memory free
    4.59 Gb Paging File | 3.77 Gb Available in Paging File | 82.23% Paging File free
    Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
    Drive C: | 93.06 Gb Total Space | 22.11 Gb Free Space | 23.76% Space Free | Partition Type: NTFS

    Computer Name: LATITUDED820 | User Name: XXX YYY | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: All users | Quick Scan
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Extra Registry (SafeList) ==========


    ========== File Associations ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
    .cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1 ",%*
    .url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l

    [HKEY_USERS\S-1-5-21-128965477-3582981272-972063890-1005\SOFTWARE\Classes\<extension>]
    .html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

    ========== Shell Spawning ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
    batfile [open] -- "%1" %*
    cmdfile [open] -- "%1" %*
    comfile [open] -- "%1" %*
    cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1 ",%*
    exefile [open] -- "%1" %*
    htafile [open] -- "%1" %*
    InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
    piffile [open] -- "%1" %*
    regfile [merge] -- Reg Error: Key error.
    scrfile [config] -- "%1 "
    scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
    scrfile [open] -- "%1" /S
    txtfile [edit] -- Reg Error: Key error.
    Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
    Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
    Directory [Bridge] -- C:\Program Files\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
    Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
    Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
    Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
    Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

    ========== Security Center Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
    "FirstRunDisabled" = 1
    "AntiVirusDisableNotify" = 0
    "FirewallDisableNotify" = 0
    "UpdatesDisableNotify" = 0
    "AntiVirusOverride" = 0
    "FirewallOverride" = 0

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
    "DisableMonitoring" = 1

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

    ========== System Restore Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
    "DisableSR" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
    "Start" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
    "Start" = 2

    ========== Firewall Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
    "139:TCP" = 139:TCP:*:Enabled:mad:xpsp2res.dll,-22004
    "445:TCP" = 445:TCP:*:Enabled:mad:xpsp2res.dll,-22005
    "137:UDP" = 137:UDP:*:Enabled:mad:xpsp2res.dll,-22001
    "138:UDP" = 138:UDP:*:Enabled:mad:xpsp2res.dll,-22002
    "1900:UDP" = 1900:UDP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22007
    "2869:TCP" = 2869:TCP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22008
    "10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Service Partage réseau du Lecteur Windows Media
    "10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Service Partage réseau du Lecteur Windows Media
    "10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Service Partage réseau du Lecteur Windows Media
    "10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Service Partage réseau du Lecteur Windows Media
    "10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Service Partage réseau du Lecteur Windows Media
    "10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Service Partage réseau du Lecteur Windows Media
    "3389:TCP" = 3389:TCP:*:Enabled:Remote Desktop
    "65533:TCP" = 65533:TCP:*:Enabled:Services
    "52344:TCP" = 52344:TCP:*:Enabled:Services

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
    "EnableFirewall" = 1
    "DoNotAllowExceptions" = 0
    "DisableNotifications" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
    "139:TCP" = 139:TCP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22004
    "445:TCP" = 445:TCP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22005
    "137:UDP" = 137:UDP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22001
    "138:UDP" = 138:UDP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22002
    "7195:TCP" = 7195:TCP:*:Disabled:eMule (TCP)
    "9961:UDP" = 9961:UDP:*:Disabled:eMule (UDP)
    "1900:UDP" = 1900:UDP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22007
    "2869:TCP" = 2869:TCP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22008
    "10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Service Partage réseau du Lecteur Windows Media
    "10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Service Partage réseau du Lecteur Windows Media
    "10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Service Partage réseau du Lecteur Windows Media
    "10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Service Partage réseau du Lecteur Windows Media
    "10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Service Partage réseau du Lecteur Windows Media
    "10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Service Partage réseau du Lecteur Windows Media
    "3389:TCP" = 3389:TCP:*:Enabled:Remote Desktop
    "65533:TCP" = 65533:TCP:*:Disabled:Services
    "52344:TCP" = 52344:TCP:*:Disabled:Services

    ========== Authorized Applications List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
    "C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger -- (Logitech Inc.)
    "C:\Program Files\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe" = C:\Program Files\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe:*:Enabled:Logitech Harmony Remote Software 7 -- ()
    "C:\Program Files\ZyXEL\ZyWALL VPN Client\IreIKE.exe" = C:\Program Files\ZyXEL\ZyWALL VPN Client\IreIKE.exe:*:Enabled:IreIke
    "C:\Program Files\ZyXEL\ZyWALL VPN Client\ViewLog.exe" = C:\Program Files\ZyXEL\ZyWALL VPN Client\ViewLog.exe:127.0.0.1/255.255.255.255:Enabled:ViewLog
    "C:\Program Files\ZyXEL\ZyWALL VPN Client\CmonApp.exe" = C:\Program Files\ZyXEL\ZyWALL VPN Client\CmonApp.exe:127.0.0.1/255.255.255.255:Enabled:CMonApp
    "C:\Program Files\ZyXEL\ZyWALL VPN Client\vpn.exe" = C:\Program Files\ZyXEL\ZyWALL VPN Client\vpn.exe:127.0.0.1/255.255.255.255:Enabled:VPN Connection Manager

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
    "C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe" = C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe:*:Enabled:Adobe Version Cue CS2 -- (Adobe Systems Incorporated)
    "C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger -- (Logitech Inc.)
    "C:\Program Files\Hewlett-Packard\hp deskjet 460 series\Toolbox\HPWRTBX.exe" = C:\Program Files\Hewlett-Packard\hp deskjet 460 series\Toolbox\HPWRTBX.exe:*:Enabled:Toolbox for HP Printing System for Windows -- (Hewlett-Packard Company)
    "C:\Program Files\Real\RealPlayer\realplay.exe" = C:\Program Files\Real\RealPlayer\realplay.exe:*:Disabled:RealPlayer -- (RealNetworks, Inc.)
    "C:\Program Files\TrackMania United\TmUnited.exe" = C:\Program Files\TrackMania United\TmUnited.exe:*:Disabled:TmUnited -- ()
    "C:\Program Files\eclipse\eclipse.exe" = C:\Program Files\eclipse\eclipse.exe:*:Disabled:eclipse -- ()
    "C:\Program Files\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe" = C:\Program Files\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe:*:Enabled:Logitech Harmony Remote Software 7 -- ()
    "C:\Program Files\mIRC\mirc.exe" = C:\Program Files\mIRC\mirc.exe:*:Enabled:mIRC -- (mIRC Co. Ltd.)
    "C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox -- (Mozilla Corporation)
    "C:\Program Files\Java\jre1.6.0_07\bin\javaw.exe" = C:\Program Files\Java\jre1.6.0_07\bin\javaw.exe:*:Disabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
    "C:\Program Files\Java\jdk1.6.0_07\jre\bin\java.exe" = C:\Program Files\Java\jdk1.6.0_07\jre\bin\java.exe:*:Disabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
    "C:\Program Files\Fichiers communs\McAfee\McSvcHost\McSvHost.exe" = C:\Program Files\Fichiers communs\McAfee\McSvcHost\McSvHost.exe:*:Enabled:McAfee Shared Service Host -- (McAfee, Inc.)
    "C:\Program Files\Free Music Zilla\FMZilla.exe" = C:\Program Files\Free Music Zilla\FMZilla.exe:*:Disabled:FMZilla -- ()
    "C:\Program Files\TrackMania Nations ESWC\TmNationsESWC.exe" = C:\Program Files\TrackMania Nations ESWC\TmNationsESWC.exe:*:Disabled:TmNationsESWC -- ()


