Cheval de Troie, Avast

epidepsychadelique -  
Bonjour,

Voilà j'ai un soucis, une fenêtre s'est affichée sur mon PC en me disant que mon antivirus (avast) a trouvé un cheval de Troie. Hors quand je veux le mettre en quarantaine un message s'affiche en disant : "Le processus de ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus." Du coup je ne peux pas effectuer cette opération, que dois-je faire ?

Merci d'avance pour votre aide, Je ne sais plus comment m'y prendre.
Si vous pouviez me répondre au plus vite, ça serait vraiment génial !
Configuration: Windows XP Internet Explorer 7.0

8 réponses

  1.  supergeronimo44 Contributeur sécurité
    Salut !

    Pour voir un peu plus en profondeur :

    * Télécharge Random's system information tool (RSIT) et enregistre le sur ton Bureau => http://images.malwareremoval.com/random/RSIT.exe

    * Double clique sur RSIT.exe pour lancer l'outil.
    * Clique sur ' continue ' à l'écran Disclaimer.
    * Si l'outil HIjackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera et tu devras accepter la licence.
    * Une fois le scan fini , 2 rapports vont apparaitre. Poste le contenu des 2 rapports.

    ( C:\RSIT\log.txt & C:\RSIT\info.txt )

    (CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

    Tutoriel de RSIT => https://www.androidworld.fr/

    Comment héberger les rapports trop longs de RSIT => https://www.androidworld.fr/
    0
    1. epidepsychadelique
      Le soucis est que je n'ai qu'un rapport qui s'affiche, c'est normal ?
      0
    2. epidepsychadelique
      @epidepsychadeliqueSi je mets "supprimer" ça va me supprimer des fichiers ?
      0
  2. 92kevin92
    Sa Veut Dire Que Le Tu Ai En Train D'Utilisez Le Cheval De Troie(C Jore Un Logiciel).Donc Quitte Tes Fenetres(Ex:Msn,Logiciel...)Et Réessaye De Le Mètre En Quarantaine^^Voila
    0
    1. supergeronimo44 Contributeur sécurité
      re- !

      poste moi le rapport

      ne suis pas ce que te dis 92Kevin92
      0
      1. epidepsychadelique
        Logfile of random's system information tool 1.06 (written by random/random)
        Run by Nathalie at 2009-12-30 14:43:13
        Microsoft Windows XP Édition familiale Service Pack 3
        System drive C: has 121 GB (80%) free of 153 GB
        Total RAM: 1023 MB (9% free)

        Logfile of Trend Micro HijackThis v2.0.2
        Scan saved at 14:43:18, on 30/12/2009
        Platform: Windows XP SP3 (WinNT 5.01.2600)
        MSIE: Internet Explorer v7.00 (7.00.6000.16945)
        Boot mode: Normal

        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\nvsvc32.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\svchost.exe
        C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
        C:\Program Files\Alwil Software\Avast4\ashServ.exe
        C:\WINDOWS\system32\spoolsv.exe
        C:\WINDOWS\Explorer.EXE
        C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
        C:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe
        C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
        C:\WINDOWS\system32\RUNDLL32.EXE
        C:\Program Files\Java\jre6\bin\jusched.exe
        C:\Program Files\iTunes\iTunesHelper.exe
        C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe
        C:\WINDOWS\system32\ctfmon.exe
        C:\Program Files\Creative\Software Update 3\SoftAuto.exe
        C:\documents and settings\nathalie\local settings\application data\ubiwdd.exe
        C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
        C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
        C:\Program Files\Bonjour\mDNSResponder.exe
        C:\Program Files\Creative\Shared Files\CTDevSrv.exe
        C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
        C:\Program Files\Java\jre6\bin\jqs.exe
        C:\WINDOWS\system32\svchost.exe
        C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
        C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
        C:\Program Files\iPod\bin\iPodService.exe
        C:\Program Files\orange\Launcher\Launcher.exe
        C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
        C:\Program Files\Orange\connectivity\connectivitymanager.exe
        C:\Program Files\Orange\systray\systrayapp.exe
        C:\Program Files\Orange\connectivity\CoreCom\CoreCom.exe
        C:\Program Files\Orange\connectivity\CoreCom\OraConfigRecover.exe
        C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
        C:\Program Files\Orange\browser\browser.exe
        c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
        C:\Program Files\Orange\Deskboard\deskboard.exe
        C:\Program Files\Orange\browser\browser.exe
        C:\Program Files\Windows Live\Messenger\msnmsgr.exe
        C:\Program Files\Windows Live\Contacts\wlcomm.exe
        C:\Documents and Settings\Nathalie\Local Settings\Temporary Internet Files\Content.IE5\RJU0D7N8\RSIT[1].exe
        C:\Program Files\trend micro\Nathalie.exe

