redémarrage en boucle intempestif Résolu

Question

Bonjour,

Mon pc démarre. Windows se lance mais, lorsque mon bureau apparait, il plante de façon intempestive : le reboot se lance.

De plus, mon antivirus n'est plus accessible (bitdefender internet security 2009). Je suis actuellement en mode sans échec.

J'ai tenté de faire une analyse en ligne sur les différents sites (kaspersky, secure, etc) et impossible.

Pouvez-vous m'aider svp ?

d'avance merci

gen-hackman · Answer

salut :

Télécharge OTL de OLDTimer

&#9654 enregistre le sur ton Bureau.

&#9654 Double clic sur OTL.exe pour le lancer.

&#9654 Coche les 2 cases Lop et Purity

&#9654 Coche la case devant scan all users

&#9654 règle-le sur "60 Days"

&#9654Clic sur Run Scan.

A la fin du scan, le Bloc-Notes va s'ouvrir avec le rapport (OTL.txt).

Ce fichier est sur ton Bureau (en général C:\Documents and settings\le_nom_de_ta_session\OTL.txt)

&#9654&#9654&#9654 NE LE POSTE PAS SUR LE FORUM

Pour me le transmettre clique sur ce lien : http://www.cijoint.fr/

&#9654 Clique sur Parcourir et cherche le fichier ci-dessus.

&#9654 Clique sur Ouvrir.

&#9654 Clique sur "Cliquez ici pour déposer le fichier".

Un lien de cette forme :

http://www.cijoint.fr/cjlink.php?file=cjge368/cijSKAP5fU.txt

est ajouté dans la page.

&#9654 Copie ce lien dans ta réponse.

Tu feras la meme chose avec le "Extra.txt".

maewa95 · Answer

bonjour,

tout d'abord merci pour ta réactivité. 

Voici les liens :

http://www.cijoint.fr/cjlink.php?file=cj200908/cijknLtjf2.txt

http://www.cijoint.fr/cjlink.php?file=cj200908/cijp3fflUK.txt

gen-hackman · Answer

&#9654 Télécharge SDFix sur ton bureau : 
ici :SDFix 
ou ici SDFix 
ou ici SDFix 

&#9654 Double-clique sur SDFix.exe et choisis "Install" . 

Tuto 

Puis une fois l'installe faite , 

Impératif !!!: Démarrer en mode sans echec . 

/!\ Ne jamais démarrer en mode sans échec via MSCONFIG /!\ 

Comment aller en Mode sans échec : 
&#9654 Redémarre ton ordi . 
&#9654 Tapote la touche F8 immédiatement, (F5 sur certains PC) juste après le "Bip" . 
&#9654 Tu tapotes jusqu' à l'apparition de l'écran avec les options de démarrage . 
&#9654 Choisis la première option : Sans Échec , et valide en tapant sur [Entrée] . 
&#9654 Choisis ton compte habituel ( et pas Administrateur ).
 
attention : pas de connexion possible en mode sans échec , donc copie ou imprime bien la manipe pour éviter les erreurs ... 


&#9654 Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double-clique sur RunThis.bat pour lancer l'outil . 

&#9654 Tapes Y pour lancer le script ...
 
Le Fix supprime les services du virus et nettoie le registre, de ce fait un redémarrage est nécessaire , donc :
 
&#9654 presse une touche pour redémarrer quand il te le sera demandé . 

Le PC va mettre du temps avant de démarrer ( c'est normal ), après le chargement du Bureau :

&#9654 presse une touche lorsque "Finished" s'affiche . 

Le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier
 
C:\SDFix sous le nom "Report.txt". 

&#9654 Poste ce dernier dans ta prochaine réponse
__________________________________________________________

&#9654Si SDfix ne se lance pas (ça arrive!) 

&#9654 Démarrer->Exécuter 

&#9654 Copie/colle ceci : 

%systemroot%\system32\cmd.exe /K %systemdrive%\SDFix\apps\FixPath.exe 

&#9654 Clique sur ok, et valide. 

&#9654 Redémarre et essaye de nouveau de lancer SDfix , toujours en mode sans echec .

maewa95 · Answer

une dernière question avant de lancer la manip :

Je suis actuellement en mode sans échec mais avec l'option connexion sur le net.

Dois-je me déconnecter totalement et revenir en mode sans echec sans connexion pour faire cette manip ou bien puis-je rester comme je suis c'est-à-dire mode sans échec et connectée stp ?

gen-hackman · Answer

sans connection pour utiliser l'outil stp

maewa95 · Answer

voici le rapport mais le problème persiste car impossible de démarrer normalement. Je suis toujours en mode sans échec

http://www.cijoint.fr/cjlink.php?file=cj200908/cij1D2ACN1.txt

gen-hackman · Answer

Desactive la protection residente de ton antivirus et ton parefeu si present , le temps du scan

Telecharge  List'em et enregistre-le sur ton bureau et pas ailleurs

double-clic (Pour vista clic droit "executer en tant qu'administrateur")sur l'icone présent sur le bureau pour le lancer

laisse travailler l'outil, le scan devrait durer moins de 10 mn

une fois le scan Terminé le rapport s'affiche

colle son contenu si des fichiers sont detectés dans ta prochaine reponse ici.

maewa95 · Answer

le problème c'est que je ne peux pas désactiver mon antivirus car je n'ai plus l'icône dans la barre en bas et lorsque je clique sur le raccourci sur mon bureau, j'ai un message qui me dit que le site de bitdefender ne répond pas. Le firewall est aussi de chez bitdefender.

Je fais comment stp ?

heuuuuuuuu j'ai beau enregistrer listem sur mon bureau mais je ne le vois pas pour l'installer

c'est normal docteur ? lol

gen-hackman · Answer

c'est un microprocesseur noir l'icone

il ne s installe pas c est une application

maewa95 · Answer

je ne comprends pas comment j'ai pu avoir sweetim sur mon pc, je sais que c'est une vraie saleté ! 

voici le rapport :

http://www.cijoint.fr/cjlink.php?file=cj200908/cijhE7FNJR.txt

gen-hackman · Answer

&#9654 Télécharge Ad-remover ( de C_XX ) sur ton bureau : 


&#9654 Déconnecte toi et ferme toutes applications en cours ! 

&#9654 Double clique sur "Ad-R.exe" pour lancer l'installation et laisse les paramètres d'installation par défaut . 

&#9654 Double-clique sur le raccourci Ad-remover qui est sur ton bureau pour lancer l'outil .
 
&#9654 Au menu principal choisis l'option "L" et tape sur [entrée] .

&#9654 Laisse travailler l'outil et ne touche à rien ... 

&#9654 Poste le rapport qui apparait à la fin , sur le forum ...

( Le rapport est sauvegardé aussi sous C:\Ad-report.log ) 
( CTRL+A Pour tout sélectionner , CTRL+C pour copier et CTRL+V pour coller ) 

&#9654 Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool. 
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. 
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.

maewa95 · Answer

Lors du scan, il y a eu un message répété environ 6/7 fois qui disait que la ligne 8 était trop longue

voici le rapport :

.
======= RAPPORT D'AD-REMOVER 1.1.4.5_O | UNIQUEMENT XP/VISTA/SEVEN =======
.
Mit à jour par C_XX le 24/06/2009 à 7:10 PM
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Lancé à: 21:21:34, 09/08/2009 | Mode sans echec | Option: CLEAN
Exécuté de: C:\Program Files\Ad-remover\
Système d'exploitation: Microsoft® Windows XP™  Service Pack 3 v5.1.2600
Nom du PC: SN402039360009 | Utilisateur actuel: maewa
.
Administrateur: Administrateur 
N'est pas administrateur: ASPNET 
Administrateur: maewa 
N'est pas administrateur: HelpAssistant *Desactive* 
N'est pas administrateur: Invité 
N'est pas administrateur: SUPPORT_388945a0 *Desactive* 
. 
============== ÉLÉMENT(S) NEUTRALISÉ(S) ============== 
.
.
HKCR\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCR\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKCR\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}
HKCR\EoRezoBHO.EoBho
HKCR\EoRezoBHO.EoBho.1
HKCR\Interface\{B0D071A1-36B3-4757-A126-14C89C56013A}
HKCR\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}
HKCR\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}
HKCR\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}
HKCR\SWEETIE.IEToolbar
HKCR\SWEETIE.IEToolbar.1
HKCR\SWEETIE.SWEETIE
HKCR\SWEETIE.SWEETIE.3
HKCR\SweetIM_URLSearchHook.ToolbarURLSearchHook
HKCR\SweetIM_URLSearchHook.ToolbarURLSearchHook.1
HKCR\Toolbar3.SWEETIE
HKCR\Toolbar3.SWEETIE.1
HKCR\Typelib\{B4C656C9-F2E9-4E77-B3F4-443DF2BD778F}
HKCR\Typelib\{EEE6C35E-6118-11DC-9C72-001320C79847}
HKCR\Typelib\{EEE6C35F-6118-11DC-9C72-001320C79847}
HKCU\Software\EoRezo
HKCU\Software\ItsLabel
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1A0AADCD-3A72-4B5F-900F-E3BB5A838E2A}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{64F56FC1-1272-44CD-BA6E-39723696E350}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BC4FFE41-DE9F-46fa-B455-AAD49B9F9938}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKCU\Software\SweetIM
HKLM\Software\EoRezo
HKLM\Software\ItsLabel
HKLM\Software\Microsoft\ESENT\Process\SweetIM
HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64F56FC1-1272-44CD-BA6E-39723696E350}
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\ItsTV_is1
HKLM\Software\SweetIM
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Sweetim
HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\{BC4FFE41-DE9F-46FA-B455-AAD49B9F9938}
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{BC4FFE41-DE9F-46FA-B455-AAD49B9F9938}
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\980289C22F80A7C4BB9323DC61255E4E
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\FA96423FE2B98E248A3B23548D1E22D9
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-21-4131921849-2024023189-673777175-1005\Components\305B09CE8C53A214DB58887F62F25536
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-21-4131921849-2024023189-673777175-1005\Components\351716A953E21214898904032EAE2E81
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-21-4131921849-2024023189-673777175-1005\Components\397C771A7BCAC904697C3EC629ED33ED
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-21-4131921849-2024023189-673777175-1005\Components\98CC8BF5A4A6E6C4ABF7051DDAB8B058
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-21-4131921849-2024023189-673777175-1005\Components\A189D17A469616C4688D23E192996267
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-21-4131921849-2024023189-673777175-1005\Components\D15DAF33C220F91468A1D7D57C31ACD7
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-21-4131921849-2024023189-673777175-1005\Components\D3BA76A44C779424889063D5098ED2D6
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-21-4131921849-2024023189-673777175-1005\Components\D6D0EB9FDBD90C04D92A7E729058F10D
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-21-4131921849-2024023189-673777175-1005\Components\E4748F9A4181FCE46A23C13B517B9420
.
C:\DOCUME~1\CLAUDE~1\APPLIC~1\ItsLabel\ItsTV 
C:\DOCUME~1\CLAUDE~1\APPLIC~1\ItsLabel\ItsTV\itsTV.xml 
C:\DOCUME~1\CLAUDE~1\APPLIC~1\ItsLabel 
C:\Program Files\ItsLabel\ItsTV.exe 
C:\Program Files\ItsLabel\ItsTV.url 
C:\Program Files\ItsLabel\ItsTV.xml 
C:\Program Files\ItsLabel\Loading.swf 
C:\Program Files\ItsLabel\unins000.dat 
C:\Program Files\ItsLabel\unins000.exe 
C:\Program Files\ItsLabel 
C:\WINDOWS\Installer\10e5c04.msi 

(!) -- Fichiers temporaires supprimés.

.
============== Scan additionnel ==============
.

* Mozilla FireFox Version 3.0.13 *

 Nom du profil: fwyph058.default (maewa)
.
(Prefs.js) user_pref("browser.startup.homepage", "www.google.fr"); 
(Prefs.js) user_pref("browser.startup.homepage_override.mstone", "rv:1.9.0.13"); 
.
. 

* Internet Explorer Version 8.0.6001.18702 *

[HKEY_CURRENT_USER\..\Internet Explorer\Main]

Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://search.msn.com/spbasic.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://fr.msn.com/

[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

   Tabs: res://ieframe.dll/tabswelcome.htm

============== Suspect (Cracks, Serials ... ) ==============

. 
C:\Documents and Settings\maewa\Mes documents\polices de caractŠres t‚l‚charg‚es\patchwork_angel.zip 
.
===================================
.
6461 Octet(s) - C:\Ad-Report-CLEAN.log 
.
0 Fichier(s) - C:\DOCUME~1\CLAUDE~1\LOCALS~1\Temp 
0 Fichier(s) - C:\WINDOWS\Temp 
.
19 Fichier(s) - C:\Program Files\Ad-remover\BACKUP
8 Fichier(s) - C:\Program Files\Ad-remover\QUARANTINE
.
Fin à: 21:56:34 | 09/08/2009
.
============== E.O.F ==============
.

gen-hackman · Answer

desinstalle AD-Remover

et refais OTL stp , avec les deux rapports

maewa95 · Answer

hola,

c'est normal que je n'ai pas eu le fichier extra.txt ?

voici un des deux rapports :

http://www.cijoint.fr/cjlink.php?file=cj200908/cijkkEr5Oe.txt

gen-hackman · Answer

&#9654 Télécharge Zeb-Restoreet enregistre ce fichier sur le bureau. 

&#9654-Clic droit Zeb-Restore.zip ==> Extraire tout choisis comme lieu d'enregistrement le bureau.
 
&#9654-Ouvre le dossier ZR_1.0.0.37 ==> double clic sur Zeb-Restore.exe 

&#9654- Coche la case devant :sites de confiance

&#9654- Ne coche aucune autre case 

&#9654-Clique sur Restaurer 

&#9654-Redémarre ton PC

ensuite :

&#9654 Double clic sur OTL.exe pour le lancer.


&#9654Copie la liste qui se trouve en gras ci-dessous,

&#9654 colle-la dans la zone sous Customs Scans/Fixes :

:processes
explorer.exe
iexplore.exe
firefox.exe
msnmsgr.exe
Teatimer.exe

:services
catchme

:OTL
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - No CLSID value found.
O2 - BHO: (no name) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No CLSID value found.
O4 - HKLM..\Run: [KernelFaultCheck]  File not found
O4 - HKLM..\Run: [Cmaudio]  File not found
O4 - HKLM..\Run: [ShStatEXE] C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-19_Classes\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-20_Classes\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-21-4131921849-2024023189-673777175-1005\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-21-4131921849-2024023189-673777175-1005_Classes\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: &Windows Live Search - Reg Error: Value error. File not found
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} Reg Error: Value error. (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab (Java Plug-in 1.5.0_09)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\msdaipp - No CLSID value found
@Alternate Data Stream - 68 bytes -> C:\WINDOWS\wiaservc.log:KAVICHS
@Alternate Data Stream - 68 bytes -> C:\WINDOWS\System32	ssoft32.acm:KAVICHS
@Alternate Data Stream - 68 bytes -> C:\WINDOWS\System32	sbyuv.dll:KAVICHS
@Alternate Data Stream - 68 bytes -> C:\WINDOWS\System32\stdole32.tlb:KAVICHS
@Alternate Data Stream - 68 bytes -> C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe:KAVICHS
@Alternate Data Stream - 68 bytes -> C:\WINDOWS\System32\slserv.exe:KAVICHS
@Alternate Data Stream - 68 bytes -> C:\WINDOWS\System32\oleacc.dll:KAVICHS
@Alternate Data Stream - 68 bytes -> C:\WINDOWS\System32\msvidc32.dll:KAVICHS
@Alternate Data Stream - 68 bytes -> C:\WINDOWS\System32\msgsm32.acm:KAVICHS
@Alternate Data Stream - 68 bytes -> C:\WINDOWS\System32\msg723.acm:KAVICHS
@Alternate Data Stream - 68 bytes -> C:\WINDOWS\System32\msg711.acm:KAVICHS
@Alternate Data Stream - 68 bytes -> C:\WINDOWS\System32\msacm32.drv:KAVICHS
@Alternate Data Stream - 68 bytes -> C:\WINDOWS\System32\ir32_32.dll:KAVICHS
@Alternate Data Stream - 68 bytes -> C:\WINDOWS\System32\drwtsn32.exe:KAVICHS
@Alternate Data Stream - 68 bytes -> C:\WINDOWS\System32\DRIVERS\ultra.sys:KAVICHS
@Alternate Data Stream - 68 bytes -> C:\WINDOWS\System32\DRIVERS	oside.sys:KAVICHS
@Alternate Data Stream - 68 bytes -> C:\WINDOWS\System32\DRIVERS\symc8xx.sys:KAVICHS
@Alternate Data Stream - 68 bytes -> C:\WINDOWS\System32\DRIVERS\symc810.sys:KAVICHS
@Alternate Data Stream - 68 bytes -> C:\WINDOWS\System32\DRIVERS\sym_u3.sys:KAVICHS
@Alternate Data Stream - 68 bytes -> C:\WINDOWS\System32\DRIVERS\sym_hi.sys:KAVICHS
@Alternate Data Stream - 68 bytes -> C:\WINDOWS\System32\DRIVERS\sparrow.sys:KAVICHS
@Alternate Data Stream - 68 bytes -> C:\WINDOWS\System32\DRIVERS\Slnthal.sys:KAVICHS
@Alternate Data Stream - 68 bytes -> C:\WINDOWS\System32\DRIVERS\SISAGPX.sys:KAVICHS
@Alternate Data Stream - 68 bytes -> C:\WINDOWS\System32\DRIVERS\ql1280.sys:KAVICHS
@Alternate Data Stream - 68 bytes -> C:\WINDOWS\System32\DRIVERS\ql1240.sys:KAVICHS
@Alternate Data Stream - 68 bytes -> C:\WINDOWS\System32\DRIVERS\ql12160.sys:KAVICHS
@Alternate Data Stream - 68 bytes -> C:\WINDOWS\System32\DRIVERS\ql10wnt.sys:KAVICHS
@Alternate Data Stream - 68 bytes -> C:\WINDOWS\System32\DRIVERS\ql1080.sys:KAVICHS
@Alternate Data Stream - 68 bytes -> C:\WINDOWS\System32\DRIVERS\perc2hib.sys:KAVICHS
@Alternate Data Stream - 68 bytes -> C:\WINDOWS\System32\DRIVERS\perc2.sys:KAVICHS
@Alternate Data Stream - 68 bytes -> C:\WINDOWS\System32\DRIVERS\Mtlstrm.sys:KAVICHS
@Alternate Data Stream - 68 bytes -> C:\WINDOWS\System32\DRIVERS\mraid35x.sys:KAVICHS
@Alternate Data Stream - 68 bytes -> C:\WINDOWS\System32\DRIVERS\ini910u.sys:KAVICHS
@Alternate Data Stream - 68 bytes -> C:\WINDOWS\System32\DRIVERS\hpn.sys:KAVICHS
@Alternate Data Stream - 68 bytes -> C:\WINDOWS\System32\DRIVERS\ftdisk.sys:KAVICHS
@Alternate Data Stream - 68 bytes -> C:\WINDOWS\System32\DRIVERS\dpti2o.sys:KAVICHS
@Alternate Data Stream - 68 bytes -> C:\WINDOWS\System32\DRIVERS\dac960nt.sys:KAVICHS
@Alternate Data Stream - 68 bytes -> C:\WINDOWS\System32\DRIVERS\dac2w2k.sys:KAVICHS
@Alternate Data Stream - 68 bytes -> C:\WINDOWS\System32\DRIVERS\cpqarray.sys:KAVICHS
@Alternate Data Stream - 68 bytes -> C:\WINDOWS\System32\DRIVERS\cmdide.sys:KAVICHS
@Alternate Data Stream - 68 bytes -> C:\WINDOWS\System32\DRIVERS\cd20xrnt.sys:KAVICHS
@Alternate Data Stream - 68 bytes -> C:\WINDOWS\System32\DRIVERS\cbidf2k.sys:KAVICHS
@Alternate Data Stream - 68 bytes -> C:\WINDOWS\System32\DRIVERS\asc3550.sys:KAVICHS
@Alternate Data Stream - 68 bytes -> C:\WINDOWS\System32\DRIVERS\asc3350p.sys:KAVICHS
@Alternate Data Stream - 68 bytes -> C:\WINDOWS\System32\DRIVERS\asc.sys:KAVICHS
@Alternate Data Stream - 68 bytes -> C:\WINDOWS\System32\DRIVERS\amsint.sys:KAVICHS
@Alternate Data Stream - 68 bytes -> C:\WINDOWS\System32\DRIVERS\aliide.sys:KAVICHS
@Alternate Data Stream - 68 bytes -> C:\WINDOWS\System32\DRIVERS\aic78xx.sys:KAVICHS
@Alternate Data Stream - 68 bytes -> C:\WINDOWS\System32\DRIVERS\aic78u2.sys:KAVICHS
@Alternate Data Stream - 68 bytes -> C:\WINDOWS\System32\DRIVERS\aha154x.sys:KAVICHS
@Alternate Data Stream - 68 bytes -> C:\WINDOWS\System32\DRIVERS\adpu160m.sys:KAVICHS
@Alternate Data Stream - 68 bytes -> C:\WINDOWS\System32\bootvid.dll:KAVICHS
@Alternate Data Stream - 68 bytes -> C:\Documents and Settings\maewa\Menu Démarrer\Programmes\Démarrage\desktop.ini:KAVICHS
@Alternate Data Stream - 68 bytes -> C:\Documents and Settings\maewa\Application Data\desktop.ini:KAVICHS
@Alternate Data Stream - 68 bytes -> C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\desktop.ini:KAVICHS
@Alternate Data Stream - 68 bytes -> c:\Apps\Powercinema\PCMService.exe:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\wshnetbs.dll:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\wshfr.dll:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\wfwnet.drv:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\vga.drv:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\vga.dll:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\user.exe:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\unicode.nls:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32	raffic.dll:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32	imer.drv:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32	apiui.dll:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\system.drv:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\sound.drv:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\sortkey.nls:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\slmh.exe:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\slmh.cab:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\SLLights.dll:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\SLGen.dll:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\slextspk.dll:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\slcpappl.cpl:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32svp.exe:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\oleaccrc.dll:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32
tsdexts.dll:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32
etui2.dll:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32
etmsg.dll:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\mycomput.dll:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\msxml3r.dll:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\mprui.dll:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\mouse.drv:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\mmdrv.dll:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\mfc42loc.dll:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\lz32.dll:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\l3codecx.ax:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\keyboard.drv:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\kdcom.dll:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\kbdus.dll:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\kbdfr.dll:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\icfgnt5.dll:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\gcdef.dll:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\dxdllreg.exe:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\drivers\wmilib.sys:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\DRIVERS\SlWdmSup.sys:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\DRIVERS\slntamr.sys:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\DRIVERS\RDPCDD.sys:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\DRIVERSaspti.sys:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\DRIVERSasacd.sys:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\DRIVERS\R8139n51.SYS:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\DRIVERS\ptilink.sys:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\DRIVERS\PhTVTune.sys:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\DRIVERS
wlnkfwd.sys:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\DRIVERS
wlnkflt.sys:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\DRIVERS\NtMtlFax.sys:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\DRIVERS\Mtlmnt5.sys:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\drivers\msmpu401.sys:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\DRIVERS\lirsgt.sys:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\DRIVERS\ipfltdrv.sys:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\drivers\dxapi.sys:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\drivers\dmload.sys:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\DRIVERS\Cap7134.sys:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\DRIVERS\audstub.sys:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\drivers\ALCXWDM.SYS:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\drivers\ALCXSENS.SYS:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\DRIVERS\ABP480N5.SYS:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\dpnwsock.dll:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\dpnmodem.dll:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\dllcache\gcdef.dll:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\dllcache\dxapi.sys:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\dllcache\dimap.dll:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\dllcache\diactfrm.dll:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\dllcache\d3dxof.dll:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\dllcache\d3drm.dll:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\dllcache\d3dramp.dll:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\dllcache\d3dpmesh.dll:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\dllcache\d3dim.dll:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\dimap.dll:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\diactfrm.dll:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\dbgeng.dll:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\d3dxof.dll:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\d3drm.dll:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\d3dramp.dll:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\d3dpmesh.dll:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\d3dim.dll:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\ctype.nls:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\comm.drv:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\amr_cpl.dll:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\ALSNDMGR.CPL:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System\crlds3d.dll:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\SOUNDMAN.EXE:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\slrundll.exe:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\sl.lng:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\setupapi.log.0.old:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\ModemLog_Aztech CNR2900 V.90 Modem.txt:KAVICHS
@Alternate Data Stream - 36 bytes -> C:ealquas.TAG:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\MCDLOG.TXT:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\hpfr5550.log:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\DWNLOG.TXT:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\Documents and Settings\maewa\Mes documents\desktop.ini:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\Documents and Settings\maewa\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\Documents and Settings\All Users\Documents\desktop.ini:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\Documents and Settings\All Users\Application Data\desktop.ini:KAVICHS
@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:33A7CC67
@Alternate Data Stream - 106 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:981884E7
@Alternate Data Stream - 100 bytes -> C:\WINDOWS\System32\OEMINFO.INI:KAVICHS

:reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"=-
"HP Software Update"=-
"LVCOMSX"=-
"nwiz"=-
"QuickTime Task"=-
"SoundMan"=-
"TkBellExe"=-


:files
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}

:commands
[purity]
[emptytemp]
[reboot]


&#9654 Clique sur RunFix pour lancer la suppression.


&#9654 Poste le rapport.

ensuite :


-> &#9654 Scan BitDefender

&#9654 Fais une analyse antivirus en ligne sur BitDefender on line avec Internet Explorer

    &#9654  Clique en bas à gauche sur Scan on line.
    &#9654  Accepte la licence et laisse-le installer l'Active x..
    &#9654  Laisse-toi guider. Colle son rapport ici.


Aide

maewa95 · Answer

Une question stp avant de faire toutes ces manips.

Pour ne pas mettre mon nom sur le forum, je l'ai remplacé par mon pseudo mais là, s'il faut que je copie colle tout cela, tout va être faussé.

Comment puis-je faire pour modifier stp ? je ne me vois pas tout revérifier ce qu'il y a à copier mdrrrrrrr

au secourssssssss lol

gen-hackman · Answer

ton nom ne sortira pas sur le rapport

maewa95 · Answer

oui mais ce n'est pas ma question : le fait que tu me fasses copier coller tout cela dans la zone sous Customs Scans/Fixes d'OTL, les données ne risquent-elles pas d'être faussées ?

gen-hackman · Answer

non

maewa95 · Answer

impossible de faire le scan en ligne sur bitdefender, j'ai eu ce message :

Impossible de charger le scanner en ligne. Le Service Pack 2 a été détecté sur cet ordinateur. Cliquez sur la barre d'information et sélectionner 'Installer Contrôle ActiveX...'.Cliquez ici pour d'autres solutions possibles. 

De plus, j'ai tenté de redémarrer mon pc normalement mais rien à faire, je suis toujours en mode sans échec.

Voici le log OTL :

All processes killed
========== PROCESSES ==========
Process explorer.exe killed successfully!
No active process named iexplore.exe was found!
No active process named firefox.exe was found!
No active process named msnmsgr.exe was found!
No active process named Teatimer.exe was found!
========== SERVICES/DRIVERS ==========

Service\Driver catchme deleted successfully.
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7E853D72-626A-48EC-A868-BA8D5E23E045}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\KernelFaultCheck deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Cmaudio deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\ShStatEXE deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Restrictions\ deleted successfully.
Registry key HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Restrictions\ not found.
Registry key HKEY_USERS\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Restrictions\ not found.
Registry key HKEY_USERS\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Restrictions\ not found.
Registry key HKEY_USERS\S-1-5-19_Classes\Software\Policies\Microsoft\Internet Explorer\Restrictions\ not found.
Registry key HKEY_USERS\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Restrictions\ not found.
Registry key HKEY_USERS\S-1-5-20_Classes\Software\Policies\Microsoft\Internet Explorer\Restrictions\ not found.
Registry key HKEY_USERS\S-1-5-21-4131921849-2024023189-673777175-1005\Software\Policies\Microsoft\Internet Explorer\Restrictions\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-4131921849-2024023189-673777175-1005_Classes\Software\Policies\Microsoft\Internet Explorer\Restrictions\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\&Windows Live Search\ deleted successfully.
Starting removal of ActiveX control {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} Reg Error: Value error.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} Reg Error: Value error.\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} Reg Error: Value error.\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} Reg Error: Value error.\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} Reg Error: Value error.\ not found.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
File Animation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab not found.
Starting removal of ActiveX control DirectAnimation Java Classes
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\DirectAnimation Java Classes\DownloadInformation\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\DirectAnimation Java Classes\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\DirectAnimation Java Classes\ not found.
File oft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab not found.
Starting removal of ActiveX control Microsoft XML Parser for Java
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Microsoft XML Parser for Java\DownloadInformation\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Microsoft XML Parser for Java\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Microsoft XML Parser for Java\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ipp\ deleted successfully.
File Protocol\Handler\ipp - No CLSID value found not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\msdaipp\ deleted successfully.
File Protocol\Handler\msdaipp - No CLSID value found not found.
ADS C:\WINDOWS\wiaservc.log:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32	ssoft32.acm:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32	sbyuv.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\stdole32.tlb:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\slserv.exe:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\oleacc.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\msvidc32.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\msgsm32.acm:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\msg723.acm:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\msg711.acm:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\msacm32.drv:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\ir32_32.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\drwtsn32.exe:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\ultra.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS	oside.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\symc8xx.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\symc810.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\sym_u3.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\sym_hi.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\sparrow.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\Slnthal.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\SISAGPX.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\ql1280.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\ql1240.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\ql12160.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\ql10wnt.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\ql1080.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\perc2hib.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\perc2.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\Mtlstrm.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\mraid35x.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\ini910u.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\hpn.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\ftdisk.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\dpti2o.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\dac960nt.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\dac2w2k.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\cpqarray.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\cmdide.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\cd20xrnt.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\cbidf2k.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\asc3550.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\asc3350p.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\asc.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\amsint.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\aliide.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\aic78xx.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\aic78u2.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\aha154x.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\adpu160m.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\bootvid.dll:KAVICHS deleted successfully.
Unable to delete ADS C:\Documents and Settings\maewa\Menu Démarrer\Programmes\Démarrage\desktop.ini:KAVICHS .
Unable to delete ADS C:\Documents and Settings\maewa\Application Data\desktop.ini:KAVICHS .
ADS C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\desktop.ini:KAVICHS deleted successfully.
ADS c:\Apps\Powercinema\PCMService.exe:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\wshnetbs.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\wshfr.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\wfwnet.drv:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\vga.drv:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\vga.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\user.exe:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\unicode.nls:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32	raffic.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32	imer.drv:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32	apiui.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\system.drv:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\sound.drv:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\sortkey.nls:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\slmh.exe:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\slmh.cab:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\SLLights.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\SLGen.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\slextspk.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\slcpappl.cpl:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32svp.exe:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\oleaccrc.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32
tsdexts.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32
etui2.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32
etmsg.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\mycomput.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\msxml3r.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\mprui.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\mouse.drv:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\mmdrv.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\mfc42loc.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\lz32.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\l3codecx.ax:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\keyboard.drv:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\kdcom.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\kbdus.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\kbdfr.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\icfgnt5.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\gcdef.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\dxdllreg.exe:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\drivers\wmilib.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\SlWdmSup.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\slntamr.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\RDPCDD.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERSaspti.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERSasacd.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\R8139n51.SYS:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\ptilink.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\PhTVTune.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS
wlnkfwd.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS
wlnkflt.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\NtMtlFax.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\Mtlmnt5.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\drivers\msmpu401.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\lirsgt.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\ipfltdrv.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\drivers\dxapi.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\drivers\dmload.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\Cap7134.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\audstub.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\drivers\ALCXWDM.SYS:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\drivers\ALCXSENS.SYS:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\ABP480N5.SYS:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\dpnwsock.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\dpnmodem.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\dllcache\gcdef.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\dllcache\dxapi.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\dllcache\dimap.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\dllcache\diactfrm.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\dllcache\d3dxof.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\dllcache\d3drm.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\dllcache\d3dramp.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\dllcache\d3dpmesh.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\dllcache\d3dim.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\dimap.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\diactfrm.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\dbgeng.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\d3dxof.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\d3drm.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\d3dramp.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\d3dpmesh.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\d3dim.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\ctype.nls:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\comm.drv:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\amr_cpl.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\ALSNDMGR.CPL:KAVICHS deleted successfully.
ADS C:\WINDOWS\System\crlds3d.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\SOUNDMAN.EXE:KAVICHS deleted successfully.
ADS C:\WINDOWS\slrundll.exe:KAVICHS deleted successfully.
ADS C:\WINDOWS\sl.lng:KAVICHS deleted successfully.
ADS C:\WINDOWS\setupapi.log.0.old:KAVICHS deleted successfully.
ADS C:\WINDOWS\ModemLog_Aztech CNR2900 V.90 Modem.txt:KAVICHS deleted successfully.
ADS C:ealquas.TAG:KAVICHS deleted successfully.
ADS C:\MCDLOG.TXT:KAVICHS deleted successfully.
ADS C:\hpfr5550.log:KAVICHS deleted successfully.
ADS C:\DWNLOG.TXT:KAVICHS deleted successfully.
Unable to delete ADS C:\Documents and Settings\maewa\Mes documents\desktop.ini:KAVICHS .
Unable to delete ADS C:\Documents and Settings\maewa\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini:KAVICHS .
ADS C:\Documents and Settings\All Users\Documents\desktop.ini:KAVICHS deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\desktop.ini:KAVICHS deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:33A7CC67 deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:981884E7 deleted successfully.
ADS C:\WINDOWS\System32\OEMINFO.INI:KAVICHS deleted successfully.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Adobe Reader Speed Launcher deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\HP Software Update deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\LVCOMSX deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\nwiz deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\QuickTime Task deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\SoundMan deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\TkBellExe deleted successfully.
========== FILES ==========
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\mWinRun.dll\unicode moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\mWinRun.dll\ansi moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\mWinRun.dll moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\mMSI.dll moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\mFileBagIDE.dll\bag moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\mFileBagIDE.dll moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\mDown.dll moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\FDC0E2AE\5024B668 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\FDC0E2AE moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\FBD75703\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\FBD75703 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\F893A1FB\B838E76F moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\F893A1FB moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\F651F3E0\B838E76F moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\F651F3E0 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\F46FA387\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\F46FA387 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\F33BB9D6\910C39B2 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\F33BB9D6 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\F2956A82\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\F2956A82 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\F2887C20\B838E76F moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\F2887C20 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\F1380987\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\F1380987 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\F12C32F3\B838E76F moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\F12C32F3 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\EDC37755\910C39B2 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\EDC37755 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\ED00841D\5024B668 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\ED00841D moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\EBA6D1A\1A3A3DF1 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\EBA6D1A moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\EA56D31\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\EA56D31 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\EA34BAAF\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\EA34BAAF moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\E9B60166\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\E9B60166 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\E86B0726\50A51220 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\E86B0726 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\E752D665\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\E752D665 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\E6644540\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\E6644540 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\E5AE77EC\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\E5AE77EC moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\E51FF6A6\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\E51FF6A6 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\E0EE73C2\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\E0EE73C2 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\DD055195\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\DD055195 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\DC8EDBC0\B838E76F moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\DC8EDBC0 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\DB7C1571\1E442F23 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\DB7C1571 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\DB52D511\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\DB52D511 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D7ED341C\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D7ED341C moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D55C16A3\1E442F23 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D55C16A3 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93\ADAC0EB7 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\D129D93 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\CFDE74F5\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\CFDE74F5 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C95D9353\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C95D9353 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C79E53FB\B838E76F moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C79E53FB moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C55612\E909F05D moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C55612 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C538629A\1E442F23 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C538629A moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C2CAA5F6\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C2CAA5F6 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C2B17A7A\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C2B17A7A moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C212498A\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C212498A moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C1997375\B838E76F moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C1997375 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C0D14A1A\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\C0D14A1A moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\BF4E4A3C\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\BF4E4A3C moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\BEFFEC08\50A51220 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\BEFFEC08 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\BED76AB0\B838E76F moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\BED76AB0 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\B707562F\B838E76F moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\B707562F moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\B5EA1688\910C39B2 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\B5EA1688 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\B5D20069\B838E76F moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\B5D20069 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\B08C920E\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\B08C920E moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF59C933\B838E76F moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF59C933 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4\879B7CA9 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AF2F67D4 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\ABE41F08\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\ABE41F08 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AAD47241\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\AAD47241 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A99B6F3A\50A51220 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A99B6F3A moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A9743784\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A9743784 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A9086970\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A9086970 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A8DEA0AF\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A8DEA0AF moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A6D814F1\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A6D814F1 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A41E22DD\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A41E22DD moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A1976D1F\B838E76F moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A1976D1F moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A142E4E0\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\A142E4E0 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\9DB57804\B838E76F moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\9DB57804 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\9BE10F84\50A51220 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\9BE10F84 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\952B11E7\B838E76F moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\952B11E7 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\944E128B\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\944E128B moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\92986C6D\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\92986C6D moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\913B56F2\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\913B56F2 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\906525A1\50A51220 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\906525A1 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\8CA96ACC\910C39B2 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\8CA96ACC moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\8AD3462C\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\8AD3462C moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\891CC926\B838E76F moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\891CC926 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\885D1BEA\B838E76F moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\885D1BEA moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\8736965\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\8736965 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\858F3B78\B901FE7D moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\858F3B78 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\819FB798\B838E76F moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\819FB798 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7E441A45\B838E76F moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7E441A45 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7DAB4E0D\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7DAB4E0D moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7D8FD7BC\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7D8FD7BC moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7972B813\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7972B813 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\747E3015\B838E76F moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\747E3015 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\73A9A402\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\73A9A402 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7387B78B\405ABA3C moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\7387B78B moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\70115A69\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\70115A69 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\6F617157\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\6F617157 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\6A8E92EB\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\6A8E92EB moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\6A11B6CA\50A51220 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\6A11B6CA moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\60A000F0\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\60A000F0 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\5E7756D9\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\5E7756D9 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\58F58E3E\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\58F58E3E moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\58CB99D2\50A51220 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\58CB99D2 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\56BE6D10\B838E76F moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\56BE6D10 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\56765788\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\56765788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\528AFA6D\B901FE7D moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\528AFA6D moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\49C9850\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\49C9850 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\458728F\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\458728F moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\44E75494\5024B668 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\44E75494 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\44E0F7FE\B838E76F moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\44E0F7FE moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\43A08E04\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\43A08E04 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\40755F35\B838E76F moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\40755F35 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\4073D79A\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\4073D79A moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\3F392FAE\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\3F392FAE moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\3D3E0332\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\3D3E0332 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\36A749A\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\36A749A moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\346E92BC\B838E76F moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\346E92BC moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\31FDE0EB\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\31FDE0EB moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\31320978\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\31320978 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\30467683\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\30467683 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2F667D2E\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2F667D2E moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2DE5BB16\B838E76F moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2DE5BB16 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2DAA3949\B838E76F moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2DAA3949 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D280EA3\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D280EA3 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A\B4B755B7 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2D17310A moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2AAC25CB\B838E76F moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2AAC25CB moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2A981B13\B838E76F moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\2A981B13 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\29C49C26\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\29C49C26 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\296FC528\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\296FC528 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\21E6B8AE\B838E76F moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\21E6B8AE moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\20DF8017\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\20DF8017 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\20B27AC6\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\20B27AC6 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1F5988A6\50A51220 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1F5988A6 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1F53229E\B901FE7D moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1F53229E moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1E393C69\B838E76F moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1E393C69 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1D038D1\B838E76F moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1D038D1 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1CF1B64\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1CF1B64 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1C6067C3\B838E76F moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1C6067C3 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1BADE67B\B838E76F moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1BADE67B moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1A96FA21\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1A96FA21 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1A3E37C3\B838E76F moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1A3E37C3 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\18D1E326\B838E76F moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\18D1E326 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1860F398\B838E76F moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1860F398 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1357F4F6\A34AD788 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE\1357F4F6 moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\OFFLINE moved successfully.
C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A} moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Administrateur
->Temporary Internet Files folder emptied: 192400 bytes
 