    ========== HKEY_LOCAL_MACHINE Uninstall List ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "{0134A1A1-C283-4A47-91A1-92F19F960372}" = Adobe Creative Suite 2
    "{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
    "{07EEE598-5F21-4B57-B40B-46592625B3D9}" = Zune Language Pack (PTB)
    "{08C7A49D-2B12-46F6-8B41-26D3B0D1C01F}" = Visual Studio C++ 9.0 Runtime
    "{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
    "{08F7CCA6-8590-4401-8B44-CEB09A909AAB}" = del.icio.us Buttons for Internet Explorer
    "{0BA2A0BA-7F4D-4B7B-AE94-5F0233AC8A5A}" = NTRU Hybrid TSS v2.0.25
    "{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help
    "{0DF3AE91-E533-3960-8516-B23737F8B7A2}" = Visual C++ 2008 x64 Runtime - (v9.0.30729)
    "{0DF3AE91-E533-3960-8516-B23737F8B7A2}.vc_x64runtime_30729_01" = Visual C++ 2008 x64 Runtime - v9.0.30729.01
    "{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
    "{133742BA-6F46-4D3E-85AF-78631D9AD8B8}" = Installation Windows Live
    "{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
    "{15FEDA5F-141C-4127-8D7E-B962D1742728}" = Adobe Photoshop CS5
    "{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
    "{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Outil de téléchargement Windows Live
    "{212748BB-0DA5-46DE-82A1-403736DC9F27}" = MSVC80_x86
    "{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
    "{22E23C71-C27A-3F30-8849-BB6129E50679}" = Visual C++ 2008 IA64 Runtime - (v9.0.30729)
    "{22E23C71-C27A-3F30-8849-BB6129E50679}.vc_i64runtime_30729_01" = Visual C++ 2008 IA64 Runtime - v9.0.30729.01
    "{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
    "{23FB368F-1399-4EAC-817C-4B83ECBE3D83}" = mProSafe
    "{26A24AE4-039D-4CA4-87B4-2F83216017FF}" = Java(TM) 6 Update 20
    "{26E1BFB0-E87E-4696-9F89-B467F01F81E5}" = Broadcom Advanced Control Suite
    "{2ADE2157-7A5E-122C-B51D-EB8A01B15943}" = DeepBurner v1.9.0.228
    "{2E8EAC71-BFE4-417A-88F0-5A1BDFBCF5D3}" = Logitech SetPoint
    "{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
    "{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java(TM) 6 Update 5
    "{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
    "{32A3A4F4-B792-11D6-A78A-00B0D0160070}" = Java(TM) SE Development Kit 6 Update 7
    "{350C940c-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
    "{352F5013-07DC-446D-8DB6-38F339086C60}" = LightScribe 1.4.84.1
    "{388E4B09-3E71-4649-8921-F44A3A2954A7}" = Microsoft Visual Studio 2005 Tools for Office Runtime
    "{3EE33958-7381-4E7B-A4F3-6E43098E9E9C}" = URL Assistant
    "{3F7924B9-D148-3141-87B1-68F36043A940}" = Microsoft .NET Framework 2.0 Service Pack 1 Language Pack - FRA
    "{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = NetWaiting
    "{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
    "{4412F224-3849-4461-A3E9-DEEF8D252790}" = Visual Studio C++ 10.0 Runtime
    "{445B183D-F4F1-45C8-B9DB-F11355CA657B}" = Windows Live Messenger
    "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
    "{4CFB3821-1582-4F3B-BF8D-30986923B36B}" = Nokia Multimedia Factory
    "{511DF669-2930-30C0-8EB6-552887E29EC8}" = Microsoft .NET Framework 3.0 Service Pack 1 Language Pack - FRA
    "{52A7C6A6-6B88-47D1-922E-9F8A7E089E6A}" = Logiciel Intel(R) PROSet/Wireless WiFi
    "{5B76AEA2-D4E5-3B55-B965-ACC36AE0EAFC}" = Microsoft .NET Framework 3.5 Language Pack - fra
    "{5C6F884D-680C-448B-B4C9-22296EE1B206}" = Logitech Harmony Remote Software 7
    "{5C93E291-A1CC-4E51-85C6-E194209FCDB4}" = Zune Language Pack (PTG)
    "{5E863175-E85D-44A6-8968-82507D34AE7F}" = QuickTime
    "{60FFB3E0-6D5B-4D73-AE5B-07E58B83AF0C}" = 32 Bit HP CIO Components Installer
    "{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
    "{6740BCB0-5863-47F4-80F4-44F394DE4FE2}" = Zune Language Pack (NLD)
    "{6753B40C-0FBD-3BED-8A9D-0ACAC2DCD85D}" = Microsoft Document Explorer 2008
    "{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD 5.9
    "{6B33492E-FBBC-4EC3-8738-09E16E395A10}" = Zune Language Pack (ESP)
    "{6C9F6D23-E9AD-43C9-B43A-011562AAF876}" = Windows Mobile 5.0 SDK R2 for Pocket PC
    "{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
    "{7006ED29-58F2-40C3-AE87-039287AD20B6}" = Zune
    "{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762
    "{786C5747-0C40-4930-9AFE-113BCE553101}" = Adobe Stock Photos 1.0
    "{7B33F480-496D-334A-BAC2-205DEC0CBC2D}" = Visual C++ 2008 x86 Runtime - (v9.0.30729.4148)
    "{7B33F480-496D-334A-BAC2-205DEC0CBC2D}.vc_x86runtime_30729_4148" = Visual C++ 2008 x86 Runtime - v9.0.30729.4148
    "{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
    "{7F142D56-3326-11D5-B229-002078017FBF}" = Modem Helper
    "{7F4C8163-F259-49A0-A018-2857A90578BC}" = Adobe InDesign CS2
    "{8471021C-F529-43DE-84DF-3612E10F58C4}" = Remote Control USB Driver
    "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
    "{8EDBA74D-0686-4C99-BFDD-F894678E5102}" = Adobe Common File Installer
    "{8FB53850-246A-3507-8ADE-0060093FFEA6}" = Visual Studio Tools for the Office system 3.0 Runtime
    "{8FFC924C-ED06-44CB-8867-3CA778ECE903}" = Adobe Help Center 2.0
    "{900B1197-53F5-4F46-A882-2CFFFE2EEDCB}" = Logitech Desktop Messenger
    "{90120000-0010-040C-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (French) 12
    "{90120000-0015-040C-0000-0000000FF1CE}" = Microsoft Office Access MUI (French) 2007
    "{90120000-0015-040C-0000-0000000FF1CE}_ENTERPRISER_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
    "{90120000-0016-040C-0000-0000000FF1CE}" = Microsoft Office Excel MUI (French) 2007
    "{90120000-0016-040C-0000-0000000FF1CE}_ENTERPRISER_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
    "{90120000-0018-040C-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (French) 2007
    "{90120000-0018-040C-0000-0000000FF1CE}_ENTERPRISER_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
    "{90120000-0019-040C-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (French) 2007
    "{90120000-0019-040C-0000-0000000FF1CE}_ENTERPRISER_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
    "{90120000-001A-040C-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (French) 2007
    "{90120000-001A-040C-0000-0000000FF1CE}_ENTERPRISER_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
    "{90120000-001B-040C-0000-0000000FF1CE}" = Microsoft Office Word MUI (French) 2007