        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ads.eorezo.com/cgi-bin/advert/getads.cgi?x_format=redirect&x_dp_id=9
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
        R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
        R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL
        O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL
        O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
        O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
        O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
        O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)
        O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
        O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
        O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
        O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
        O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
        O3 - Toolbar: My Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
        O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
        O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
        O4 - HKLM\..\Run: [MyWebSearch Plugin] rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\M3PLUGIN.DLL,UPF
        O4 - HKLM\..\Run: [My Web Search Bar Search Scope Monitor] "C:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe" /m=2 /w /h
        O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
        O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
        O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe /install
        O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
        O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
        O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
        O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
        O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
        O4 - HKLM\..\Run: [Samsung PanelMgr] C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe /autorun
        O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
        O4 - HKCU\..\Run: [nurbrule] C:\DOCUME~1\Nathalie\APPLIC~1\DENTSA~1\Way Cake.exe
        O4 - HKCU\..\Run: [SoftAuto.exe] "C:\Program Files\Creative\Software Update 3\SoftAuto.exe"
        O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
        O4 - HKCU\..\Run: [ubiwdd] "c:\documents and settings\nathalie\local settings\application data\ubiwdd.exe" ubiwdd
        O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
        O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
        O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
        O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
        O4 - Startup: Outil de détection de support de Cyber-shot Viewer.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
        O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZJxdm351YYFR
        O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
        O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
        O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
        O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
        O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
        O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
        O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O15 - Trusted Zone: https://www.orange.fr/portail
        O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net/...
        O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
        O16 - DPF: {195B4BBF-E1E4-4020-9773-0A8C6F65EA35} (CPlayFirstCookingDasControl Object) - http://jeuxentelechargement.orange.fr/...
        O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/...
        O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
        O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
        O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
        O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
        O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
        O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
        O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
        O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
        O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
        O16 - DPF: {BAE1D8DF-0B35-47E3-A1E7-EEB3FF2ECD19} (CPlayFirstddfotgControl Object) - file:///C:/Documents%20and%20Settings/Nathalie/Local%20Settings/Application%20Data/Oberon%20Media/Oberon%20Games%20Host/ddfotg.1.0.0.37.cab
        O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
        O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://jeuxentelechargement.orange.fr/Gameshell/GameHost/1.0/OberonGameHost.cab
        O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
        O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab
        O16 - DPF: {E85362EF-40D4-4E5D-BE07-D6B036CCA277} (GoPets Control) - https://secure.gopetslive.com/dev/gopets.cab
        O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
        O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab
        O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
        O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
        O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
        O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
        O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
        O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
        O23 - Service: CT Device Query service (CTDevice_Srv) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTDevSrv.exe
        O23 - Service: Creative Centrale Media Server (CTUPnPSv) - Creative Technology Ltd - C:\Program Files\Creative\Creative Centrale\CTUPnPSv.exe
        O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
        O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
        O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
        O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
        O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
        O23 - Service: My Web Search Service (MyWebSearchService) - MyWebSearch.com - C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwssvc.exe
        O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
        0
    2. supergeronimo44 Contributeur sécurité
      ok,

      je regarde ton rapport et je te dis quoi faire.

      Si l'autre rapport ne s'affiche pas, c'est que tu as dû utiliser RSIT une autre fois, et que les rapports n'ont pas été supprimés( mais je n'en ai pas besoin pour l'instant)

      je te tiens au courant
      0
      1. epidepsychadelique
        D'accord j'attends ton prochain message ! Merci beaucoup !
        0
    4. supergeronimo44 Contributeur sécurité
      donc,

      * Rends-toi à cette adresse afin de télécharger AD-Remover :
      https://www.androidworld.fr/
      * Clique sur TÉLÉCHARGER et enregistre-le sur ton bureau.
      * Double clique sur le fichier d'installation de AD-Remover, le programme s'installera automatiquement.
      * Au menu principal choisi l'option "S" et tape sur [entrée] .
      * Laisse travailler l'outil et ne touche à rien ...
      * Poste le rapport qui apparait à la fin.

      ( le rapport est sauvegardé aussi sous C:\Ad-report.log )

      (CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

      Note :

      Process.exe est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
      Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
      Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.

      ++
      0
      1. epidepsychadelique
        .
        ======= RAPPORT D'AD-REMOVER 1.1.4.6_F | UNIQUEMENT XP/VISTA/7 =======
        .
        Mit à jour par C_XX le 26.12.2009 à 20:47
        Contact: AdRemover.contact@gmail.com
        Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
        .
        Lancé à: 15:03:56, 30/12/2009 | Mode Normal | Option: SCAN
        Exécuté de: C:\Program Files\Ad-Remover\
        Système d'exploitation: Microsoft® Windows XP™ Service Pack 3 v5.1.2600
        Nom du PC: BRANCHY | Utilisateur actuel: Nathalie

        Bonnes fêtes de fin d'année à vous tous :)
        .
        ============== ÉLÉMENT(S) TROUVÉ(S) ==============
        .