User: Administrateur.SN402039360009
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 22418212 bytes
 
User: All Users
 
User: claude catheline
->Temp folder emptied: 32768 bytes
->Temporary Internet Files folder emptied: 4478701 bytes
->Java cache emptied: 8141413 bytes
->FireFox cache emptied: 47946743 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
 
User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Propriétaire
 
%systemdrive% .tmp files removed: 0 bytes
C:\WINDOWS\LastGood.Tmp\INF folder deleted successfully.
C:\WINDOWS\LastGood.Tmp folder deleted successfully.
%systemroot% .tmp files removed: 432313 bytes
%systemroot%\System32 .tmp files removed: 1163264 bytes
Windows Temp folder emptied: 664 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 80,97 mb
 
 
OTL by OldTimer - Version 3.0.10.5 log created on 08102009_002819

gen-hackman · Answer

refais OTL stp

maewa95 · Answer

bonjour,

j'ai refait OTL en recopiant tout à nouveau. J'espère que c'était bien comme cela qu'il fallait faire et non pas comme tu m'as fait faire en premier ?

Voici le rapport :

All processes killed
========== PROCESSES ==========
Process explorer.exe killed successfully!
No active process named iexplore.exe was found!
No active process named firefox.exe was found!
No active process named msnmsgr.exe was found!
No active process named Teatimer.exe was found!
========== SERVICES/DRIVERS ==========
Service\Driver catchme not found.
Service\Driver catchme not found.
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7E853D72-626A-48EC-A868-BA8D5E23E045}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\KernelFaultCheck deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Cmaudio not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\ShStatEXE not found.
Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Restrictions\ not found.
Registry key HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Restrictions\ not found.
Registry key HKEY_USERS\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Restrictions\ not found.
Registry key HKEY_USERS\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Restrictions\ not found.
Registry key HKEY_USERS\S-1-5-19_Classes\Software\Policies\Microsoft\Internet Explorer\Restrictions\ not found.
Registry key HKEY_USERS\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Restrictions\ not found.
Registry key HKEY_USERS\S-1-5-20_Classes\Software\Policies\Microsoft\Internet Explorer\Restrictions\ not found.
Registry key HKEY_USERS\S-1-5-21-4131921849-2024023189-673777175-1005\Software\Policies\Microsoft\Internet Explorer\Restrictions\ not found.
Registry key HKEY_USERS\S-1-5-21-4131921849-2024023189-673777175-1005_Classes\Software\Policies\Microsoft\Internet Explorer\Restrictions\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\&Windows Live Search\ not found.
Starting removal of ActiveX control {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} Reg Error: Value error.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} Reg Error: Value error.\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} Reg Error: Value error.\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} Reg Error: Value error.\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} Reg Error: Value error.\ not found.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
File Animation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab not found.
Starting removal of ActiveX control DirectAnimation Java Classes
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\DirectAnimation Java Classes\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\DirectAnimation Java Classes\ not found.
File oft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab not found.
Starting removal of ActiveX control Microsoft XML Parser for Java
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Microsoft XML Parser for Java\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Microsoft XML Parser for Java\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ipp\ not found.
File Protocol\Handler\ipp - No CLSID value found not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\msdaipp\ not found.
File Protocol\Handler\msdaipp - No CLSID value found not found.
Unable to delete ADS C:\WINDOWS\wiaservc.log:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32	ssoft32.acm:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32	sbyuv.dll:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\stdole32.tlb:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\slserv.exe:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\oleacc.dll:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\msvidc32.dll:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\msgsm32.acm:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\msg723.acm:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\msg711.acm:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\msacm32.drv:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\ir32_32.dll:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\drwtsn32.exe:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\DRIVERS\ultra.sys:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\DRIVERS	oside.sys:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\DRIVERS\symc8xx.sys:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\DRIVERS\symc810.sys:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\DRIVERS\sym_u3.sys:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\DRIVERS\sym_hi.sys:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\DRIVERS\sparrow.sys:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\DRIVERS\Slnthal.sys:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\DRIVERS\SISAGPX.sys:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\DRIVERS\ql1280.sys:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\DRIVERS\ql1240.sys:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\DRIVERS\ql12160.sys:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\DRIVERS\ql10wnt.sys:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\DRIVERS\ql1080.sys:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\DRIVERS\perc2hib.sys:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\DRIVERS\perc2.sys:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\DRIVERS\Mtlstrm.sys:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\DRIVERS\mraid35x.sys:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\DRIVERS\ini910u.sys:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\DRIVERS\hpn.sys:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\DRIVERS\ftdisk.sys:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\DRIVERS\dpti2o.sys:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\DRIVERS\dac960nt.sys:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\DRIVERS\dac2w2k.sys:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\DRIVERS\cpqarray.sys:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\DRIVERS\cmdide.sys:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\DRIVERS\cd20xrnt.sys:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\DRIVERS\cbidf2k.sys:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\DRIVERS\asc3550.sys:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\DRIVERS\asc3350p.sys:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\DRIVERS\asc.sys:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\DRIVERS\amsint.sys:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\DRIVERS\aliide.sys:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\DRIVERS\aic78xx.sys:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\DRIVERS\aic78u2.sys:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\DRIVERS\aha154x.sys:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\DRIVERS\adpu160m.sys:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\bootvid.dll:KAVICHS .
Unable to delete ADS C:\Documents and Settings\maewa\Menu Démarrer\Programmes\Démarrage\desktop.ini:KAVICHS .
Unable to delete ADS C:\Documents and Settings\maewa\Application Data\desktop.ini:KAVICHS .
Unable to delete ADS C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\desktop.ini:KAVICHS .
Unable to delete ADS c:\Apps\Powercinema\PCMService.exe:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\wshnetbs.dll:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\wshfr.dll:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\wfwnet.drv:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\vga.drv:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\vga.dll:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\user.exe:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\unicode.nls:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32	raffic.dll:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32	imer.drv:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32	apiui.dll:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\system.drv:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\sound.drv:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\sortkey.nls:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\slmh.exe:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\slmh.cab:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\SLLights.dll:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\SLGen.dll:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\slextspk.dll:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\slcpappl.cpl:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32svp.exe:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\oleaccrc.dll:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32
tsdexts.dll:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32
etui2.dll:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32
etmsg.dll:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\mycomput.dll:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\msxml3r.dll:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\mprui.dll:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\mouse.drv:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\mmdrv.dll:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\mfc42loc.dll:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\lz32.dll:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\l3codecx.ax:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\keyboard.drv:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\kdcom.dll:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\kbdus.dll:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\kbdfr.dll:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\icfgnt5.dll:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\gcdef.dll:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\dxdllreg.exe:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\drivers\wmilib.sys:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\DRIVERS\SlWdmSup.sys:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\DRIVERS\slntamr.sys:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\DRIVERS\RDPCDD.sys:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\DRIVERSaspti.sys:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\DRIVERSasacd.sys:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\DRIVERS\R8139n51.SYS:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\DRIVERS\ptilink.sys:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\DRIVERS\PhTVTune.sys:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\DRIVERS
wlnkfwd.sys:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\DRIVERS
wlnkflt.sys:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\DRIVERS\NtMtlFax.sys:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\DRIVERS\Mtlmnt5.sys:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\drivers\msmpu401.sys:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\DRIVERS\lirsgt.sys:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\DRIVERS\ipfltdrv.sys:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\drivers\dxapi.sys:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\drivers\dmload.sys:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\DRIVERS\Cap7134.sys:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\DRIVERS\audstub.sys:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\drivers\ALCXWDM.SYS:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\drivers\ALCXSENS.SYS:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\DRIVERS\ABP480N5.SYS:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\dpnwsock.dll:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\dpnmodem.dll:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\dllcache\gcdef.dll:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\dllcache\dxapi.sys:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\dllcache\dimap.dll:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\dllcache\diactfrm.dll:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\dllcache\d3dxof.dll:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\dllcache\d3drm.dll:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\dllcache\d3dramp.dll:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\dllcache\d3dpmesh.dll:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\dllcache\d3dim.dll:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\dimap.dll:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\diactfrm.dll:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\dbgeng.dll:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\d3dxof.dll:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\d3drm.dll:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\d3dramp.dll:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\d3dpmesh.dll:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\d3dim.dll:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\ctype.nls:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\comm.drv:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\amr_cpl.dll:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\ALSNDMGR.CPL:KAVICHS .
Unable to delete ADS C:\WINDOWS\System\crlds3d.dll:KAVICHS .
Unable to delete ADS C:\WINDOWS\SOUNDMAN.EXE:KAVICHS .
Unable to delete ADS C:\WINDOWS\slrundll.exe:KAVICHS .
Unable to delete ADS C:\WINDOWS\sl.lng:KAVICHS .
Unable to delete ADS C:\WINDOWS\setupapi.log.0.old:KAVICHS .
Unable to delete ADS C:\WINDOWS\ModemLog_Aztech CNR2900 V.90 Modem.txt:KAVICHS .
Unable to delete ADS C:ealquas.TAG:KAVICHS .
Unable to delete ADS C:\MCDLOG.TXT:KAVICHS .
Unable to delete ADS C:\hpfr5550.log:KAVICHS .
Unable to delete ADS C:\DWNLOG.TXT:KAVICHS .
Unable to delete ADS C:\Documents and Settings\maewa\Mes documents\desktop.ini:KAVICHS .
Unable to delete ADS C:\Documents and Settings\maewa\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini:KAVICHS .
Unable to delete ADS C:\Documents and Settings\All Users\Documents\desktop.ini:KAVICHS .
Unable to delete ADS C:\Documents and Settings\All Users\Application Data\desktop.ini:KAVICHS .
Unable to delete ADS C:\Documents and Settings\All Users\Application Data\TEMP:33A7CC67 .
Unable to delete ADS C:\Documents and Settings\All Users\Application Data\TEMP:981884E7 .
Unable to delete ADS C:\WINDOWS\System32\OEMINFO.INI:KAVICHS .
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Adobe Reader Speed Launcher not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\HP Software Update not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\LVCOMSX not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\nwiz not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\QuickTime Task not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\SoundMan not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\TkBellExe not found.
========== FILES ==========
File\Folder C:\Documents and Settings\All Users\Application Data\{A91C477B-655B-4FEA-8B8E-CC6820970F3A} not found.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Administrateur
->Temporary Internet Files folder emptied: 0 bytes
 
User: Administrateur.SN402039360009
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: All Users
 
User: maewa
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 134030 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 25430398 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Propriétaire
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
Windows Temp folder emptied: 17048 bytes
RecycleBin emptied: 8110374 bytes
 
Total Files Cleaned = 32,16 mb
 
 
OTL by OldTimer - Version 3.0.10.5 log created on 08102009_072756

maewa95 · Answer

Mon antivirus ne fonctionne toujours pas et je n'arrive pas non plus à démarrer en mode normal. Je suis toujours en mode sans échec et sans antivirus. 

Il va passer par la fenêtre ce pc mdrrrrrrrr

Pourrais-tu me dire stp : 

- ce que j'ai chopé
- comment je l'ai attrapé sachant que je ne vais plus sur msn depuis pas mal de temps, que je n'ouvre pas de pièce jointe sans la passer à l'antivirus, que je vire systématiquement tous les e-mails de personnes que je ne connais pas ?

D'autre part, dans la mesure où, lorsque l'on achète un pc, Windows n'est plus fourni systématiquement, j'aimerais en acheter un mais comment savoir si c'est une vraie version et non pas une version piratée ? 

Merci à toi

gen-hackman · Answer

salut non je voulais que tu fasses "run scan"^^

n'oublie pas les 3 cases ^^

maewa95 · Answer

bonsoir,

mdrrrrr je suis blonde lol il faut tout me détailler 

voici le rapport :

http://www.cijoint.fr/cjlink.php?file=cj200908/cij6Wy5NTJ.txt

gen-hackman · Answer

&#9654;- double clic sur Zeb-Restore.exe

&#9654;- Coche la case devant :sites de confiance

&#9654;- Ne coche aucune autre case

&#9654;-Clique sur Restaurer

&#9654;-Redémarre ton PC

ensuite :

vide la quarantaine de Malwarebytes , fais une mise à jour et refais un sca complet

maewa95 · Answer

elle est où la quarantaine de malwabytes stp ? je la trouve où ?

et quand tu parles de mise à jour, tu parles de mise à jour de quoi please ?

je t'ai dit que je suis blonde lol

gen-hackman · Answer

j'adore les blondes ^^

mais j'ai ma poussinette ^^

dans malwrebytes , tu as un onglet qui s'appelle quarantaine , tu supprime tout

ensuite tu as un onglet qui s'apelle mise a jour , execute

ensuite fais un exament complet

maewa95 · Answer

garde la bien au chaud ta poussinette car on croit que l'herbe est plus verte ailleurs alors qu'il n'en est rien mdrrr

et je le télécharge où Malwarebytes ?

edit : non laisse tomber je viens de percuter que je l'ai sur mon pc 

houla la ça va mal moi ce soir mdrrrrrr

gen-hackman · Answer

t'inquiete pour ma poussinette ^^

bon là c'est moi qui ait fait le blond 

laisse tomber j'ai cru que je t'avais deja fait faire l'analyse ^^

as-tu essayé de cracker un programme dernierement ?

toi ou quelqu'un dautre qui joue avec les cracks ?

maewa95 · Answer

j'ai installé un logiciel de broderie que j'ai acheté à un belge. Penses-tu que ce puisse être cela ?

sinon, j'ai prêté mon pc à une petite de 9 ans qui a joué en ligne.

maewa95 · Answer

j'ai tenté de le refaire web-restore et va voir l'impression écran que je t'ai mise. 

Impossible de détecter où est "site de confiance"

http://www.cijoint.fr/cjlink.php?file=cj200908/cijkJ1Um9k.doc

maewa95 · Answer

je repense à un truc : j'ai installé ce logiciel (PE Design 7) via un CD qu'il m'a envoyé. Le CD serait-il vérolé ?

Et il m'a envoyé également un autre CD avec des motifs. Comment je peux savoir si ça vient de là ?

gen-hackman · Answer

tu as du l'executer dans l'archive au lien de l executer dans le dossier extrait

maewa95 · Answer

ha, je me rappelle que j'avais oublié le CD dans le lecteur et lorsque j'ai rallumé mon pc je me suis aperçue que le lecteur travaillait. Peut-être que oui, je l'ai peut-être exécuté du CD

Je fais quoi maintenant stp ? je lance quel analyse ?

gen-hackman · Answer

il m est impossible de voir ta page

maewa95 · Answer

mince, c'est un doc word, j'ai fait une impression écran.

Je fais quoi maintenant stp ? Je lance quel logiciel ? Parce que pour OTL, les cases à cocher ne sont plus renseignées. Je suis à l'aveugle, donc dans l'impossibilité de cliquer sur sites de confiance.

gen-hackman · Answer

tu as bien le dossier decompressé Zeb-Restore sur ton bureau ?

maewa95 · Answer

oui, je lance le scan et je reviens

gen-hackman · Answer

???????

maewa95 · Answer

j'ai exécuté zeb-restore et houla, lors du redémarrage de mon pc (j'ai tenté un redémarrage en mode normal) et ben, c'était noël avant l'heure. Mon écran n'arrêtait pas de clignoter, de se mettre en veille. Les icônes de mon bureau arrivaient petit à petit avec des phases noires et l'écran en veille qui se rallumait.

Tout cela pendant plus de 30 mn pour finalement, une fois le son que tu as après "bienvenue" il a redémarré tout seul. 

J'ai donc fait un démarrage mode sans échec.

Par contre, comme il était super lent, j'ai eu le temps de voir l'icône en bas à droite dans la barre des tâches : il me disait que mon antivirus devait être périmé alors que je l'ai installé depuis le début de l'année seulement je crois.

Pinaise, j'ai envie de le mettre par la fenêtre ce ouf de pc ! ça commence à me chauffer grave

Je fais quoi maintenant stp ?

gen-hackman · Answer

Desactive la protection residente de ton antivirus et ton parefeu si present , le temps du scan

Telecharge  List'em et enregistre-le sur ton bureau et pas ailleurs

double-clic (Pour vista clic droit "executer en tant qu'administrateur")sur l'icone présent sur le bureau pour le lancer

laisse travailler l'outil, le scan devrait durer moins de 10 mn

une fois le scan Terminé le rapport s'affiche

colle son contenu si des fichiers sont detectés dans ta prochaine reponse ici.

maewa95 · Answer

voila le rapport :

List'em by g3n-h@ckm@n 1.0.1.1 


Microsoft Windows XP [version 5.1.2600]

Infections possibles : 

LVCOMSX.EXE - Présent ! 
Clé infectieuse présente ! HKCU\SOFTWARE\Microsoft\Installer\Upgradecodes\A97CEC23332751B47BA4B95BAA50C9D0  
Clé infectieuse présente ! HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\A97CEC23332751B47BA4B95BAA50C9D0

gen-hackman · Answer

&#9654 Double clic sur OTL.exe pour le lancer.


&#9654Copie la liste qui se trouve en gras ci-dessous,

&#9654 colle-la dans la zone sous Customs Scans/Fixes :

:processes
explorer.exe
iexplore.exe
firefox.exe
msnmsgr.exe
Teatimer.exe

:reg
[-HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Upgradecodes\A97CEC2333275­1B47BA4B95BAA50C9D0]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Upg­radeCodes\A97CEC23332751B47BA4B95BAA50C9D0]

:commands
[emptytemp]
[reboot]


&#9654 Clique sur RunFix pour lancer la suppression.


&#9654 Poste le rapport.

ensuite :

refais un "run scan" avec OTL sans oublier de cocher les cases , et le rapport par cijoinr.fr

maewa95 · Answer

voici les rapports :

http://www.cijoint.fr/cjlink.php?file=cj200908/cijMc7X7Mh.txt

http://www.cijoint.fr/cjlink.php?file=cj200908/cijMKo2gKl.txt

gen-hackman · Answer

???????????????????????????????

maewa95 · Answer

tu ne vois pas les pièces jointes ?

que se passe-t-il ?

gen-hackman · Answer

si mais ce n'est pas ce que j ai demandé

maewa95 · Answer

ben tu m'as demandé de faire OTL.exe

de copier ce que tu m'avais mis dans customs scan fixe et de lancer pour la suppression

puis ensuite un run scan avec OTL 

Ce n'est pas cela que tu voulais ?

gen-hackman · Answer

si mais tu m'as envoyé 2 fois le rapport du run scan :)

maewa95 · Answer

mdrrrrrrrrrr je n'ai pas bu pourtant lol

All processes killed
========== PROCESSES ==========
Process explorer.exe killed successfully!
No active process named iexplore.exe was found!
No active process named firefox.exe was found!
No active process named msnmsgr.exe was found!
No active process named Teatimer.exe was found!
========== REGISTRY ==========
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Upgradecodes\A97CEC2333275­1B47BA4B95BAA50C9D0\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Upg­radeCodes\A97CEC23332751B47BA4B95BAA50C9D0\ not found.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Administrateur
->Temporary Internet Files folder emptied: 0 bytes
 
User: Administrateur.SN402039360009
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: All Users
 
User: maewa
->Temp folder emptied: 59243 bytes
->Temporary Internet Files folder emptied: 192802 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 41621797 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Propriétaire
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
Windows Temp folder emptied: 17048 bytes
RecycleBin emptied: 309788 bytes
 
Total Files Cleaned = 40,28 mb
 
 
OTL by OldTimer - Version 3.0.10.5 log created on 08112009_001700

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

gen-hackman · Answer

repasse-le en mode sans echec stp

maewa95 · Answer

mais je suis en mode sans échec et je l'ai fait en mode sans échec. Impossible pour moi de faire autrement car le mode normal ne fonctionne pas lol

bon je me déconnecte et je le relance

maewa95 · Answer

voila, je viens de refaire. J'ai l'impression que cela n'a rien changé. Il ne reconnait toujours pas ces deux clés !

http://www.cijoint.fr/cjlink.php?file=cj200908/cijcEyAmsR.txt

All processes killed
========== PROCESSES ==========
Process explorer.exe killed successfully!
No active process named iexplore.exe was found!
No active process named firefox.exe was found!
No active process named msnmsgr.exe was found!
No active process named Teatimer.exe was found!
========== REGISTRY ==========
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Upgradecodes\A97CEC2333275-1B47BA4B95BAA50C9D0\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Upg-radeCodes\A97CEC23332751B47BA4B95BAA50C9D0\ not found.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Administrateur
->Temporary Internet Files folder emptied: 0 bytes
 
User: Administrateur.SN402039360009
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: All Users
 
User: claude catheline
->Temp folder emptied: 3400 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 20930689 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Propriétaire
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
Windows Temp folder emptied: 664 bytes
RecycleBin emptied: 325074 bytes
 
Total Files Cleaned = 20,31 mb
 
 
OTL by OldTimer - Version 3.0.10.5 log created on 08112009_011052

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

gen-hackman · Answer

/!\ ATTENTION SUIVRE SCRUPULEUSEMENT A LA LETTRE CES INDICATIONS/!\ ▶ Surtout , pense à l'enregistrement à renommer Combofix en "ton prenom.exe" _________________________________________________________________ >Ce logiciel n'est à utiliser que prescrit par un helper qualifié et formé à l'outil.< >>>>>>>Ne pas utiliser en dehors de ce cas de figure : dangereux!<<<<<<<< ===================================================== ▶ On va utiliser ComboFix.exe. Rends toi sur cette page web pour obtenir les liens de téléchargement, ainsi que des instructions pour exécuter l'outil: https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix Avant d'utiliser ComboFix : ______________________________________________________________________ >> referme les fenêtres de tous les programmes en cours. >> Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, >>la protection en temps réel de ton Antivirus et de tes Antispywares, >>qui peuvent gêner fortement la procédure de recherche et de nettoyage de l'outil. °°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°° ▶ !!!!!NE TOUCHE A RIEN PENDANT LE TRAVAIL DE COMBOFIX (SOURIS/CLAVIER.....)!!!!! ▶ n'oublie pas de reactiver la garde de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet. >> Reviens sur le forum, et ▶ copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.

maewa95 · Answer

le problème c'est que je ne peux pas ni activer ni désactiver mon antivirus et c'est aussi mon antispywares

je fais comment ?

Lorsque je clique sur l'icône de mon antivirus, j'ai une fenêtre qui me dit que le site bit defender n'est pas disponible

Je lance quand même combofix ?

maewa95 · Answer

bon je vais me coucher je suis naze je lirai ta réponse demain 

et puis, comme je ne peux pas imprimer de chez moi, que ça ne reconnait pas mon imprimante, j'imprimerai le modop à mon boulot

bonne nuit à toi et merci 

à demain

gen-hackman · Answer

aqucune importance tu n'as qu'a le lancer en mode sans echec et ignorer les messages d'erreur

maewa95 · Answer

bonjour,

voici le log de combofix

ComboFix 09-08-10.06 - claude catheline 11/08/2009 17:43.3.2 - NTFSx86 MINIMAL
Microsoft Windows XP Édition familiale  5.1.2600.3.1252.33.1036.18.1023.785 [GMT 2:00]
Running from: c:\documents and settings\claude catheline\Bureau\Maewa.exe
AV: Antivirus BitDefender  *On-access scanning enabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}
FW: Pare-feu BitDefender  *enabled* {4055920F-2E99-48A8-A270-4243D2B8F242}
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\install.exe
c:\windows\Installer\254f7d.msi


.
(((((((((((((((((((((((((   Files Created from 2009-07-11 to 2009-08-11  )))))))))))))))))))))))))))))))
.