    "{90120000-001B-040C-0000-0000000FF1CE}_ENTERPRISER_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
    "{90120000-001F-0401-0000-0000000FF1CE}" = Microsoft Office Proof (Arabic) 2007
    "{90120000-001F-0401-0000-0000000FF1CE}_ENTERPRISER_{14809F99-C601-4D4A-9391-F1E8FAA964C5}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
    "{90120000-001F-0401-0000-0000000FF1CE}_PRJPROR_{14809F99-C601-4D4A-9391-F1E8FAA964C5}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
    "{90120000-001F-0401-0000-0000000FF1CE}_VISPROR_{14809F99-C601-4D4A-9391-F1E8FAA964C5}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
    "{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
    "{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISER_{A0516415-ED61-419A-981D-93596DA74165}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
    "{90120000-001F-0407-0000-0000000FF1CE}_PRJPROR_{A0516415-ED61-419A-981D-93596DA74165}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
    "{90120000-001F-0407-0000-0000000FF1CE}_VISPROR_{A0516415-ED61-419A-981D-93596DA74165}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
    "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
    "{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISER_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
    "{90120000-001F-0409-0000-0000000FF1CE}_PRJPROR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
    "{90120000-001F-0409-0000-0000000FF1CE}_VISPROR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
    "{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
    "{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISER_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
    "{90120000-001F-040C-0000-0000000FF1CE}_PRJPROR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
    "{90120000-001F-040C-0000-0000000FF1CE}_VISPROR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
    "{90120000-001F-0413-0000-0000000FF1CE}" = Microsoft Office Proof (Dutch) 2007
    "{90120000-001F-0413-0000-0000000FF1CE}_ENTERPRISER_{D66D5A44-E480-4BA4-B4F2-C554F6B30EBB}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
    "{90120000-001F-0413-0000-0000000FF1CE}_PRJPROR_{D66D5A44-E480-4BA4-B4F2-C554F6B30EBB}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
    "{90120000-001F-0413-0000-0000000FF1CE}_VISPROR_{D66D5A44-E480-4BA4-B4F2-C554F6B30EBB}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
    "{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
    "{90120000-001F-0C0A-0000-0000000FF1CE}_ENTERPRISER_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
    "{90120000-001F-0C0A-0000-0000000FF1CE}_PRJPROR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
    "{90120000-001F-0C0A-0000-0000000FF1CE}_VISPROR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
    "{90120000-0020-040C-0000-0000000FF1CE}" = Module de compatibilité pour Microsoft Office System 2007
    "{90120000-002C-040C-0000-0000000FF1CE}" = Microsoft Office Proofing (French) 2007
    "{90120000-0044-040C-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (French) 2007
    "{90120000-0044-040C-0000-0000000FF1CE}_ENTERPRISER_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
    "{90120000-0054-040C-0000-0000000FF1CE}" = Microsoft Office Visio MUI (French) 2007
    "{90120000-0054-040C-0000-0000000FF1CE}_VISPROR_{7EC87B94-B9A7-4C72-9C55-21C1C9DEE3C5}" = Microsoft Office Visio 2007 Service Pack 2 (SP2)
    "{90120000-006E-040C-0000-0000000FF1CE}" = Microsoft Office Shared MUI (French) 2007
    "{90120000-006E-040C-0000-0000000FF1CE}_ENTERPRISER_{B165D3C2-40AE-4D39-86F7-E5C87C4264C0}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
    "{90120000-006E-040C-0000-0000000FF1CE}_PRJPROR_{B165D3C2-40AE-4D39-86F7-E5C87C4264C0}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
    "{90120000-006E-040C-0000-0000000FF1CE}_VISPROR_{B165D3C2-40AE-4D39-86F7-E5C87C4264C0}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
    "{90120000-00A1-040C-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (French) 2007
    "{90120000-00A1-040C-0000-0000000FF1CE}_ENTERPRISER_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
    "{90120000-00A4-0409-0000-0000000FF1CE}" = Microsoft Office 2003 Web Components
    "{90120000-00B4-040C-0000-0000000FF1CE}" = Microsoft Office Project MUI (French) 2007
    "{90120000-00B4-040C-0000-0000000FF1CE}_PRJPROR_{427E1F73-275B-4344-BB19-BEFC1DD15AB6}" = Microsoft Office Project 2007 Service Pack 2 (SP2)
    "{90120000-00BA-040C-0000-0000000FF1CE}" = Microsoft Office Groove MUI (French) 2007
    "{90120000-00BA-040C-0000-0000000FF1CE}_ENTERPRISER_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
    "{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
    "{91120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
    "{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
    "{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
    "{91120000-003B-0000-0000-0000000FF1CE}" = Microsoft Office Project Professional 2007
    "{91120000-003B-0000-0000-0000000FF1CE}_PRJPROR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
    "{91120000-003B-0000-0000-0000000FF1CE}_PRJPROR_{9E73617F-2F38-4864-BD61-BB2DDFE43323}" = Microsoft Office Project 2007 Service Pack 2 (SP2)
    "{91120000-0051-0000-0000-0000000FF1CE}" = Microsoft Office Visio Professional 2007
    "{91120000-0051-0000-0000-0000000FF1CE}_VISPROR_{0FD405D3-CAF8-4CA6-8BFD-911D2F8A6585}" = Microsoft Office Visio 2007 Service Pack 2 (SP2)
    "{91120000-0051-0000-0000-0000000FF1CE}_VISPROR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
    "{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
    "{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
    "{9656F3AC-6BA9-43F0-ABED-F214B5DAB27B}" = Windows Mobile 5.0 SDK R2 for Smartphone
    "{9875BF9C-8565-4085-B6A4-5D8D838FB5C3}" = HP Deskjet 460
    "{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = ALPS Touch Pad Driver
    "{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
    "{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
    "{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
    "{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}" = SigmaTel Audio
    "{A50C25D7-62E9-4511-AD70-8E2DA5E79B7D}" = Apple Software Update
    "{A5181519-9F3D-4372-ABC6-C333C2F3A816}_is1" = RunAlyzer
    "{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