        C:\WINDOWS\System32\f3PSSavr.scr
        C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\EoRezo
        C:\Program Files\EoRezo
        C:\Program Files\FunWebProducts
        C:\Program Files\GamesBar
        C:\Program Files\MyWebSearch
        C:\DOCUME~1\Nathalie\APPLIC~1\EoRezo
        C:\DOCUME~1\Nathalie\APPLIC~1\FunWebProducts
        C:\DOCUME~1\Nathalie\APPLIC~1\ItsLabel
        C:\DOCUME~1\ALLUSE~1\APPLIC~1\Games-Attack
        C:\Program Files\Windows Live\Messenger\Riched20.dll
        C:\Documents and Settings\Nathalie\Local Settings\Application Data\ubiwdd.dat
        C:\Documents and Settings\Nathalie\Local Settings\Application Data\ubiwdd.exe
        C:\Documents and Settings\Nathalie\Local Settings\Application Data\ubiwdd_nav.dat
        C:\Documents and Settings\Nathalie\Local Settings\Application Data\ubiwdd_navps.dat
        .
        HKCU\software\EoRezo
        HKCU\software\fcn
        HKCU\software\Fun Web Products
        HKCU\software\FunWebProducts
        HKCU\software\ItsLabel
        HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
        HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\\{00A6FAF6-072E-44cf-8957-5838F569A31D}
        HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF1-072E-44CF-8957-5838F569A31D}
        HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
        HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
        HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1A93C934-025B-4C3A-B38E-9654A7003239}
        HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{64F56FC1-1272-44CD-BA6E-39723696E350}
        HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6F282B65-56BF-4BD1-A8B2-A4449A05863D}
        HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\MyWebSearch Email Plugin
        HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\ubiwdd
        HKCU\software\MyWebSearch
        HKLM\Software\Classes\CLSID\{00A6FAF1-072E-44cf-8957-5838F569A31D}
        HKLM\Software\Classes\CLSID\{00A6FAF6-072E-44cf-8957-5838F569A31D}
        HKLM\Software\Classes\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
        HKLM\Software\Classes\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
        HKLM\Software\Classes\CLSID\{07B18EAB-A523-4961-B6BB-170DE4475CCA}
        HKLM\Software\Classes\CLSID\{0F8ECF4F-3646-4C3A-8881-8E138FFCAF70}
        HKLM\Software\Classes\CLSID\{1E0DE227-5CE4-4ea3-AB0C-8B03E1AA76BC}
        HKLM\Software\Classes\CLSID\{25560540-9571-4D7B-9389-0F166788785A}
        HKLM\Software\Classes\CLSID\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8}
        HKLM\Software\Classes\CLSID\{3E720452-B472-4954-B7AA-33069EB53906}
        HKLM\Software\Classes\CLSID\{53CED2D0-5E9A-4761-9005-648404E6F7E5}
        HKLM\Software\Classes\CLSID\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C}
        HKLM\Software\Classes\CLSID\{64F56FC1-1272-44CD-BA6E-39723696E350}
        HKLM\Software\Classes\CLSID\{7473D292-B7BB-4f24-AE82-7E2CE94BB6A9}
        HKLM\Software\Classes\CLSID\{7473D294-B7BB-4f24-AE82-7E2CE94BB6A9}
        HKLM\Software\Classes\CLSID\{7473D296-B7BB-4f24-AE82-7E2CE94BB6A9}
        HKLM\Software\Classes\CLSID\{84DA4FDF-A1CF-4195-8688-3E961F505983}
        HKLM\Software\Classes\CLSID\{8E6F1832-9607-4440-8530-13BE7C4B1D14}
        HKLM\Software\Classes\CLSID\{938AA51A-996C-4884-98CE-80DD16A5C9DA}
        HKLM\Software\Classes\CLSID\{98D9753D-D73B-42D5-8C85-4469CDA897AB}
        HKLM\Software\Classes\CLSID\{9FF05104-B030-46FC-94B8-81276E4E27DF}
        HKLM\Software\Classes\CLSID\{A9571378-68A1-443d-B082-284F960C6D17}
        HKLM\Software\Classes\CLSID\{ADB01E81-3C79-4272-A0F1-7B2BE7A782DC}
        HKLM\Software\Classes\CLSID\{B813095C-81C0-4E40-AA14-67520372B987}
        HKLM\Software\Classes\CLSID\{C9D7BE3E-141A-4C85-8CD6-32461F3DF2C7}
        HKLM\Software\Classes\CLSID\{CFF4CE82-3AA2-451F-9B77-7165605FB835}
        HKLM\Software\Classes\CLSID\{D9FFFB27-D62A-4D64-8CEC-1FF006528805}
        HKLM\Software\Classes\CLSID\{E79DFBCA-5697-4fbd-94E5-5B2A9C7C1612}
        HKLM\software\classes\EoRezoBHO.EoBho
        HKLM\software\classes\EoRezoBHO.EoBho.1
        HKLM\software\classes\FunWebProducts.DataControl
        HKLM\software\classes\FunWebProducts.DataControl.1
        HKLM\software\classes\FunWebProducts.HistoryKillerScheduler
        HKLM\software\classes\FunWebProducts.HistoryKillerScheduler.1
        HKLM\software\classes\FunWebProducts.HistorySwatterControlBar
        HKLM\software\classes\FunWebProducts.HistorySwatterControlBar.1
        HKLM\software\classes\FunWebProducts.HTMLMenu
        HKLM\software\classes\FunWebProducts.HTMLMenu.1
        HKLM\software\classes\FunWebProducts.HTMLMenu.2
        HKLM\software\classes\FunWebProducts.IECookiesManager
        HKLM\software\classes\FunWebProducts.IECookiesManager.1
        HKLM\software\classes\FunWebProducts.KillerObjManager
        HKLM\software\classes\FunWebProducts.KillerObjManager.1
        HKLM\software\classes\FunWebProducts.PopSwatterBarButton
        HKLM\software\classes\FunWebProducts.PopSwatterBarButton.1