2009-08-09 22:28 . 2009-08-09 22:28	--------	d-----w-	C:\_OTL
2009-08-09 19:21 . 2009-08-09 20:52	--------	d-----w-	c:\program files\Ad-remover
2009-08-09 15:50 . 2009-08-09 15:50	579584	----a-w-	c:\windows\system32\dllcache\user32.dll
2009-08-09 15:46 . 2009-08-09 15:47	--------	d-----w-	c:\windows\ERUNT
2009-08-09 15:42 . 2009-08-09 16:16	--------	d-----w-	C:\SDFix
2009-08-09 14:02 . 2009-08-09 14:02	188312	----a-w-	c:\documents and settings\Administrateur.SN402039360009\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-09 13:22 . 2009-08-09 13:22	--------	d-----w-	c:\documents and settings\Administrateur.SN402039360009\Application Data\BitDefender
2009-08-09 13:11 . 2009-08-09 13:11	--------	d-----w-	c:\documents and settings\Administrateur.SN402039360009\Application Data\HouseCall 6.6
2009-08-09 13:11 . 2009-08-09 13:11	--------	d-----w-	c:\windows\system32\HouseCall 6.6
2009-08-09 12:12 . 2009-08-09 12:12	664	----a-w-	c:\windows\system32\d3d9caps.dat
2009-08-09 11:54 . 2009-08-09 11:54	--------	d-----w-	c:\windows\system32\wbem\Repository
2009-08-09 11:19 . 2009-08-09 11:19	--------	d-----w-	c:\documents and settings\Administrateur\Application Data\Malwarebytes
2009-08-09 11:18 . 2009-08-09 11:18	--------	d-----w-	c:\documents and settings\Administrateur\Application Data\Bitdefender
2009-08-09 11:17 . 2009-08-09 11:53	--------	d-----w-	c:\documents and settings\Administrateur\Modèles
2009-08-09 11:17 . 2009-08-09 11:53	--------	d-----w-	c:\documents and settings\Administrateur\Local Settings\Application Data\Microsoft
2009-08-09 11:17 . 2009-08-09 11:53	--------	d-----w-	c:\documents and settings\Administrateur\Favoris
2009-08-09 11:17 . 2009-05-14 01:06	--------	d-----w-	c:\documents and settings\Administrateur\IETldCache
2009-08-09 11:17 . 2009-08-09 11:53	--------	d-s---w-	c:\documents and settings\Administrateur
2009-07-30 11:09 . 2009-07-30 11:09	--------	d-----w-	c:\documents and settings\claude catheline\Local Settings\Application Data\MicroVision Applications
2009-07-14 13:32 . 2008-09-08 11:49	277096	----a-w-	c:\windows\system32\YSys.dll
2009-07-14 13:32 . 2008-08-20 13:20	40040	----a-w-	c:\windows\system32\SysChkVC.dll
2009-07-14 13:32 . 2008-08-20 13:20	350312	----a-w-	c:\windows\system32\SysCheck2.dll
2009-07-14 13:32 . 2009-07-14 13:32	--------	d-----w-	C:\Metaboli

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-09 12:07 . 2002-09-30 11:49	94286	----a-w-	c:\windows\system32\perfc00C.dat
2009-08-09 12:07 . 2002-09-30 11:49	535584	----a-w-	c:\windows\system32\perfh00C.dat
2009-08-01 06:05 . 2009-01-18 13:24	--------	d-----w-	c:\program files\Microsoft Silverlight
2009-08-01 06:01 . 2007-04-26 07:17	--------	d-----w-	c:\documents and settings\claude catheline\Application Data\ZoomBrowser EX
2009-08-01 05:46 . 2007-04-26 07:05	--------	d-----w-	c:\documents and settings\All Users\Application Data\ZoomBrowser
2009-07-31 15:24 . 2009-02-27 07:47	81984	----a-w-	c:\windows\system32\bdod.bin
2009-07-16 01:06 . 2008-07-26 13:09	--------	d-----w-	c:\documents and settings\All Users\Application Data\Microsoft Help
2009-07-14 13:34 . 2008-10-23 19:03	--------	d-----w-	c:\program files\Player Metaboli
2009-07-14 13:34 . 2008-10-01 18:46	68	----a-w-	c:\windows\GPlrLanc.dat
2009-07-14 13:34 . 2008-10-01 18:46	--------	d-----w-	c:\documents and settings\All Users\Application Data\Player Metaboli
2009-07-14 07:31 . 2009-06-01 18:25	--------	d-----w-	c:\program files\Brother
2009-07-14 07:31 . 2008-11-22 20:14	--------	d--h--w-	c:\program files\InstallShield Installation Information
2009-07-03 16:57 . 2007-03-31 07:57	915456	----a-w-	c:\windows\system32\wininet.dll
2009-06-27 10:40 . 2006-12-25 08:51	188312	----a-w-	c:\documents and settings\claude catheline\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-20 11:10 . 2009-06-06 18:13	--------	d-----w-	c:\program files\PE DESIGN V7 DEMO
2009-06-16 14:40 . 2002-09-30 11:49	119808	----a-w-	c:\windows\system32	2embed.dll
2009-06-16 14:40 . 2002-09-30 11:49	81920	----a-w-	c:\windows\system32\fontsub.dll
2009-06-13 05:50 . 2009-06-13 05:45	--------	d-----w-	c:\program files\THRED
2009-06-03 19:10 . 2005-08-30 08:26	1297408	----a-w-	c:\windows\system32\quartz.dll
2009-05-24 22:24 . 2008-05-26 21:18	350208	----a-w-	c:\windows\system32\mssph.dll
2009-04-07 16:24 . 2008-10-30 16:34	49664	----a-w-	c:\program files\mozilla firefox\components\FFComm.dll
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LDM"="c:\program files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [2007-03-04 20480]
"LogitechSoftwareUpdate"="c:\program files\Logitech\Video\ManifestEngine.exe" [2005-01-18 196608]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-06-26 1211176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-01-03 13508608]
"PCMService"="c:\apps\Powercinema\PCMService.exe" [2004-01-30 81920]
"HPDJ Taskbar Utility"="c:\windows\System32\spool\drivers\w32x86\3\hpztsb05.exe" [2002-03-18 188416]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 132496]
"LogitechVideoRepair"="c:\program files\Logitech\Video\ISStart.exe" [2005-01-18 458752]
"LogitechVideoTray"="c:\program files\Logitech\Video\LogiTray.exe" [2005-01-18 217088]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-01-03 86016]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\claude catheline\Menu D‚marrer\Programmes\D‚marrage\
OneNote 2007 - Capture d'‚cran et lancement.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2008-10-25 98696]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"=
"c:\Program Files\Messenger\msmsgs.exe"=
"%windir%\Network Diagnostic\xpnetdiag.exe"=
"c:\StubInstaller.exe"=
"c:\WINDOWS\system32\rtcshare.exe"=
"c:\Program Files\NetMeeting\conf.exe"=
"c:\Program Files\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpqste08.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hposfx08.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hposid01.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe"=
"c:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe"=
"c:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpoews01.exe"=
"c:\program files\Microsoft ActiveSyncapimgr.exe"= c:\program files\Microsoft ActiveSyncapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\WINDOWS\system32\dpvsetup.exe"=
"c:\Program Files\Mozilla Firefox\firefox.exe"=
"c:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"=
"c:\Program Files\Microsoft Office\Office12\GROOVE.EXE"=
"c:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"=
"c:\Program Files\Windows Live\Messenger\wlcsdk.exe"=
"c:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"=
"c:\Program Files\Windows Live\Messenger\msnmsgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R1 Asapi;Asapi;c:\windows\system32\drivers\asapi.sys [25/11/2006 11:37 11264]
S2 BDVEDISK;BDVEDISK;c:\program files\BitDefender\BitDefender 2009\BDVEDISK.sys [04/09/2008 17:33 82696]
S2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [18/01/2009 15:23 55136]
S2 wlidsvc;Windows Live ID Sign-in Assistant;c:\program files\Fichiers communs\Microsoft Shared\Windows Live\WLIDSVC.EXE [30/03/2009 16:28 1533808]
S2 X4HSX32Ex;X4HSX32Ex;c:\program files\Player Metaboli\X4HSX32Ex.sys [24/01/2009 17:55 29856]
S3 Arrakis3;BitDefender Arrakis Server;c:\program files\Fichiers communs\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe [17/07/2008 13:06 118784]
S3 ASIOMI;ASIOMI;c:\windows\system32\drivers\ASIOMI.sys [25/11/2006 11:37 5396]
S3 bdfm;BDFM;c:\windows\system32\drivers\bdfm.sys [18/09/2008 12:09 111112]
S3 Bdfndisf;BitDefender Firewall NDIS Filter Service;c:\windows\system32\drivers\bdfndisf.sys [17/10/2008 15:01 104328]
S3 busbcrw;USB Card Reader Writer driver;c:\windows\system32\drivers\busbcrw.sys [23/04/2003 09:45 16896]
S3 fsssvc;Windows Live Contrôle parental;c:\program files\Windows Live\Family Safety\fsssvc.exe [08/12/2008 18:01 533344]
S3 ids00026;ids00026;\??\c:\documents and settings\All Users\Application Data\Kaspersky Anti-Virus Personal\5.0\bases\ids00026.sys --> c:\documents and settings\All Users\Application Data\Kaspersky Anti-Virus Personal\5.0\bases\ids00026.sys [?]
S3 klstm;klstm;\??\c:\documents and settings\All Users\Application Data\Kaspersky Anti-Virus Personal\5.0\bases\klstm.sys --> c:\documents and settings\All Users\Application Data\Kaspersky Anti-Virus Personal\5.0\bases\klstm.sys [?]
S3 maconfservice;Ma-Config Service;c:\program files\pour detection config pilotes\ma-config.com\maconfservice.exe [21/04/2009 15:36 216232]
S3 PhTVTune;ASUS WDM TV Tuner;c:\windows\system32\drivers\PhTVTune.sys [01/01/1980 01:00 24608]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx	REG_MULTI_SZ   	scan

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32undll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-Adobe Photo Downloader - c:\programme cc\photoshop\3.0\Apps\apdproxy.exe
HKLM-Run-McAfeeUpdaterUI - c:\program files\Network Associates\Common Framework\UpdaterUI.exe
HKLM-Run-Network Associates Error Reporting Service - c:\program files\Fichiers communs\Network Associates\TalkBack	bmon.exe
SafeBoot-AVG Anti-Spyware Driver
SafeBoot-AVG Anti-Spyware Guard


.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = localhost
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\claude catheline\Application Data\Mozilla\Firefox\Profiles\fwyph058.default\
FF - prefs.js: browser.startup.homepage - www.google.fr
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?mkt=fr-fr&FORM=MIMWA1&q=
FF - component: c:\program files\Mozilla Firefox\components\FFComm.dll
FF - component: c:\program files\Mozilla Firefox\extensions\YPlayer@yummy.net\components\FYPlayer.dll
FF - plugin: c:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer
pzylomgamesplayer.dll
FF - plugin: c:\program files\Microsoft\Office Live
pOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins
pExentCtl.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins
pkimi.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins
pzylomgamesplayer.dll
FF - plugin: c:\program files\pour detection config pilotes\ma-config.com
phardwaredetection.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6
ppl3260.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6
prjplug.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6
prpjplug.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: c:\programme cc\adobe\Reader\browser
ppdf32.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
FF - user.js: signed.applets.codebase_principal_support - true

/* To avoid the user interaction, add the following lines: */
FF - user.js: capability.principal.codebase.YummyPlayer_YAEL.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_YAEL.id - hxxp://yael.metaboli.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_LHOST.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_LHOST.id - hxxp://localhost/

/* GLDE */
FF - user.js: capability.principal.codebase.YummyPlayer_GLDE.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_GLDE.id - hxxp://gamesflatrate.de/
FF - user.js: capability.principal.codebase.YummyPlayer_WGLDE.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_WGLDE.id - hxxp://www.gamesflatrate.de/
FF - user.js: capability.principal.codebase.YummyPlayer_GLDEINT.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_GLDEINT.id - hxxp://glde-int.metaboli.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_SGLDE.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SGLDE.id - hxxps://gamesflatrate.de/
FF - user.js: capability.principal.codebase.YummyPlayer_WSGLDE.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_WSGLDE.id - hxxps://www.gamesflatrate.de/

/* BGFR */
FF - user.js: capability.principal.codebase.YummyPlayer_BGFR.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_BGFR.id - hxxp://linternaute.metaboli.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_SBGFR.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SBGFR.id - hxxps://linternaute.metaboli.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_BGFRINT.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_BGFRINT.id - hxxp://bgfr-int.metaboli.fr/

/* BILD */
FF - user.js: capability.principal.codebase.YummyPlayer_BILD.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_BILD.id - hxxp://bild.metaboli.de/
FF - user.js: capability.principal.codebase.YummyPlayer_SBILD.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SBILD.id - hxxps://bild.metaboli.de/
FF - user.js: capability.principal.codebase.YummyPlayer_BILDINT.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_BILDINT.id - hxxp://bild-int.metaboli.fr/

/* BTUK */
FF - user.js: capability.principal.codebase.YummyPlayer_BTUK.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_BTUK.id - hxxp://btvision.metaboli.co.uk/
FF - user.js: capability.principal.codebase.YummyPlayer_SBTUK.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SBTUK.id - hxxps://btvision.metaboli.co.uk/
FF - user.js: capability.principal.codebase.YummyPlayer_BTUKINT.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_BTUKINT.id - hxxp://bt-int.metaboli.fr/

/* CLIC */
FF - user.js: capability.principal.codebase.YummyPlayer_CLIC.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_CLIC.id - hxxp://clubic.metaboli.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_SCLIC.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SCLIC.id - hxxps://clubic.metaboli.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_CLICINT.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_CLICINT.id - hxxp://clic-int.metaboli.fr/

/* COUK */
FF - user.js: capability.principal.codebase.YummyPlayer_COUK.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_COUK.id - hxxp://metaboli.co.uk/
FF - user.js: capability.principal.codebase.YummyPlayer_WCOUK.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_WCOUK.id - hxxp://www.metaboli.co.uk/
FF - user.js: capability.principal.codebase.YummyPlayer_WSCOUK.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_WSCOUK.id - hxxps://www.metaboli.co.uk/
FF - user.js: capability.principal.codebase.YummyPlayer_SCOUK.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SCOUK.id - hxxps://metaboli.co.uk/
FF - user.js: capability.principal.codebase.YummyPlayer_COUKINT.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_COUKINT.id - hxxp://uk-int.metaboli.fr/

/* MEDE */
FF - user.js: capability.principal.codebase.YummyPlayer_MEDE.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_MEDE.id - hxxp://metaboli.de/
FF - user.js: capability.principal.codebase.YummyPlayer_WMEDE.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_WMEDE.id - hxxp://www.metaboli.de/
FF - user.js: capability.principal.codebase.YummyPlayer_SMEDE.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SMEDE.id - hxxps://metaboli.de/
FF - user.js: capability.principal.codebase.YummyPlayer_MEDEINT.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_MEDEINT.id - hxxp://de-int.metaboli.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_WSMEDE.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_WSMEDE.id - hxxps://www.metaboli.de/

/* CUUK */
FF - user.js: capability.principal.codebase.YummyPlayer_CUUK.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_CUUK.id - hxxp://custompc.metaboli.co.uk/
FF - user.js: capability.principal.codebase.YummyPlayer_SCUUK.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SCUUK.id - hxxps://custompc.metaboli.co.uk/
FF - user.js: capability.principal.codebase.YummyPlayer_CUUKINT.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_CUUKINT.id - hxxp://cuuk-int.metaboli.fr/

/* EUUK */
FF - user.js: capability.principal.codebase.YummyPlayer_EUUK.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_EUUK.id - hxxp://eurogamer.metaboli.co.uk/
FF - user.js: capability.principal.codebase.YummyPlayer_SEUUK.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SEUUK.id - hxxps://eurogamer.metaboli.co.uk/
FF - user.js: capability.principal.codebase.YummyPlayer_EUUKINT.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_EUUKINT.id - hxxp://euuk-int.metaboli.fr/

/* FUNR */
FF - user.js: capability.principal.codebase.YummyPlayer_FUNR.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_FUNR.id - hxxp://fun.metaboli.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_SFUNR.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SFUNR.id - hxxps://fun.metaboli.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_FUNRINT.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_FUNRINT.id - hxxp://fun-int.metaboli.fr/

/* GONE */
FF - user.js: capability.principal.codebase.YummyPlayer_GONE.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_GONE.id - hxxp://gameone.metaboli.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_SGONE.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SGONE.id - hxxps://gameone.metaboli.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_GONEINT.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_GONEINT.id - hxxp://gone-int.metaboli.fr/

/* GUDE */
FF - user.js: capability.principal.codebase.YummyPlayer_GUDE.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_GUDE.id - hxxp://gamerunlimited.metaboli.de/
FF - user.js: capability.principal.codebase.YummyPlayer_SGUDE.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SGUDE.id - hxxps://gamerunlimited.metaboli.de/
FF - user.js: capability.principal.codebase.YummyPlayer_GUDEINT.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_GUDEINT.id - hxxp://gude-int.metaboli.fr/

/* META */
FF - user.js: capability.principal.codebase.YummyPlayer_META.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_META.id - hxxp://metaboli.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_WMETA.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_WMETA.id - hxxp://www.metaboli.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_SMETA.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SMETA.id - hxxps://metaboli.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_WSMETA.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_WSMETA.id - hxxps://www.metaboli.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_METAINT.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_METAINT.id - hxxp://fr-int.metaboli.fr/

/* MNDE */
FF - user.js: capability.principal.codebase.YummyPlayer_MNDE.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_MNDE.id - hxxp://livegames.metaboli.de/
FF - user.js: capability.principal.codebase.YummyPlayer_SMNDE.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SMNDE.id - hxxps://livegames.metaboli.de/
FF - user.js: capability.principal.codebase.YummyPlayer_MNDEINT.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_MNDEINT.id - hxxp://msde-int.metaboli.fr/

/* MNFR */
FF - user.js: capability.principal.codebase.YummyPlayer_MNFR.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_MNFR.id - hxxp://livegames.metaboli.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_SMNFR.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SMNFR.id - hxxps://livegames.metaboli.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_MNFRINT.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_MNFRINT.id - hxxp://msfr-int.metaboli.fr/

/* MNUK */
FF - user.js: capability.principal.codebase.YummyPlayer_MNUK.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_MNUK.id - hxxp://livegames.metaboli.co.uk/
FF - user.js: capability.principal.codebase.YummyPlayer_SMNUK.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SMNUK.id - hxxps://livegames.metaboli.co.uk/
FF - user.js: capability.principal.codebase.YummyPlayer_MNUKINT.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_MNUKINT.id - hxxp://msuk-int.metaboli.fr/

/* NCNU */
FF - user.js: capability.principal.codebase.YummyPlayer_NCNU.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_NCNU.id - hxxp://numericable.metaboli.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_SNCNU.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SNCNU.id - hxxps://numericable.metaboli.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_NCNUINT.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_NCNUINT.id - hxxp://ncnu-int.metaboli.fr/

/* QPUK */
FF - user.js: capability.principal.codebase.YummyPlayer_QPUK.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_QPUK.id - hxxp://quintplay.metaboli.co.uk/
FF - user.js: capability.principal.codebase.YummyPlayer_SQPUK.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SQPUK.id - hxxps://quintplay.metaboli.co.uk/
FF - user.js: capability.principal.codebase.YummyPlayer_QPUKINT.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_QPUKINT.id - hxxp://qpuk-int.metaboli.fr/

/* SFFR */
FF - user.js: capability.principal.codebase.YummyPlayer_SFFR.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SFFR.id - hxxp://jeux-pc.sfr.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_SSFFR.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SSFFR.id - hxxps://jeux-pc.sfr.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_SFFRM.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SFFRM.id - hxxp://sfr.metaboli.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_SSFFRM.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SSFFRM.id - hxxps://sfr.metaboli.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_SFFRINT.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SFFRINT.id - hxxp://sfr-int.metaboli.fr/

/* SPDE */
FF - user.js: capability.principal.codebase.YummyPlayer_SPDE.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SPDE.id - hxxp://spieletipps.metaboli.de/
FF - user.js: capability.principal.codebase.YummyPlayer_SSPDE.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SSPDE.id - hxxps://spieletipps.metaboli.de/
FF - user.js: capability.principal.codebase.YummyPlayer_SPDEINT.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SPDEINT.id - hxxp://spde-int.metaboli.fr/

/* WOJ_ */
FF - user.js: capability.principal.codebase.YummyPlayer_WOJ_.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_WOJ_.id - hxxp://woj-prod.metaboli.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_SWOJ_.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SWOJ_.id - hxxps://woj-prod.metaboli.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_WOJ_INT.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_WOJ_INT.id - hxxp://woj-int.metaboli.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_SWOJ_INT.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SWOJ_INT.id - hxxps://woj-int.metaboli.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_WOJ_PP.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_WOJ_PP.id - hxxp://woj-pp.metaboli.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_SWOJ_PP.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SWOJ_PP.id - hxxps://woj-pp.metaboli.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_WOJ_PPINT.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_WOJ_PPINT.id - hxxp://woj-int.jeu.orange.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_SWOJ_PPINT.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SWOJ_PPINT.id - hxxps://woj-int.jeu.orange.fr/

user_pref(capability.principal.codebase.YummyPlayer_XX0001.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0001.id,hxxp://www.neufgame.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0002.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0002.id,hxxps://www.neufgame.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0003.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0003.id,hxxp://neufgame.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0004.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0004.id,hxxp://ad.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0005.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0005.id,hxxps://ad.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0006.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0006.id,hxxp://ads.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0007.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0007.id,hxxps://ads.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0008.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0008.id,hxxp://ads.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0009.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0009.id,hxxps://ads.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0010.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0010.id,hxxp://ads.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0011.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0011.id,hxxps://ads.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0012.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0012.id,hxxp://ag.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0013.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0013.id,hxxps://ag.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0014.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0014.id,hxxp://alice.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0015.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0015.id,hxxps://alice.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0016.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0016.id,hxxp://allocine.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0017.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0017.id,hxxps://allocine.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0018.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0018.id,hxxp://am.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0019.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0019.id,hxxps://am.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0020.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0020.id,hxxp://aol.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0021.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0021.id,hxxps://aol.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0022.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0022.id,hxxp://bc.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0023.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0023.id,hxxps://bc.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0024.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0024.id,hxxp://linternaute.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0025.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0025.id,hxxps://linternaute.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0026.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0026.id,hxxp://bild.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0027.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0027.id,hxxps://bild.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0028.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0028.id,hxxp://btvision.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0029.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0029.id,hxxps://btvision.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0030.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0030.id,hxxp://www.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0031.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0031.id,hxxp://cg.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0032.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0032.id,hxxps://cg.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0033.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0033.id,hxxp://cibleclick.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0034.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0034.id,hxxps://cibleclick.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0035.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0035.id,hxxp://cegetel.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0036.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0036.id,hxxps://cegetel.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0037.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0037.id,hxxp://choc.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0038.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0038.id,hxxps://choc.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0039.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0039.id,hxxp://cj.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0040.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0040.id,hxxps://cj.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0041.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0041.id,hxxp://cj.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0042.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0042.id,hxxps://cj.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0043.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0043.id,hxxp://cj.metaboli.it);
user_pref(capability.principal.codebase.YummyPlayer_XX0044.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0044.id,hxxps://cj.metaboli.it);
user_pref(capability.principal.codebase.YummyPlayer_XX0045.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0045.id,hxxp://cj.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0046.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0046.id,hxxps://cj.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0047.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0047.id,hxxp://metaboli.clubic.com);
user_pref(capability.principal.codebase.YummyPlayer_XX0048.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0048.id,hxxps://metaboli.clubic.com);
user_pref(capability.principal.codebase.YummyPlayer_XX0049.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0049.id,hxxp://metaboli.club-internet.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0050.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0050.id,hxxps://metaboli.club-internet.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0051.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0051.id,hxxp://coeur.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0052.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0052.id,hxxps://coeur.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0053.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0053.id,hxxp://come.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0054.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0054.id,hxxps://come.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0055.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0055.id,hxxp://lesaccros2.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0056.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0056.id,hxxps://lesaccros2.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0057.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0057.id,hxxp://surcouf.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0058.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0058.id,hxxps://surcouf.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0059.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0059.id,hxxp://www.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0060.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0060.id,hxxps://www.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0061.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0061.id,hxxp://cs.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0062.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0062.id,hxxps://cs.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0063.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0063.id,hxxp://custompc.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0064.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0064.id,hxxps://custompc.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0065.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0065.id,hxxp://cvg.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0066.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0066.id,hxxps://cvg.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0067.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0067.id,hxxp://daooda.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0068.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0068.id,hxxps://daooda.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0069.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0069.id,hxxp://daooda.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0070.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0070.id,hxxps://daooda.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0071.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0071.id,hxxp://daooda.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0072.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0072.id,hxxps://daooda.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0073.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0073.id,hxxp://digitaldownload.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0074.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0074.id,hxxps://digitaldownload.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0075.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0075.id,hxxp://eurogamer.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0076.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0076.id,hxxps://eurogamer.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0077.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0077.id,hxxp://eurogamer.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0078.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0078.id,hxxps://eurogamer.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0079.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0079.id,hxxp://exagame.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0080.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0080.id,hxxps://exagame.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0081.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0081.id,hxxp://fb.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0082.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0082.id,hxxps://fb.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0083.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0083.id,hxxp://fb.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0084.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0084.id,hxxps://fb.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0085.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0085.id,hxxp://fb.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0086.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0086.id,hxxps://fb.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0087.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0087.id,hxxp://firstcoffee.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0088.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0088.id,hxxps://firstcoffee.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0089.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0089.id,hxxp://fnac.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0090.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0090.id,hxxps://fnac.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0091.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0091.id,hxxp://fox.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0092.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0092.id,hxxps://fox.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0093.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0093.id,hxxp://fox.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0094.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0094.id,hxxps://fox.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0095.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0095.id,hxxp://fox.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0096.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0096.id,hxxps://fox.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0097.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0097.id,hxxp://free.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0098.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0098.id,hxxps://free.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0099.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0099.id,hxxp://funsta.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0100.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0100.id,hxxps://funsta.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0101.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0101.id,hxxp://funsta.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0102.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0102.id,hxxps://funsta.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0103.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0103.id,hxxp://metaboli.funradio.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0104.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0104.id,hxxps://metaboli.funradio.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0105.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0105.id,hxxp://fastweb.metaboli.it);
user_pref(capability.principal.codebase.YummyPlayer_XX0106.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0106.id,hxxps://fastweb.metaboli.it);
user_pref(capability.principal.codebase.YummyPlayer_XX0107.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0107.id,hxxp://god1.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0108.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0108.id,hxxps://god1.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0109.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0109.id,hxxp://god2.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0110.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0110.id,hxxps://god2.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0111.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0111.id,hxxp://god3.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0112.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0112.id,hxxps://god3.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0113.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0113.id,hxxp://gamona.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0114.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0114.id,hxxps://gamona.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0115.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0115.id,hxxp://giga.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0116.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0116.id,hxxps://giga.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0117.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0117.id,hxxp://gameseek.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0118.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0118.id,hxxps://gameseek.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0119.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0119.id,hxxp://www.gamesflatrate.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0120.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0120.id,hxxps://www.gamesflatrate.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0121.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0121.id,hxxp://games24.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0122.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0122.id,hxxps://games24.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0123.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0123.id,hxxp://ondemand.game.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0124.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0124.id,hxxps://ondemand.game.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0125.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0125.id,hxxp://google.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0126.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0126.id,hxxps://google.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0127.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0127.id,hxxp://google.metaboli.it);
user_pref(capability.principal.codebase.YummyPlayer_XX0128.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0128.id,hxxps://google.metaboli.it);
user_pref(capability.principal.codebase.YummyPlayer_XX0129.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0129.id,hxxp://gameone.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0130.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0130.id,hxxps://gameone.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0131.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0131.id,hxxp://google.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0132.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0132.id,hxxps://google.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0133.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0133.id,hxxp://goog.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0134.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0134.id,hxxps://goog.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0135.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0135.id,hxxp://google.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0136.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0136.id,hxxps://google.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0137.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0137.id,hxxp://gameplay.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0138.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0138.id,hxxps://gameplay.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0139.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0139.id,hxxp://gamesonradar.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0140.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0140.id,hxxps://gamesonradar.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0141.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0141.id,hxxp://gameshadow.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0142.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0142.id,hxxps://gameshadow.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0143.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0143.id,hxxp://gametap.metaboli.com);
user_pref(capability.principal.codebase.YummyPlayer_XX0144.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0144.id,hxxps://gametap.metaboli.com);
user_pref(capability.principal.codebase.YummyPlayer_XX0145.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0145.id,hxxp://gametap2.metaboli.com);
user_pref(capability.principal.codebase.YummyPlayer_XX0146.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0146.id,hxxps://gametap2.metaboli.com);
user_pref(capability.principal.codebase.YummyPlayer_XX0147.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0147.id,hxxp://gamespot.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0148.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0148.id,hxxps://gamespot.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0149.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0149.id,hxxp://gamerunlimited.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0150.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0150.id,hxxps://gamerunlimited.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0151.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0151.id,hxxp://guts.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0152.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0152.id,hxxps://guts.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0153.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0153.id,hxxp://gameswelt.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0154.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0154.id,hxxps://gameswelt.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0155.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0155.id,hxxp://gmx.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0156.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0156.id,hxxps://gmx.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0157.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0157.id,hxxp://hoaxbuster.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0158.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0158.id,hxxps://hoaxbuster.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0159.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0159.id,hxxp://incgamers.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0160.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0160.id,hxxps://incgamers.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0161.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0161.id,hxxp://imbogames.metaboli.it);
user_pref(capability.principal.codebase.YummyPlayer_XX0162.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0162.id,hxxps://imbogames.metaboli.it);
user_pref(capability.principal.codebase.YummyPlayer_XX0163.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0163.id,hxxp://ja.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0164.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0164.id,hxxps://ja.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0165.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0165.id,hxxp://janews.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0166.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0166.id,hxxps://janews.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0167.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0167.id,hxxp://jvfr.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0168.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0168.id,hxxps://jvfr.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0169.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0169.id,hxxp://jeux-pc.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0170.granted,UniversalXPConnect);
user_pref(capability.prin

gen-hackman · Answer

il est trop long , envoie-le par cijoint.fr

maewa95 · Answer

le voici :

http://www.cijoint.fr/cjlink.php?file=cj200908/cijcNSHheb.txt

gen-hackman · Answer

__________________________________________________________ =>/!\ ATTENTION /!\ Le script qui suit a été écrit spécialement cet ordinateur,<= =>il est fort déconseillé de le transposer sur un autre ordinateur !<=====| --------------------------------------------------------------- Toujours avec toutes les protections désactivées, fais ceci : ▶ Ouvre le bloc-notes (Menu démarrer --> programmes --> accessoires --> bloc-notes) ▶ Copie/colle dans le bloc-notes ce qui entre les lignes ci dessous (sans les lignes) : ---------------------------------------------------------- File:: c:\windows\system32\YSys.dll c:\windows\system32\SysChkVC.dll c:\windows\system32\SysCheck2.dll Folder:: C:\Metaboli ------------------------------------------------------------------ ▶ Enregistre ce fichier sur ton Bureau (et pas ailleurs !) sous le nom CFScript.txt ▶ Quitte le Bloc Notes ▶ Fais un glisser/déposer de ce fichier CFScript sur le fichier C-Fix.exe (combofix) Comme ceci ▶ Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal ! Ne touche à rien tant que le scan n'est pas terminé. ▶ Une fois le scan achevé, un rapport va s'afficher: poste son contenu. ▶ Si le fichier ne s'ouvre pas, il se trouve ici => C:\ComboFix.txt

maewa95 · Answer

voilà le log (en espérant qu'il passe, qu'il ne soit pas trop long) lol

Comment ce fait-il que Metaboli apparaisse partout ? Aurais-je été contaminée par ce site ? C'est un site de jeux en ligne payant !


ComboFix 09-08-10.06 - maewa 11/08/2009 19:33.4.2 - NTFSx86 MINIMAL
Microsoft Windows XP Édition familiale  5.1.2600.3.1252.33.1036.18.1023.786 [GMT 2:00]
Running from: c:\documents and settings\maewa\Bureau\Maewa.exe
Command switches used :: c:\documents and settings\maewa\Bureau\CFScript.txt
AV: Antivirus BitDefender  *On-access scanning enabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}
FW: Pare-feu BitDefender  *enabled* {4055920F-2E99-48A8-A270-4243D2B8F242}

FILE ::
"c:\windows\system32\SysCheck2.dll"
"c:\windows\system32\SysChkVC.dll"
"c:\windows\system32\YSys.dll"
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Metaboli
c:\metaboli\Games\YPlayer.dll
c:\metaboli\Games\YPlayer.ygsq
c:\metaboli\SampleHelperApp.exe
c:\metaboli\YBroker.exe
c:\metaboli\YProx.ocx
c:\metaboli\YProxAut.exe
c:\windows\system32\SysCheck2.dll
c:\windows\system32\SysChkVC.dll
c:\windows\system32\YSys.dll


.
(((((((((((((((((((((((((   Files Created from 2009-07-11 to 2009-08-11  )))))))))))))))))))))))))))))))
.

2009-08-09 22:28 . 2009-08-09 22:28	--------	d-----w-	C:\_OTL
2009-08-09 19:21 . 2009-08-09 20:52	--------	d-----w-	c:\program files\Ad-remover
2009-08-09 15:50 . 2009-08-09 15:50	579584	----a-w-	c:\windows\system32\dllcache\user32.dll
2009-08-09 15:46 . 2009-08-09 15:47	--------	d-----w-	c:\windows\ERUNT
2009-08-09 15:42 . 2009-08-09 16:16	--------	d-----w-	C:\SDFix
2009-08-09 14:02 . 2009-08-09 14:02	188312	----a-w-	c:\documents and settings\Administrateur.SN402039360009\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-09 13:22 . 2009-08-09 13:22	--------	d-----w-	c:\documents and settings\Administrateur.SN402039360009\Application Data\BitDefender
2009-08-09 13:11 . 2009-08-09 13:11	--------	d-----w-	c:\documents and settings\Administrateur.SN402039360009\Application Data\HouseCall 6.6
2009-08-09 13:11 . 2009-08-09 13:11	--------	d-----w-	c:\windows\system32\HouseCall 6.6
2009-08-09 12:12 . 2009-08-09 12:12	664	----a-w-	c:\windows\system32\d3d9caps.dat
2009-08-09 11:54 . 2009-08-09 11:54	--------	d-----w-	c:\windows\system32\wbem\Repository
2009-08-09 11:19 . 2009-08-09 11:19	--------	d-----w-	c:\documents and settings\Administrateur\Application Data\Malwarebytes
2009-08-09 11:18 . 2009-08-09 11:18	--------	d-----w-	c:\documents and settings\Administrateur\Application Data\Bitdefender
2009-08-09 11:17 . 2009-08-09 11:53	--------	d-----w-	c:\documents and settings\Administrateur\Modèles
2009-08-09 11:17 . 2009-08-09 11:53	--------	d-----w-	c:\documents and settings\Administrateur\Local Settings\Application Data\Microsoft
2009-08-09 11:17 . 2009-08-09 11:53	--------	d-----w-	c:\documents and settings\Administrateur\Favoris
2009-08-09 11:17 . 2009-05-14 01:06	--------	d-----w-	c:\documents and settings\Administrateur\IETldCache
2009-08-09 11:17 . 2009-08-09 11:53	--------	d-s---w-	c:\documents and settings\Administrateur
2009-07-30 11:09 . 2009-07-30 11:09	--------	d-----w-	c:\documents and settings\maewa\Local Settings\Application Data\MicroVision Applications

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-09 12:07 . 2002-09-30 11:49	94286	----a-w-	c:\windows\system32\perfc00C.dat
2009-08-09 12:07 . 2002-09-30 11:49	535584	----a-w-	c:\windows\system32\perfh00C.dat
2009-08-01 06:05 . 2009-01-18 13:24	--------	d-----w-	c:\program files\Microsoft Silverlight
2009-08-01 06:01 . 2007-04-26 07:17	--------	d-----w-	c:\documents and settings\maewa\Application Data\ZoomBrowser EX
2009-08-01 05:46 . 2007-04-26 07:05	--------	d-----w-	c:\documents and settings\All Users\Application Data\ZoomBrowser
2009-07-31 15:24 . 2009-02-27 07:47	81984	----a-w-	c:\windows\system32\bdod.bin
2009-07-16 01:06 . 2008-07-26 13:09	--------	d-----w-	c:\documents and settings\All Users\Application Data\Microsoft Help
2009-07-14 13:34 . 2008-10-23 19:03	--------	d-----w-	c:\program files\Player Metaboli
2009-07-14 13:34 . 2008-10-01 18:46	68	----a-w-	c:\windows\GPlrLanc.dat
2009-07-14 13:34 . 2008-10-01 18:46	--------	d-----w-	c:\documents and settings\All Users\Application Data\Player Metaboli
2009-07-14 07:31 . 2009-06-01 18:25	--------	d-----w-	c:\program files\Brother
2009-07-14 07:31 . 2008-11-22 20:14	--------	d--h--w-	c:\program files\InstallShield Installation Information
2009-07-03 16:57 . 2007-03-31 07:57	915456	----a-w-	c:\windows\system32\wininet.dll
2009-06-27 10:40 . 2006-12-25 08:51	188312	----a-w-	c:\documents and settings\maewa\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-20 11:10 . 2009-06-06 18:13	--------	d-----w-	c:\program files\PE DESIGN V7 DEMO
2009-06-16 14:40 . 2002-09-30 11:49	119808	----a-w-	c:\windows\system32	2embed.dll
2009-06-16 14:40 . 2002-09-30 11:49	81920	----a-w-	c:\windows\system32\fontsub.dll
2009-06-13 05:50 . 2009-06-13 05:45	--------	d-----w-	c:\program files\THRED
2009-06-03 19:10 . 2005-08-30 08:26	1297408	----a-w-	c:\windows\system32\quartz.dll
2009-05-24 22:24 . 2008-05-26 21:18	350208	----a-w-	c:\windows\system32\mssph.dll
2009-04-07 16:24 . 2008-10-30 16:34	49664	----a-w-	c:\program files\mozilla firefox\components\FFComm.dll
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LDM"="c:\program files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [2007-03-04 20480]
"LogitechSoftwareUpdate"="c:\program files\Logitech\Video\ManifestEngine.exe" [2005-01-18 196608]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-06-26 1211176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-01-03 13508608]
"PCMService"="c:\apps\Powercinema\PCMService.exe" [2004-01-30 81920]
"HPDJ Taskbar Utility"="c:\windows\System32\spool\drivers\w32x86\3\hpztsb05.exe" [2002-03-18 188416]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 132496]
"LogitechVideoRepair"="c:\program files\Logitech\Video\ISStart.exe" [2005-01-18 458752]
"LogitechVideoTray"="c:\program files\Logitech\Video\LogiTray.exe" [2005-01-18 217088]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-01-03 86016]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\maewa\Menu D‚marrer\Programmes\D‚marrage\
OneNote 2007 - Capture d'‚cran et lancement.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2008-10-25 98696]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"=
"c:\Program Files\Messenger\msmsgs.exe"=
"%windir%\Network Diagnostic\xpnetdiag.exe"=
"c:\StubInstaller.exe"=
"c:\WINDOWS\system32\rtcshare.exe"=
"c:\Program Files\NetMeeting\conf.exe"=
"c:\Program Files\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpqste08.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hposfx08.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hposid01.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe"=
"c:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe"=
"c:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe"=
"c:\Program Files\HP\Digital Imaging\bin\hpoews01.exe"=
"c:\program files\Microsoft ActiveSyncapimgr.exe"= c:\program files\Microsoft ActiveSyncapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\WINDOWS\system32\dpvsetup.exe"=
"c:\Program Files\Mozilla Firefox\firefox.exe"=
"c:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"=
"c:\Program Files\Microsoft Office\Office12\GROOVE.EXE"=
"c:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"=
"c:\Program Files\Windows Live\Messenger\wlcsdk.exe"=
"c:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"=
"c:\Program Files\Windows Live\Messenger\msnmsgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R1 Asapi;Asapi;c:\windows\system32\drivers\asapi.sys [25/11/2006 11:37 11264]
S2 BDVEDISK;BDVEDISK;c:\program files\BitDefender\BitDefender 2009\BDVEDISK.sys [04/09/2008 17:33 82696]
S2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [18/01/2009 15:23 55136]
S2 wlidsvc;Windows Live ID Sign-in Assistant;c:\program files\Fichiers communs\Microsoft Shared\Windows Live\WLIDSVC.EXE [30/03/2009 16:28 1533808]
S2 X4HSX32Ex;X4HSX32Ex;c:\program files\Player Metaboli\X4HSX32Ex.sys [24/01/2009 17:55 29856]
S3 Arrakis3;BitDefender Arrakis Server;c:\program files\Fichiers communs\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe [17/07/2008 13:06 118784]
S3 ASIOMI;ASIOMI;c:\windows\system32\drivers\ASIOMI.sys [25/11/2006 11:37 5396]
S3 bdfm;BDFM;c:\windows\system32\drivers\bdfm.sys [18/09/2008 12:09 111112]
S3 Bdfndisf;BitDefender Firewall NDIS Filter Service;c:\windows\system32\drivers\bdfndisf.sys [17/10/2008 15:01 104328]
S3 busbcrw;USB Card Reader Writer driver;c:\windows\system32\drivers\busbcrw.sys [23/04/2003 09:45 16896]
S3 fsssvc;Windows Live Contrôle parental;c:\program files\Windows Live\Family Safety\fsssvc.exe [08/12/2008 18:01 533344]
S3 ids00026;ids00026;\??\c:\documents and settings\All Users\Application Data\Kaspersky Anti-Virus Personal\5.0\bases\ids00026.sys --> c:\documents and settings\All Users\Application Data\Kaspersky Anti-Virus Personal\5.0\bases\ids00026.sys [?]
S3 klstm;klstm;\??\c:\documents and settings\All Users\Application Data\Kaspersky Anti-Virus Personal\5.0\bases\klstm.sys --> c:\documents and settings\All Users\Application Data\Kaspersky Anti-Virus Personal\5.0\bases\klstm.sys [?]
S3 maconfservice;Ma-Config Service;c:\program files\pour detection config pilotes\ma-config.com\maconfservice.exe [21/04/2009 15:36 216232]
S3 PhTVTune;ASUS WDM TV Tuner;c:\windows\system32\drivers\PhTVTune.sys [01/01/1980 01:00 24608]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx	REG_MULTI_SZ   	scan