    "{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
    "{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder
    "{AA59DDE4-B672-4621-A016-4C248204957A}" = Skypeâ„¢ 5.5
    "{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter
    "{AC76BA86-7AD7-1036-7B44-AA1000000001}" = Adobe Reader X (10.1.0) - Français
    "{ADBE46EE-54E0-4610-B436-D7E93D829100}" = Adobe Version Cue CS2
    "{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder
    "{AF111648-99A1-453E-81DD-80DBBF6DAD0D}" = MSVC90_x86
    "{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
    "{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
    "{B2F5D08C-7E79-4FCD-AAF4-57AD35FF0601}" = Adobe Illustrator CS2
    "{B32E7732-B2FB-3FD0-81AC-6025B1104C66}" = Microsoft Device Emulator version 3.0 - ENU
    "{B3B487E7-6171-4376-9074-B28082CEB504}" = Windows Live Call
    "{B3FED300-806C-11E0-A0D0-B8AC6F97B88E}" = Google*Earth
    "{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
    "{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Click to Call with Skype
    "{B74D4E10-6884-0000-0000-000000000101}" = Adobe Bridge 1.0
    "{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
    "{BE236D9A-52EC-4A17-82DA-84B5EAD31E3E}" = Zune Language Pack (DEU)
    "{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
    "{C49DAA9C-5BA8-459A-8244-E57B69DF0F04}" = Suite Specific
    "{C5074CC4-0E26-4716-A307-960272A90040}" = QuickSet
    "{C5D37FFA-7483-410B-982B-91E93FD3B7DA}" = Zune Language Pack (ITA)
    "{C68D33B1-0204-4EBE-BC45-A6E432B1D13A}" = Zune Language Pack (FRA)
    "{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
    "{CD49361E-3FE6-457E-90A1-9C59E29B5D02}" = Java DB 10.3.1.4
    "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
    "{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}" = Bluetooth Stack for Windows by Toshiba
    "{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
    "{D3116CC7-24DC-4CA3-9CE1-23FED836E9F2}" = Assistant de connexion Windows Live
    "{D61524CF-93FE-4193-91AD-C6E21FEEAA5A}" = Logitech Harmony Remote Software 7
    "{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
    "{E646DCF0-5A68-11D5-B229-002078017FBF}" = Digital Line Detect
    "{EAF092E3-6B95-41E8-B468-94B85DAD8603}" = eDocPrinter PDF Pro Ver 6.18
    "{EBFEEB3F-3E3B-4725-A4E0-376144CE4F76}" = Citrix XenApp Web Plugin
    "{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
    "{F2CB8C3C-9C9E-4FAB-9067-655601C5F748}" = Windows Mobile Device Updater Component
    "{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
    "{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
    "{FC053571-8507-44E4-8B6D-AACEAB8CA57C}" = Sansa Media Converter
    "{FCA651F3-5BDA-4DDA-9E4A-5D87D6914CC4}" = mWlsSafe
    "Adobe AIR" = Adobe AIR
    "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
    "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
    "Adobe Shockwave Player" = Adobe Shockwave Player
    "Adobe SVG Viewer" = Adobe SVG Viewer 3.0
    "chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
    "CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFA&SUBSYS_14F100C3" = Conexant HDA D110 MDC V.92 Modem
    "dBpoweramp Music Converter" = dBpoweramp Music Converter
    "Defraggler" = Defraggler
    "disk2goCnM_POD" = disk2go® CARD'N MUSIC - set power on defaults
    "DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
    "DVD Shrink_is1" = DVD Shrink 3.2
    "ENTERPRISER" = Microsoft Office Enterprise 2007
    "Formule Dé_is1" = Formule Dé 0.944
    "FPFarm" = La Petite Famille à la ferme
    "Free Music Zilla_is1" = Free Music Zilla
    "FTH Petite Sirène" = FTH Petite Sirène
    "Google Desktop" = Google Desktop
    "hp deskjet 460 series" = HP Deskjet 460 Series
    "IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
    "ie7" = Windows Internet Explorer 7
    "ie8" = Windows Internet Explorer 8
    "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.1.1800
    "McAfee Security Scan" = McAfee Security Scan Plus
    "Media Player Classic" = Media Player Classic fr
    "Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
    "Microsoft .NET Framework 3.5 Language Pack - fra" = Module linguistique Microsoft .NET Framework 3.5 - fra
    "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
    "Microsoft Document Explorer 2008" = Microsoft Document Explorer 2008
    "Microsoft Visual Studio 2005 Tools for Office Runtime" = Visual Studio 2005 Tools pour Office Second Edition Runtime
    "Mozilla Firefox 6.0.1 (x86 fr)" = Mozilla Firefox 6.0.1 (x86 fr)
    "MSC" = McAfee AntiVirus Plus
    "MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
    "MVApplication1" = SureThing CD Labeler 4 SE
    "MyTomTom" = MyTomTom 3.0.2.377
    "NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
    "NVIDIA Drivers" = NVIDIA Drivers
    "PRJPROR" = Microsoft Office Project Professional 2007
    "ProInst" = Intel PROSet Wireless
    "RealPlayer 6.0" = RealPlayer
    "SonicWALL SSL-VPN NetExtender" = SonicWALL SSL-VPN NetExtender
    "TmNations_is1" = TrackMania Nations ESWC - PlayLinc Update
    "TmUnited_is1" = TrackMania United DVD Patch 2006-12-15
    "Totalcmd" = Total Commander (Remove or Repair)
    "VaudTax2006" = VaudTax2006
    "VaudTax2007" = VaudTax2007
    "VaudTax2008" = VaudTax2008
    "VaudTax2009" = VaudTax2009
    "VaudTax2010" = VaudTax2010
    "VISPROR" = Microsoft Office Visio Professional 2007
    "Visual Studio Tools for the Office system 3.0 Runtime" = Visual Studio Tools for the Office system 3.0 Runtime
    "VLC media player" = VLC media player 1.1.4
    "WavePad" = WavePad Sound Editor
    "Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
    "Wdf01009" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
    "Windows Media Format Runtime" = Windows Media Format 11 runtime
    "Windows Media Player" = Lecteur Windows Media*11
    "Windows XP Service" = Windows XP Service Pack*3
    "WinLiveSuite_Wave3" = Installation Windows Live
    "WinRAR archiver" = Archiveur WinRAR
    "winusb0100" = Microsoft WinUsb 1.0
    "WinZip" = WinZip
    "WMFDist11" = Windows Media Format 11 runtime
    "wmp11" = Windows Media Player 11
    "Wudf01009" = Microsoft User-Mode Driver Framework Feature Pack 1.9
    "XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
    "XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
    "Xvid_is1" = Xvid 1.1.3 final uninstall
    "Zune" = Zune