        HKLM\software\classes\FunWebProducts.PopSwatterSettingsControl
        HKLM\software\classes\FunWebProducts.PopSwatterSettingsControl.1
        HKLM\Software\Classes\Interface\{07B18EAA-A523-4961-B6BB-170DE4475CCA}
        HKLM\Software\Classes\Interface\{07B18EAC-A523-4961-B6BB-170DE4475CCA}
        HKLM\Software\Classes\Interface\{1093995A-BA37-41D2-836E-091067C4AD17}
        HKLM\Software\Classes\Interface\{120927BF-1700-43BC-810F-FAB92549B390}
        HKLM\Software\Classes\Interface\{17DE5E5E-BFE3-4E83-8E1F-8755795359EC}
        HKLM\Software\Classes\Interface\{1F52A5FA-A705-4415-B975-88503B291728}
        HKLM\Software\Classes\Interface\{247A115F-06C2-4FB3-967D-2D62D3CF4F0A}
        HKLM\Software\Classes\Interface\{2E3537FC-CF2F-4F56-AF54-5A6A3DD375CC}
        HKLM\Software\Classes\Interface\{2E9937FC-CF2F-4F56-AF54-5A6A3DD375CC}
        HKLM\Software\Classes\Interface\{3E1656ED-F60E-4597-B6AA-B6A58E171495}
        HKLM\Software\Classes\Interface\{3E53E2CB-86DB-4A4A-8BD9-FFEB7A64DF82}
        HKLM\Software\Classes\Interface\{3E720451-B472-4954-B7AA-33069EB53906}
        HKLM\Software\Classes\Interface\{3E720453-B472-4954-B7AA-33069EB53906}
        HKLM\Software\Classes\Interface\{63D0ED2B-B45B-4458-8B3B-60C69BBBD83C}
        HKLM\Software\Classes\Interface\{63D0ED2D-B45B-4458-8B3B-60C69BBBD83C}
        HKLM\Software\Classes\Interface\{6E74766C-4D93-4CC0-96D1-47B8E07FF9CA}
        HKLM\Software\Classes\Interface\{72EE7F04-15BD-4845-A005-D6711144D86A}
        HKLM\Software\Classes\Interface\{741DE825-A6F0-4497-9AA6-8023CF9B0FFF}
        HKLM\Software\Classes\Interface\{7473D291-B7BB-4F24-AE82-7E2CE94BB6A9}
        HKLM\Software\Classes\Interface\{7473D293-B7BB-4F24-AE82-7E2CE94BB6A9}
        HKLM\Software\Classes\Interface\{7473D295-B7BB-4F24-AE82-7E2CE94BB6A9}
        HKLM\Software\Classes\Interface\{7473D297-B7BB-4F24-AE82-7E2CE94BB6A9}
        HKLM\Software\Classes\Interface\{90449521-D834-4703-BB4E-D3AA44042FF8}
        HKLM\Software\Classes\Interface\{991AAC62-B100-47CE-8B75-253965244F69}
        HKLM\Software\Classes\Interface\{A626CDBD-3D13-4F78-B819-440A28D7E8FC}
        HKLM\Software\Classes\Interface\{B0D071A1-36B3-4757-A126-14C89C56013A}
        HKLM\Software\Classes\Interface\{BBABDC90-F3D5-4801-863A-EE6AE529862D}
        HKLM\Software\Classes\Interface\{CF54BE1C-9359-4395-8533-1657CF209CFE}
        HKLM\Software\Classes\Interface\{D6FF3684-AD3B-48EB-BBB4-B9E6C5A355C1}
        HKLM\Software\Classes\Interface\{DE38C398-B328-4F4C-A3AD-1B5E4ED93477}
        HKLM\Software\Classes\Interface\{E342AF55-B78A-4CD0-A2BB-DA7F52D9D25E}
        HKLM\Software\Classes\Interface\{E342AF55-B78A-4CD0-A2BB-DA7F52D9D25F}
        HKLM\Software\Classes\Interface\{E79DFBC9-5697-4FBD-94E5-5B2A9C7C1612}
        HKLM\Software\Classes\Interface\{E79DFBCB-5697-4FBD-94E5-5B2A9C7C1612}
        HKLM\Software\Classes\Interface\{EB9E5C1C-B1F9-4C2B-BE8A-27D6446FDAF8}
        HKLM\Software\Classes\Interface\{F87D7FB5-9DC5-4C8C-B998-D8DFE02E2978}
        HKLM\software\classes\MyWebSearch.ChatSessionPlugin
        HKLM\software\classes\MyWebSearch.ChatSessionPlugin.1
        HKLM\software\classes\MyWebSearch.HTMLPanel
        HKLM\software\classes\MyWebSearch.HTMLPanel.1
        HKLM\software\classes\MyWebSearch.OutlookAddin
        HKLM\software\classes\MyWebSearch.OutlookAddin.1
        HKLM\software\classes\MyWebSearch.PseudoTransparentPlugin
        HKLM\software\classes\MyWebSearch.PseudoTransparentPlugin.1
        HKLM\software\classes\MyWebSearchToolBar.SettingsPlugin
        HKLM\software\classes\MyWebSearchToolBar.SettingsPlugin.1
        HKLM\software\classes\MyWebSearchToolBar.ToolbarPlugin
        HKLM\software\classes\MyWebSearchToolBar.ToolbarPlugin.1
        HKLM\software\classes\ScreenSaverControl.ScreenSaverInstaller
        HKLM\software\classes\ScreenSaverControl.ScreenSaverInstaller.1
        HKLM\Software\Classes\TypeLib\{07B18EA0-A523-4961-B6BB-170DE4475CCA}
        HKLM\Software\Classes\TypeLib\{0D26BC71-A633-4E71-AD31-EADC3A1B6A3A}
        HKLM\Software\Classes\TypeLib\{29D67D3C-509A-4544-903F-C8C1B8236554}
        HKLM\Software\Classes\TypeLib\{3E720450-B472-4954-B7AA-33069EB53906}
        HKLM\Software\Classes\TypeLib\{7473D290-B7BB-4F24-AE82-7E2CE94BB6A9}
        HKLM\Software\Classes\TypeLib\{8CA01F0E-987C-49C3-B852-2F1AC4A7094C}
        HKLM\Software\Classes\TypeLib\{8E6F1830-9607-4440-8530-13BE7C4B1D14}
        HKLM\Software\Classes\TypeLib\{B4C656C9-F2E9-4E77-B3F4-443DF2BD778F}
        HKLM\Software\Classes\TypeLib\{C8CECDE3-1AE1-4C4A-AD82-6D5B00212144}
        HKLM\Software\Classes\TypeLib\{D518921A-4A03-425E-9873-B9A71756821E}
        HKLM\Software\Classes\TypeLib\{E47CAEE0-DEEA-464A-9326-3F2801535A4D}
        HKLM\Software\Classes\TypeLib\{E79DFBC0-5697-4FBD-94E5-5B2A9C7C1612}
        HKLM\Software\Classes\TypeLib\{F42228FB-E84E-479E-B922-FBBD096E792C}
        HKLM\software\EoRezo
        HKLM\software\FocusInteractive
        HKLM\software\Fun Web Products
        HKLM\software\FunWebProducts
        HKLM\software\GamesBarSetup
        HKLM\software\ItsLabel