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32undll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = localhost
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\maewa\Application Data\Mozilla\Firefox\Profiles\fwyph058.default\
FF - prefs.js: browser.startup.homepage - www.google.fr
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?mkt=fr-fr&FORM=MIMWA1&q=
FF - component: c:\program files\Mozilla Firefox\components\FFComm.dll
FF - component: c:\program files\Mozilla Firefox\extensions\YPlayer@yummy.net\components\FYPlayer.dll
FF - plugin: c:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer
pzylomgamesplayer.dll
FF - plugin: c:\program files\Microsoft\Office Live
pOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins
pExentCtl.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins
pkimi.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins
pzylomgamesplayer.dll
FF - plugin: c:\program files\pour detection config pilotes\ma-config.com
phardwaredetection.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6
ppl3260.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6
prjplug.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6
prpjplug.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: c:\programme cc\adobe\Reader\browser
ppdf32.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
FF - user.js: signed.applets.codebase_principal_support - true

/* To avoid the user interaction, add the following lines: */
FF - user.js: capability.principal.codebase.YummyPlayer_YAEL.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_YAEL.id - hxxp://yael.metaboli.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_LHOST.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_LHOST.id - hxxp://localhost/

/* GLDE */
FF - user.js: capability.principal.codebase.YummyPlayer_GLDE.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_GLDE.id - hxxp://gamesflatrate.de/
FF - user.js: capability.principal.codebase.YummyPlayer_WGLDE.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_WGLDE.id - hxxp://www.gamesflatrate.de/
FF - user.js: capability.principal.codebase.YummyPlayer_GLDEINT.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_GLDEINT.id - hxxp://glde-int.metaboli.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_SGLDE.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SGLDE.id - hxxps://gamesflatrate.de/
FF - user.js: capability.principal.codebase.YummyPlayer_WSGLDE.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_WSGLDE.id - hxxps://www.gamesflatrate.de/

/* BGFR */
FF - user.js: capability.principal.codebase.YummyPlayer_BGFR.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_BGFR.id - hxxp://linternaute.metaboli.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_SBGFR.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SBGFR.id - hxxps://linternaute.metaboli.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_BGFRINT.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_BGFRINT.id - hxxp://bgfr-int.metaboli.fr/

/* BILD */
FF - user.js: capability.principal.codebase.YummyPlayer_BILD.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_BILD.id - hxxp://bild.metaboli.de/
FF - user.js: capability.principal.codebase.YummyPlayer_SBILD.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SBILD.id - hxxps://bild.metaboli.de/
FF - user.js: capability.principal.codebase.YummyPlayer_BILDINT.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_BILDINT.id - hxxp://bild-int.metaboli.fr/

/* BTUK */
FF - user.js: capability.principal.codebase.YummyPlayer_BTUK.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_BTUK.id - hxxp://btvision.metaboli.co.uk/
FF - user.js: capability.principal.codebase.YummyPlayer_SBTUK.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SBTUK.id - hxxps://btvision.metaboli.co.uk/
FF - user.js: capability.principal.codebase.YummyPlayer_BTUKINT.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_BTUKINT.id - hxxp://bt-int.metaboli.fr/

/* CLIC */
FF - user.js: capability.principal.codebase.YummyPlayer_CLIC.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_CLIC.id - hxxp://clubic.metaboli.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_SCLIC.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SCLIC.id - hxxps://clubic.metaboli.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_CLICINT.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_CLICINT.id - hxxp://clic-int.metaboli.fr/

/* COUK */
FF - user.js: capability.principal.codebase.YummyPlayer_COUK.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_COUK.id - hxxp://metaboli.co.uk/
FF - user.js: capability.principal.codebase.YummyPlayer_WCOUK.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_WCOUK.id - hxxp://www.metaboli.co.uk/
FF - user.js: capability.principal.codebase.YummyPlayer_WSCOUK.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_WSCOUK.id - hxxps://www.metaboli.co.uk/
FF - user.js: capability.principal.codebase.YummyPlayer_SCOUK.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SCOUK.id - hxxps://metaboli.co.uk/
FF - user.js: capability.principal.codebase.YummyPlayer_COUKINT.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_COUKINT.id - hxxp://uk-int.metaboli.fr/

/* MEDE */
FF - user.js: capability.principal.codebase.YummyPlayer_MEDE.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_MEDE.id - hxxp://metaboli.de/
FF - user.js: capability.principal.codebase.YummyPlayer_WMEDE.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_WMEDE.id - hxxp://www.metaboli.de/
FF - user.js: capability.principal.codebase.YummyPlayer_SMEDE.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SMEDE.id - hxxps://metaboli.de/
FF - user.js: capability.principal.codebase.YummyPlayer_MEDEINT.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_MEDEINT.id - hxxp://de-int.metaboli.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_WSMEDE.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_WSMEDE.id - hxxps://www.metaboli.de/

/* CUUK */
FF - user.js: capability.principal.codebase.YummyPlayer_CUUK.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_CUUK.id - hxxp://custompc.metaboli.co.uk/
FF - user.js: capability.principal.codebase.YummyPlayer_SCUUK.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SCUUK.id - hxxps://custompc.metaboli.co.uk/
FF - user.js: capability.principal.codebase.YummyPlayer_CUUKINT.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_CUUKINT.id - hxxp://cuuk-int.metaboli.fr/

/* EUUK */
FF - user.js: capability.principal.codebase.YummyPlayer_EUUK.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_EUUK.id - hxxp://eurogamer.metaboli.co.uk/
FF - user.js: capability.principal.codebase.YummyPlayer_SEUUK.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SEUUK.id - hxxps://eurogamer.metaboli.co.uk/
FF - user.js: capability.principal.codebase.YummyPlayer_EUUKINT.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_EUUKINT.id - hxxp://euuk-int.metaboli.fr/

/* FUNR */
FF - user.js: capability.principal.codebase.YummyPlayer_FUNR.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_FUNR.id - hxxp://fun.metaboli.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_SFUNR.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SFUNR.id - hxxps://fun.metaboli.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_FUNRINT.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_FUNRINT.id - hxxp://fun-int.metaboli.fr/

/* GONE */
FF - user.js: capability.principal.codebase.YummyPlayer_GONE.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_GONE.id - hxxp://gameone.metaboli.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_SGONE.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SGONE.id - hxxps://gameone.metaboli.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_GONEINT.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_GONEINT.id - hxxp://gone-int.metaboli.fr/

/* GUDE */
FF - user.js: capability.principal.codebase.YummyPlayer_GUDE.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_GUDE.id - hxxp://gamerunlimited.metaboli.de/
FF - user.js: capability.principal.codebase.YummyPlayer_SGUDE.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SGUDE.id - hxxps://gamerunlimited.metaboli.de/
FF - user.js: capability.principal.codebase.YummyPlayer_GUDEINT.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_GUDEINT.id - hxxp://gude-int.metaboli.fr/

/* META */
FF - user.js: capability.principal.codebase.YummyPlayer_META.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_META.id - hxxp://metaboli.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_WMETA.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_WMETA.id - hxxp://www.metaboli.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_SMETA.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SMETA.id - hxxps://metaboli.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_WSMETA.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_WSMETA.id - hxxps://www.metaboli.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_METAINT.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_METAINT.id - hxxp://fr-int.metaboli.fr/

/* MNDE */
FF - user.js: capability.principal.codebase.YummyPlayer_MNDE.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_MNDE.id - hxxp://livegames.metaboli.de/
FF - user.js: capability.principal.codebase.YummyPlayer_SMNDE.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SMNDE.id - hxxps://livegames.metaboli.de/
FF - user.js: capability.principal.codebase.YummyPlayer_MNDEINT.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_MNDEINT.id - hxxp://msde-int.metaboli.fr/

/* MNFR */
FF - user.js: capability.principal.codebase.YummyPlayer_MNFR.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_MNFR.id - hxxp://livegames.metaboli.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_SMNFR.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SMNFR.id - hxxps://livegames.metaboli.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_MNFRINT.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_MNFRINT.id - hxxp://msfr-int.metaboli.fr/

/* MNUK */
FF - user.js: capability.principal.codebase.YummyPlayer_MNUK.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_MNUK.id - hxxp://livegames.metaboli.co.uk/
FF - user.js: capability.principal.codebase.YummyPlayer_SMNUK.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SMNUK.id - hxxps://livegames.metaboli.co.uk/
FF - user.js: capability.principal.codebase.YummyPlayer_MNUKINT.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_MNUKINT.id - hxxp://msuk-int.metaboli.fr/

/* NCNU */
FF - user.js: capability.principal.codebase.YummyPlayer_NCNU.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_NCNU.id - hxxp://numericable.metaboli.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_SNCNU.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SNCNU.id - hxxps://numericable.metaboli.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_NCNUINT.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_NCNUINT.id - hxxp://ncnu-int.metaboli.fr/

/* QPUK */
FF - user.js: capability.principal.codebase.YummyPlayer_QPUK.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_QPUK.id - hxxp://quintplay.metaboli.co.uk/
FF - user.js: capability.principal.codebase.YummyPlayer_SQPUK.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SQPUK.id - hxxps://quintplay.metaboli.co.uk/
FF - user.js: capability.principal.codebase.YummyPlayer_QPUKINT.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_QPUKINT.id - hxxp://qpuk-int.metaboli.fr/

/* SFFR */
FF - user.js: capability.principal.codebase.YummyPlayer_SFFR.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SFFR.id - hxxp://jeux-pc.sfr.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_SSFFR.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SSFFR.id - hxxps://jeux-pc.sfr.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_SFFRM.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SFFRM.id - hxxp://sfr.metaboli.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_SSFFRM.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SSFFRM.id - hxxps://sfr.metaboli.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_SFFRINT.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SFFRINT.id - hxxp://sfr-int.metaboli.fr/

/* SPDE */
FF - user.js: capability.principal.codebase.YummyPlayer_SPDE.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SPDE.id - hxxp://spieletipps.metaboli.de/
FF - user.js: capability.principal.codebase.YummyPlayer_SSPDE.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SSPDE.id - hxxps://spieletipps.metaboli.de/
FF - user.js: capability.principal.codebase.YummyPlayer_SPDEINT.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SPDEINT.id - hxxp://spde-int.metaboli.fr/

/* WOJ_ */
FF - user.js: capability.principal.codebase.YummyPlayer_WOJ_.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_WOJ_.id - hxxp://woj-prod.metaboli.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_SWOJ_.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SWOJ_.id - hxxps://woj-prod.metaboli.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_WOJ_INT.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_WOJ_INT.id - hxxp://woj-int.metaboli.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_SWOJ_INT.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SWOJ_INT.id - hxxps://woj-int.metaboli.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_WOJ_PP.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_WOJ_PP.id - hxxp://woj-pp.metaboli.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_SWOJ_PP.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SWOJ_PP.id - hxxps://woj-pp.metaboli.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_WOJ_PPINT.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_WOJ_PPINT.id - hxxp://woj-int.jeu.orange.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_SWOJ_PPINT.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SWOJ_PPINT.id - hxxps://woj-int.jeu.orange.fr/

user_pref(capability.principal.codebase.YummyPlayer_XX0001.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0001.id,hxxp://www.neufgame.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0002.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0002.id,hxxps://www.neufgame.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0003.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0003.id,hxxp://neufgame.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0004.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0004.id,hxxp://ad.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0005.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0005.id,hxxps://ad.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0006.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0006.id,hxxp://ads.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0007.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0007.id,hxxps://ads.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0008.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0008.id,hxxp://ads.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0009.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0009.id,hxxps://ads.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0010.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0010.id,hxxp://ads.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0011.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0011.id,hxxps://ads.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0012.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0012.id,hxxp://ag.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0013.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0013.id,hxxps://ag.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0014.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0014.id,hxxp://alice.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0015.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0015.id,hxxps://alice.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0016.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0016.id,hxxp://allocine.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0017.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0017.id,hxxps://allocine.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0018.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0018.id,hxxp://am.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0019.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0019.id,hxxps://am.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0020.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0020.id,hxxp://aol.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0021.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0021.id,hxxps://aol.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0022.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0022.id,hxxp://bc.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0023.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0023.id,hxxps://bc.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0024.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0024.id,hxxp://linternaute.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0025.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0025.id,hxxps://linternaute.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0026.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0026.id,hxxp://bild.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0027.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0027.id,hxxps://bild.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0028.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0028.id,hxxp://btvision.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0029.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0029.id,hxxps://btvision.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0030.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0030.id,hxxp://www.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0031.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0031.id,hxxp://cg.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0032.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0032.id,hxxps://cg.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0033.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0033.id,hxxp://cibleclick.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0034.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0034.id,hxxps://cibleclick.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0035.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0035.id,hxxp://cegetel.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0036.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0036.id,hxxps://cegetel.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0037.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0037.id,hxxp://choc.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0038.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0038.id,hxxps://choc.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0039.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0039.id,hxxp://cj.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0040.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0040.id,hxxps://cj.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0041.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0041.id,hxxp://cj.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0042.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0042.id,hxxps://cj.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0043.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0043.id,hxxp://cj.metaboli.it);
user_pref(capability.principal.codebase.YummyPlayer_XX0044.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0044.id,hxxps://cj.metaboli.it);
user_pref(capability.principal.codebase.YummyPlayer_XX0045.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0045.id,hxxp://cj.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0046.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0046.id,hxxps://cj.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0047.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0047.id,hxxp://metaboli.clubic.com);
user_pref(capability.principal.codebase.YummyPlayer_XX0048.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0048.id,hxxps://metaboli.clubic.com);
user_pref(capability.principal.codebase.YummyPlayer_XX0049.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0049.id,hxxp://metaboli.club-internet.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0050.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0050.id,hxxps://metaboli.club-internet.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0051.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0051.id,hxxp://coeur.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0052.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0052.id,hxxps://coeur.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0053.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0053.id,hxxp://come.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0054.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0054.id,hxxps://come.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0055.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0055.id,hxxp://lesaccros2.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0056.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0056.id,hxxps://lesaccros2.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0057.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0057.id,hxxp://surcouf.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0058.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0058.id,hxxps://surcouf.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0059.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0059.id,hxxp://www.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0060.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0060.id,hxxps://www.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0061.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0061.id,hxxp://cs.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0062.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0062.id,hxxps://cs.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0063.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0063.id,hxxp://custompc.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0064.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0064.id,hxxps://custompc.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0065.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0065.id,hxxp://cvg.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0066.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0066.id,hxxps://cvg.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0067.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0067.id,hxxp://daooda.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0068.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0068.id,hxxps://daooda.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0069.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0069.id,hxxp://daooda.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0070.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0070.id,hxxps://daooda.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0071.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0071.id,hxxp://daooda.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0072.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0072.id,hxxps://daooda.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0073.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0073.id,hxxp://digitaldownload.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0074.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0074.id,hxxps://digitaldownload.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0075.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0075.id,hxxp://eurogamer.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0076.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0076.id,hxxps://eurogamer.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0077.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0077.id,hxxp://eurogamer.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0078.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0078.id,hxxps://eurogamer.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0079.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0079.id,hxxp://exagame.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0080.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0080.id,hxxps://exagame.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0081.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0081.id,hxxp://fb.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0082.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0082.id,hxxps://fb.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0083.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0083.id,hxxp://fb.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0084.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0084.id,hxxps://fb.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0085.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0085.id,hxxp://fb.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0086.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0086.id,hxxps://fb.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0087.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0087.id,hxxp://firstcoffee.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0088.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0088.id,hxxps://firstcoffee.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0089.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0089.id,hxxp://fnac.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0090.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0090.id,hxxps://fnac.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0091.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0091.id,hxxp://fox.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0092.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0092.id,hxxps://fox.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0093.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0093.id,hxxp://fox.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0094.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0094.id,hxxps://fox.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0095.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0095.id,hxxp://fox.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0096.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0096.id,hxxps://fox.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0097.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0097.id,hxxp://free.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0098.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0098.id,hxxps://free.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0099.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0099.id,hxxp://funsta.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0100.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0100.id,hxxps://funsta.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0101.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0101.id,hxxp://funsta.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0102.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0102.id,hxxps://funsta.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0103.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0103.id,hxxp://metaboli.funradio.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0104.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0104.id,hxxps://metaboli.funradio.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0105.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0105.id,hxxp://fastweb.metaboli.it);
user_pref(capability.principal.codebase.YummyPlayer_XX0106.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0106.id,hxxps://fastweb.metaboli.it);
user_pref(capability.principal.codebase.YummyPlayer_XX0107.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0107.id,hxxp://god1.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0108.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0108.id,hxxps://god1.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0109.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0109.id,hxxp://god2.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0110.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0110.id,hxxps://god2.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0111.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0111.id,hxxp://god3.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0112.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0112.id,hxxps://god3.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0113.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0113.id,hxxp://gamona.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0114.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0114.id,hxxps://gamona.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0115.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0115.id,hxxp://giga.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0116.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0116.id,hxxps://giga.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0117.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0117.id,hxxp://gameseek.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0118.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0118.id,hxxps://gameseek.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0119.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0119.id,hxxp://www.gamesflatrate.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0120.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0120.id,hxxps://www.gamesflatrate.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0121.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0121.id,hxxp://games24.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0122.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0122.id,hxxps://games24.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0123.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0123.id,hxxp://ondemand.game.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0124.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0124.id,hxxps://ondemand.game.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0125.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0125.id,hxxp://google.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0126.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0126.id,hxxps://google.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0127.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0127.id,hxxp://google.metaboli.it);
user_pref(capability.principal.codebase.YummyPlayer_XX0128.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0128.id,hxxps://google.metaboli.it);
user_pref(capability.principal.codebase.YummyPlayer_XX0129.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0129.id,hxxp://gameone.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0130.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0130.id,hxxps://gameone.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0131.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0131.id,hxxp://google.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0132.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0132.id,hxxps://google.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0133.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0133.id,hxxp://goog.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0134.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0134.id,hxxps://goog.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0135.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0135.id,hxxp://google.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0136.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0136.id,hxxps://google.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0137.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0137.id,hxxp://gameplay.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0138.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0138.id,hxxps://gameplay.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0139.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0139.id,hxxp://gamesonradar.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0140.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0140.id,hxxps://gamesonradar.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0141.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0141.id,hxxp://gameshadow.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0142.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0142.id,hxxps://gameshadow.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0143.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0143.id,hxxp://gametap.metaboli.com);
user_pref(capability.principal.codebase.YummyPlayer_XX0144.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0144.id,hxxps://gametap.metaboli.com);
user_pref(capability.principal.codebase.YummyPlayer_XX0145.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0145.id,hxxp://gametap2.metaboli.com);
user_pref(capability.principal.codebase.YummyPlayer_XX0146.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0146.id,hxxps://gametap2.metaboli.com);
user_pref(capability.principal.codebase.YummyPlayer_XX0147.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0147.id,hxxp://gamespot.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0148.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0148.id,hxxps://gamespot.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0149.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0149.id,hxxp://gamerunlimited.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0150.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0150.id,hxxps://gamerunlimited.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0151.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0151.id,hxxp://guts.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0152.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0152.id,hxxps://guts.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0153.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0153.id,hxxp://gameswelt.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0154.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0154.id,hxxps://gameswelt.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0155.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0155.id,hxxp://gmx.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0156.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0156.id,hxxps://gmx.metaboli.de);
user_pref(capability.principal.codebase.YummyPlayer_XX0157.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0157.id,hxxp://hoaxbuster.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0158.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0158.id,hxxps://hoaxbuster.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0159.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0159.id,hxxp://incgamers.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0160.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0160.id,hxxps://incgamers.metaboli.co.uk);
user_pref(capability.principal.codebase.YummyPlayer_XX0161.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0161.id,hxxp://imbogames.metaboli.it);
user_pref(capability.principal.codebase.YummyPlayer_XX0162.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0162.id,hxxps://imbogames.metaboli.it);
user_pref(capability.principal.codebase.YummyPlayer_XX0163.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0163.id,hxxp://ja.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0164.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0164.id,hxxps://ja.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0165.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0165.id,hxxp://janews.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0166.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0166.id,hxxps://janews.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0167.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0167.id,hxxp://jvfr.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0168.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0168.id,hxxps://jvfr.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0169.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0169.id,hxxp://jeux-pc.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0170.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX0170.id,hxxps://jeux-pc.metaboli.fr);
user_pref(capability.principal.codebase.YummyPlayer_XX0171.granted,UniversalXPConnect);
user_pref(capability.principal.codebase.YummyPlayer_XX01

gen-hackman · Answer

ok refais un run Run scan avec OTL toujours les trois cases cochées et "ALL" pour la derniere option colonne de gauche d'OTL

maewa95 · Answer

"All" pour la colonne "extra Registry" ? c'est bien celle-ci ?