    ========== HKEY_USERS Uninstall List ==========

    [HKEY_USERS\S-1-5-21-128965477-3582981272-972063890-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "b99583ccc4b39447" = ROUTE 66 Sync
    "Sansa Updater" = Sansa Updater

    ========== Last 10 Event Log Errors ==========

    [ Application Events ]
    Error - 10.09.2011 16:13:34 | Computer Name = LATITUDED820 | Source = Windows Search Service | ID = 3013
    Description = Impossible de mettre à jour l'entrée <C:\DOCUMENTS AND SETTINGS\ALL
    USERS\MENU DÉMARRER\PROGRAMMES\MCAFEE\MCAFEE ANTIVIRUS PLUS.LNK> dans la configuration
    de hachage. Contexte : Application , Catalogue SystemIndex Détails : Un périphérique
    attaché au système ne fonctionne pas correctement. (0x8007001f)

    Error - 10.09.2011 16:13:34 | Computer Name = LATITUDED820 | Source = Windows Search Service | ID = 3013
    Description = Impossible de mettre à jour l'entrée <C:\DOCUMENTS AND SETTINGS\ALL
    USERS\MENU DÉMARRER\PROGRAMMES\MCAFEE\MCAFEE ANTIVIRUS PLUS.LNK> dans la configuration
    de hachage. Contexte : Application , Catalogue SystemIndex Détails : Un périphérique
    attaché au système ne fonctionne pas correctement. (0x8007001f)

    Error - 10.09.2011 16:58:35 | Computer Name = LATITUDED820 | Source = Windows Search Service | ID = 3013
    Description = Impossible de mettre à jour l'entrée <C:\DOCUMENTS AND SETTINGS\ALL
    USERS\MENU DÉMARRER\PROGRAMMES\MCAFEE\MCAFEE ANTIVIRUS PLUS.LNK> dans la configuration
    de hachage. Contexte : Application , Catalogue SystemIndex Détails : Un périphérique
    attaché au système ne fonctionne pas correctement. (0x8007001f)

    Error - 10.09.2011 16:58:35 | Computer Name = LATITUDED820 | Source = Windows Search Service | ID = 3013
    Description = Impossible de mettre à jour l'entrée <C:\DOCUMENTS AND SETTINGS\ALL
    USERS\MENU DÉMARRER\PROGRAMMES\MCAFEE\MCAFEE ANTIVIRUS PLUS.LNK> dans la configuration
    de hachage. Contexte : Application , Catalogue SystemIndex Détails : Un périphérique
    attaché au système ne fonctionne pas correctement. (0x8007001f)

    Error - 11.09.2011 05:20:27 | Computer Name = LATITUDED820 | Source = crypt32 | ID = 131080
    Description = Échec de la récupération de la mise à jour automatique du numéro de
    séquence de la liste racine tierce partie à partir de : <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
    avec l'erreur : Cette opération s'est terminée car le délai d'attente a expiré.


    Error - 11.09.2011 05:20:38 | Computer Name = LATITUDED820 | Source = crypt32 | ID = 131080
    Description = Échec de la récupération de la mise à jour automatique du numéro de
    séquence de la liste racine tierce partie à partir de : <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
    avec l'erreur : Le serveur spécifié ne peut pas exécuter l'opération demandée.

    Error - 11.09.2011 05:20:38 | Computer Name = LATITUDED820 | Source = crypt32 | ID = 131080
    Description = Échec de la récupération de la mise à jour automatique du numéro de
    séquence de la liste racine tierce partie à partir de : <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
    avec l'erreur : Le serveur spécifié ne peut pas exécuter l'opération demandée.

    Error - 11.09.2011 05:20:38 | Computer Name = LATITUDED820 | Source = crypt32 | ID = 131080
    Description = Échec de la récupération de la mise à jour automatique du numéro de
    séquence de la liste racine tierce partie à partir de : <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
    avec l'erreur : Le serveur spécifié ne peut pas exécuter l'opération demandée.

    Error - 11.09.2011 05:20:39 | Computer Name = LATITUDED820 | Source = crypt32 | ID = 131080
    Description = Échec de la récupération de la mise à jour automatique du numéro de
    séquence de la liste racine tierce partie à partir de : <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
    avec l'erreur : Le serveur spécifié ne peut pas exécuter l'opération demandée.