        HKLM\Software\Microsoft\Code Store Database\Distribution Units\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB}
        HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59C7FC09-1C83-4648-B3E6-003D2BBC7481}
        HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68AF847F-6E91-45DD-9B68-D6A12C30E5D7}
        HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170B96C-28D4-4626-8358-27E6CAEEF907}
        HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D1A71FA0-FF48-48dd-9B6D-7A13A3E42127}
        HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DDB1968E-EAD6-40fd-8DAE-FF14757F60C7}
        HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F138D901-86F0-4383-99B6-9CDD406036DA}
        HKLM\Software\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll
        HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0}
        HKLM\software\microsoft\internet explorer\searchscopes\{56256A51-B582-467e-B8D4-7786EDA79AE0}
        HKLM\Software\Microsoft\Internet Explorer\Toolbar\\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
        HKLM\Software\Microsoft\Multimedia\WMPlayer\Schemes\f3pss
        HKLM\Software\Microsoft\Office\Outlook\Addins\MyWebSearch.OutlookAddin
        HKLM\Software\Microsoft\Office\Word\Addins\MyWebSearch.OutlookAddin
        HKLM\Software\Microsoft\Windows Media\Wmsdk\Sources\\F3PopularScreenSavers
        HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\MyWebSearch bar Uninstall
        HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00A6FAF1-072E-44cf-8957-5838F569A31D}
        HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
        HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64F56FC1-1272-44CD-BA6E-39723696E350}
        HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{07B18EAB-A523-4961-B6BB-170DE4475CCA}
        HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{25560540-9571-4D7B-9389-0F166788785A}
        HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8}
        HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3E720452-B472-4954-B7AA-33069EB53906}
        HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C}
        HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7473d294-b7bb-4f24-ae82-7e2ce94bb6a9}
        HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{98D9753D-D73B-42D5-8C85-4469CDA897AB}
        HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9FF05104-B030-46FC-94B8-81276E4E27DF}
        HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{E79DFBCA-5697-4FBD-94E5-5B2A9C7C1612}
        HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\post platform\\FunWebProducts
        HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\My Web Search Bar Search Scope Monitor
        HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\MyWebSearch Email Plugin
        HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\MyWebSearch Plugin
        HKLM\software\MyWebSearch
        HKLM\SYSTEM\ControlSet003\Enum\Root\LEGACY_MYWEBSEARCHSERVICE
        HKLM\SYSTEM\ControlSet003\Services\MyWebSearchService
        HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MYWEBSEARCHSERVICE
        HKLM\SYSTEM\CurrentControlSet\Services\MyWebSearchService
        HKU\s-1-5-21-299502267-1767777339-839522115-1004\software\EoRezo
        HKU\s-1-5-21-299502267-1767777339-839522115-1004\software\fcn
        HKU\s-1-5-21-299502267-1767777339-839522115-1004\software\Fun Web Products
        HKU\s-1-5-21-299502267-1767777339-839522115-1004\software\FunWebProducts
        HKU\s-1-5-21-299502267-1767777339-839522115-1004\software\ItsLabel
        HKU\s-1-5-21-299502267-1767777339-839522115-1004\software\MyWebSearch
        .
        ============== Scan additionnel ==============
        .
        .
        * Internet Explorer Version 7.0.5730.11 *
        .
        [HKEY_CURRENT_USER\..\Internet Explorer\Main]
        .
        Do404Search: 01000000
        Local Page: C:\WINDOWS\system32\blank.htm
        Show_ToolBar: yes
        Start Page: hxxp://ads.eorezo.com/cgi-bin/advert/getads.cgi?x_format=redirect&x_dp_id=9
        Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
        Enable Browser Extensions: yes
        Use Search Asst: no
        Use Custom Search URL: 1 (0x1)
        Search Bar: hxxp://www.google.com/ie
        .
        [HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]
        .
        Default_Page_URL: hxxp://go.microsoft.com/fwlink/?LinkId=69157
        Default_Search_URL: hxxp://go.microsoft.com/fwlink/?LinkId=54896
        Search Page: hxxp://go.microsoft.com/fwlink/?LinkId=54896
        Delete_Temp_Files_On_Exit: yes
        Local Page: %SystemRoot%\system32\blank.htm
        Start Page: hxxp://go.microsoft.com/fwlink/?LinkId=69157
        .
        [HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]
        .
        Tabs: res://ieframe.dll/tabswelcome.htm
        .
        ===================================
        .
        14659 Octet(s) - C:\Ad-Report-SCAN[1].log
        .
        0
    5. supergeronimo44 Contributeur sécurité
      maintenant :