gen-hackman · Answer

oui

maewa95 · Answer

j'en ai eu deux pour le prix d'un mdr OTL Extras logfile created on: 11/08/2009 20:51:47 - Run 6 OTL by OldTimer - Version 3.0.10.5 Folder = C:\Documents and Settings\maewa\Bureau Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 0000040C | Country: France | Language: FRA | Date Format: dd/MM/yyyy 1022,79 Mb Total Physical Memory | 780,13 Mb Available Physical Memory | 76,27% Memory free 2,91 Gb Paging File | 2,83 Gb Available in Paging File | 97,21% Paging File free Paging file location(s): C:\pagefile.sys 2048 2048 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 149,04 Gb Total Space | 90,61 Gb Free Space | 60,80% Space Free | Partition Type: NTFS Drive D: | 149,05 Gb Total Space | 73,74 Gb Free Space | 49,47% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: SN402039360009 Current User Name: maewa Logged in as Administrator. Current Boot Mode: SafeMode with Networking Scan Mode: All users Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 60 Days Output = Standard [color=#E56717]========== Extra Registry (All) ==========[/color] [color=#E56717]========== File Associations ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\] .chm [@ = chm.file] -- C:\WINDOWS\hh.exe (Microsoft Corporation) .cpl [@ = cplfile] -- C:\WINDOWS\System32\shell32.DLL (Microsoft Corporation) .hlp [@ = hlpfile] -- C:\WINDOWS\System32\winhlp32.exe (Microsoft Corporation) .hta [@ = htafile] -- C:\WINDOWS\System32\mshta.exe (Microsoft Corporation) .html [@ = htmlfile] -- C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation) .inf [@ = inffile] -- C:\WINDOWS\System32\NOTEPAD.EXE (Microsoft Corporation) .ini [@ = inifile] -- C:\WINDOWS\System32\NOTEPAD.EXE (Microsoft Corporation) .url [@ = InternetShortcut] -- C:\WINDOWS\System32\ieframe.DLL (Microsoft Corporation) .js [@ = JSFile] -- C:\WINDOWS\System32\WScript.exe (Microsoft Corporation) .jse [@ = JSEFile] -- C:\WINDOWS\System32\WScript.exe (Microsoft Corporation) .reg [@ = regfile] -- C:\WINDOWS\regedit.exe (Microsoft Corporation) .txt [@ = txtfile] -- C:\WINDOWS\System32\NOTEPAD.EXE (Microsoft Corporation) .vbe [@ = VBEFile] -- C:\WINDOWS\System32\WScript.exe (Microsoft Corporation) .vbs [@ = VBSFile] -- C:\WINDOWS\System32\WScript.exe (Microsoft Corporation) .wsf [@ = WSFFile] -- C:\WINDOWS\System32\WScript.exe (Microsoft Corporation) .wsh [@ = WSHFile] -- C:\WINDOWS\System32\WScript.exe (Microsoft Corporation) [color=#E56717]========== Security Center Settings ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "AntiVirusDisableNotify" = 0 "FirewallDisableNotify" = 0 "UpdatesDisableNotify" = 0 "AntiVirusOverride" = 0 "FirewallOverride" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List] "139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004 "445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005 "137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001 "138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002 "26675:TCP" = 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall" = 0 "DoNotAllowExceptions" = 0 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List] "139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004 "445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005 "137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001 "138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002 "26675:TCP" = 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service "1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007 "2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008 "48113:TCP" = 48113:TCP:LocalSubNet:Enabled:maconfig_tcp "48113:UDP" = 48113:UDP:LocalSubNet:Enabled:maconfig_udp [color=#E56717]========== Authorized Applications List ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] "%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation) "C:\Program Files\Microsoft ActiveSync\rapimgr.exe" = C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager -- (Microsoft Corporation) "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" = C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager -- (Microsoft Corporation) "C:\Program Files\Microsoft ActiveSync\WCESMgr.exe" = C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application -- (Microsoft Corporation) "C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation) "C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe" = C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync -- (Microsoft Corporation) "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" = C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger -- (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "C:\Program Files\Messenger\msmsgs.exe" = C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger -- (Microsoft Corporation) "%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation) "C:\StubInstaller.exe" = C:\StubInstaller.exe:*:Enabled:LimeWire swarmed installer -- (LimeWire) "C:\WINDOWS\system32\rtcshare.exe" = C:\WINDOWS\system32\rtcshare.exe:*:Disabled:Partage de l'application RTC -- (Microsoft Corporation) "C:\Program Files\NetMeeting\conf.exe" = C:\Program Files\NetMeeting\conf.exe:*:Disabled:Windows® NetMeeting® -- (Microsoft Corporation) "C:\Program Files\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe" = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe:*:Enabled:Logitech Desktop Messenger -- (Logitech) "C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe -- (Hewlett-Packard Co.) "C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe -- (Hewlett-Packard Co.) "C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe -- (Hewlett-Packard Co.) "C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe" = C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe -- (Hewlett-Packard Co.) "C:\Program Files\HP\Digital Imaging\bin\hposid01.exe" = C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe -- (Hewlett-Packard Co.) "C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe -- () "C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe -- (Hewlett-Packard) "C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe -- (Hewlett-Packard Co.) "C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe" = C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe -- (Hewlett-Packard) "C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe -- (Hewlett-Packard Co.) "C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe" = C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe -- () "C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe" = C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe -- ( ) "C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe -- (Hewlett-Packard Co.) "C:\Program Files\Microsoft ActiveSync\rapimgr.exe" = C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager -- (Microsoft Corporation) "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" = C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager -- (Microsoft Corporation) "C:\Program Files\Microsoft ActiveSync\WCESMgr.exe" = C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application -- (Microsoft Corporation) "C:\WINDOWS\system32\dpvsetup.exe" = C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test -- (Microsoft Corporation) "C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Disabled:Firefox -- (Mozilla Corporation) "C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE" = C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook -- (Microsoft Corporation) "C:\Program Files\Microsoft Office\Office12\GROOVE.EXE" = C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove -- (Microsoft Corporation) "C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE" = C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote -- (Microsoft Corporation) "C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation) "C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe" = C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync -- (Microsoft Corporation) "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" = C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger -- (Microsoft Corporation) "C:\Program Files\pour detection config pilotes\ma-config.com\maconfservice.exe" = C:\Program Files\pour detection config pilotes\ma-config.com\maconfservice.exe:LocalSubNet:Enabled:maconfservice -- (CybelSoft) [color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 "{01523985-2098-43AF-9C97-12B07BE02A9B}" = Windows Live Call "{03B1B42B-F6DE-41d9-8CFF-DC44E895C7A7}" = PhotoGallery "{059C042E-796A-4ACC-A81A-ECC2010BB78C}" = Windows Live Messenger "{0611BD4E-4FE4-4a62-B0C0-18A4CC463428}" = CP_Package_Variety1 "{09984AEC-6B9F-4ca7-B78D-CB44D4771DA3}" = Destinations "{0BD83598-C2EF-3343-847B-7D2E84599128}" = Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - FRA "{0C858954-92B6-40C8-84D0-D095070C263C}" = Extension MSN pour Windows Live Toolbar "{10A44844-4465-456E-8C97-80BDD4F68845}" = Assistant de connexion Windows Live ID "{15EE79F4-4ED1-4267-9B0F-351009325D7D}" = HP Software Update "{172975EB-9465-4861-95B5-C7BB6D3DE62A}" = DocumentViewer "{1C139D7D-9FEA-468d-A9C8-2A6E3BDE564A}" = CP_Package_Variety3 "{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Outil de téléchargement Windows Live "{21DB3D90-D816-4092-A260-CA3F6B55A6DD}" = Sonic_PrimoSDK "{2231CE39-B963-4B9D-823A-F412ECA637B1}" = Windows Live Writer "{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT "{23A7B376-BBEC-4e76-BBD7-0F155E70D74B}" = CP_Panorama1Config "{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java(TM) 6 Update 11 "{27040F24-7260-4BCE-B45F-E19B40970EEE}" = PE-DESIGN Ver.7 "{27DC4D5B-1EFF-4666-8FED-2A7D32A495AF}" = PE-DESIGN Lite "{2B7BDADB-EC8C-4C54-B5DD-CE45A016D3A7}" = Player Metaboli "{2BB6C96F-D886-4494-961B-1AD282F3394B}" = PE-DESIGN Ver7 (Trial version) "{2CADCEAB-D5DA-44D6-B5FC-7DEE87AB3C0C}" = Unload "{30C19FF2-7FBA-4d09-B9DE-1659977F64F6}" = TrayApp "{3248F0A8-6813-11D6-A77B-00B0D0150090}" = J2SE Runtime Environment 5.0 Update 9 "{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java(TM) 6 Update 3 "{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java(TM) 6 Update 5 "{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7 "{32BDCCB8-9DC8-496d-9DB1-F77510775BDB}" = InstantShareDevices "{350C940c-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP "{36E47DA1-10E1-45d9-8B19-14D19607CDCF}" = CP_CalendarTemplates1 "{3CCB732A-E472-4CF9-B1EE-F18365341FE0}" = Installation Windows Live "{3E0E698E-28DA-4F2A-91AE-F208B3716283}" = Domino 3D "{3E31821C-7917-367E-938E-E65FC413EA31}" = Microsoft .NET Framework 3.5 Language Pack SP1 - fra "{3E386744-10FA-44b2-98C9-DF7A270DECB3}" = HP PSC & OfficeJet 5.3.A "{43563ACB-371B-4C58-8979-B192B390424C}" = Galerie de photos Windows Live "{47FF921C-E834-47A6-8CE4-F0A99CDE347F}" = ViaMichelin Navigation PND "{4AB8B41B-3AF1-46BE-99B0-0ACD3B300C0A}" = Junk Mail filter update "{4BDFD2CE-6329-42E4-9801-9B3D1F10D79B}" = Adobe® Photoshop® Album Edition Découverte 3.0 "{4CBA3D4C-8F51-4D60-B27E-F6B641C571E7}" = Microsoft Search Enhancement Pack "{4CD67A02-DF59-43f7-8E8F-86DCF40543EF}" = 2570_Help "{50E7BB78-02B4-469a-9D8B-B2F42835F90E}" = ProductContextNPI "{525DE7A9-5A0E-4ED8-85F9-FC67F0B377CC}" = Cartes "{53EE9E42-CECB-4C92-BF76-9CA65DAF8F1C}" = FullDPAppQFolder "{567C23E1-7580-4185-B8C2-30805677297C}" = NewCopy_CDA "{56EE8B17-8274-418d-89AC-C057C5DB251E}" = RandMap "{56F8AFC3-FA98-4ff1-9673-8A026CBF85BE}" = WebReg "{57C23D06-7708-4778-9005-8C78BABA5513}" = ACDSee Retouche photo "{59971D79-8111-42C2-9E40-883A0C277E78}" = SweetIM Toolbar for Internet Explorer 3.1 "{5A01C58E-B0EC-49b9-AD71-7C0468688087}" = CP_Package_Basic1 "{5B622B7A-60FB-4630-B11D-F121D20BCCD6}" = MarketResearch "{5F26311C-B135-4F7F-B11E-8E650F83651E}" = DeviceFunctionQFolder "{63DC2DA0-2A6C-4C38-9249-B75395458657}" = Windows Live Mail "{64D114CE-4234-45C2-B60A-2B07D5A48F72}" = Microsoft Works 7.0 "{66BA8C26-AFE4-4408-807B-43E76B57EF53}" = SkinsHP1 "{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder "{67D0313C-4F15-437D-9A2D-C1564088A26A}" = Windows Live Sync "{6BB6627C-694F-4FDC-A3E5-C7F4BED4C724}" = DocProc "{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable "{72AD53CC-CCC0-3757-8480-9EE176866A7C}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - FRA "{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 "{7C03270C-4FAB-4F5C-B10D-52FEDA190790}" = DocumentViewerQFolder "{7E27304E-BAA2-4d90-A34E-76641FAFABB4}" = CP_AtenaShokunin1Config "{8234A27D-C5A4-4F84-8718-3BF34BCFC89F}" = JourneySoftwarePromo "{83459B05-68A9-4F0F-B840-B5346236DF04}" = ViaMichelin Navigation PND "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86) "{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}" = Choice Guard "{900B1197-53F5-4F46-A882-2CFFFE2EEDCB}" = Logitech Desktop Messenger "{90120000-0010-040C-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (French) 12 "{90120000-0015-040C-0000-0000000FF1CE}" = Microsoft Office Access MUI (French) 2007 "{90120000-0015-040C-0000-0000000FF1CE}_ENTERPRISER_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0016-040C-0000-0000000FF1CE}" = Microsoft Office Excel MUI (French) 2007 "{90120000-0016-040C-0000-0000000FF1CE}_ENTERPRISER_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0018-040C-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (French) 2007 "{90120000-0018-040C-0000-0000000FF1CE}_ENTERPRISER_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0019-040C-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (French) 2007 "{90120000-0019-040C-0000-0000000FF1CE}_ENTERPRISER_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-001A-040C-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (French) 2007 "{90120000-001A-040C-0000-0000000FF1CE}_ENTERPRISER_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-001B-040C-0000-0000000FF1CE}" = Microsoft Office Word MUI (French) 2007 "{90120000-001B-040C-0000-0000000FF1CE}_ENTERPRISER_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-001F-0401-0000-0000000FF1CE}" = Microsoft Office Proof (Arabic) 2007 "{90120000-001F-0401-0000-0000000FF1CE}_ENTERPRISER_{14809F99-C601-4D4A-9391-F1E8FAA964C5}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007 "{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISER_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007 "{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISER_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007 "{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISER_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-001F-0413-0000-0000000FF1CE}" = Microsoft Office Proof (Dutch) 2007 "{90120000-001F-0413-0000-0000000FF1CE}_ENTERPRISER_{D66D5A44-E480-4BA4-B4F2-C554F6B30EBB}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007 "{90120000-001F-0C0A-0000-0000000FF1CE}_ENTERPRISER_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-002C-040C-0000-0000000FF1CE}" = Microsoft Office Proofing (French) 2007 "{90120000-0044-040C-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (French) 2007 "{90120000-0044-040C-0000-0000000FF1CE}_ENTERPRISER_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-006E-040C-0000-0000000FF1CE}" = Microsoft Office Shared MUI (French) 2007 "{90120000-006E-040C-0000-0000000FF1CE}_ENTERPRISER_{B165D3C2-40AE-4D39-86F7-E5C87C4264C0}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-00A1-040C-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (French) 2007 "{90120000-00A1-040C-0000-0000000FF1CE}_ENTERPRISER_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-00BA-040C-0000-0000000FF1CE}" = Microsoft Office Groove MUI (French) 2007 "{90120000-00BA-040C-0000-0000000FF1CE}_ENTERPRISER_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90AF040C-6000-11D3-8CFE-0150048383C9}" = Microsoft Office PowerPoint Viewer 2003 "{91120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007 "{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{915809D6-1F93-45F2-9699-5F1DA64DC24B}" = Windows Live Toolbar "{91A06334-CB8D-422A-9699-251217674FD4}" = ACDSee 9 Gestionnaire de photos "{923A7F5A-1E8C-4FBE-8DF6-85940A60A79F}" = Readme "{94FB906A-CF42-4128-A509-D353026A607E}" = REALTEK Gigabit and Fast Ethernet NIC Driver "{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting "{95120000-0122-040C-0000-0000000FF1CE}" = Microsoft Office Outlook Connector "{9541FED0-327F-4DF0-8B96-EF57EF622F19}" = Sonic RecordNow! "{961CE74B-30C0-47D6-ACD9-0C887A5E23F5}" = BitDefender Internet Security 2009 "{97C82B44-D408-4F14-9252-47FC1636D23E}_is1" = IZArc 3.81 "{9A394342-4A68-4EBA-85A6-55B559F4E700}" = Microsoft .NET Framework 1.1 French Language Pack "{A195B13E-A5E3-4BAF-A995-7F70F445CD06}" = ScannerCopy "{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI "{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2 "{A5BB5365-EFB4-44c3-A7E2-EB59B7EFD23D}" = CueTour "{A8D91906-4032-4443-8C49-69F90E38F39D}" = 2570 "{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder "{AC76BA86-7AD7-1036-7B44-A81000000003}" = Adobe Reader 8.1.0 - Français "{AE3CF174-872C-46C6-B9F6-C0593F3BC7B8}" = Microsoft Office Live Add-in 1.4 "{B158F76F-76AB-4115-A4F0-4C6EF6956093}_is1" = VirtualDubMOD 1.5.10.3 Fr "{B208806F-A231-4FA0-AB3F-5C1B8979223E}" = Microsoft ActiveSync 4.0 "{B276997E-4367-4b1b-A39C-4CAE7464337A}" = AiO_Scan_CDA "{B4D279F1-4309-49cc-A4B5-3A0D2E59C7B5}" = PanoStandAlone "{B60E7826-F117-4d26-8165-D2DC5A494AB0}" = Fax_CDA "{B64E3AFC-59EF-4f18-BF11-E751462450D3}" = AiOSoftwareNPI "{B824B5C9-849F-4b9e-9EA7-6FD8CD8116DA}" = CP_Package_Variety2 "{B996AE66-10DB-4ac5-B151-E8B4BFBC42FC}" = BufferChm "{B9C5669B-4705-4046-A3EE-0BFD08D7B668}" = Détecteur de flux Windows Live Toolbar "{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86) "{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2 "{C43048A9-742C-4DAD-90D2-E3B53C9DB825}" = Logiciel QuickCam de Logitech "{C506A18C-1469-4678-B094-F4EC9DAE6DB7}" = Scan "{CAE7D1D9-3794-4169-B4DD-964ADBC534EE}" = HP Product Detection "{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1 "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1 "{DD54C6DE-B787-406D-A5A7-A49E0471E45B}" = ACDSee 8 "{E3F90083-80D4-4b5a-87C7-E97E12F5516D}" = HPProductAssistant "{E5430A11-6799-41E0-A9D5-F68BDC67AAD8}" = OpenOffice.org 2.1 "{E780E536-16CE-4CD1-8FE0-2D5E52FAA65B}" = Ma-Config.com "{EA103B64-C0E4-4C0E-A506-751590E1653D}" = SolutionCenter "{EB8BAA0D-11EF-4EDC-A960-2AB7CA8F53F0}" = Windows Live Contrôle parental "{EE55FD52-0D47-4c5a-96EC-48F70FF30520}" = 2570Trb "{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU] "{F41C11EC-7C13-47A7-A07C-251D96EC3879}" = Les Chevaliers de Baphomet - Les Gardiens du Temple de Salomon "{F4C2E5F5-2970-45f4-ABD3-C180C4D961C4}" = Status "{F69E83CF-B440-43F8-89E6-6EA80712109B}" = Windows Live Communications Platform "{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 "Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "CAL" = Canon Camera Access Library "CameraWindowDVC5" = Canon Camera Window DC_DV 5 for ZoomBrowser EX "CameraWindowDVC6" = Canon Camera Window DC_DV 6 for ZoomBrowser EX "CameraWindowMC" = Canon Camera Window MC 6 for ZoomBrowser EX "Canon G.726 WMP-Decoder" = Canon G.726 WMP-Decoder "CANON iMAGE GATEWAY Task" = CANON iMAGE GATEWAY Task for ZoomBrowser EX "Canon Internet Library for ZoomBrowser EX" = Canon Internet Library for ZoomBrowser EX "CCleaner" = CCleaner (remove only) "C-Media Audio" = C-Media 3D Audio "CSCLIB" = Canon Camera Support Core Library "ENTERPRISER" = Microsoft Office Enterprise 2007 "EOS Utility" = Canon Utilities EOS Utility "exent_201554" = Post Mortem "exent_262354" = Aménophis "exent_280354" = Egypt 3 "exent_314854" = Obscure "exent_361554" = Still Life "exent_389354" = Leisure Suit Larry M "exent_458654" = Arthur et les Minimoys "exent_617954" = Narnia Chapitre 1 "ffdshow_is1" = ffdshow [rev 497] [2006-11-04] "FileZilla" = FileZilla (remove only) "Filters Unlimited_is1" = Filters Unlimited 2.0 "Free YouTube to Mp3 Converter_is1" = Free YouTube to Mp3 Converter version 3.1 "GML GrowCut Mask_is1" = GML GrowCut Mask 1.1 "hp deskjet 5550 series" = hp deskjet 5550 series (Supprimer uniquement) "HP Document Viewer" = HP Document Viewer 5.3 "HP Imaging Device Functions" = HP Imaging Device Functions 5.3 "HP Photo & Imaging" = HP Image Zone 5.3 "hp print screen utility" = hp print screen utility "HP Solution Center & Imaging Support Tools" = HP Solution Center & Imaging Support Tools 5.3 "HPExtendedCapabilities" = HP Extended Capabilities 5.3 "IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs "ie7" = Windows Internet Explorer 7 "ie8" = Windows Internet Explorer 8 "Imikimi Plugin" = Imikimi Plugin "Le pic rouge_is1" = Le pic rouge "Logitech Print Service" = Logitech Print Service "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware "Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1 "Microsoft .NET Framework 3.5 Language Pack SP1 - fra" = Module linguistique Microsoft .NET Framework 3.5 SP1- fra "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1 "MovieEditTask" = Canon MovieEdit Task for ZoomBrowser EX "Mozilla Firefox (3.0.13)" = Mozilla Firefox (3.0.13) "MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP "NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs "NVIDIA Drivers" = NVIDIA Drivers "PhotoFiltre" = PhotoFiltre "PhotoStitch" = Canon Utilities PhotoStitch "QcDrv" = Programme de gestion Camera de Logitech® "RAW Image Task" = Canon RAW Image Task for ZoomBrowser EX "RemoteCaptureTask" = Canon RemoteCapture Task for ZoomBrowser EX "ScMgr30Uninstall" = Caere Scan Manager 4.01 "Uninstall_is1" = Uninstall 1.0.0.0 "VLC media player" = VideoLAN VLC media player 0.8.6f "Windows Live OneCare safety scanner" = Windows Live OneCare safety scanner "Windows Media Format Runtime" = Windows Media Format 11 runtime "Windows Media Player" = Lecteur Windows Media 11 "Windows XP Service" = Windows XP Service Pack 3 "WinLiveSuite_Wave3" = Installation Windows Live "WMFDist11" = Windows Media Format 11 runtime "wmp11" = Windows Media Player 11 "Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0 "XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0 "ZoomBrowser EX" = Canon Utilities ZoomBrowser EX "Zylom Games Player Plugin" = Zylom Games Player Plugin [color=#E56717]========== Last 10 Event Log Errors ==========[/color] [ Application Events ] Error - 11/08/2009 11:54:22 | Computer Name = SN402039360009 | Source = crypt32 | ID = 131080 Description = Échec de la récupération de la mise à jour automatique du numéro de séquence de la liste racine tierce partie à partir de : avec l'erreur : Cette connexion réseau n'existe pas. Error - 11/08/2009 11:54:22 | Computer Name = SN402039360009 | Source = crypt32 | ID = 131080 Description = Échec de la récupération de la mise à jour automatique du numéro de séquence de la liste racine tierce partie à partir de : avec l'erreur : Cette connexion réseau n'existe pas. Error - 11/08/2009 13:44:08 | Computer Name = SN402039360009 | Source = crypt32 | ID = 131080 Description = Échec de la récupération de la mise à jour automatique du numéro de séquence de la liste racine tierce partie à partir de : avec l'erreur : The server name or address could not be resolved Error - 11/08/2009 13:44:08 | Computer Name = SN402039360009 | Source = crypt32 | ID = 131080 Description = Échec de la récupération de la mise à jour automatique du numéro de séquence de la liste racine tierce partie à partir de : avec l'erreur : Cette connexion réseau n'existe pas. Error - 11/08/2009 13:44:08 | Computer Name = SN402039360009 | Source = crypt32 | ID = 131080 Description = Échec de la récupération de la mise à jour automatique du numéro de séquence de la liste racine tierce partie à partir de : avec l'erreur : Cette connexion réseau n'existe pas. Error - 11/08/2009 13:44:08 | Computer Name = SN402039360009 | Source = crypt32 | ID = 131080 Description = Échec de la récupération de la mise à jour automatique du numéro de séquence de la liste racine tierce partie à partir de : avec l'erreur : Cette connexion réseau n'existe pas. Error - 11/08/2009 13:44:14 | Computer Name = SN402039360009 | Source = crypt32 | ID = 131080 Description = Échec de la récupération de la mise à jour automatique du numéro de séquence de la liste racine tierce partie à partir de : avec l'erreur : Cette connexion réseau n'existe pas. Error - 11/08/2009 13:44:14 | Computer Name = SN402039360009 | Source = crypt32 | ID = 131080 Description = Échec de la récupération de la mise à jour automatique du numéro de séquence de la liste racine tierce partie à partir de : avec l'erreur : Cette connexion réseau n'existe pas. Error - 11/08/2009 13:44:14 | Computer Name = SN402039360009 | Source = crypt32 | ID = 131080 Description = Échec de la récupération de la mise à jour automatique du numéro de séquence de la liste racine tierce partie à partir de : avec l'erreur : Cette connexion réseau n'existe pas. Error - 11/08/2009 13:44:14 | Computer Name = SN402039360009 | Source = crypt32 | ID = 131080 Description = Échec de la récupération de la mise à jour automatique du numéro de séquence de la liste racine tierce partie à partir de : avec l'erreur : Cette connexion réseau n'existe pas. [ OSession Events ] Error - 07/08/2008 02:44:22 | Computer Name = SN402039360009 | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6308.5000, Microsoft Office Version: 12.0.4518.1014. This session lasted 286 seconds with 240 seconds of active time. This session ended with a crash. Error - 05/05/2009 05:33:03 | Computer Name = SN402039360009 | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6423.1000, Microsoft Office Version: 12.0.6425.1000. This session lasted 20 seconds with 0 seconds of active time. This session ended with a crash. Error - 05/05/2009 05:33:22 | Computer Name = SN402039360009 | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6423.1000, Microsoft Office Version: 12.0.6425.1000. This session lasted 29 seconds with 0 seconds of active time. This session ended with a crash. Error - 05/05/2009 05:33:41 | Computer Name = SN402039360009 | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6423.1000, Microsoft Office Version: 12.0.6425.1000. This session lasted 27 seconds with 0 seconds of active time. This session ended with a crash. Error - 05/05/2009 05:34:01 | Computer Name = SN402039360009 | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6423.1000, Microsoft Office Version: 12.0.6425.1000. This session lasted 32 seconds with 0 seconds of active time. This session ended with a crash. Error - 05/05/2009 05:34:18 | Computer Name = SN402039360009 | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6423.1000, Microsoft Office Version: 12.0.6425.1000. This session lasted 30 seconds with 0 seconds of active time. This session ended with a crash. Error - 05/05/2009 05:34:57 | Computer Name = SN402039360009 | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6423.1000, Microsoft Office Version: 12.0.6425.1000. This session lasted 51 seconds with 0 seconds of active time. This session ended with a crash. Error - 10/05/2009 06:10:06 | Computer Name = SN402039360009 | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6423.1000, Microsoft Office Version: 12.0.6425.1000. This session lasted 30 seconds with 0 seconds of active time. This session ended with a crash. Error - 10/05/2009 06:10:58 | Computer Name = SN402039360009 | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6423.1000, Microsoft Office Version: 12.0.6425.1000. This session lasted 39 seconds with 0 seconds of active time. This session ended with a crash. Error - 14/06/2009 08:00:46 | Computer Name = SN402039360009 | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6504.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 85 seconds with 0 seconds of active time. This session ended with a crash. [ System Events ] Error - 11/08/2009 13:30:19 | Computer Name = SN402039360009 | Source = Service Control Manager | ID = 7001 Description = Le service Services IPSEC dépend du service Pilote IPSEC qui n'a pas pu démarrer en raison de l'erreur : %%31 Error - 11/08/2009 13:30:19 | Computer Name = SN402039360009 | Source = Service Control Manager | ID = 7026 Description = Le pilote de démarrage système ou d'amorçage suivant n'a pas pu se charger : AFD bdftdif Fips intelppm IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss Tcpip Error - 11/08/2009 13:33:05 | Computer Name = SN402039360009 | Source = Service Control Manager | ID = 7009 Description = Délai (30000 millisecondes) d'attente pour une connexion du service PEVSystemStart. Error - 11/08/2009 13:45:01 | Computer Name = SN402039360009 | Source = Service Control Manager | ID = 7009 Description = Délai (30000 millisecondes) d'attente pour une connexion du service PEVSystemStart. Error - 11/08/2009 13:45:03 | Computer Name = SN402039360009 | Source = Service Control Manager | ID = 7009 Description = Délai (30000 millisecondes) d'attente pour une connexion du service PEVSystemStart. Error - 11/08/2009 13:52:20 | Computer Name = SN402039360009 | Source = DCOM | ID = 10005 Description = DCOM a reçu l'erreur "%1084" lors de la mise en route du service StiSvc avec les arguments "" pour démarrer le serveur : {A1F4E726-8CF1-11D1-BF92-0060081ED811} Error - 11/08/2009 13:52:44 | Computer Name = SN402039360009 | Source = DCOM | ID = 10005 Description = DCOM a reçu l'erreur "%1084" lors de la mise en route du service EventSystem avec les arguments "" pour démarrer le serveur : {1BE1F766-5536-11D1-B726-00C04FB926AF} Error - 11/08/2009 13:54:09 | Computer Name = SN402039360009 | Source = Dhcp | ID = 1002 Description = Le bail de l'adresse IP 192.168.0.2 pour la carte réseau dont l'adresse réseau est 0013D41DE147 a été refusé par le serveur DHCP 78.250.255.253 (celui-ci a envoyé un message DHCPNACK). Error - 11/08/2009 13:54:40 | Computer Name = SN402039360009 | Source = DCOM | ID = 10005 Description = DCOM a reçu l'erreur "%1084" lors de la mise en route du service EventSystem avec les arguments "" pour démarrer le serveur : {1BE1F766-5536-11D1-B726-00C04FB926AF} Error - 11/08/2009 13:55:40 | Computer Name = SN402039360009 | Source = Service Control Manager | ID = 7026 Description = Le pilote de démarrage système ou d'amorçage suivant n'a pas pu se charger : Fips intelppm < End of report > OTL Extras logfile created on: 11/08/2009 20:51:47 - Run 6 OTL by OldTimer - Version 3.0.10.5 Folder = C:\Documents and Settings\maewa\Bureau Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 0000040C | Country: France | Language: FRA | Date Format: dd/MM/yyyy 1022,79 Mb Total Physical Memory | 780,13 Mb Available Physical Memory | 76,27% Memory free 2,91 Gb Paging File | 2,83 Gb Available in Paging File | 97,21% Paging File free Paging file location(s): C:\pagefile.sys 2048 2048 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 149,04 Gb Total Space | 90,61 Gb Free Space | 60,80% Space Free | Partition Type: NTFS Drive D: | 149,05 Gb Total Space | 73,74 Gb Free Space | 49,47% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: SN402039360009 Current User Name: maewa Logged in as Administrator. Current Boot Mode: SafeMode with Networking Scan Mode: All users Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 60 Days Output = Standard [color=#E56717]========== Extra Registry (All) ==========[/color] [color=#E56717]========== File Associations ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\] .chm [@ = chm.file] -- C:\WINDOWS\hh.exe (Microsoft Corporation) .cpl [@ = cplfile] -- C:\WINDOWS\System32\shell32.DLL (Microsoft Corporation) .hlp [@ = hlpfile] -- C:\WINDOWS\System32\winhlp32.exe (Microsoft Corporation) .hta [@ = htafile] -- C:\WINDOWS\System32\mshta.exe (Microsoft Corporation) .html [@ = htmlfile] -- C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation) .inf [@ = inffile] -- C:\WINDOWS\System32\NOTEPAD.EXE (Microsoft Corporation) .ini [@ = inifile] -- C:\WINDOWS\System32\NOTEPAD.EXE (Microsoft Corporation) .url [@ = InternetShortcut] -- C:\WINDOWS\System32\ieframe.DLL (Microsoft Corporation) .js [@ = JSFile] -- C:\WINDOWS\System32\WScript.exe (Microsoft Corporation) .jse [@ = JSEFile] -- C:\WINDOWS\System32\WScript.exe (Microsoft Corporation) .reg [@ = regfile] -- C:\WINDOWS\regedit.exe (Microsoft Corporation) .txt [@ = txtfile] -- C:\WINDOWS\System32\NOTEPAD.EXE (Microsoft Corporation) .vbe [@ = VBEFile] -- C:\WINDOWS\System32\WScript.exe (Microsoft Corporation) .vbs [@ = VBSFile] -- C:\WINDOWS\System32\WScript.exe (Microsoft Corporation) .wsf [@ = WSFFile] -- C:\WINDOWS\System32\WScript.exe (Microsoft Corporation) .wsh [@ = WSHFile] -- C:\WINDOWS\System32\WScript.exe (Microsoft Corporation) [color=#E56717]========== Security Center Settings ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "AntiVirusDisableNotify" = 0 "FirewallDisableNotify" = 0 "UpdatesDisableNotify" = 0 "AntiVirusOverride" = 0 "FirewallOverride" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List] "139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004 "445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005 "137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001 "138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002 "26675:TCP" = 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall" = 0 "DoNotAllowExceptions" = 0 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List] "139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004 "445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005 "137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001 "138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002 "26675:TCP" = 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service "1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007 "2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008 "48113:TCP" = 48113:TCP:LocalSubNet:Enabled:maconfig_tcp "48113:UDP" = 48113:UDP:LocalSubNet:Enabled:maconfig_udp [color=#E56717]========== Authorized Applications List ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] "%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation) "C:\Program Files\Microsoft ActiveSync\rapimgr.exe" = C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager -- (Microsoft Corporation) "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" = C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager -- (Microsoft Corporation) "C:\Program Files\Microsoft ActiveSync\WCESMgr.exe" = C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application -- (Microsoft Corporation) "C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation) "C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe" = C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync -- (Microsoft Corporation) "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" = C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger -- (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "C:\Program Files\Messenger\msmsgs.exe" = C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger -- (Microsoft Corporation) "%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation) "C:\StubInstaller.exe" = C:\StubInstaller.exe:*:Enabled:LimeWire swarmed installer -- (LimeWire) "C:\WINDOWS\system32\rtcshare.exe" = C:\WINDOWS\system32\rtcshare.exe:*:Disabled:Partage de l'application RTC -- (Microsoft Corporation) "C:\Program Files\NetMeeting\conf.exe" = C:\Program Files\NetMeeting\conf.exe:*:Disabled:Windows® NetMeeting® -- (Microsoft Corporation) "C:\Program Files\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe" = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe:*:Enabled:Logitech Desktop Messenger -- (Logitech) "C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe -- (Hewlett-Packard Co.) "C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe -- (Hewlett-Packard Co.) "C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe -- (Hewlett-Packard Co.) "C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe" = C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe -- (Hewlett-Packard Co.) "C:\Program Files\HP\Digital Imaging\bin\hposid01.exe" = C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe -- (Hewlett-Packard Co.) "C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe -- () "C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe -- (Hewlett-Packard) "C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe -- (Hewlett-Packard Co.) "C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe" = C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe -- (Hewlett-Packard) "C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe -- (Hewlett-Packard Co.) "C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe" = C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe -- () "C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe" = C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe -- ( ) "C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe -- (Hewlett-Packard Co.) "C:\Program Files\Microsoft ActiveSync\rapimgr.exe" = C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager -- (Microsoft Corporation) "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" = C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager -- (Microsoft Corporation) "C:\Program Files\Microsoft ActiveSync\WCESMgr.exe" = C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application -- (Microsoft Corporation) "C:\WINDOWS\system32\dpvsetup.exe" = C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test -- (Microsoft Corporation) "C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Disabled:Firefox -- (Mozilla Corporation) "C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE" = C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook -- (Microsoft Corporation) "C:\Program Files\Microsoft Office\Office12\GROOVE.EXE" = C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove -- (Microsoft Corporation) "C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE" = C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote -- (Microsoft Corporation) "C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation) "C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe" = C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync -- (Microsoft Corporation) "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" = C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger -- (Microsoft Corporation) "C:\Program Files\pour detection config pilotes\ma-config.com\maconfservice.exe" = C:\Program Files\pour detection config pilotes\ma-config.com\maconfservice.exe:LocalSubNet:Enabled:maconfservice -- (CybelSoft) [color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 "{01523985-2098-43AF-9C97-12B07BE02A9B}" = Windows Live Call "{03B1B42B-F6DE-41d9-8CFF-DC44E895C7A7}" = PhotoGallery "{059C042E-796A-4ACC-A81A-ECC2010BB78C}" = Windows Live Messenger "{0611BD4E-4FE4-4a62-B0C0-18A4CC463428}" = CP_Package_Variety1 "{09984AEC-6B9F-4ca7-B78D-CB44D4771DA3}" = Destinations "{0BD83598-C2EF-3343-847B-7D2E84599128}" = Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - FRA "{0C858954-92B6-40C8-84D0-D095070C263C}" = Extension MSN pour Windows Live Toolbar "{10A44844-4465-456E-8C97-80BDD4F68845}" = Assistant de connexion Windows Live ID "{15EE79F4-4ED1-4267-9B0F-351009325D7D}" = HP Software Update "{172975EB-9465-4861-95B5-C7BB6D3DE62A}" = DocumentViewer "{1C139D7D-9FEA-468d-A9C8-2A6E3BDE564A}" = CP_Package_Variety3 "{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Outil de téléchargement Windows Live "{21DB3D90-D816-4092-A260-CA3F6B55A6DD}" = Sonic_PrimoSDK "{2231CE39-B963-4B9D-823A-F412ECA637B1}" = Windows Live Writer "{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT "{23A7B376-BBEC-4e76-BBD7-0F155E70D74B}" = CP_Panorama1Config "{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java(TM) 6 Update 11 "{27040F24-7260-4BCE-B45F-E19B40970EEE}" = PE-DESIGN Ver.7 "{27DC4D5B-1EFF-4666-8FED-2A7D32A495AF}" = PE-DESIGN Lite "{2B7BDADB-EC8C-4C54-B5DD-CE45A016D3A7}" = Player Metaboli "{2BB6C96F-D886-4494-961B-1AD282F3394B}" = PE-DESIGN Ver7 (Trial version) "{2CADCEAB-D5DA-44D6-B5FC-7DEE87AB3C0C}" = Unload "{30C19FF2-7FBA-4d09-B9DE-1659977F64F6}" = TrayApp "{3248F0A8-6813-11D6-A77B-00B0D0150090}" = J2SE Runtime Environment 5.0 Update 9 "{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java(TM) 6 Update 3 "{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java(TM) 6 Update 5 "{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7 "{32BDCCB8-9DC8-496d-9DB1-F77510775BDB}" = InstantShareDevices "{350C940c-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP "{36E47DA1-10E1-45d9-8B19-14D19607CDCF}" = CP_CalendarTemplates1 "{3CCB732A-E472-4CF9-B1EE-F18365341FE0}" = Installation Windows Live "{3E0E698E-28DA-4F2A-91AE-F208B3716283}" = Domino 3D "{3E31821C-7917-367E-938E-E65FC413EA31}" = Microsoft .NET Framework 3.5 Language Pack SP1 - fra "{3E386744-10FA-44b2-98C9-DF7A270DECB3}" = HP PSC & OfficeJet 5.3.A "{43563ACB-371B-4C58-8979-B192B390424C}" = Galerie de photos Windows Live "{47FF921C-E834-47A6-8CE4-F0A99CDE347F}" = ViaMichelin Navigation PND "{4AB8B41B-3AF1-46BE-99B0-0ACD3B300C0A}" = Junk Mail filter update "{4BDFD2CE-6329-42E4-9801-9B3D1F10D79B}" = Adobe® Photoshop® Album Edition Découverte 3.0 "{4CBA3D4C-8F51-4D60-B27E-F6B641C571E7}" = Microsoft Search Enhancement Pack "{4CD67A02-DF59-43f7-8E8F-86DCF40543EF}" = 2570_Help "{50E7BB78-02B4-469a-9D8B-B2F42835F90E}" = ProductContextNPI "{525DE7A9-5A0E-4ED8-85F9-FC67F0B377CC}" = Cartes "{53EE9E42-CECB-4C92-BF76-9CA65DAF8F1C}" = FullDPAppQFolder "{567C23E1-7580-4185-B8C2-30805677297C}" = NewCopy_CDA "{56EE8B17-8274-418d-89AC-C057C5DB251E}" = RandMap "{56F8AFC3-FA98-4ff1-9673-8A026CBF85BE}" = WebReg "{57C23D06-7708-4778-9005-8C78BABA5513}" = ACDSee Retouche photo "{59971D79-8111-42C2-9E40-883A0C277E78}" = SweetIM Toolbar for Internet Explorer 3.1 "{5A01C58E-B0EC-49b9-AD71-7C0468688087}" = CP_Package_Basic1 "{5B622B7A-60FB-4630-B11D-F121D20BCCD6}" = MarketResearch "{5F26311C-B135-4F7F-B11E-8E650F83651E}" = DeviceFunctionQFolder "{63DC2DA0-2A6C-4C38-9249-B75395458657}" = Windows Live Mail "{64D114CE-4234-45C2-B60A-2B07D5A48F72}" = Microsoft Works 7.0 "{66BA8C26-AFE4-4408-807B-43E76B57EF53}" = SkinsHP1 "{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder "{67D0313C-4F15-437D-9A2D-C1564088A26A}" = Windows Live Sync "{6BB6627C-694F-4FDC-A3E5-C7F4BED4C724}" = DocProc "{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable "{72AD53CC-CCC0-3757-8480-9EE176866A7C}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - FRA "{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 "{7C03270C-4FAB-4F5C-B10D-52FEDA190790}" = DocumentViewerQFolder "{7E27304E-BAA2-4d90-A34E-76641FAFABB4}" = CP_AtenaShokunin1Config "{8234A27D-C5A4-4F84-8718-3BF34BCFC89F}" = JourneySoftwarePromo "{83459B05-68A9-4F0F-B840-B5346236DF04}" = ViaMichelin Navigation PND "{89F4137D-6C26-4A84-BDB8-2

gen-hackman · Answer

et tu peux m'envoyer l'OTL.txt par cijoint.fr stp ?

maewa95 · Answer

zoup là, le voici, le voilou 

http://www.cijoint.fr/cjlink.php?file=cj200908/cijkUJZ85i.txt

gen-hackman · Answer

&#9654 Clique sur le menu Demarrer /Panneau de configuration/Options des dossiers/ puis dans l'onglet Affichage
* - Coche    Afficher les fichiers et dossiers cachés
* - Décoche Masquer les extensions des fichiers dont le type est connu
* - Décoche Masquer les fichiers protégés du système d'exploitation (recommandé)

&#9654 clique sur Appliquer, puis OK.

N'oublie pas de recacher à nouveau les fichiers cachés et protégés du système d'exploitation en fin de désinfection, c'est important

Fais analyser le(s) fichier(s) suivants sur Virustotal :

Virus Total

    * Clique sur Parcourir en haut, choisis Poste de travail et cherche ces fichiers :

C:\WINDOWS\Tpwf016.dll
C:\WINDOWS\System32\sh33w32.dll 

    * Clique maintenant sur Envoyer le fichier. et laisse travailler tant que "Situation actuelle : en cours d'analyse" est affiché.
    * Il est possible que le fichier soit mis en file d'attente en raison d'un grand nombre de demandes d'analyses. En ce cas, il te faudra patienter sans actualiser la page.
    * Lorsque l'analyse est terminée ("Situation actuelle: terminé"), clique sur Formaté
    * Une nouvelle fenêtre de ton navigateur va apparaître
    * Clique alors sur les deux fleches
    * Fais un clic droit sur la page, et choisis Sélectionner tout, puis copier
    * Enfin colle le résultat dans ta prochaine réponse.