    Error - 11.09.2011 05:20:39 | Computer Name = LATITUDED820 | Source = crypt32 | ID = 131080
    Description = Échec de la récupération de la mise à jour automatique du numéro de
    séquence de la liste racine tierce partie à partir de : <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
    avec l'erreur : Le serveur spécifié ne peut pas exécuter l'opération demandée.

    [ OSession Events ]
    Error - 21.01.2010 02:28:02 | Computer Name = LATITUDED820 | Source = Microsoft Office 12 Sessions | ID = 7001
    Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
    12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 209
    seconds with 60 seconds of active time. This session ended with a crash.

    Error - 29.01.2010 08:39:16 | Computer Name = LATITUDED820 | Source = Microsoft Office 12 Sessions | ID = 7001
    Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
    12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 66
    seconds with 0 seconds of active time. This session ended with a crash.

    Error - 15.02.2010 14:13:56 | Computer Name = LATITUDED820 | Source = Microsoft Office 12 Sessions | ID = 7001
    Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
    12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 5732
    seconds with 180 seconds of active time. This session ended with a crash.

    Error - 12.09.2010 07:47:14 | Computer Name = LATITUDED820 | Source = Microsoft Office 12 Sessions | ID = 7001
    Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
    12.0.6541.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 86549
    seconds with 4140 seconds of active time. This session ended with a crash.

    Error - 10.01.2011 06:48:18 | Computer Name = LATITUDED820 | Source = Microsoft Office 12 Sessions | ID = 7001
    Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
    12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 514
    seconds with 300 seconds of active time. This session ended with a crash.

    Error - 18.05.2011 14:17:28 | Computer Name = LATITUDED820 | Source = Microsoft Office 12 Sessions | ID = 7001
    Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
    12.0.6557.5001, Microsoft Office Version: 12.0.6425.1000. This session lasted 115
    seconds with 60 seconds of active time. This session ended with a crash.

    Error - 03.07.2011 11:32:21 | Computer Name = LATITUDED820 | Source = Microsoft Office 12 Sessions | ID = 7001
    Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
    12.0.6557.5001, Microsoft Office Version: 12.0.6425.1000. This session lasted 116163
    seconds with 360 seconds of active time. This session ended with a crash.

    [ System Events ]
    Error - 10.09.2011 16:11:45 | Computer Name = LATITUDED820 | Source = DCOM | ID = 10016
    Description = Les paramètres d'autorisation par défaut de l'ordinateur n'accordent
    pas d'autorisation Locale Activation pour l'application serveur COM avec le CLSID
    {A4199E55-EBB9-49E5-AF1A-7A5408B2E206} au SID AUTORITE NT\SERVICE RÉSEAU de l'utilisateur
    (S-1-5-20). Cette autorisation de sécurité peut être modifiée à l'aide de l'outil
    d'administration Services de composants.

    Error - 10.09.2011 16:11:45 | Computer Name = LATITUDED820 | Source = DCOM | ID = 10016
    Description = Les paramètres d'autorisation par défaut de l'ordinateur n'accordent
    pas d'autorisation Locale Activation pour l'application serveur COM avec le CLSID
    {A4199E55-EBB9-49E5-AF1A-7A5408B2E206} au SID AUTORITE NT\SERVICE RÉSEAU de l'utilisateur
    (S-1-5-20). Cette autorisation de sécurité peut être modifiée à l'aide de l'outil
    d'administration Services de composants.

    Error - 10.09.2011 16:11:45 | Computer Name = LATITUDED820 | Source = DCOM | ID = 10016
    Description = Les paramètres d'autorisation par défaut de l'ordinateur n'accordent
    pas d'autorisation Locale Activation pour l'application serveur COM avec le CLSID
    {A4199E55-EBB9-49E5-AF1A-7A5408B2E206} au SID AUTORITE NT\SERVICE RÉSEAU de l'utilisateur
    (S-1-5-20). Cette autorisation de sécurité peut être modifiée à l'aide de l'outil
    d'administration Services de composants.

    Error - 10.09.2011 16:13:03 | Computer Name = LATITUDED820 | Source = DCOM | ID = 10016
    Description = Les paramètres d'autorisation par défaut de l'ordinateur n'accordent
    pas d'autorisation Locale Activation pour l'application serveur COM avec le CLSID
    {A4199E55-EBB9-49E5-AF1A-7A5408B2E206} au SID AUTORITE NT\SERVICE RÉSEAU de l'utilisateur
    (S-1-5-20). Cette autorisation de sécurité peut être modifiée à l'aide de l'outil
    d'administration Services de composants.

    Error - 10.09.2011 16:13:04 | Computer Name = LATITUDED820 | Source = DCOM | ID = 10016
    Description = Les paramètres d'autorisation par défaut de l'ordinateur n'accordent
    pas d'autorisation Locale Activation pour l'application serveur COM avec le CLSID
    {A4199E55-EBB9-49E5-AF1A-7A5408B2E206} au SID AUTORITE NT\SERVICE RÉSEAU de l'utilisateur
    (S-1-5-20). Cette autorisation de sécurité peut être modifiée à l'aide de l'outil
    d'administration Services de composants.

    Error - 10.09.2011 16:13:04 | Computer Name = LATITUDED820 | Source = DCOM | ID = 10016
    Description = Les paramètres d'autorisation par défaut de l'ordinateur n'accordent
    pas d'autorisation Locale Activation pour l'application serveur COM avec le CLSID
    {A4199E55-EBB9-49E5-AF1A-7A5408B2E206} au SID AUTORITE NT\SERVICE RÉSEAU de l'utilisateur
    (S-1-5-20). Cette autorisation de sécurité peut être modifiée à l'aide de l'outil
    d'administration Services de composants.

    Error - 10.09.2011 16:13:33 | Computer Name = LATITUDED820 | Source = Service Control Manager | ID = 7022
    Description = Le service NTRU Hybrid TSS v2.0.25 TCS est en attente de démarrage.

    Error - 10.09.2011 16:13:33 | Computer Name = LATITUDED820 | Source = Service Control Manager | ID = 7034
    Description = Le service NTRU Hybrid TSS v2.0.25 TCS s'est terminé de façon inattendue
    pour la 1ème fois.

    Error - 10.09.2011 16:14:30 | Computer Name = LATITUDED820 | Source = DCOM | ID = 10010
    Description = Le serveur {3A185DDE-E020-4985-A8F2-E27CDC4A0F3A} ne s'est pas enregistré
    sur DCOM avant la fin du temps imparti.