      *relance Ad-remover
      *au menu principal, choisis l'option "L" et valide par "Entrée"
      * patiente pendant la durée du scan
      * poste le rapport créé

      Note : le rapport se trouve aussi à la racine du disque => C:\

      ++
      0
      1. epidepsychadelique
        .
        ======= RAPPORT D'AD-REMOVER 1.1.4.6_F | UNIQUEMENT XP/VISTA/7 =======
        .
        Mit à jour par C_XX le 26.12.2009 à 20:47
        Contact: AdRemover.contact@gmail.com
        Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
        .
        Lancé à: 15:57:59, 30/12/2009 | Mode Normal | Option: CLEAN
        Exécuté de: C:\Program Files\Ad-Remover\
        Système d'exploitation: Microsoft® Windows XP™ Service Pack 3 v5.1.2600
        Nom du PC: BRANCHY | Utilisateur actuel: Nathalie

        Bonnes fêtes de fin d'année à vous tous :)
        .
        ============== ÉLÉMENT(S) NEUTRALISÉ(S) ==============
        .

        C:\WINDOWS\System32\f3PSSavr.scr
        C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\EoRezo
        C:\Program Files\EoRezo
        C:\Program Files\FunWebProducts
        C:\Program Files\GamesBar
        C:\DOCUME~1\Nathalie\APPLIC~1\EoRezo
        C:\DOCUME~1\Nathalie\APPLIC~1\FunWebProducts
        C:\DOCUME~1\Nathalie\APPLIC~1\ItsLabel
        C:\DOCUME~1\ALLUSE~1\APPLIC~1\Games-Attack
        C:\Program Files\Windows Live\Messenger\Riched20.dll
        C:\Documents and Settings\Nathalie\Local Settings\Application Data\ubiwdd.dat
        C:\Documents and Settings\Nathalie\Local Settings\Application Data\ubiwdd.exe
        C:\Documents and Settings\Nathalie\Local Settings\Application Data\ubiwdd_nav.dat
        C:\Documents and Settings\Nathalie\Local Settings\Application Data\ubiwdd_navps.dat
        C:\Program Files\MyWebSearch - ... [b]ERREUR SUPPRESSION !!/b

        (!) -- Fichiers temporaires supprimés.