Note : Pour analyser un autre fichier, clique en bas sur Autre fichier.

maewa95 · Answer

voici l'analyse du fichier tpwf016.dll : Fichier Tpwf016.dll reçu le 2009.08.11 19:48:41 (UTC) Antivirus Version Dernière mise à jour Résultat a-squared 4.5.0.24 2009.08.11 - AhnLab-V3 5.0.0.2 2009.08.11 - AntiVir 7.9.1.0 2009.08.11 - Antiy-AVL 2.0.3.7 2009.08.11 - Authentium 5.1.2.4 2009.08.11 - Avast 4.8.1335.0 2009.08.10 - AVG 8.5.0.406 2009.08.11 - BitDefender 7.2 2009.08.11 - CAT-QuickHeal 10.00 2009.08.11 - ClamAV 0.94.1 2009.08.11 - Comodo 1945 2009.08.11 - DrWeb 5.0.0.12182 2009.08.11 - eSafe 7.0.17.0 2009.08.11 - eTrust-Vet 31.6.6672 2009.08.11 - F-Prot 4.4.4.56 2009.08.10 - F-Secure 8.0.14470.0 2009.08.11 - Fortinet 3.120.0.0 2009.08.11 - GData 19 2009.08.11 - Ikarus T3.1.1.64.0 2009.08.11 - K7AntiVirus 7.10.816 2009.08.11 - Kaspersky 7.0.0.125 2009.08.11 - McAfee 5706 2009.08.11 - McAfee+Artemis 5706 2009.08.11 - McAfee-GW-Edition 6.8.5 2009.08.11 - Microsoft 1.4903 2009.08.11 - NOD32 4326 2009.08.11 - nProtect 2009.1.8.0 2009.08.11 - Panda 10.0.0.14 2009.08.11 - PCTools 4.4.2.0 2009.08.11 - Prevx 3.0 2009.08.11 - Rising 21.42.14.00 2009.08.11 - Sophos 4.44.0 2009.08.11 - Sunbelt 3.2.1858.2 2009.08.11 - Symantec 1.4.4.12 2009.08.11 - TheHacker 6.3.4.3.380 2009.08.11 - TrendMicro 8.950.0.1094 2009.08.11 - VBA32 3.12.10.9 2009.08.10 - ViRobot 2009.8.11.1879 2009.08.11 - VirusBuster 4.6.5.0 2009.08.11 - Information additionnelle File size: 34304 bytes MD5...: 5e940998d7bf9de5ada29914757c779a SHA1..: ff93d321af37db4f5a819502b006aedf3cfe15b0 SHA256: 8c92cb649e30f23b7ac9affa2dd20c4ae04114c8c8048c3d91cf04db01b791a2 ssdeep: 384:F1HSsB7SQeAb/1PU5LOe3+k56oNEGF2V3FXifFzfz3uDojR7yh30DO3:uQ7c
cNPU7IgaVIFzaDoQ30
PEiD..: - TrID..: File type identification
Win32 Executable MS Visual C++ 4.x (69.2%)
Win32 Executable MS Visual C++ (generic) (19.3%)
Win32 Executable Generic (4.3%)
Win32 Dynamic Link Library (generic) (3.8%)
Win16/32 Executable Delphi generic (1.0%) PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x1810
timedatestamp.....: 0x3343be63 (Thu Apr 03 14:27:47 1997)
machinetype.......: 0x14c (I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x4f75 0x5000 6.38 580454580e7e6b3bce9b76aeb5012e8b
.rdata 0x6000 0x2ee 0x400 3.93 eb5ec01c758223fa634cca4404fe02db
.data 0x7000 0x31c4 0x2000 3.78 3ee131e462e22214172ee678a3eadc93
.idata 0xb000 0x4f4 0x600 4.38 7ee7268ca05d6cf2c6051b11ca5b8944
.reloc 0xc000 0x6de 0x800 4.39 285a69d26a14c80f65b19efed1c65ba6

( 1 imports )
> KERNEL32.dll: GetModuleFileNameA, GlobalFree, GetACP, GetCPInfo, GetCommandLineA, GetProcAddress, GetModuleHandleA, GetVersion, LoadLibraryA, GetCurrentThreadId, TlsSetValue, TlsAlloc, TlsFree, SetLastError, TlsGetValue, GetLastError, ExitProcess, HeapCreate, HeapDestroy, SetHandleCount, GetFileType, GetStdHandle, GetStartupInfoA, DeleteCriticalSection, lstrcpyA, SetStdHandle, SetFilePointer, GetOEMCP, FreeEnvironmentStringsA, MultiByteToWideChar, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, WideCharToMultiByte, WriteFile, HeapAlloc, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, HeapFree, GetStringTypeA, GetStringTypeW, LCMapStringA, LCMapStringW, FlushFileBuffers, CloseHandle

( 21 exports )
TPW_class, TPW_computeBorder, TPW_filter, TPW_icon, TPW_infoBitmap, TPW_infoText, TPW_margin, TPW_nameBitmap, TPW_nameText, TPW_nextDstRect, TPW_nextSrcRect, TPW_partSize, TPW_rectwidth, TPW_sliderDefaultSetting, TPW_sliderDescription, TPW_sliderIsActive, TPW_special, TPW_startDstRect, TPW_startSrcRect, TPW_totalSize, TPW_version
PDFiD.: - RDS...: NSRL Reference Data Set
- Antivirus Version Dernière mise à jour Résultat a-squared 4.5.0.24 2009.08.11 - AhnLab-V3 5.0.0.2 2009.08.11 - AntiVir 7.9.1.0 2009.08.11 - Antiy-AVL 2.0.3.7 2009.08.11 - Authentium 5.1.2.4 2009.08.11 - Avast 4.8.1335.0 2009.08.10 - AVG 8.5.0.406 2009.08.11 - BitDefender 7.2 2009.08.11 - CAT-QuickHeal 10.00 2009.08.11 - ClamAV 0.94.1 2009.08.11 - Comodo 1945 2009.08.11 - DrWeb 5.0.0.12182 2009.08.11 - eSafe 7.0.17.0 2009.08.11 - eTrust-Vet 31.6.6672 2009.08.11 - F-Prot 4.4.4.56 2009.08.10 - F-Secure 8.0.14470.0 2009.08.11 - Fortinet 3.120.0.0 2009.08.11 - GData 19 2009.08.11 - Ikarus T3.1.1.64.0 2009.08.11 - K7AntiVirus 7.10.816 2009.08.11 - Kaspersky 7.0.0.125 2009.08.11 - McAfee 5706 2009.08.11 - McAfee+Artemis 5706 2009.08.11 - McAfee-GW-Edition 6.8.5 2009.08.11 - Microsoft 1.4903 2009.08.11 - NOD32 4326 2009.08.11 - nProtect 2009.1.8.0 2009.08.11 - Panda 10.0.0.14 2009.08.11 - PCTools 4.4.2.0 2009.08.11 - Prevx 3.0 2009.08.11 - Rising 21.42.14.00 2009.08.11 - Sophos 4.44.0 2009.08.11 - Sunbelt 3.2.1858.2 2009.08.11 - Symantec 1.4.4.12 2009.08.11 - TheHacker 6.3.4.3.380 2009.08.11 - TrendMicro 8.950.0.1094 2009.08.11 - VBA32 3.12.10.9 2009.08.10 - ViRobot 2009.8.11.1879 2009.08.11 - VirusBuster 4.6.5.0 2009.08.11 - Information additionnelle File size: 34304 bytes MD5...: 5e940998d7bf9de5ada29914757c779a SHA1..: ff93d321af37db4f5a819502b006aedf3cfe15b0 SHA256: 8c92cb649e30f23b7ac9affa2dd20c4ae04114c8c8048c3d91cf04db01b791a2 ssdeep: 384:F1HSsB7SQeAb/1PU5LOe3+k56oNEGF2V3FXifFzfz3uDojR7yh30DO3:uQ7c
cNPU7IgaVIFzaDoQ30
PEiD..: - TrID..: File type identification
Win32 Executable MS Visual C++ 4.x (69.2%)
Win32 Executable MS Visual C++ (generic) (19.3%)
Win32 Executable Generic (4.3%)
Win32 Dynamic Link Library (generic) (3.8%)
Win16/32 Executable Delphi generic (1.0%) PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x1810
timedatestamp.....: 0x3343be63 (Thu Apr 03 14:27:47 1997)
machinetype.......: 0x14c (I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x4f75 0x5000 6.38 580454580e7e6b3bce9b76aeb5012e8b
.rdata 0x6000 0x2ee 0x400 3.93 eb5ec01c758223fa634cca4404fe02db
.data 0x7000 0x31c4 0x2000 3.78 3ee131e462e22214172ee678a3eadc93
.idata 0xb000 0x4f4 0x600 4.38 7ee7268ca05d6cf2c6051b11ca5b8944
.reloc 0xc000 0x6de 0x800 4.39 285a69d26a14c80f65b19efed1c65ba6

( 1 imports )
> KERNEL32.dll: GetModuleFileNameA, GlobalFree, GetACP, GetCPInfo, GetCommandLineA, GetProcAddress, GetModuleHandleA, GetVersion, LoadLibraryA, GetCurrentThreadId, TlsSetValue, TlsAlloc, TlsFree, SetLastError, TlsGetValue, GetLastError, ExitProcess, HeapCreate, HeapDestroy, SetHandleCount, GetFileType, GetStdHandle, GetStartupInfoA, DeleteCriticalSection, lstrcpyA, SetStdHandle, SetFilePointer, GetOEMCP, FreeEnvironmentStringsA, MultiByteToWideChar, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, WideCharToMultiByte, WriteFile, HeapAlloc, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, HeapFree, GetStringTypeA, GetStringTypeW, LCMapStringA, LCMapStringW, FlushFileBuffers, CloseHandle

( 21 exports )
TPW_class, TPW_computeBorder, TPW_filter, TPW_icon, TPW_infoBitmap, TPW_infoText, TPW_margin, TPW_nameBitmap, TPW_nameText, TPW_nextDstRect, TPW_nextSrcRect, TPW_partSize, TPW_rectwidth, TPW_sliderDefaultSetting, TPW_sliderDescription, TPW_sliderIsActive, TPW_special, TPW_startDstRect, TPW_startSrcRect, TPW_totalSize, TPW_version
PDFiD.: - RDS...: NSRL Reference Data Set
-

maewa95 · Answer

heuuuuuu là, pour le fichier system32\sh33w32.dll j'ai eu le message suivant : ce fichier a déjà été analysé et il m'a donné un permalien. Pourtant je ne l'avais pas lancé avant ! bon voici ce que j'ai eu en allant sur le permalien Fichier sh33w32.dll reçu le 2009.06.18 11:14:13 (UTC) Antivirus Version Dernière mise à jour Résultat a-squared 4.5.0.18 2009.06.18 - AhnLab-V3 5.0.0.2 2009.06.18 - AntiVir 7.9.0.191 2009.06.18 - Antiy-AVL 2.0.3.1 2009.06.18 - Authentium 5.1.2.4 2009.06.18 - Avast 4.8.1335.0 2009.06.17 - AVG 8.5.0.339 2009.06.18 - BitDefender 7.2 2009.06.18 - CAT-QuickHeal 10.00 2009.06.18 - ClamAV 0.94.1 2009.06.18 - Comodo 1362 2009.06.18 - DrWeb 5.0.0.12182 2009.06.18 - eSafe 7.0.17.0 2009.06.17 - eTrust-Vet 31.6.6567 2009.06.18 - F-Prot 4.4.4.56 2009.06.17 - F-Secure 8.0.14470.0 2009.06.18 - Fortinet 3.117.0.0 2009.06.18 - GData 19 2009.06.18 - Ikarus T3.1.1.59.0 2009.06.18 - Jiangmin 11.0.706 2009.06.18 - K7AntiVirus 7.10.766 2009.06.17 - Kaspersky 7.0.0.125 2009.06.18 - McAfee 5649 2009.06.17 - McAfee+Artemis 5649 2009.06.17 - McAfee-GW-Edition 6.7.6 2009.06.18 - Microsoft 1.4701 2009.06.18 - NOD32 4166 2009.06.18 - Norman 6.01.09 2009.06.17 - nProtect 2009.1.8.0 2009.06.18 - Panda 10.0.0.14 2009.06.17 - PCTools 4.4.2.0 2009.06.17 - Prevx 3.0 2009.06.18 - Rising 21.34.33.00 2009.06.18 - Sophos 4.42.0 2009.06.18 - Sunbelt 3.2.1858.2 2009.06.18 - Symantec 1.4.4.12 2009.06.18 - TheHacker 6.3.4.3.348 2009.06.17 - TrendMicro 8.950.0.1094 2009.06.18 - VBA32 3.12.10.7 2009.06.18 - ViRobot 2009.6.18.1794 2009.06.18 - VirusBuster 4.6.5.0 2009.06.17 - Information additionnelle File size: 108032 bytes MD5 : 9ee770044e1e9ce205bf5605c5b4bc58 SHA1 : 95013c7f1de4a54f8be2f2057e9ad7987430df31 SHA256: d0033f9b0960f10a91d081d152e3e863d1149c763c3a3347c030436644aa9185 PEInfo: PE Structure information

( base data )
entrypointaddress.: 0xCAED
timedatestamp.....: 0x3393C00F (Tue Jun 3 08:56:15 1997)
machinetype.......: 0x14C (Intel I386)

( 9 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xF632 0xF800 6.47 e1c8989da83c44e22467c62eaed3f910
.bss 0x11000 0x1514 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
.sdata 0x13000 0x10C 0x200 0.00 bf619eac0cdf3f68d496ea9344137e8b
.rdata 0x14000 0x25D 0x400 3.27 0a1946d05c169e6d744a878d61c9117b
.data 0x15000 0x61C4 0x6200 2.36 166e0a9ea6cfd4b27ba7fe082a3d429e
.idata 0x1C000 0x9D4 0xA00 5.82 b2f772be8cc55af51f8b792bdc32dad7
.edata 0x1D000 0xB13 0xC00 3.93 c41ad6106bca66c7561b722bf717082f
.rsrc 0x1E000 0x314 0x400 2.80 3082472e35418d8a616f23cc57685683
.reloc 0x1F000 0x1114 0x1200 6.07 a4dac991abf18862473f8ba12750c639

( 3 imports )

> advapi32.dll: RegCloseKey, RegOpenKeyExA, RegCreateKeyExA, RegSetValueExA, RegQueryValueExA
> kernel32.dll: VirtualLock, VirtualAlloc, VirtualFree, VirtualQuery, HeapAlloc, GetProcessHeap, HeapReAlloc, HeapFree, IsBadCodePtr, UnmapViewOfFile, MapViewOfFileEx, CreateFileMappingA, OpenFileMappingA, GetSystemInfo, OpenProcess, GetCurrentProcess, VirtualQueryEx, WaitForMultipleObjects, GetLastError, SetThreadPriority, CreateRemoteThread, ReadProcessMemory, InterlockedIncrement, OpenMutexA, MapViewOfFile, GetCurrentProcessId, CreateMutexA, GetCurrentThreadId, CreateEventA, SetEvent, GetVersion, GetModuleFileNameA, GetProcAddress, VirtualProtect, WriteProcessMemory, GetModuleHandleA, LoadLibraryA, LoadLibraryW, GetModuleHandleW, LoadLibraryExA, LoadLibraryExW, FreeLibrary, DeleteCriticalSection, CloseHandle, GetProcessHeaps, LeaveCriticalSection, LocalHandle, HeapLock, HeapSize, RaiseException, HeapDestroy, SetLastError, GlobalFlags, GlobalFree, GlobalHandle, GlobalLock, GlobalReAlloc, GlobalUnlock, RtlUnwind, GetEnvironmentStrings, GetCommandLineA, TlsSetValue, TlsAlloc, TlsFree, TlsGetValue, ExitProcess, WriteFile, GetACP, GetOEMCP, GetCPInfo, GetStdHandle, GetFileType, GetStartupInfoA, SetFilePointer, WideCharToMultiByte, CreateFileA, MultiByteToWideChar, SetStdHandle, FlushFileBuffers, SetEndOfFile, ReadFile, InitializeCriticalSection, WaitForSingleObject, ReleaseMutex, EnterCriticalSection, HeapWalk, ExitThread, HeapUnlock
> user32.dll: IsWindow, MessageBeep, MessageBoxA

( 1 exports )

> @_shi_deletePage@8, @_shi_initPageVariable@8, @_shi_sysAlloc@8, @_shi_sysFree@4, @_shi_sysSize@4, MemAlloc, MemAllocFS, MemAllocPtr, MemCheckPtr, MemDefaultErrorHandler, MemErrorUnwind, MemFix, MemFree, MemFreeFS, MemFreePtr, MemHandle, MemIsMoveable, MemLock, MemLockCount, MemPoolAttachShared, MemPoolCheck, MemPoolCount, MemPoolFirst, MemPoolFree, MemPoolInfo, MemPoolInit, MemPoolInitFS, MemPoolInitNamedShared, MemPoolInitNamedSharedEx, MemPoolInitRegion, MemPoolLock, MemPoolNext, MemPoolPreAllocate, MemPoolPreAllocateHandles, MemPoolSetBlockSizeFS, MemPoolSetCeiling, MemPoolSetFloor, MemPoolSetPageSize, MemPoolSetSmallBlockSize, MemPoolShrink, MemPoolSize, MemPoolUnlock, MemPoolWalk, MemReAlloc, MemReAllocPtr, MemRegisterTask, MemSetErrorHandler, MemSize, MemSizePtr, MemSizeRequested, MemUnfix, MemUnlock, MemUnregisterTask, MemVersion, _shi_MemFreeDefaultPool@0, _shi_MemInitDefaultPool@0, _shi_deleteStdcall@4, _shi_enterCriticalSection, _shi_leaveCriticalSection, _shi_newStdcall@4, shi_MemDefaultPool, shi_calloc, shi_delete, shi_expand, shi_free, shi_heapadd, shi_heapchk, shi_heapmin, shi_heapset, shi_heapused, shi_heapwalk, shi_malloc, shi_msize, shi_new, shi_realloc, shi_set_new_handler TrID : File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%) ssdeep: 3072:EdPymhFflYmXgCaPdT9IMUFMtwOTo5BB2kNDwI46mf:JUEdTaOT0B2kq6C PEiD : - RDS : NSRL Reference Data Set

( Hewlett Packard )

HP scanjet 7400c series: sh33w32.dll
( Vivendi Universal Games )

Little People Discovery Games: SH33W32.DLL
( Novell Inc. )

CNE Net NetWare 5 Beta 3: SH33W32.DLL
( Corel Corporation )

1,300,000 Corel Gallery: sh33w32.dllCorel Draw 8: SH33W32.DLLCorel Print House 6: sh33w32.dllCorel PrintOffice: sh33w32.dllGallery: sh33w32.dllPrint House Magic: SH33W32.DLLPrint House Magic: SH33W32.DLLPrint Office: sh33w32.dll
( WRQ )

Reflection Evaluator: sh33w32.dll Antivirus Version Dernière mise à jour Résultat a-squared 4.5.0.18 2009.06.18 - AhnLab-V3 5.0.0.2 2009.06.18 - AntiVir 7.9.0.191 2009.06.18 - Antiy-AVL 2.0.3.1 2009.06.18 - Authentium 5.1.2.4 2009.06.18 - Avast 4.8.1335.0 2009.06.17 - AVG 8.5.0.339 2009.06.18 - BitDefender 7.2 2009.06.18 - CAT-QuickHeal 10.00 2009.06.18 - ClamAV 0.94.1 2009.06.18 - Comodo 1362 2009.06.18 - DrWeb 5.0.0.12182 2009.06.18 - eSafe 7.0.17.0 2009.06.17 - eTrust-Vet 31.6.6567 2009.06.18 - F-Prot 4.4.4.56 2009.06.17 - F-Secure 8.0.14470.0 2009.06.18 - Fortinet 3.117.0.0 2009.06.18 - GData 19 2009.06.18 - Ikarus T3.1.1.59.0 2009.06.18 - Jiangmin 11.0.706 2009.06.18 - K7AntiVirus 7.10.766 2009.06.17 - Kaspersky 7.0.0.125 2009.06.18 - McAfee 5649 2009.06.17 - McAfee+Artemis 5649 2009.06.17 - McAfee-GW-Edition 6.7.6 2009.06.18 - Microsoft 1.4701 2009.06.18 - NOD32 4166 2009.06.18 - Norman 6.01.09 2009.06.17 - nProtect 2009.1.8.0 2009.06.18 - Panda 10.0.0.14 2009.06.17 - PCTools 4.4.2.0 2009.06.17 - Prevx 3.0 2009.06.18 - Rising 21.34.33.00 2009.06.18 - Sophos 4.42.0 2009.06.18 - Sunbelt 3.2.1858.2 2009.06.18 - Symantec 1.4.4.12 2009.06.18 - TheHacker 6.3.4.3.348 2009.06.17 - TrendMicro 8.950.0.1094 2009.06.18 - VBA32 3.12.10.7 2009.06.18 - ViRobot 2009.6.18.1794 2009.06.18 - VirusBuster 4.6.5.0 2009.06.17 - Information additionnelle File size: 108032 bytes MD5 : 9ee770044e1e9ce205bf5605c5b4bc58 SHA1 : 95013c7f1de4a54f8be2f2057e9ad7987430df31 SHA256: d0033f9b0960f10a91d081d152e3e863d1149c763c3a3347c030436644aa9185 PEInfo: PE Structure information

( base data )
entrypointaddress.: 0xCAED
timedatestamp.....: 0x3393C00F (Tue Jun 3 08:56:15 1997)
machinetype.......: 0x14C (Intel I386)

( 9 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xF632 0xF800 6.47 e1c8989da83c44e22467c62eaed3f910
.bss 0x11000 0x1514 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
.sdata 0x13000 0x10C 0x200 0.00 bf619eac0cdf3f68d496ea9344137e8b
.rdata 0x14000 0x25D 0x400 3.27 0a1946d05c169e6d744a878d61c9117b
.data 0x15000 0x61C4 0x6200 2.36 166e0a9ea6cfd4b27ba7fe082a3d429e
.idata 0x1C000 0x9D4 0xA00 5.82 b2f772be8cc55af51f8b792bdc32dad7
.edata 0x1D000 0xB13 0xC00 3.93 c41ad6106bca66c7561b722bf717082f
.rsrc 0x1E000 0x314 0x400 2.80 3082472e35418d8a616f23cc57685683
.reloc 0x1F000 0x1114 0x1200 6.07 a4dac991abf18862473f8ba12750c639

( 3 imports )

> advapi32.dll: RegCloseKey, RegOpenKeyExA, RegCreateKeyExA, RegSetValueExA, RegQueryValueExA
> kernel32.dll: VirtualLock, VirtualAlloc, VirtualFree, VirtualQuery, HeapAlloc, GetProcessHeap, HeapReAlloc, HeapFree, IsBadCodePtr, UnmapViewOfFile, MapViewOfFileEx, CreateFileMappingA, OpenFileMappingA, GetSystemInfo, OpenProcess, GetCurrentProcess, VirtualQueryEx, WaitForMultipleObjects, GetLastError, SetThreadPriority, CreateRemoteThread, ReadProcessMemory, InterlockedIncrement, OpenMutexA, MapViewOfFile, GetCurrentProcessId, CreateMutexA, GetCurrentThreadId, CreateEventA, SetEvent, GetVersion, GetModuleFileNameA, GetProcAddress, VirtualProtect, WriteProcessMemory, GetModuleHandleA, LoadLibraryA, LoadLibraryW, GetModuleHandleW, LoadLibraryExA, LoadLibraryExW, FreeLibrary, DeleteCriticalSection, CloseHandle, GetProcessHeaps, LeaveCriticalSection, LocalHandle, HeapLock, HeapSize, RaiseException, HeapDestroy, SetLastError, GlobalFlags, GlobalFree, GlobalHandle, GlobalLock, GlobalReAlloc, GlobalUnlock, RtlUnwind, GetEnvironmentStrings, GetCommandLineA, TlsSetValue, TlsAlloc, TlsFree, TlsGetValue, ExitProcess, WriteFile, GetACP, GetOEMCP, GetCPInfo, GetStdHandle, GetFileType, GetStartupInfoA, SetFilePointer, WideCharToMultiByte, CreateFileA, MultiByteToWideChar, SetStdHandle, FlushFileBuffers, SetEndOfFile, ReadFile, InitializeCriticalSection, WaitForSingleObject, ReleaseMutex, EnterCriticalSection, HeapWalk, ExitThread, HeapUnlock
> user32.dll: IsWindow, MessageBeep, MessageBoxA

( 1 exports )

> @_shi_deletePage@8, @_shi_initPageVariable@8, @_shi_sysAlloc@8, @_shi_sysFree@4, @_shi_sysSize@4, MemAlloc, MemAllocFS, MemAllocPtr, MemCheckPtr, MemDefaultErrorHandler, MemErrorUnwind, MemFix, MemFree, MemFreeFS, MemFreePtr, MemHandle, MemIsMoveable, MemLock, MemLockCount, MemPoolAttachShared, MemPoolCheck, MemPoolCount, MemPoolFirst, MemPoolFree, MemPoolInfo, MemPoolInit, MemPoolInitFS, MemPoolInitNamedShared, MemPoolInitNamedSharedEx, MemPoolInitRegion, MemPoolLock, MemPoolNext, MemPoolPreAllocate, MemPoolPreAllocateHandles, MemPoolSetBlockSizeFS, MemPoolSetCeiling, MemPoolSetFloor, MemPoolSetPageSize, MemPoolSetSmallBlockSize, MemPoolShrink, MemPoolSize, MemPoolUnlock, MemPoolWalk, MemReAlloc, MemReAllocPtr, MemRegisterTask, MemSetErrorHandler, MemSize, MemSizePtr, MemSizeRequested, MemUnfix, MemUnlock, MemUnregisterTask, MemVersion, _shi_MemFreeDefaultPool@0, _shi_MemInitDefaultPool@0, _shi_deleteStdcall@4, _shi_enterCriticalSection, _shi_leaveCriticalSection, _shi_newStdcall@4, shi_MemDefaultPool, shi_calloc, shi_delete, shi_expand, shi_free, shi_heapadd, shi_heapchk, shi_heapmin, shi_heapset, shi_heapused, shi_heapwalk, shi_malloc, shi_msize, shi_new, shi_realloc, shi_set_new_handler TrID : File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%) ssdeep: 3072:EdPymhFflYmXgCaPdT9IMUFMtwOTo5BB2kNDwI46mf:JUEdTaOT0B2kq6C PEiD : - RDS : NSRL Reference Data Set

( Hewlett Packard )

HP scanjet 7400c series: sh33w32.dll
( Vivendi Universal Games )

Little People Discovery Games: SH33W32.DLL
( Novell Inc. )

CNE Net NetWare 5 Beta 3: SH33W32.DLL
( Corel Corporation )

1,300,000 Corel Gallery: sh33w32.dllCorel Draw 8: SH33W32.DLLCorel Print House 6: sh33w32.dllCorel PrintOffice: sh33w32.dllGallery: sh33w32.dllPrint House Magic: SH33W32.DLLPrint House Magic: SH33W32.DLLPrint Office: sh33w32.dll
( WRQ )

Reflection Evaluator: sh33w32.dll

maewa95 · Answer

attends, dans le doute, j'ai relancé l'analyse pour sh33w32 voici le rapport : Fichier sh33w32.dll reçu le 2009.08.11 19:56:47 (UTC) Antivirus Version Dernière mise à jour Résultat a-squared 4.5.0.24 2009.08.11 - AhnLab-V3 5.0.0.2 2009.08.11 - AntiVir 7.9.1.0 2009.08.11 - Antiy-AVL 2.0.3.7 2009.08.11 - Authentium 5.1.2.4 2009.08.11 - Avast 4.8.1335.0 2009.08.10 - AVG 8.5.0.406 2009.08.11 - BitDefender 7.2 2009.08.11 - CAT-QuickHeal 10.00 2009.08.11 - ClamAV 0.94.1 2009.08.11 - Comodo 1945 2009.08.11 - DrWeb 5.0.0.12182 2009.08.11 - eSafe 7.0.17.0 2009.08.11 - eTrust-Vet 31.6.6672 2009.08.11 - F-Prot 4.4.4.56 2009.08.10 - F-Secure 8.0.14470.0 2009.08.11 - Fortinet 3.120.0.0 2009.08.11 - GData 19 2009.08.11 - Ikarus T3.1.1.64.0 2009.08.11 - Jiangmin 11.0.800 2009.08.11 - K7AntiVirus 7.10.816 2009.08.11 - Kaspersky 7.0.0.125 2009.08.11 - McAfee 5706 2009.08.11 - McAfee+Artemis 5706 2009.08.11 - McAfee-GW-Edition 6.8.5 2009.08.11 - Microsoft 1.4903 2009.08.11 - NOD32 4326 2009.08.11 - Norman 6.01.09 2009.08.11 - nProtect 2009.1.8.0 2009.08.11 - Panda 10.0.0.14 2009.08.11 - PCTools 4.4.2.0 2009.08.11 - Prevx 3.0 2009.08.11 - Rising 21.42.14.00 2009.08.11 - Sophos 4.44.0 2009.08.11 - Sunbelt 3.2.1858.2 2009.08.11 - Symantec 1.4.4.12 2009.08.11 - TheHacker 6.3.4.3.381 2009.08.11 - TrendMicro 8.950.0.1094 2009.08.11 - VBA32 3.12.10.9 2009.08.10 - ViRobot 2009.8.11.1879 2009.08.11 - VirusBuster 4.6.5.0 2009.08.11 - Information additionnelle File size: 108032 bytes MD5...: 9ee770044e1e9ce205bf5605c5b4bc58 SHA1..: 95013c7f1de4a54f8be2f2057e9ad7987430df31 SHA256: d0033f9b0960f10a91d081d152e3e863d1149c763c3a3347c030436644aa9185 ssdeep: 3072:EdPymhFflYmXgCaPdT9IMUFMtwOTo5BB2kNDwI46mf:JUEdTaOT0B2kq6C
PEiD..: - TrID..: File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%) PEInfo: PE Structure information

( base data )
entrypointaddress.: 0xcaed
timedatestamp.....: 0x3393c00f (Tue Jun 03 06:56:15 1997)
machinetype.......: 0x14c (I386)

( 9 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xf632 0xf800 6.47 e1c8989da83c44e22467c62eaed3f910
.bss 0x11000 0x1514 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
.sdata 0x13000 0x10c 0x200 0.00 bf619eac0cdf3f68d496ea9344137e8b
.rdata 0x14000 0x25d 0x400 3.27 0a1946d05c169e6d744a878d61c9117b
.data 0x15000 0x61c4 0x6200 2.36 166e0a9ea6cfd4b27ba7fe082a3d429e
.idata 0x1c000 0x9d4 0xa00 5.82 b2f772be8cc55af51f8b792bdc32dad7
.edata 0x1d000 0xb13 0xc00 3.93 c41ad6106bca66c7561b722bf717082f
.rsrc 0x1e000 0x314 0x400 2.80 3082472e35418d8a616f23cc57685683
.reloc 0x1f000 0x1114 0x1200 6.07 a4dac991abf18862473f8ba12750c639

( 3 imports )
> KERNEL32.dll: VirtualLock, VirtualAlloc, VirtualFree, VirtualQuery, HeapAlloc, GetProcessHeap, HeapReAlloc, HeapFree, IsBadCodePtr, UnmapViewOfFile, MapViewOfFileEx, CreateFileMappingA, OpenFileMappingA, GetSystemInfo, OpenProcess, GetCurrentProcess, VirtualQueryEx, WaitForMultipleObjects, GetLastError, SetThreadPriority, CreateRemoteThread, ReadProcessMemory, InterlockedIncrement, OpenMutexA, MapViewOfFile, GetCurrentProcessId, CreateMutexA, GetCurrentThreadId, CreateEventA, SetEvent, GetVersion, GetModuleFileNameA, GetProcAddress, VirtualProtect, WriteProcessMemory, GetModuleHandleA, LoadLibraryA, LoadLibraryW, GetModuleHandleW, LoadLibraryExA, LoadLibraryExW, FreeLibrary, DeleteCriticalSection, CloseHandle, GetProcessHeaps, LeaveCriticalSection, LocalHandle, HeapLock, HeapSize, RaiseException, HeapDestroy, SetLastError, GlobalFlags, GlobalFree, GlobalHandle, GlobalLock, GlobalReAlloc, GlobalUnlock, RtlUnwind, GetEnvironmentStrings, GetCommandLineA, TlsSetValue, TlsAlloc, TlsFree, TlsGetValue, ExitProcess, WriteFile, GetACP, GetOEMCP, GetCPInfo, GetStdHandle, GetFileType, GetStartupInfoA, SetFilePointer, WideCharToMultiByte, CreateFileA, MultiByteToWideChar, SetStdHandle, FlushFileBuffers, SetEndOfFile, ReadFile, InitializeCriticalSection, WaitForSingleObject, ReleaseMutex, EnterCriticalSection, HeapWalk, ExitThread, HeapUnlock
> USER32.dll: IsWindow, MessageBeep, MessageBoxA
> ADVAPI32.dll: RegCloseKey, RegOpenKeyExA, RegCreateKeyExA, RegSetValueExA, RegQueryValueExA

( 76 exports )
@_shi_deletePage@8, @_shi_initPageVariable@8, @_shi_sysAlloc@8, @_shi_sysFree@4, @_shi_sysSize@4, MemAlloc, MemAllocFS, MemAllocPtr, MemCheckPtr, MemDefaultErrorHandler, MemErrorUnwind, MemFix, MemFree, MemFreeFS, MemFreePtr, MemHandle, MemIsMoveable, MemLock, MemLockCount, MemPoolAttachShared, MemPoolCheck, MemPoolCount, MemPoolFirst, MemPoolFree, MemPoolInfo, MemPoolInit, MemPoolInitFS, MemPoolInitNamedShared, MemPoolInitNamedSharedEx, MemPoolInitRegion, MemPoolLock, MemPoolNext, MemPoolPreAllocate, MemPoolPreAllocateHandles, MemPoolSetBlockSizeFS, MemPoolSetCeiling, MemPoolSetFloor, MemPoolSetPageSize, MemPoolSetSmallBlockSize, MemPoolShrink, MemPoolSize, MemPoolUnlock, MemPoolWalk, MemReAlloc, MemReAllocPtr, MemRegisterTask, MemSetErrorHandler, MemSize, MemSizePtr, MemSizeRequested, MemUnfix, MemUnlock, MemUnregisterTask, MemVersion, _shi_MemFreeDefaultPool@0, _shi_MemInitDefaultPool@0, _shi_deleteStdcall@4, _shi_enterCriticalSection, _shi_leaveCriticalSection, _shi_newStdcall@4, shi_MemDefaultPool, shi_calloc, shi_delete, shi_expand, shi_free, shi_heapadd, shi_heapchk, shi_heapmin, shi_heapset, shi_heapused, shi_heapwalk, shi_malloc, shi_msize, shi_new, shi_realloc, shi_set_new_handler
PDFiD.: - RDS...: NSRL Reference Data Set

( Corel Corporation )