    Error - 11.09.2011 05:35:45 | Computer Name = LATITUDED820 | Source = DCOM | ID = 10005
    Description = DCOM a reçu l'erreur "%1058" lors de la mise en route du service IISADMIN
    avec les arguments " " pour démarrer le serveur*: {A9E69610-B80D-11D0-B9B9-00A0C922E750}


    < End of report >
     
    MuadDib,
    #30
  12. 2011/09/11
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    1. Update your Java version here: http://www.java.com/en/download/installed.jsp

    Note 1: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

    Note 2: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. If you don't want to run another extra service, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and restart your computer.

    2. Now, we need to remove old Java version and its remnants...

    Download JavaRa to your desktop and unzip it to its own folder
    • Run JavaRa.exe (Vista users! Right click on JavaRa.exe, click Run As Administrator), pick the language of your choice and click Select. Then click Remove Older Versions.
    • Accept any prompts.

    ==================================================

    Run OTL
    • Under the [color= "#0000FF"]Custom Scans/Fixes[/color] box at the bottom, paste in the following

      Code:
      :OTL
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings:  "ProxyServer" = proxy.heig-vd.ch:8080
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings:  "ProxyServer" = proxy.heig-vd.ch:8080
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: File not found
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file:///C:/WINDOWS/Java/classes/xmldso.cab (Reg Error: Key error.)
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2011.02.20 00:31:00 | 000,014,082 | -HS- | C] () -- C:\Documents and Settings\XXX YYY\Local Settings\Application Data\i258bi41o6f8c31hv73s74rec05dk42
[2011.02.20 00:31:00 | 000,014,082 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\i258bi41o6f8c31hv73s74rec05dk42
@Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:456A69E6
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:1940DBE8


:Services

:Reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 "DisableMonitoring" =-

:Files

:Commands
[purity]
[emptytemp]
[emptyflash]
[Reboot]
    • Then click the [color= "#FF0000"]Run Fix[/color] button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • You will get a log that shows the results of the fix. Please post it.

    ================================================

    Last scans...

    1. Download Security Check from HERE, and save it to your Desktop.
    • Double-click SecurityCheck.exe
    • Follow the onscreen instructions inside of the black box.
    • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

      NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.


    2. Download Temp File Cleaner (TFC)
    • Double click on TFC.exe to run the program.
    • Click on Start button to begin cleaning process.
    • TFC will close all running programs, and it may ask you to restart computer.


    3. Please run a free online scan with the ESET Online Scanner

    • Disable your antivirus program
    • Tick the box next to YES, I accept the Terms of Use
    • Click Start
    • Accept any security warnings from your browser.
    • Check Scan archives
    • Click Start
    • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    • When the scan completes, push List of found threats
    • Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
    • NOTE. If Eset won't find any threats, it won't produce any log.
     
    broni,
    #31
  13. 2011/09/11
    MuadDib

    MuadDib Inactive Thread Starter

    Joined:
    2011/09/07
    Messages:
    29
    Likes Received:
    0
    Here's the log from OTL
    All processes killed
    ========== OTL ==========
    HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!
    HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!
    Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=\ deleted successfully.
    Starting removal of ActiveX control {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found.
    Starting removal of ActiveX control {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
    File oft XML Parser for Java file:///C:/WINDOWS/Java/classes/xmldso.cab not found.
    Starting removal of ActiveX control Microsoft XML Parser for Java
    Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Microsoft XML Parser for Java\DownloadInformation\\INF .
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Microsoft XML Parser for Java\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Microsoft XML Parser for Java\ not found.
    C:\WINDOWS\002956_.tmp deleted successfully.
    C:\WINDOWS\4DCA27399D164B55808CE72CD70A5BD3.TMP\WiseCustomCalla.dll deleted successfully.
    C:\WINDOWS\4DCA27399D164B55808CE72CD70A5BD3.TMP\WiseData.ini deleted successfully.
    C:\WINDOWS\4DCA27399D164B55808CE72CD70A5BD3.TMP folder deleted successfully.
    C:\WINDOWS\System32\CONFIG.TMP deleted successfully.
    C:\Documents and Settings\XXX YYY\Local Settings\Application Data\i258bi41o6f8c31hv73s74rec05dk42 moved successfully.
    C:\Documents and Settings\All Users\Application Data\i258bi41o6f8c31hv73s74rec05dk42 moved successfully.
    ADS C:\Documents and Settings\All Users\Application Data\TEMP:456A69E6 deleted successfully.
    ADS C:\Documents and Settings\All Users\Application Data\TEMP:1940DBE8 deleted successfully.
    ========== SERVICES/DRIVERS ==========
    ========== REGISTRY ==========
    Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus\\DisableMonitoring deleted successfully.
    ========== FILES ==========
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: Administrateur
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: All Users

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 81569 bytes
    ->Flash cache emptied: 41620 bytes

    User: XXX YYY
    ->Temp folder emptied: 21077 bytes
    ->Temporary Internet Files folder emptied: 146907886 bytes
    ->Java cache emptied: 27710429 bytes
    ->FireFox cache emptied: 142505682 bytes
    ->Flash cache emptied: 211623 bytes

    User: LocalService
    ->Temp folder emptied: 65748 bytes
    ->Temporary Internet Files folder emptied: 262278 bytes

    User: XXX YYY
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 78991 bytes
    ->FireFox cache emptied: 2503466 bytes

    User: NetworkService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 33170 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32\dllcache .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 3555 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 36713 bytes
    RecycleBin emptied: 0 bytes

    Total Files Cleaned = 306.00 mb


    [EMPTYFLASH]

    User: Administrateur

    User: All Users

    User: Default User
    ->Flash cache emptied: 0 bytes

    User: XXX YYY
    ->Flash cache emptied: 0 bytes

    User: LocalService

    User: XXX YYY

    User: NetworkService

    Total Flash Files Cleaned = 0.00 mb


    OTL by OldTimer - Version 3.2.27.0 log created on 09112011_224611

    Files\Folders moved on Reboot...

    Registry entries deleted on Reboot...
     