        .
        HKCU\software\EoRezo
        HKCU\software\fcn
        HKCU\software\Fun Web Products
        HKCU\software\FunWebProducts
        HKCU\software\ItsLabel
        HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
        HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\\{00A6FAF6-072E-44cf-8957-5838F569A31D}
        HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF1-072E-44CF-8957-5838F569A31D}
        HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
        HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
        HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1A93C934-025B-4C3A-B38E-9654A7003239}
        HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{64F56FC1-1272-44CD-BA6E-39723696E350}
        HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6F282B65-56BF-4BD1-A8B2-A4449A05863D}
        HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\MyWebSearch Email Plugin
        HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\ubiwdd
        HKCU\software\MyWebSearch
        HKLM\Software\Classes\CLSID\{00A6FAF1-072E-44cf-8957-5838F569A31D}
        HKLM\Software\Classes\CLSID\{00A6FAF6-072E-44cf-8957-5838F569A31D}
        HKLM\Software\Classes\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
        HKLM\Software\Classes\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
        HKLM\Software\Classes\CLSID\{07B18EAB-A523-4961-B6BB-170DE4475CCA}
        HKLM\Software\Classes\CLSID\{0F8ECF4F-3646-4C3A-8881-8E138FFCAF70}
        HKLM\Software\Classes\CLSID\{1E0DE227-5CE4-4ea3-AB0C-8B03E1AA76BC}
        HKLM\Software\Classes\CLSID\{25560540-9571-4D7B-9389-0F166788785A}
        HKLM\Software\Classes\CLSID\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8}
        HKLM\Software\Classes\CLSID\{3E720452-B472-4954-B7AA-33069EB53906}
        HKLM\Software\Classes\CLSID\{53CED2D0-5E9A-4761-9005-648404E6F7E5}
        HKLM\Software\Classes\CLSID\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C}
        HKLM\Software\Classes\CLSID\{64F56FC1-1272-44CD-BA6E-39723696E350}
        HKLM\Software\Classes\CLSID\{7473D292-B7BB-4f24-AE82-7E2CE94BB6A9}
        HKLM\Software\Classes\CLSID\{7473D294-B7BB-4f24-AE82-7E2CE94BB6A9}
        HKLM\Software\Classes\CLSID\{7473D296-B7BB-4f24-AE82-7E2CE94BB6A9}
        HKLM\Software\Classes\CLSID\{84DA4FDF-A1CF-4195-8688-3E961F505983}
        HKLM\Software\Classes\CLSID\{8E6F1832-9607-4440-8530-13BE7C4B1D14}
        HKLM\Software\Classes\CLSID\{938AA51A-996C-4884-98CE-80DD16A5C9DA}
        HKLM\Software\Classes\CLSID\{98D9753D-D73B-42D5-8C85-4469CDA897AB}
        HKLM\Software\Classes\CLSID\{9FF05104-B030-46FC-94B8-81276E4E27DF}
        HKLM\Software\Classes\CLSID\{A9571378-68A1-443d-B082-284F960C6D17}
        HKLM\Software\Classes\CLSID\{ADB01E81-3C79-4272-A0F1-7B2BE7A782DC}
        HKLM\Software\Classes\CLSID\{B813095C-81C0-4E40-AA14-67520372B987}
        HKLM\Software\Classes\CLSID\{C9D7BE3E-141A-4C85-8CD6-32461F3DF2C7}
        HKLM\Software\Classes\CLSID\{CFF4CE82-3AA2-451F-9B77-7165605FB835}
        HKLM\Software\Classes\CLSID\{D9FFFB27-D62A-4D64-8CEC-1FF006528805}
        HKLM\Software\Classes\CLSID\{E79DFBCA-5697-4fbd-94E5-5B2A9C7C1612}
        HKLM\software\classes\EoRezoBHO.EoBho
        HKLM\software\classes\EoRezoBHO.EoBho.1
        HKLM\software\classes\FunWebProducts.DataControl
        HKLM\software\classes\FunWebProducts.DataControl.1