> Print House Magic: SH33W32.DLL
> 1,300,000 Corel Gallery: sh33w32.dll
> Print Office: sh33w32.dll
> Corel Print House 6: sh33w32.dll
> Corel Draw 8: SH33W32.DLL
> Gallery: sh33w32.dll
> Corel PrintOffice: sh33w32.dll

( Vivendi Universal Games )

> Little People Discovery Games: SH33W32.DLL

( Novell Inc. )

> CNE Net NetWare 5 Beta 3: SH33W32.DLL

( Hewlett Packard )

> HP scanjet 7400c series: sh33w32.dll

( WRQ )

> Reflection Evaluator: sh33w32.dll

Antivirus Version Dernière mise à jour Résultat a-squared 4.5.0.24 2009.08.11 - AhnLab-V3 5.0.0.2 2009.08.11 - AntiVir 7.9.1.0 2009.08.11 - Antiy-AVL 2.0.3.7 2009.08.11 - Authentium 5.1.2.4 2009.08.11 - Avast 4.8.1335.0 2009.08.10 - AVG 8.5.0.406 2009.08.11 - BitDefender 7.2 2009.08.11 - CAT-QuickHeal 10.00 2009.08.11 - ClamAV 0.94.1 2009.08.11 - Comodo 1945 2009.08.11 - DrWeb 5.0.0.12182 2009.08.11 - eSafe 7.0.17.0 2009.08.11 - eTrust-Vet 31.6.6672 2009.08.11 - F-Prot 4.4.4.56 2009.08.10 - F-Secure 8.0.14470.0 2009.08.11 - Fortinet 3.120.0.0 2009.08.11 - GData 19 2009.08.11 - Ikarus T3.1.1.64.0 2009.08.11 - Jiangmin 11.0.800 2009.08.11 - K7AntiVirus 7.10.816 2009.08.11 - Kaspersky 7.0.0.125 2009.08.11 - McAfee 5706 2009.08.11 - McAfee+Artemis 5706 2009.08.11 - McAfee-GW-Edition 6.8.5 2009.08.11 - Microsoft 1.4903 2009.08.11 - NOD32 4326 2009.08.11 - Norman 6.01.09 2009.08.11 - nProtect 2009.1.8.0 2009.08.11 - Panda 10.0.0.14 2009.08.11 - PCTools 4.4.2.0 2009.08.11 - Prevx 3.0 2009.08.11 - Rising 21.42.14.00 2009.08.11 - Sophos 4.44.0 2009.08.11 - Sunbelt 3.2.1858.2 2009.08.11 - Symantec 1.4.4.12 2009.08.11 - TheHacker 6.3.4.3.381 2009.08.11 - TrendMicro 8.950.0.1094 2009.08.11 - VBA32 3.12.10.9 2009.08.10 - ViRobot 2009.8.11.1879 2009.08.11 - VirusBuster 4.6.5.0 2009.08.11 - Information additionnelle File size: 108032 bytes MD5...: 9ee770044e1e9ce205bf5605c5b4bc58 SHA1..: 95013c7f1de4a54f8be2f2057e9ad7987430df31 SHA256: d0033f9b0960f10a91d081d152e3e863d1149c763c3a3347c030436644aa9185 ssdeep: 3072:EdPymhFflYmXgCaPdT9IMUFMtwOTo5BB2kNDwI46mf:JUEdTaOT0B2kq6C
PEiD..: - TrID..: File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%) PEInfo: PE Structure information

( base data )
entrypointaddress.: 0xcaed
timedatestamp.....: 0x3393c00f (Tue Jun 03 06:56:15 1997)
machinetype.......: 0x14c (I386)

( 9 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xf632 0xf800 6.47 e1c8989da83c44e22467c62eaed3f910
.bss 0x11000 0x1514 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
.sdata 0x13000 0x10c 0x200 0.00 bf619eac0cdf3f68d496ea9344137e8b
.rdata 0x14000 0x25d 0x400 3.27 0a1946d05c169e6d744a878d61c9117b
.data 0x15000 0x61c4 0x6200 2.36 166e0a9ea6cfd4b27ba7fe082a3d429e
.idata 0x1c000 0x9d4 0xa00 5.82 b2f772be8cc55af51f8b792bdc32dad7
.edata 0x1d000 0xb13 0xc00 3.93 c41ad6106bca66c7561b722bf717082f
.rsrc 0x1e000 0x314 0x400 2.80 3082472e35418d8a616f23cc57685683
.reloc 0x1f000 0x1114 0x1200 6.07 a4dac991abf18862473f8ba12750c639

( 3 imports )
> KERNEL32.dll: VirtualLock, VirtualAlloc, VirtualFree, VirtualQuery, HeapAlloc, GetProcessHeap, HeapReAlloc, HeapFree, IsBadCodePtr, UnmapViewOfFile, MapViewOfFileEx, CreateFileMappingA, OpenFileMappingA, GetSystemInfo, OpenProcess, GetCurrentProcess, VirtualQueryEx, WaitForMultipleObjects, GetLastError, SetThreadPriority, CreateRemoteThread, ReadProcessMemory, InterlockedIncrement, OpenMutexA, MapViewOfFile, GetCurrentProcessId, CreateMutexA, GetCurrentThreadId, CreateEventA, SetEvent, GetVersion, GetModuleFileNameA, GetProcAddress, VirtualProtect, WriteProcessMemory, GetModuleHandleA, LoadLibraryA, LoadLibraryW, GetModuleHandleW, LoadLibraryExA, LoadLibraryExW, FreeLibrary, DeleteCriticalSection, CloseHandle, GetProcessHeaps, LeaveCriticalSection, LocalHandle, HeapLock, HeapSize, RaiseException, HeapDestroy, SetLastError, GlobalFlags, GlobalFree, GlobalHandle, GlobalLock, GlobalReAlloc, GlobalUnlock, RtlUnwind, GetEnvironmentStrings, GetCommandLineA, TlsSetValue, TlsAlloc, TlsFree, TlsGetValue, ExitProcess, WriteFile, GetACP, GetOEMCP, GetCPInfo, GetStdHandle, GetFileType, GetStartupInfoA, SetFilePointer, WideCharToMultiByte, CreateFileA, MultiByteToWideChar, SetStdHandle, FlushFileBuffers, SetEndOfFile, ReadFile, InitializeCriticalSection, WaitForSingleObject, ReleaseMutex, EnterCriticalSection, HeapWalk, ExitThread, HeapUnlock
> USER32.dll: IsWindow, MessageBeep, MessageBoxA
> ADVAPI32.dll: RegCloseKey, RegOpenKeyExA, RegCreateKeyExA, RegSetValueExA, RegQueryValueExA

( 76 exports )
@_shi_deletePage@8, @_shi_initPageVariable@8, @_shi_sysAlloc@8, @_shi_sysFree@4, @_shi_sysSize@4, MemAlloc, MemAllocFS, MemAllocPtr, MemCheckPtr, MemDefaultErrorHandler, MemErrorUnwind, MemFix, MemFree, MemFreeFS, MemFreePtr, MemHandle, MemIsMoveable, MemLock, MemLockCount, MemPoolAttachShared, MemPoolCheck, MemPoolCount, MemPoolFirst, MemPoolFree, MemPoolInfo, MemPoolInit, MemPoolInitFS, MemPoolInitNamedShared, MemPoolInitNamedSharedEx, MemPoolInitRegion, MemPoolLock, MemPoolNext, MemPoolPreAllocate, MemPoolPreAllocateHandles, MemPoolSetBlockSizeFS, MemPoolSetCeiling, MemPoolSetFloor, MemPoolSetPageSize, MemPoolSetSmallBlockSize, MemPoolShrink, MemPoolSize, MemPoolUnlock, MemPoolWalk, MemReAlloc, MemReAllocPtr, MemRegisterTask, MemSetErrorHandler, MemSize, MemSizePtr, MemSizeRequested, MemUnfix, MemUnlock, MemUnregisterTask, MemVersion, _shi_MemFreeDefaultPool@0, _shi_MemInitDefaultPool@0, _shi_deleteStdcall@4, _shi_enterCriticalSection, _shi_leaveCriticalSection, _shi_newStdcall@4, shi_MemDefaultPool, shi_calloc, shi_delete, shi_expand, shi_free, shi_heapadd, shi_heapchk, shi_heapmin, shi_heapset, shi_heapused, shi_heapwalk, shi_malloc, shi_msize, shi_new, shi_realloc, shi_set_new_handler
PDFiD.: - RDS...: NSRL Reference Data Set

( Corel Corporation )

> Print House Magic: SH33W32.DLL
> 1,300,000 Corel Gallery: sh33w32.dll
> Print Office: sh33w32.dll
> Corel Print House 6: sh33w32.dll
> Corel Draw 8: SH33W32.DLL
> Gallery: sh33w32.dll
> Corel PrintOffice: sh33w32.dll

( Vivendi Universal Games )

> Little People Discovery Games: SH33W32.DLL

( Novell Inc. )

> CNE Net NetWare 5 Beta 3: SH33W32.DLL

( Hewlett Packard )

> HP scanjet 7400c series: sh33w32.dll

( WRQ )

> Reflection Evaluator: sh33w32.dll

gen-hackman · Answer

&#9654 Télécharge Zeb-Restoreet enregistre ce fichier sur le bureau. 

&#9654-Clic droit Zeb-Restore.zip ==> Extraire tout choisis comme lieu d'enregistrement le bureau.
 
&#9654-Ouvre le dossier ZR_1.0.0.37 ==> double clic sur Zeb-Restore.exe 

&#9654- Coche la case devant :sites de confiance

&#9654- Ne coche aucune autre case 

&#9654-Clique sur Restaurer 

&#9654-Redémarre ton PC

ensuite :

&#9654 Double clic sur OTL.exe pour le lancer.


&#9654Copie la liste qui se trouve en gras ci-dessous,

&#9654 colle-la dans la zone sous Customs Scans/Fixes :

:processes
explorer.exe
iexplore.exe
firefox.exe
msnmsgr.exe
Teatimer.exe

:OTL
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-4131921849-2024023189-673777175-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} Reg Error: Value error. (Reg Error: Key error.)
@Alternate Data Stream - 68 bytes -> C:\Documents and Settings\maewa\Menu Démarrer\Programmes\Démarrage\desktop.ini:KAVICHS
@Alternate Data Stream - 68 bytes -> C:\Documents and Settings\maewa\Application Data\desktop.ini:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\Documents and Settings\maewa\Mes documents\desktop.ini:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\Documents and Settings\maewa\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini:KAVICHS

:files
C:\WINDOWS\PEV.exe

:commands
[emptytemp]
[start explorer]
[reboot]


&#9654 Clique sur RunFix pour lancer la suppression.


&#9654 Poste le rapport.

maewa95 · Answer

dis gen, tu crois qu'on va y arriver à la destroy cette sale bête ?

allez, voilà le rapport :

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
No active process named iexplore.exe was found!
No active process named firefox.exe was found!
No active process named msnmsgr.exe was found!
No active process named Teatimer.exe was found!
========== OTL ==========
Registry value HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\NoDriveAutoRun deleted successfully.
Registry value HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\NoDriveAutoRun not found.
Registry value HKEY_USERS\S-1-5-21-4131921849-2024023189-673777175-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\NoDriveAutoRun deleted successfully.
Starting removal of ActiveX control {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} Reg Error: Value error.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} Reg Error: Value error.\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} Reg Error: Value error.\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} Reg Error: Value error.\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} Reg Error: Value error.\ not found.
ADS C:\Documents and Settings\maewa\Menu Démarrer\Programmes\Démarrage\desktop.ini:KAVICHS deleted successfully.
ADS C:\Documents and Settings\maewa\Application Data\desktop.ini:KAVICHS deleted successfully.
ADS C:\Documents and Settings\maewa\Mes documents\desktop.ini:KAVICHS deleted successfully.
ADS C:\Documents and Settings\maewa\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini:KAVICHS deleted successfully.
========== FILES ==========
C:\WINDOWS\PEV.exe moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Administrateur
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Administrateur.SN402039360009
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: All Users
 
User: maewa
->Temp folder emptied: 142728 bytes
->Temporary Internet Files folder emptied: 210210 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 38672722 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Propriétaire
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
Windows Temp folder emptied: 664 bytes
RecycleBin emptied: 15557 bytes
 
Total Files Cleaned = 37,23 mb
 
 
OTL by OldTimer - Version 3.0.10.5 log created on 08112009_224430

gen-hackman · Answer

on a l air pas mal là


Imprime ces instructions car il faudra fermer toutes les fenêtres et applications lors de l'installation et de l'analyse.



&#9654 Télécharge :

Malwarebytes  

ou  :

Malwarebytes

&#9654 Installe le ( choisis bien "francais" ; ne modifie pas les paramètres d'installe ) et mets le à jour .

(NB : Si tu as un message d'erreur t'indiquant qu'il te manque "COMCTL32.OCX" lors de l'installe, alors télécharge le ici : COMCTL32.OCX

&#9654 Potasses le Tuto pour te familiariser avec le prg :


( cela dit, il est très simple d'utilisation ).

relance malwarebytes en suivant scrupuleusement ces consignes :

! Déconnecte toi et ferme toutes applications en cours !

&#9654 Lance Malwarebyte's .

Fais un examen dit "Complet" .

&#9654 Laisse le programme travailler ( et ne rien faire d'autre avec le PC durant le scan ).
&#9654 à la fin tu cliques sur "résultat" .
&#9654 Vérifie que tous les objets infectés soient validés, puis clique sur " suppression " .

&#9654 Note : si il faut redémarrer ton PC pour finir le nettoyage, fais le !


&#9654 Poste le rapport sauvegardé après la suppression des objets infectés (dans l'onglet "rapport/log"de Malwarebytes, le dernier en date)

maewa95 · Answer

bonjour gen,

c'est à n'y rien comprendre. Aucun objet infecté, mais toujours impossible de démarrer normalement. J'arrive jusqu'à "bienvenue" où là, il se met à clignoter comme une guirlande de noël, et puis zou reboot. Il est tout de même lent pour arriver à "bienvenue"

je te mets le log

Malwarebytes' Anti-Malware 1.40
Version de la base de données: 2605
Windows 5.1.2600 Service Pack 3 (Safe Mode)

12/08/2009 06:11:59
mbam-log-2009-08-12 (06-11-59).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 289160
Temps écoulé: 1 hour(s), 56 minute(s), 20 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

gen-hackman · Answer

hello je vais finir par me demander si ce n'est pas materiel ton histoire

maewa95 · Answer

tu crois ? ça pourrait être quoi à ton avis si c'est matériel ? 

Car je démarre en mode sans échec sans problème. C'est le mode normal qui pose problème.

gen-hackman · Answer

refais un OTL mais regle sur 90 jours cette fois-ci

maewa95 · Answer

ok mais je le ferai ce soir car je commence à 11 heures et je suis encore chez moi et pas pris ma douche mdrrr et je travaille au bout du monde lol lol lol

bonne journée à ce soir

gen-hackman · Answer

ok lol te fais pas virer pour ton pc ^^

maewa95 · Answer

mdrrrrrrrrrr c'est toujours moi lol je suis encore là ^^

bon finalement j'ai fait le log mais j'ai eu un message avec OTL "access violation à l'adresse...." je ne me souviens plus quelle adresse

voici le log :

http://www.cijoint.fr/cjlink.php?file=cj200908/cijZAeUzBL.txt

Il me vient une idée. Mon bitdefender ne voulant plus me laisser l'ouvrir, ne serait-ce pas dû à lui ?  et je n'ai pas de moyen d'y accéder, il ne veut rien entendre. Impossible de l'ouvrir pour accéder aux paramètres

maewa95 · Answer

bon allez cette fois, j'y go

à ce soir

gen-hackman · Answer

&#9654 Double clic sur OTL.exe pour le lancer.


&#9654Copie la liste qui se trouve en gras ci-dessous,

&#9654 colle-la dans la zone sous Customs Scans/Fixes :

:processes
explorer.exe
iexplore.exe
firefox.exe
msnmsgr.exe
Teatimer.exe

:OTL
O4 - HKLM..\Run: [KernelFaultCheck]  File not found
O4 - HKLM..\RunOnce: [InnoSetupRegFile.0000000001] C:\WINDOWS\is-3A7GD.exe

:files
C:\WINDOWS\is-3A7GD.exe
C:\WINDOWS\is-3A7GD.msg
C:\WINDOWS\is-3A7GD.lst
C:\WINDOWS\System32\SysChkVC.dll.manifest
C:\WINDOWS\System32\as.disabled
C:\WINDOWS\Tpwf*.dll

:commands
[emptytemp]
[start explorer]
[reboot]


&#9654 Clique sur RunFix pour lancer la suppression.


&#9654 Poste le rapport.

maewa95 · Answer

bonjour gen,

impossible d'effectuer le fix, OTL bloque à la première ligne 004

gen-hackman · Answer

ok j'ai modifié voir s'il passe comme ceci :

:processes
explorer.exe
iexplore.exe
firefox.exe
msnmsgr.exe
Teatimer.exe

:reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"KernelFaultCheck"=-
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Runonce]
"InnoSetupRegFile.0000000001"=-

:files
C:\WINDOWS\is-3A7GD.exe
C:\WINDOWS\is-3A7GD.msg
C:\WINDOWS\is-3A7GD.lst
C:\WINDOWS\System32\SysChkVC.dll.manifest
C:\WINDOWS\System32\as.disabled
C:\WINDOWS\Tpwf*.dll

:commands
[emptytemp]
[reboot]

maewa95 · Answer

c'est bon, ça a marché

Dis, c'est quoi ce 7wonder qui sort dans le log du scan stp ? je ne vois pas du tout à quoi ça peut correspondre ?

voici le log. J'ai également refait un run scan, je te mets le lien

http://www.cijoint.fr/cjlink.php?file=cj200908/cijiUeZSWR.txt

All processes killed
========== PROCESSES ==========
Process explorer.exe killed successfully!
No active process named iexplore.exe was found!
No active process named firefox.exe was found!
No active process named msnmsgr.exe was found!
No active process named Teatimer.exe was found!
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersio¬n\Run not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Runonce\InnoSetupRegFile.0000000001 not found.
========== FILES ==========
C:\WINDOWS\is-3A7GD.exe moved successfully.
C:\WINDOWS\is-3A7GD.msg moved successfully.
C:\WINDOWS\is-3A7GD.lst moved successfully.
C:\WINDOWS\System32\SysChkVC.dll.manifest moved successfully.
C:\WINDOWS\System32\as.disabled moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\Tpwf001.dll
C:\WINDOWS\Tpwf001.dll NOT unregistered.
C:\WINDOWS\Tpwf001.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\Tpwf002.dll
C:\WINDOWS\Tpwf002.dll NOT unregistered.
C:\WINDOWS\Tpwf002.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\Tpwf003.dll
C:\WINDOWS\Tpwf003.dll NOT unregistered.
C:\WINDOWS\Tpwf003.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\Tpwf004.dll
C:\WINDOWS\Tpwf004.dll NOT unregistered.
C:\WINDOWS\Tpwf004.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\Tpwf005.dll
C:\WINDOWS\Tpwf005.dll NOT unregistered.
C:\WINDOWS\Tpwf005.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\Tpwf006.dll
C:\WINDOWS\Tpwf006.dll NOT unregistered.
C:\WINDOWS\Tpwf006.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\Tpwf007.dll
C:\WINDOWS\Tpwf007.dll NOT unregistered.
C:\WINDOWS\Tpwf007.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\Tpwf008.dll
C:\WINDOWS\Tpwf008.dll NOT unregistered.
C:\WINDOWS\Tpwf008.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\Tpwf009.dll
C:\WINDOWS\Tpwf009.dll NOT unregistered.
C:\WINDOWS\Tpwf009.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\Tpwf010.dll
C:\WINDOWS\Tpwf010.dll NOT unregistered.
C:\WINDOWS\Tpwf010.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\Tpwf011.dll
C:\WINDOWS\Tpwf011.dll NOT unregistered.
C:\WINDOWS\Tpwf011.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\Tpwf012.dll
C:\WINDOWS\Tpwf012.dll NOT unregistered.
C:\WINDOWS\Tpwf012.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\Tpwf013.dll
C:\WINDOWS\Tpwf013.dll NOT unregistered.
C:\WINDOWS\Tpwf013.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\Tpwf014.dll
C:\WINDOWS\Tpwf014.dll NOT unregistered.
C:\WINDOWS\Tpwf014.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\Tpwf015.dll
C:\WINDOWS\Tpwf015.dll NOT unregistered.
C:\WINDOWS\Tpwf015.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\Tpwf016.dll
C:\WINDOWS\Tpwf016.dll NOT unregistered.
C:\WINDOWS\Tpwf016.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\Tpwf017.dll
C:\WINDOWS\Tpwf017.dll NOT unregistered.
C:\WINDOWS\Tpwf017.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\Tpwf018.dll
C:\WINDOWS\Tpwf018.dll NOT unregistered.
C:\WINDOWS\Tpwf018.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\Tpwf019.dll
C:\WINDOWS\Tpwf019.dll NOT unregistered.
C:\WINDOWS\Tpwf019.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\Tpwf020.dll
C:\WINDOWS\Tpwf020.dll NOT unregistered.
C:\WINDOWS\Tpwf020.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\Tpwf021.dll
C:\WINDOWS\Tpwf021.dll NOT unregistered.
C:\WINDOWS\Tpwf021.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\Tpwf022.dll
C:\WINDOWS\Tpwf022.dll NOT unregistered.
C:\WINDOWS\Tpwf022.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\Tpwf023.dll
C:\WINDOWS\Tpwf023.dll NOT unregistered.
C:\WINDOWS\Tpwf023.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\Tpwf024.dll
C:\WINDOWS\Tpwf024.dll NOT unregistered.
C:\WINDOWS\Tpwf024.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\Tpwf025.dll
C:\WINDOWS\Tpwf025.dll NOT unregistered.
C:\WINDOWS\Tpwf025.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\Tpwf026.dll
C:\WINDOWS\Tpwf026.dll NOT unregistered.
C:\WINDOWS\Tpwf026.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\Tpwf027.dll
C:\WINDOWS\Tpwf027.dll NOT unregistered.
C:\WINDOWS\Tpwf027.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\Tpwf028.dll
C:\WINDOWS\Tpwf028.dll NOT unregistered.
C:\WINDOWS\Tpwf028.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\Tpwf029.dll
C:\WINDOWS\Tpwf029.dll NOT unregistered.
C:\WINDOWS\Tpwf029.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\Tpwf030.dll
C:\WINDOWS\Tpwf030.dll NOT unregistered.
C:\WINDOWS\Tpwf030.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\Tpwf031.dll
C:\WINDOWS\Tpwf031.dll NOT unregistered.
C:\WINDOWS\Tpwf031.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\Tpwf032.dll
C:\WINDOWS\Tpwf032.dll NOT unregistered.
C:\WINDOWS\Tpwf032.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\Tpwf033.dll
C:\WINDOWS\Tpwf033.dll NOT unregistered.
C:\WINDOWS\Tpwf033.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\Tpwf034.dll
C:\WINDOWS\Tpwf034.dll NOT unregistered.
C:\WINDOWS\Tpwf034.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\Tpwf035.dll
C:\WINDOWS\Tpwf035.dll NOT unregistered.
C:\WINDOWS\Tpwf035.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\Tpwf036.dll
C:\WINDOWS\Tpwf036.dll NOT unregistered.
C:\WINDOWS\Tpwf036.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\Tpwf037.dll
C:\WINDOWS\Tpwf037.dll NOT unregistered.
C:\WINDOWS\Tpwf037.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\Tpwf038.dll
C:\WINDOWS\Tpwf038.dll NOT unregistered.
C:\WINDOWS\Tpwf038.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\Tpwf039.dll
C:\WINDOWS\Tpwf039.dll NOT unregistered.
C:\WINDOWS\Tpwf039.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\Tpwf040.dll
C:\WINDOWS\Tpwf040.dll NOT unregistered.
C:\WINDOWS\Tpwf040.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\Tpwf041.dll
C:\WINDOWS\Tpwf041.dll NOT unregistered.
C:\WINDOWS\Tpwf041.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\Tpwf042.dll
C:\WINDOWS\Tpwf042.dll NOT unregistered.
C:\WINDOWS\Tpwf042.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\Tpwf043.dll
C:\WINDOWS\Tpwf043.dll NOT unregistered.
C:\WINDOWS\Tpwf043.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\Tpwf044.dll
C:\WINDOWS\Tpwf044.dll NOT unregistered.
C:\WINDOWS\Tpwf044.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\Tpwf045.dll
C:\WINDOWS\Tpwf045.dll NOT unregistered.
C:\WINDOWS\Tpwf045.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\Tpwf046.dll
C:\WINDOWS\Tpwf046.dll NOT unregistered.
C:\WINDOWS\Tpwf046.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\Tpwf047.dll
C:\WINDOWS\Tpwf047.dll NOT unregistered.
C:\WINDOWS\Tpwf047.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\Tpwf048.dll
C:\WINDOWS\Tpwf048.dll NOT unregistered.
C:\WINDOWS\Tpwf048.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\Tpwf049.dll
C:\WINDOWS\Tpwf049.dll NOT unregistered.
C:\WINDOWS\Tpwf049.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\Tpwf050.dll
C:\WINDOWS\Tpwf050.dll NOT unregistered.
C:\WINDOWS\Tpwf050.dll moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Administrateur
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Administrateur.SN402039360009
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: All Users
 
User: maewa
->Temp folder emptied: 3910 bytes
->Temporary Internet Files folder emptied: 2549393 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 39882834 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Propriétaire
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
Windows Temp folder emptied: 17048 bytes
RecycleBin emptied: 678411 bytes
 
Total Files Cleaned = 41,17 mb
 
 
OTL by OldTimer - Version 3.0.10.5 log created on 08132009_103407

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

gen-hackman · Answer

ben ca veut dire 7 merveilles 

ca viendrait pas d'un programme que tu as installé ? toi ou....

maewa95 · Answer

heuuuuuuuuu ben non, je n'ai pas installé ce truc et pas de ou à la maison mdrrrrr ^^^

gen-hackman · Answer

supprime le dans ce cas

maewa95 · Answer

Je verrai cela en rentrant à la maison ce soir.

Que penses-tu du nouveau scan que j'ai fait ? Est-ce que d'après toi tout est clean ?

Je tenterai de le redémarrer normalement ce soir en rentrant. J 'espère que ça va le faire cette fois.

gen-hackman · Answer

tu as bien fait zeb-restore ???

maewa95 · Answer

après OTL ? non, il ne me semble pas avoir vu que tu me l'aies demandé. Aurais-je loupé une ligne ? lol

gen-hackman · Answer

ici :

https://forums.commentcamarche.net/forum/affich-13796558-redemarrage-en-boucle-intempestif?entiere#15

et ici :

https://forums.commentcamarche.net/forum/affich-13796558-redemarrage-en-boucle-intempestif?entiere#74

maewa95 · Answer

oups non je ne l'ai pas fait

c'est grave ?

Je fais quoi maintenant ?

gen-hackman · Answer

ben tu le fais et tu me renvoie un OTL tout neuf apres redemarrage

maewa95 · Answer

re gen

juste une confirmation de ce que je copie dans zeb-restore (peur de faire une bêtise)

est-ce bien cela stp ?

:processes
explorer.exe
iexplore.exe
firefox.exe
msnmsgr.exe
Teatimer.exe

:reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersio­n\Run]
"KernelFaultCheck"=-
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Runonce]
"InnoSetupRegFile.0000000001"=-

:files
C:\WINDOWS\is-3A7GD.exe
C:\WINDOWS\is-3A7GD.msg
C:\WINDOWS\is-3A7GD.lst
C:\WINDOWS\System32\SysChkVC.dll.manifest
C:\WINDOWS\System32\as.disabled
C:\WINDOWS\Tpwf*.dll

:commands
[emptytemp]
[reboot]

gen-hackman · Answer

euh il n'a rien a copier dans zeb-restore....déstresse !!!         :)     ^^

maewa95 · Answer

mdr après une bonne nuit, le calme est revenu en moi lol 

voici le rapport :

http://www.cijoint.fr/cjlink.php?file=cj200908/cijvY7sJe4.txt

Je viens de tester après ces manips un redémarrage en mode normal.

Impossible. Il se comporte bien jusqu'à "windows est en cours de démarrage" et à partir de ce moment là, il se met à clignoter et il reboot. -(

gen-hackman · Answer

te rapelles- tu avoir fait quelque chose de particulier avec ton PC le 14/07 à 9h30 ?

maewa95 · Answer

non par contre, il y avait la petite de mon amie chez moi et elle a joué sur mon pc. Peut-être a-t-elle cliqué sur quelque chose.... 

Tu penserais à quoi stp ?

remarque, j'ai reçu le CD du belge vers cette date là mais pas le 14 juillet car la poste était fermée.....

gen-hackman · Answer

disons que ce matin-là , beaucoup de fichiers ont été créés sans que j'arrive à en determiner la provenace

maewa95 · Answer

Je tente de me souvenir mais pas facile. Il se pourrait que j'aie reçu le CD le 13 (et plus je réfléchis, plus je pense que c'est cela) et que je l'ai installé le 14 au matin......

Penses-tu qu'en redémarrant mon pc à une autre date antérieure ça puisse le faire stp ?

gen-hackman · Answer

&#9654 Clique sur le menu Demarrer /Panneau de configuration/Options des dossiers/ puis dans l'onglet Affichage
* - Coche    Afficher les fichiers et dossiers cachés
* - Décoche Masquer les extensions des fichiers dont le type est connu
* - Décoche Masquer les fichiers protégés du système d'exploitation (recommandé)

&#9654 clique sur Appliquer, puis OK.

N'oublie pas de recacher à nouveau les fichiers cachés et protégés du système d'exploitation en fin de désinfection, c'est important

Fais analyser le(s) fichier(s) suivants sur Virustotal :

Virus Total

    * Clique sur Parcourir en haut, choisis Poste de travail et cherche ces fichiers :

c:\program files\Player Metaboli\X4HSX32Ex.sys

    * Clique maintenant sur Envoyer le fichier. et laisse travailler tant que "Situation actuelle : en cours d'analyse" est affiché.
    * Il est possible que le fichier soit mis en file d'attente en raison d'un grand nombre de demandes d'analyses. En ce cas, il te faudra patienter sans actualiser la page.
    * Lorsque l'analyse est terminée ("Situation actuelle: terminé"), clique sur Formaté
    * Une nouvelle fenêtre de ton navigateur va apparaître
    * Clique alors sur les deux fleches
    * Fais un clic droit sur la page, et choisis Sélectionner tout, puis copier
    * Enfin colle le résultat dans ta prochaine réponse.

Note : Pour analyser un autre fichier, clique en bas sur Autre fichier.

maewa95 · Answer

ok je le ferai en rentrant chez moi.

Tu sais, je pense à un truc. J'étais abonnée chez métaboli et j'ai résilié (mon abonnement se terminait début août). Lorsque la petite était là, j'ai voulu le réinstaller et il se peut que ce soit le 14 juillet.