    MuadDib,
    #32
  14. 2011/09/11
    MuadDib

    MuadDib Inactive Thread Starter

    Joined:
    2011/09/07
    Messages:
    29
    Likes Received:
    0
    Security Check :
    Results of screen317's Security Check version 0.99.7
    Windows XP Service Pack 3
    Internet Explorer 8
    ``````````````````````````````
    Antivirus/Firewall Check:
    McAfee AntiVirus Plus
    McAfee Security Scan Plus
    Antivirus up to date!
    ```````````````````````````````
    Anti-malware/Other Utilities Check:
    Malwarebytes' Anti-Malware
    Java(TM) 6 Update 27
    Java(TM) 6 Update 5
    Java(TM) 6 Update 7
    Java(TM) SE Development Kit 6 Update 7
    Java DB 10.3.1.4
    Out of date Java installed!
    Adobe Flash Player 10.2.153.1
    Adobe Reader X (10.1.0) - Français
    Mozilla Firefox (x86 fr..) Firefox Out of Date!
    ````````````````````````````````
    Process Check:
    objlist.exe by Laurent
    ``````````End of Log````````````

    And from Eset on line scanner :
    C:\Download\TorpigRemovalTool\TorpigRemovalTool.exe probably a variant of Win32/SecurityStronghold application deleted - quarantined
    C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP793\A0213179.exe probably a variant of Win32/SecurityStronghold application deleted - quarantined
     
    MuadDib,
    #33
  15. 2011/09/11
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Uninstall:
    Java(TM) 6 Update 5
    Java(TM) 6 Update 7
    Java(TM) SE Development Kit 6 Update 7
    Java DB 10.3.1.4

    =============================================

    Your computer is clean [​IMG]

    1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

    Run OTL

    • Under the Custom Scans/Fixes box at the bottom, paste in the following:

    Code:
    :OTL
:Commands
[purity]
[emptytemp]
[EMPTYFLASH]
[CLEARALLRESTOREPOINTS]
[Reboot]
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • Post resulting log.

    2. Now, we'll remove all tools, we used during our cleaning process

    Clean up with OTL:

    • Double-click OTL.exe to start the program.
    • Close all other programs apart from OTL as this step will require a reboot
    • On the OTL main screen, press the CLEANUP button
    • Say Yes to the prompt and then allow the program to reboot your computer.

    If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

    3. Make sure, Windows Updates are current.

    4. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

    5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

    6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

    7. Run Temporary File Cleaner (TFC) weekly.

    8. Download and install Secunia Personal Software Inspector (PSI): http://secunia.com/vulnerability_scanning/personal/. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

    9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
    The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

    10. (Windows XP only) Run defrag at your convenience.

    11. When installing\updating ANY program, make sure you always select "Custom " installation, so you can UN-check any possible "drive-by-install" (foistware), like toolbars etc., which may try to install along with the legitimate program. Do NOT click "Next" button without looking at any given page.

    12. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

    13. Please, let me know, how your computer is doing.
     
    broni,
    #34
  16. 2011/09/12
    MuadDib

    MuadDib Inactive Thread Starter

    Joined:
    2011/09/07
    Messages:
    29
    Likes Received:
    0
    Thanks for the help. I just complete the steps this evening when I'm back home.
    I've just some more questions :
    1. I forgot I have a USB disk that I just connect sometimes, how can I be sure that it's safe to connect it ? How can I "simply" scan it ?
    2. Same questions for USB key
    3. Can you tell me of what kind of infection I got ?
    4. I have Windows Firewall activated all the time, why did it not warn me about a Trojan sending informations on the net ?
    Thanks in advance for your reply.
     
    MuadDib,
    #35
  17. 2011/09/12
    MuadDib

    MuadDib Inactive Thread Starter

    Joined:
    2011/09/07
    Messages:
    29
    Likes Received:
    0
    And here's the last log of OTL:
    All processes killed
    ========== OTL ==========
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: Administrateur
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: All Users

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: XXX YYY
    ->Temp folder emptied: 116863 bytes
    ->Temporary Internet Files folder emptied: 2891924 bytes
    ->Java cache emptied: 0 bytes
    ->FireFox cache emptied: 45540336 bytes
    ->Flash cache emptied: 456 bytes

    User: LocalService
    ->Temp folder emptied: 66016 bytes
    ->Temporary Internet Files folder emptied: 33170 bytes

    User: XXX YYY
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->FireFox cache emptied: 0 bytes

    User: NetworkService
    ->Temp folder emptied: 66016 bytes
    ->Temporary Internet Files folder emptied: 33170 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 4464128 bytes
    %systemroot%\System32\dllcache .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 483 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
    RecycleBin emptied: 0 bytes

    Total Files Cleaned = 51.00 mb


    [EMPTYFLASH]

    User: Administrateur

    User: All Users

    User: Default User
    ->Flash cache emptied: 0 bytes

    User: XXX YYY
    ->Flash cache emptied: 0 bytes

    User: LocalService

    User: XXX YYY

    User: NetworkService

    Total Flash Files Cleaned = 0.00 mb

    Restore points cleared and new OTL Restore Point set!

    OTL by OldTimer - Version 3.2.27.0 log created on 09122011_220651

    Files\Folders moved on Reboot...
    File\Folder C:\WINDOWS\System32\OLDDA35.tmp not found!

    Registry entries deleted on Reboot...

    Just one more question : my computer beeps (internal speaker) when XP displays message for WiFi connection. Before all this stuff of cleaning it was not the same. Any idea about that?
    Thanks
     
    MuadDib,
    #36
  18. 2011/09/12
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    1 and 2...
    Install this on your computer and then it's safe to plugin any USB device to scan it with your AV program...

    Download, and run Flash Disinfector, and save it to your desktop (Windows Vista and Windows 7 users, scroll down)

    *Please disable any AV / ScriptBlockers as they might detect Flash Disinfector to be malicious and block it. Hence, the failure in executing. You can enable them back after the cleaning process*

    • Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear.
    • The utility may ask you to insert your flash drive and/or other removable drives. Please do so and allow the utility to clean up those drives as well.
    • Hold down the Shift key when inserting the drive until Windows detects it to keep autorun.inf from executing if it is present.
    • Wait until it has finished scanning and then exit the program.
    • Reboot your computer when done.
    Note: As part of its routine, Flash_Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive that was plugged in when you ran it. Do not delete this folder...it will help protect your drives from future infection by keeping the autorun file from being installed on the root drive and running other malicious files.

    Windows Vista and Windows 7 users
    Flash Disinfector is not compatible with the above Windows version.
    Please, use Panda USB Vaccine, or BitDefender’s USB Immunizer

    3. Multiple trojans removed by Combofix.

    4. Windows firewall is one-way firewall. It doesn't control outgoing traffic. Only incoming.

    As for WiFi - no clue. Try different forum.

    In any case...
    Good luck and stay safe :)
     
    broni,
    #37
Page 2 of 2

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...