De toute façon, j'ai installé juste deux choses en juillet :

- le logiciel PE Design 7
- le player metaboli

A ce soir

gen-hackman · Answer

je comprends mieux la presence de tous ces .ocx :)

maewa95 · Answer

re gen, voici le résultat : Fichier X4HSX32Ex.sys reçu le 2009.06.23 17:16:08 (UTC) Antivirus Version Dernière mise à jour Résultat a-squared 4.5.0.18 2009.06.23 - AhnLab-V3 5.0.0.2 2009.06.23 - AntiVir 7.9.0.193 2009.06.23 - Antiy-AVL 2.0.3.1 2009.06.23 - Authentium 5.1.2.4 2009.06.23 - Avast 4.8.1335.0 2009.06.23 - AVG 8.5.0.339 2009.06.23 - BitDefender 7.2 2009.06.23 - CAT-QuickHeal 10.00 2009.06.22 - ClamAV 0.94.1 2009.06.23 - Comodo 1400 2009.06.23 - DrWeb 5.0.0.12182 2009.06.23 - eSafe 7.0.17.0 2009.06.23 - eTrust-Vet 31.6.6575 2009.06.23 - F-Prot 4.4.4.56 2009.06.23 - F-Secure 8.0.14470.0 2009.06.23 - Fortinet 3.117.0.0 2009.06.23 - GData 19 2009.06.23 - Ikarus T3.1.1.59.0 2009.06.23 - Jiangmin 11.0.706 2009.06.23 - K7AntiVirus 7.10.768 2009.06.19 - Kaspersky 7.0.0.125 2009.06.23 - McAfee 5655 2009.06.23 - McAfee+Artemis 5655 2009.06.23 - McAfee-GW-Edition 6.7.6 2009.06.23 - Microsoft 1.4803 2009.06.23 - NOD32 4181 2009.06.23 - Norman 6.01.09 2009.06.23 - nProtect 2009.1.8.0 2009.06.23 - Panda 10.0.0.16 2009.06.23 - PCTools 4.4.2.0 2009.06.22 - Prevx 3.0 2009.06.23 - Rising 21.35.14.00 2009.06.23 - Sophos 4.42.0 2009.06.23 - Sunbelt 3.2.1858.2 2009.06.23 - Symantec 1.4.4.12 2009.06.23 - TheHacker 6.3.4.3.351 2009.06.22 - TrendMicro 8.950.0.1094 2009.06.23 - VBA32 3.12.10.7 2009.06.23 - ViRobot 2009.6.23.1800 2009.06.23 - VirusBuster 4.6.5.0 2009.06.23 - Information additionnelle File size: 29856 bytes MD5 : 9c37e802e5e0534304619583d008b36b SHA1 : 8fa1c8584c5241435b25477eb5841fa80ff8fa62 SHA256: 43b9bed05818ea081ce0baa4ed3d63b3e8b9f0f4cf0268701ec7de46eb935b01 PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x3D80
timedatestamp.....: 0x4739BE01 (Tue Nov 13 16:08:49 2007)
machinetype.......: 0x14C (Intel I386)

( 7 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x480 0x38C4 0x3900 6.20 0de08bc59c655dfd0779dbb1713d7c36
init 0x3D80 0x3D 0x80 3.19 0a2d9a78a5d59bc0f699388832dc41b7
.rdata 0x3E00 0x2E4 0x300 3.97 a0ff79c5107f1f6087ba957d009bdd0c
.data 0x4100 0x324 0x380 0.45 a2e5711a7753395a64763c47768cf049
INIT 0x4480 0x8DE 0x900 5.27 f4c0d23a6e2dc09726d6b125d0245ee9
.rsrc 0x4D80 0x448 0x480 3.25 bce030f644a191d999d7bbf0fce1d6fe
.reloc 0x5200 0x830 0x880 5.17 5c64ec8bbcbd29da4924c02f430ee79e

( 2 imports )

> hal.dll: KfReleaseSpinLock, KfAcquireSpinLock, KeGetCurrentIrql
> ntoskrnl.exe: IofCompleteRequest, ZwLoadDriver, RtlInitUnicodeString, ZwUnloadDriver, ZwClose, ZwDeviceIoControlFile, InterlockedExchange, MmIsAddressValid, ExAllocatePoolWithTag, ExAllocatePoolWithQuotaTag, ExAllocatePoolWithTagPriority, ExFreePool, ZwOpenFile, PsSetCreateThreadNotifyRoutine, PsSetCreateProcessNotifyRoutine, ZwSetInformationThread, ZwOpenThread, ZwSetInformationProcess, ZwDuplicateObject, ZwReplaceKey, ZwRestoreKey, ZwUnloadKey, ZwLoadKey, ZwDeleteValueKey, ZwCreateKey, ZwSetValueKey, ZwFlushKey, ZwDeleteKey, ZwEnumerateKey, ZwEnumerateValueKey, ZwQueryValueKey, ZwQueryKey, ZwOpenKey, ZwCreateSymbolicLinkObject, ZwOpenProcess, ZwDeleteFile, ZwSetInformationFile, ZwQueryInformationFile, ZwQueryDirectoryFile, ZwQueryVolumeInformationFile, ZwCreateFile, wcslen, IoCreateDevice, InterlockedDecrement, KeInitializeEvent, KeWaitForSingleObject, _allmul, KeSetEvent, KeClearEvent, KeInitializeSpinLock, InterlockedIncrement, PsGetVersion, PsTerminateSystemThread, KeQueryPriorityThread, ObReferenceObjectByHandle, PsCreateSystemThread, ObfDereferenceObject, KeGetCurrentThread, ObReferenceObjectByName, IoFreeMdl, MmProbeAndLockPages, IoAllocateMdl, _except_handler3, ZwWriteFile, RtlTimeToTimeFields, KeQuerySystemTime, PsGetCurrentProcessId, KeReleaseMutex, IoQueueWorkItem, IoAllocateWorkItem, strncat, _vsnprintf, IoFreeWorkItem, MmUnlockPages, MmMapLockedPages, KeServiceDescriptorTable, MmUnmapLockedPages, RtlValidSecurityDescriptor, RtlSetDaclSecurityDescriptor, RtlSetOwnerSecurityDescriptor, RtlCreateSecurityDescriptor, RtlAddAccessAllowedAce, SeExports, RtlCreateAcl, IoIsSystemThread, InterlockedExchangeAdd

( 0 exports )
TrID : File type identification
Win32 Executable Generic (58.4%)
Clipper DOS Executable (13.8%)
Generic Win/DOS Executable (13.7%)
DOS Executable Generic (13.7%)
VXD Driver (0.2%) ssdeep: 384:fcQDcIsK0F7/wIvbDGIIEFA+TqMqmSbfnmzQcXonZYMQB2j5fElAps8LTUU5Ku7U:fG7xfqN8lAG6TbKudrL3FDLkLAmBbh PEiD : - RDS : NSRL Reference Data Set
- Antivirus Version Dernière mise à jour Résultat a-squared 4.5.0.18 2009.06.23 - AhnLab-V3 5.0.0.2 2009.06.23 - AntiVir 7.9.0.193 2009.06.23 - Antiy-AVL 2.0.3.1 2009.06.23 - Authentium 5.1.2.4 2009.06.23 - Avast 4.8.1335.0 2009.06.23 - AVG 8.5.0.339 2009.06.23 - BitDefender 7.2 2009.06.23 - CAT-QuickHeal 10.00 2009.06.22 - ClamAV 0.94.1 2009.06.23 - Comodo 1400 2009.06.23 - DrWeb 5.0.0.12182 2009.06.23 - eSafe 7.0.17.0 2009.06.23 - eTrust-Vet 31.6.6575 2009.06.23 - F-Prot 4.4.4.56 2009.06.23 - F-Secure 8.0.14470.0 2009.06.23 - Fortinet 3.117.0.0 2009.06.23 - GData 19 2009.06.23 - Ikarus T3.1.1.59.0 2009.06.23 - Jiangmin 11.0.706 2009.06.23 - K7AntiVirus 7.10.768 2009.06.19 - Kaspersky 7.0.0.125 2009.06.23 - McAfee 5655 2009.06.23 - McAfee+Artemis 5655 2009.06.23 - McAfee-GW-Edition 6.7.6 2009.06.23 - Microsoft 1.4803 2009.06.23 - NOD32 4181 2009.06.23 - Norman 6.01.09 2009.06.23 - nProtect 2009.1.8.0 2009.06.23 - Panda 10.0.0.16 2009.06.23 - PCTools 4.4.2.0 2009.06.22 - Prevx 3.0 2009.06.23 - Rising 21.35.14.00 2009.06.23 - Sophos 4.42.0 2009.06.23 - Sunbelt 3.2.1858.2 2009.06.23 - Symantec 1.4.4.12 2009.06.23 - TheHacker 6.3.4.3.351 2009.06.22 - TrendMicro 8.950.0.1094 2009.06.23 - VBA32 3.12.10.7 2009.06.23 - ViRobot 2009.6.23.1800 2009.06.23 - VirusBuster 4.6.5.0 2009.06.23 - Information additionnelle File size: 29856 bytes MD5 : 9c37e802e5e0534304619583d008b36b SHA1 : 8fa1c8584c5241435b25477eb5841fa80ff8fa62 SHA256: 43b9bed05818ea081ce0baa4ed3d63b3e8b9f0f4cf0268701ec7de46eb935b01 PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x3D80
timedatestamp.....: 0x4739BE01 (Tue Nov 13 16:08:49 2007)
machinetype.......: 0x14C (Intel I386)

( 7 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x480 0x38C4 0x3900 6.20 0de08bc59c655dfd0779dbb1713d7c36
init 0x3D80 0x3D 0x80 3.19 0a2d9a78a5d59bc0f699388832dc41b7
.rdata 0x3E00 0x2E4 0x300 3.97 a0ff79c5107f1f6087ba957d009bdd0c
.data 0x4100 0x324 0x380 0.45 a2e5711a7753395a64763c47768cf049
INIT 0x4480 0x8DE 0x900 5.27 f4c0d23a6e2dc09726d6b125d0245ee9
.rsrc 0x4D80 0x448 0x480 3.25 bce030f644a191d999d7bbf0fce1d6fe
.reloc 0x5200 0x830 0x880 5.17 5c64ec8bbcbd29da4924c02f430ee79e

( 2 imports )

> hal.dll: KfReleaseSpinLock, KfAcquireSpinLock, KeGetCurrentIrql
> ntoskrnl.exe: IofCompleteRequest, ZwLoadDriver, RtlInitUnicodeString, ZwUnloadDriver, ZwClose, ZwDeviceIoControlFile, InterlockedExchange, MmIsAddressValid, ExAllocatePoolWithTag, ExAllocatePoolWithQuotaTag, ExAllocatePoolWithTagPriority, ExFreePool, ZwOpenFile, PsSetCreateThreadNotifyRoutine, PsSetCreateProcessNotifyRoutine, ZwSetInformationThread, ZwOpenThread, ZwSetInformationProcess, ZwDuplicateObject, ZwReplaceKey, ZwRestoreKey, ZwUnloadKey, ZwLoadKey, ZwDeleteValueKey, ZwCreateKey, ZwSetValueKey, ZwFlushKey, ZwDeleteKey, ZwEnumerateKey, ZwEnumerateValueKey, ZwQueryValueKey, ZwQueryKey, ZwOpenKey, ZwCreateSymbolicLinkObject, ZwOpenProcess, ZwDeleteFile, ZwSetInformationFile, ZwQueryInformationFile, ZwQueryDirectoryFile, ZwQueryVolumeInformationFile, ZwCreateFile, wcslen, IoCreateDevice, InterlockedDecrement, KeInitializeEvent, KeWaitForSingleObject, _allmul, KeSetEvent, KeClearEvent, KeInitializeSpinLock, InterlockedIncrement, PsGetVersion, PsTerminateSystemThread, KeQueryPriorityThread, ObReferenceObjectByHandle, PsCreateSystemThread, ObfDereferenceObject, KeGetCurrentThread, ObReferenceObjectByName, IoFreeMdl, MmProbeAndLockPages, IoAllocateMdl, _except_handler3, ZwWriteFile, RtlTimeToTimeFields, KeQuerySystemTime, PsGetCurrentProcessId, KeReleaseMutex, IoQueueWorkItem, IoAllocateWorkItem, strncat, _vsnprintf, IoFreeWorkItem, MmUnlockPages, MmMapLockedPages, KeServiceDescriptorTable, MmUnmapLockedPages, RtlValidSecurityDescriptor, RtlSetDaclSecurityDescriptor, RtlSetOwnerSecurityDescriptor, RtlCreateSecurityDescriptor, RtlAddAccessAllowedAce, SeExports, RtlCreateAcl, IoIsSystemThread, InterlockedExchangeAdd

( 0 exports )
TrID : File type identification
Win32 Executable Generic (58.4%)
Clipper DOS Executable (13.8%)
Generic Win/DOS Executable (13.7%)
DOS Executable Generic (13.7%)
VXD Driver (0.2%) ssdeep: 384:fcQDcIsK0F7/wIvbDGIIEFA+TqMqmSbfnmzQcXonZYMQB2j5fElAps8LTUU5Ku7U:fG7xfqN8lAG6TbKudrL3FDLkLAmBbh PEiD : - RDS : NSRL Reference Data Set
-

gen-hackman · Answer

ben je comprends pas tu devrais pouvoir redemarrer en mode normal

maewa95 · Answer

attends, je retente.

Mais j'ai un doute sur le logiciel PE design 7

je me suis peut-être faite avoir...... :(

Je me tâte pour l'analyser, qu'en penses-tu ?

gen-hackman · Answer

ben en meme temps ton antivirus aurait fait des bons !!

maewa95 · Answer

ben il ne fait pas de bon parce que je ne peux plus y accéder ! 

lorsque je clique sur l'icône, j'ai le message suivant :

"les services bitdefender ne répondent pas"

bon je viens de refaire plusieurs tentatives :

- ok pour le logo windows
- ok pour "windows est en cours de démarrage"
- et dès que le son de windows arrive, il reboot

c'est un truc de fou !!!!!!!!!

gen-hackman · Answer

tres bien

c'est une carte son séparée que tu as ou elle est integrée ?

maewa95 · Answer

c'est une carte son séparée je crois.

C'est une tour que j'ai, en principe, sur les tours, c'est séparé non ? Comment je vérifie déjà mon matériel, je ne me souviens plus comment on fait 

tu penses à la carte graphique qui aurait pu lâcher ? mais si c'est le cas, comment se fait-il que je puisse me connecter en mode sans échec sans problème ?

gen-hackman · Answer

non la carte son

en mode sans echec , les pilotes ne sont pas chargés

ta sortie son derriere est avec toutes les prises ou plus bas sur une plaquette metallique independante ?

Utilisateur anonyme · Answer

moi aussi , ma sortie son est derrière ... parfois elle petarade :)

maewa95 · Answer

mdrrrrrrrrrrr

bon, tu penses à quoi alors ? 

et si je tentais de redémarrer à une date ultérieure ?

Il y  a un truc qui m'intrigue :

je peux lancer une analyse bitdefender lorsque je rentre dans démarrer, programmes, bitdefender

mais je n'ai pas accès au raccourci ce qui veut dire qu'il ne se met plus à jour....

comment expliques-tu cela ?

gen-hackman · Answer

fais un scan complet et poste le rapport dans ce cas

maewa95 · Answer

Je le fais hors connexion ou connectée ?

gen-hackman · Answer

en mode sans echec sans prise en charge reseau

maewa95 · Answer

ok

est-ce que je coche les fichiers et dossiers cachés et décoche masquer les extentions des fichiers dont le type est connu et les fichiers protégés du système d'exploit ?

Je viens de lire dans la notice bitdefender que je peux télécharger un CD de secours (comme le mien ne se met plus à jour a priori) tu en penses quoi ? lis ça :

"Le CD de secours BitDefender est une distribution Knoppix remasterisée de BitDefender qui intègre les dernières solutions de sécurité BitDefender pour Linux dans le Live CD de GNU/Linux Knoppix, offrant un antivirus pour poste de travail capable d'analyser et de désinfecter les disques durs (y compris les partitions Windows NTFS). Le CD de secours BitDefender peut aussi être utilisée pour restaurer toutes vos données importantes lorsque Windows ne démarre pas. "

gen-hackman · Answer

sur clubic.com ?

maewa95 · Answer

non, ils disent ceci :

"Note 
Le CD de secours BitDefender peut être téléchargé à partir de cette adresse: http://download.bitdefender.com/rescue_cd/

maewa95 · Answer

par contre, il y a plusieurs liens et je ne sais pas lequel est le bon :

Parent Directory   -  
 BitDefenderRescueCD_v2.0.0_3_08_2009.iso 03-Aug-2009 11:55  260M 
 BitDefenderRescueCD_v2.0.0_3_08_2009.iso.md5 03-Aug-2009 11:54  75  
 Old/ 02-Mar-2009 09:57

gen-hackman · Answer

le deuxieme

maewa95 · Answer

ok je le télécharge et je fais une analyse complète ensuite

maewa95 · Answer

j'ai un problème, c'est un format "iso MD5"

Je fais comment pour le lire stp ?

gen-hackman · Answer

ben il faut le graver lol !

ensuite booter dessus il me semble

maewa95 · Answer

oui je sais qu'il faut le graver car c'est une image du cd mais c'est ensuite que je ne sais pas comment faire.

Tant pis, j'ai fait une analyse avec celui que j'ai dans : démarrer, programme, mais je doute qu'il soit à jour.....

http://www.cijoint.fr/cjlink.php?file=cj200908/cijCYpWPrf.doc

gen-hackman · Answer

ouais je sais pas ce que c est ce logiciel motifs à broder mais les liens qui sont avec , j en ai pas trouvé un qui tombe quelque part

maewa95 · Answer

ben c'est justement un deuxième CD que j'ai acheté au belge

en fait, je lui ai acheté le programme pour numériser les broderies et un dvd complet de motif

ces fichiers qui n'ont pas pu être analysés sont des motifs de broderies

gen-hackman · Answer

oui j ai vu mais je me demande pourquoi ils sont proteges pas mots de passe et tombent sur des liens morts

moi jje virerais vite-fait ce truc qui vient d'on sait pas où...

maewa95 · Answer

je vais les virer

maewa95 · Answer

en fait, ce sont des fichiers zippés que je n'ai pas eu le temps de dézipper et c'est pour cela qu'ils ne passent pas à l'analyse non ?

gen-hackman · Answer

je pense pas que tu puisses les dézipper

maewa95 · Answer

bonjour gen,

j'ai pu les dézipper, j'ai repassé tout le dossier "motifs à broder" à l'antivirus et nada

Par contre, j'ai retenté de redémarrer en mode normal.

Je l'ai laissé faire. Il a rebooté à chaque fois pour obtenir vers la 3ème/4ème fois un message d'alerte que je n'ai pas eu le temps de lire totalement mais j'ai pu relever qu'il y avait un problème sur le fichier NV4_ (pas certaine mais il m'a semblé voir "nv4_disp") 

Par contre, je suis certaine du début : NV4_

C'est un fichier de la carte graphique non ?

maewa95 · Answer

J'ai lancé la commande dxdiag et voici ce que j'ai obtenu :

http://www.cijoint.fr/cjlink.php?file=cj200908/cijYkskAF8.txt

maewa95 · Answer

j'ai retenté une analyse en ligne avec bitdefender et j'ai eu le message suivant : (je ne comprends pas car j'ai pris Explorer pour tenter l'analyse et dans le message d'erreur, il me parle de Mozilla)

Détails de l’erreur de la page Web

Agent utilisateur : Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)
Horodateur : Sat, 15 Aug 2009 09:07:51 UTC


Message : Objet attendu
Ligne : 71
Caractère : 2
Code : 0
URI : http://www.bitdefender.fr/scan_fr/scan8/ie.html

gen-hackman · Answer

salut ca serait pas plutot nv_4.sys  ?

maewa95 · Answer

je ne sais pas, je n'ai pas eu le temps de lire jusqu'au bout :(

tu as lu tout ce que je t'ai envoyé ? il y a des anomalies dans la carte vidéo je crois.....

gen-hackman · Answer

il me faut exactement le nom du fichier

maewa95 · Answer

je comprends bien mais impossible de l'obtenir.

J'ai tenté de le redémarrer en mode normal une dizaine de fois en boucle mais il ne m'a pas redonné le message 

ça commence à me taper sur le système 

et si je changeais la carte graphique ? pourtant, c'est étrange car si elle était HS, je ne pourrais pas me connecter en mode sans échec non ? tu en penses quoi stp ?

gen-hackman · Answer

as-tu ce fichier ?  :

c:\windows\system32\drivers
v4_disp.sys ou un truc comme ca ?

maewa95 · Answer

j'ai les fichiers suivants : j'ai fait une recherche sur nv4*.*

C:\NV4_DISP                     c\pnp\vidéo                      catalogue de sécurité                         13/02/2004
C:\NV4_DISP.dll                 c\pnp\vidéo                      Extension de l'application                    04/02/2004
C:\NV4_DISP                     c\pnp\vidéo                       Information de configuration              04/02/2004
C:\NV4_DISP.PNF               c\pnp\vidéo                      Information d'installation préco          25/11/2006
C:\NV4_DISP                     c\pnp\vidéo                      fichier système                                 04/02/2004
C:
v4_disp.dll                   c\windows pack uninstall   Extension de l'appli                           20/08/2004
C:\NV4                              C\Windows I386  Fichier IN_                                                    30/08/2002
C:\NV4_disp                      C\Windows I386  Fichier IN_                                                     30/08/2002
C:\NV4                              C\Windows\inf                  inform. de configuration                    20/08/2004 
C:\NV4.PNF                        C\Windows\inf                 inform. d'installation préconisée         21/01/2007
C:
v4_disp.dll                    C\Windows\system32       Extension de l'application                  03/01/2008
C:
v4_disp.dll                    C\Windows\service packfile\i386 Extension de l'appli                 14/04/2008              
C:
v4_disp                        C\Windows\service packfile\i386 info. conf.                              20/08/2008
C:
v4_mini                        C\Windows\service packfile\i386 fichier système                      04/08/2004
C:
v4_mini                        C\Windows\system32\driver       fichier système                      04/08/2004


Un truc que j'ai remarqué : je n'ai pas le son en mode sans échec. C'est peut-être pour cela que ça fonctionne ! 

car mon pc plante juste après avoir eu le son de mise en route de windows en démarrage normal. J'ai aussi remarqué qu'un problème de pixels avait lieu en démarrage normal lorsqu'il me dit que windows est en cours de démarrage

gen-hackman · Answer

fais une recherche dans tous les dossier et fichiers (coche fichiers cachés)

de : nv4_*.sys

maewa95 · Answer

fichier absent du système, je n'ai rien trouvé. Il a analysé tout mon disque C:\ et nada

il est en train de rechercher sur mon D:\ mais tout ce qui concerne le système est sur le C:\

Je fais comment stp sachant que je n'ai pas le CD Windows ? Je tente de redémarrer à une date ultérieure ou est-ce qu'une mise à jour forcée du pack 3 pourrait suffir ?

gen-hackman · Answer

bien ben il me faut le nom reel du fichier car la solution je l'ai mais sans nom de fichier on peut pas se permettre de faire n'importe quoi avec des fichiers systeme

sinon ce nom ne te dit rien non plus ? : nvlddmkm.sys

maewa95 · Answer

ben non ça ne me dit rien :(

Où as-tu pris ce nom de fichier mdrrrr ? 

on fait comment pour se le trouver ce nom de fichier ?

gen-hackman · Answer

quand ton message d'erreur reviendra....

maewa95 · Answer

je n'ai pas compris ta réponse.... Je ne vois pas ce que tu veux dire

gen-hackman · Answer

tu n'est pas en mode normal là....si ?

maewa95 · Answer

ben non, je suis en mode sans échec. ^^

gen-hackman · Answer

ben redemarre en mode normal et note le nom du fichier dont se plaint windows ^^

maewa95 · Answer

mais non, tu ne me suis plus mdrrrr

je t'ai dit plus haut, j'ai tenté de le redémarrer en mode normal au moins une dizaine de fois et il n'a pas voulu me le refaire !

gen-hackman · Answer

oui et tu m'as dit qu'il t'avait donné le message d'erreur contenant ce nom de fichier !

maewa95 · Answer

ben oui mais après, comme tu voulais le nom du fichier exact j'ai retenté plusieurs fois mais que nenni, il n'a rien voulu savoir. Il a décidé de m'agacer ce pc lol

Il ne me l'a fait qu'une seule fois.... 

J'ai vu sur des forums qu'il n'y a pas qu'à moi que ça arrive. Comment un fichier système peut-il partir ainsi ?

tiens lis ça :

http://www.presence-pc.com/forum/ppc/Hardware/stop-nv4_disp-ecran-bleu-sujet-21263-1.htm

https://forum.zebulon.fr/topic/123077-recherche-driver-nv4sys-gratuit

gen-hackman · Answer

ben apparemment le mieux est de desinstaller l pilote graphique et le reinstaller

maewa95 · Answer

je n'ai jamais fait ça, je ne sais pas faire.

C'est mon ex qui faisait tout cela avant :(

et quel pilote je prends, il y en a tellement que j'ai peur de me planter

gen-hackman · Answer

pose la question ici en explicant ton souci , ils sont plus calés que moi en pilotes :

https://forums.commentcamarche.net/forum/logiciels-1

maewa95 · Answer

Ok merci gen, je reviendrai vers toi pour te dire si tout fonctionne. J'ai peur que d'autres fichiers soient partis en vacances aussi ^^

@+

gen-hackman · Answer

ok à te relire ;)

maewa95 · Answer

re gen

nouveau pilote réinstallé, et problème toujours existant

j'ai pu constater que, en voulant me connecter en wifi avec mon portable, ma connexion wifi n'existe plus. Je suis allée voir dans "connexions" et effectivement, la connexion wifi a une grosse croix rouge.

c'est un truc de fou ! j'ai pu regarder le journal des incidents dans bitdefender, en fait j'ai eu un virus mi-juin et un autre en mars, tous deux mentionnés "déplacés" dans le journal mais déplacé où ? je n'en ai aucune idée.

Bonne soirée

gen-hackman · Answer

dans la quarantaine de bit defender ^^

maewa95 · Answer

bonjour gen,

au secours ! je viens de lire le journal de bitdefender et je m'aperçois que, dans l'historique, dans la rubrique "parfeu", il y a, en date du 10/08/09 à 22h50 : "nouveau profil créé" et lorsque je clique pour savoir ce que c'était, il me dit que c'est ma connexion wifi

Je ne comprends pas, je n'ai rien modifié !

et dans la rubrique "antivirus" je vois que, depuis le 26/03/2009, il y a eu plein de virus détectés avec "application autorisée à s'exécuter" et la dernière fois remonte au 10 août à 23h 10mn 34s et 23h 12mn 20s

Je m'aperçois également que la dernière mise à jour remonte au 10/08/09 à 23h 11mn 01s (étrangement, une minute avant la détection de virus

Le dernier virus détecté se trouve :

C:\Program Files\Logitech\Desktop Messenger\8876480

avec comme motif dans la colonne "action appliquée" : application autorisée

C'est quoi cette appli stp ?

gen-hackman · Answer

c'est la mise à jour de ton clavier ou souris logitech ^^

maewa95 · Answer

bon je ne sais plus quoi faire 

J'ai lancé un scan depuis ce matin sur secure.com et, pour l'instant (car il tourne encore) il a trouvé 7 infections

gen-hackman · Answer

tu peux me donner le chemin des infections trouvées ?

maewa95 · Answer

le problème c'est que secure ne me les donne pas

il me dit :

CRACKINAPPS_KEYGEN : aucune information supplémentaire sur ce grayware/programme espion n'est actuellement disponible

et puis les 6 autres soucis il me dit que ce sont des cookies http pour surveiller mes habitudes sur internet

Il me propose de virer le virus. Je fais quoi stp ?

gen-hackman · Answer

les cookies , lol

heureusement que tu en as sinon tu pourrrais pas naviguer sur le net

pour le truc keygen , tu dois avoir ou etre en train d'en telecharger ^^

maewa95 · Answer

comment ça j'en télécharge des key gen ? Il me dit que c'est une infection :(

J'accepte de tout supprimer ? il n'y a pas de risque ?*

Oui, les cookies, je sais, c'est normal

là je surf à partir de mon portable que j'ai enfin configuré pour pouvoir surfer. L'autre pc n'était connecté que pour l'analyse en ligne

Tiens, j'ai une question : j'ai mis antivir et spybot. Vois-tu autre chose que je puisse ajouter pour me couvrir un peu plus stp ou bien est-ce que ça suffit ?

gen-hackman · Answer

tout est expliqué ici : ▶ Télécharge :ATF Cleaner par Atribune Double-clique (clic droit "en tant qu'administrateur" pour Vista) ATF-Cleaner.exe afin de lancer le programme. Sous l'onglet Main, choisis : Select All Clique sur le bouton Empty Selected Si tu utilises le navigateur Firefox : Clique Firefox au haut et choisis : Select All Clique le bouton Empty Selected a NOTE : Si tu veux conserver tes mots de passe sauvegardés, clique No à l'invité. Si tu utilises le navigateur Opera : Clique Opera au haut et choisis : Select All Clique le bouton Empty Selected NOTE : Si tu veux conserver tes mots de passe sauvegardés, clique No à l'invité. Clique Exit, du menu prinicipal, afin de fermer le programme. Pour obtenir du Support technique, double-clique l'adresse électronique située au bas de chacun des menus. __________________________________________________ ▶ Tu peux garder ATF pour d'eventuels netttoyages un peu plus poussés __________________________________________________ ▶---> Télécharge ToolsCleaner2sur ton Bureau. * Double-clique (clic droit "en tant qu'administrateur" pour Vista) sur ToolsCleaner2.exe pour le lancer. * Clique sur Recherche et laisse le scan agir. * Clique sur Suppression pour finaliser. * Tu peux, si tu le souhaites, te servir des Options Facultatives. * Clique sur Quitter pour obtenir le rapport. * Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\). ________________________________________________ ▶ Tu peux supprimer ToolCleaner _________________________________________________ ▶ Télécharge et installe CCleaner (N'installe pas la Yahoo Toolbar) : * Lance-le.(clic droit "en tant qu'administrateur" pour Vista) Va dans Options puis Avancé et décoche la case Effacer uniquement les fichiers etc.... * Va dans Nettoyeur, choisis Analyse. Une fois terminé, lance le nettoyage. * Ensuite, choisis Registre, puis Chercher des erreurs. Une fois terminé, répare toutes les erreurs tant de fois qu il en trouve a l analyse * Veille a ce que dans les options le reglage soit au demarrage de windows et réglé sur "effacement securisé" 35 passes (guttman) __________________________________________________ Attention : ne pas toucher au PC pendant qu'il travaille ! ▶ Nettoyage et Défragmentation de tes Disques *Nettoyage : Clic droit sur "poste de travail"(ordinateur pour vista) ==>"ouvrir" ==>clic droit sur le disque C ==>Propriétés ==>onglet "Général" Cliques sur le bouton "nettoyage de disque", OK tu le fais pour chacun de tes disques ________________________________________________ *Vérifications des erreurs : Clic droit sur "poste de travail"(ordinateur pour vista) ==>"ouvrir" ==>clic droit sur le disque C ==>Propriétés ==>onglet "Outil" "Vérifier maintenant", une boîte s'ouvre, cocher les cases : -réparer automatiquement les erreurs... -rechercher et tenter une récupération... --->Démarrer, ok Note : s'il te dis de redémarrer ton Pc pour le faire , tu redémarres et tu laisses faire, cela prend un peu de temps c'est normal tu le fais pour chacun de tes disques ________________________________________________ ensuite toujours dans le même onglet tu choisis : *Défragmentation : "défragmenter maintenant", OK une boîte s'ouvre, tu sélectionnes le disque à défragmenter, et tu cliques sur "analyser", puis après l'analyse, "défragmenter" . OK tu le fais pour chacun de tes disques _______________________________________________ Note : si tu as un utilitaire pour défragmenter , utilises le à la place pour ce faire Defraggler est proposé _________________________________________________ ▶ Peux-tu vérifier ta Console Java ? : et installer la nouvelle version si besoin est (dans ce cas désinstalle avant l'ancienne version). voici pour desinstaller : JavaRa Décompresse le fichier sur le Bureau (Clic droit > Extraire tout). * Double-clique (clic droit "en tant qu'administrateur" pour Vista) sur le répertoire JavaRa. * Puis double-clique sur le fichier JavaRa.exe (le exe peut ne pas s'afficher). * Choisis Français puis clique sur Select. * Clique sur Recherche de mises à jour. * Sélectionne Mettre à jour via jucheck.exe puis clique sur Rechercher. * Autorise le processus à se connecter s'il le demande, clique sur Installer et suis les instructions d'installation qui prennent quelques minutes. * L'installation est terminée, reviens à l'écran de JavaRa et clique sur Effacer les anciennes versions. * Clique sur Oui pour confirmer. Laisse travailler et clique ensuite sur OK, puis une deuxième fois sur OK. * Un rapport va s'ouvrir. Poste-le dans ta prochaine réponse. * Ferme l'application. Note : le rapport se trouve aussi dans C:\ sous le nom JavaRa.log. _________________________________________________ ▶ Mets à jour Adobe Reader si ce n'est pas le cas (désinstalle avant la version antérieure) __________________________________________________ ▶ Je te conseille si tu n en as pas , afin de mieux securiser ton pc , d'installer un parefeu : Online armor ou KERIO ou JETICO ou ZONE ALARM (mettre que le parefeu gratuit) ou COMODO https://www.commentcamarche.net/telecharger/securite/16545-online-armor-personal-firewall/ https://www.01net.com/telecharger/windows/Securite/firewall/fiches/39911.html https://forum.pcastuces.com/sujet.asp?f=25&s=35606 https://www.clubic.com/telecharger-fiche11071-sunbelt-personal-firewall-ex-kerio.html https://manuelsdaide.com/contact/ http://www.open-files.com/forum/index.php?showtopic=29277 https://www.commentcamarche.net/telecharger/securite/24863-zonealarm/ ___________________________________________________ ▶ Tu peux aussi vider ta corbeille,quoi que Ccleaner le fasse tout seul _____________________________________________________ ▶ Si nous avons utilisé MalwareByte's Anti-Malware , vide sa quarantaine : * Lance le programme puis clique sur . * Sélectionne tous les éléments puis clique sur . * Quitte le programme. ______________________________________________________ ▶ si tu as installé Antivir : Configuration ________________________________________________________ ▶ Idem pour ton antivirus : vide sa quarantaine si ce n'est pas déjà fait ______________________________________________________ ▶ Désactive et réactive la restauration de système, pour cela : suis les instructions du lien : Lien XP Lien Vista ▶ Sitôt fait , recrées un point de restoration dit "sain" pour parer à quelques eventuels problêmes dans le futur ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Quelques conseils et recommandations pour l'avenir : ▶ Passe un coup de MalwareByte's Anti-Malware de temps en temps (1 fois par semaine , suivant l'utilisation que tu fais de ton PC. ▶ Utilise aussi tes autres logiciels de protection (scannes antivirus, antispywares...). N'oublie pas de faire les mises à jour avant de les utiliser. * Pense aussi à faire une défragmentation de tes disques durs de temps en temps (garde suffisamment d'espace sur C:\ (1/3 de libre pour être à l'aise)) _____________ ▶ Pour bien protéger ton PC : [1 seul Antivirus] + [1 seul Pare feu] + [Un bon Antispyware avec immunisation] + [Mises à Jour récentes Windows et Logiciels de Protection] + [Utilisation de Firefox -ou autres- (Internet Explorer présente des failles de sécurité qui mettent longtemps avant d'être corrigées mais il faut absolument le conserver pour les mises à jour Windows et Windows live Messenger)] Je te conseille d'installer cette extension pour Firefox pour securiser ton surf : WOT Je te conseille d'installer cette extension pour Internet Explorer pour securiser ton surf : WOT PS : En fait la meilleure des protections c'est toi même : ce que tu fais avec ton PC : où tu surfes, télécharges...ect.... Les virus utilisent les failles de ton PC pour infecter un système ▶ dans le souhait de vouloir desinstaller un antivirus au profit d'un autre , voici quelques liens : Desinstaller Avast Desinstaller BitDefender Desinstaller Norton Desinstaller Kaspersky Desinstaller AVG ou tout en un : Désinstallation Antivirus , Parefeu , Antispyware _____________ ▶ SpywareBlaster = petit logiciel qui bloque l'installation d'activeX nuisibles au PC.(Fonctionne en arrière plan) ____________ ▶ Si tu as Vista n'oublie pas de réactiver le controle des comptes des utilisateurs(UAC) ___________ ▶ Si tu as Spybot S&D et que nous avons desactive le "Tea-timer" tu peux le réactiver ___________ ▶ si nous avons affiché les fichiers cachés , n'oublies pas de les remettre en attribut "caché" ▶ Clique sur le menu Demarrer /Panneau de configuration/Options des dossiers/ puis dans l'onglet Affichage * - Décoche Afficher les fichiers et dossiers cachés * - coche Masquer les extensions des fichiers dont le type est connu * - coche Masquer les fichiers protégés du système d'exploitation (recommandé) ▶ clique sur Appliquer, puis OK. ____________ Voila, Bonne lecture, à bientot , une fois tout ceci fait, tu peux mettre le topic en resolu Bonne continuation et surtout , prudence et bon surf :)

maewa95 · Answer

Merci à toi gen et bonne continuation

heuuuu non pas à bientôt lol pas envie d'avoir des problèmes avec ce pc. Pour l'autre, il va finir au cimetière puisqu'il ne veut rien entendre

Bon courage et un grand bravo à vous tous et toutes les bénévoles qui donnez de votre temps personnels pour nous dépanner

gen-hackman · Answer

:)

Redémarrage en boucle intempestif

173 réponses

Votre réponse

Discussions similaires

Newsletters