        HKLM\software\classes\FunWebProducts.HistoryKillerScheduler
        HKLM\software\classes\FunWebProducts.HistoryKillerScheduler.1
        HKLM\software\classes\FunWebProducts.HistorySwatterControlBar
        HKLM\software\classes\FunWebProducts.HistorySwatterControlBar.1
        HKLM\software\classes\FunWebProducts.HTMLMenu
        HKLM\software\classes\FunWebProducts.HTMLMenu.1
        HKLM\software\classes\FunWebProducts.HTMLMenu.2
        HKLM\software\classes\FunWebProducts.IECookiesManager
        HKLM\software\classes\FunWebProducts.IECookiesManager.1
        HKLM\software\classes\FunWebProducts.KillerObjManager
        HKLM\software\classes\FunWebProducts.KillerObjManager.1
        HKLM\software\classes\FunWebProducts.PopSwatterBarButton
        HKLM\software\classes\FunWebProducts.PopSwatterBarButton.1
        HKLM\software\classes\FunWebProducts.PopSwatterSettingsControl
        HKLM\software\classes\FunWebProducts.PopSwatterSettingsControl.1
        HKLM\Software\Classes\Interface\{07B18EAA-A523-4961-B6BB-170DE4475CCA}
        HKLM\Software\Classes\Interface\{07B18EAC-A523-4961-B6BB-170DE4475CCA}
        HKLM\Software\Classes\Interface\{1093995A-BA37-41D2-836E-091067C4AD17}
        HKLM\Software\Classes\Interface\{120927BF-1700-43BC-810F-FAB92549B390}
        HKLM\Software\Classes\Interface\{17DE5E5E-BFE3-4E83-8E1F-8755795359EC}
        HKLM\Software\Classes\Interface\{1F52A5FA-A705-4415-B975-88503B291728}
        HKLM\Software\Classes\Interface\{247A115F-06C2-4FB3-967D-2D62D3CF4F0A}
        HKLM\Software\Classes\Interface\{2E3537FC-CF2F-4F56-AF54-5A6A3DD375CC}
        HKLM\Software\Classes\Interface\{2E9937FC-CF2F-4F56-AF54-5A6A3DD375CC}
        HKLM\Software\Classes\Interface\{3E1656ED-F60E-4597-B6AA-B6A58E171495}
        HKLM\Software\Classes\Interface\{3E53E2CB-86DB-4A4A-8BD9-FFEB7A64DF82}
        HKLM\Software\Classes\Interface\{3E720451-B472-4954-B7AA-33069EB53906}
        HKLM\Software\Classes\Interface\{3E720453-B472-4954-B7AA-33069EB53906}
        HKLM\Software\Classes\Interface\{63D0ED2B-B45B-4458-8B3B-60C69BBBD83C}
        HKLM\Software\Classes\Interface\{63D0ED2D-B45B-4458-8B3B-60C69BBBD83C}
        HKLM\Software\Classes\Interface\{6E74766C-4D93-4CC0-96D1-47B8E07FF9CA}
        HKLM\Software\Classes\Interface\{72EE7F04-15BD-4845-A005-D6711144D86A}
        HKLM\Software\Classes\Interface\{741DE825-A6F0-4497-9AA6-8023CF9B0FFF}
        HKLM\Software\Classes\Interface\{7473D291-B7BB-4F24-AE82-7E2CE94BB6A9}
        HKLM\Software\Classes\Interface\{7473D293-B7BB-4F24-AE82-7E2CE94BB6A9}
        HKLM\Software\Classes\Interface\{7473D295-B7BB-4F24-AE82-7E2CE94BB6A9}
        HKLM\Software\Classes\Interface\{7473D297-B7BB-4F24-AE82-7E2CE94BB6A9}
        HKLM\Software\Classes\Interface\{90449521-D834-4703-BB4E-D3AA44042FF8}
        HKLM\Software\Classes\Interface\{991AAC62-B100-47CE-8B75-253965244F69}
        HKLM\Software\Classes\Interface\{A626CDBD-3D13-4F78-B819-440A28D7E8FC}
        HKLM\Software\Classes\Interface\{B0D071A1-36B3-4757-A126-14C89C56013A}
        HKLM\Software\Classes\Interface\{BBABDC90-F3D5-4801-863A-EE6AE529862D}
        HKLM\Software\Classes\Interface\{CF54BE1C-9359-4395-8533-1657CF209CFE}
        HKLM\Software\Classes\Interface\{D6FF3684-AD3B-48EB-BBB4-B9E6C5A355C1}
        HKLM\Software\Classes\Interface\{DE38C398-B328-4F4C-A3AD-1B5E4ED93477}
        HKLM\Software\Classes\Interface\{E342AF55-B78A-4CD0-A2BB-DA7F52D9D25E}
        HKLM\Software\Classes\Interface\{E342AF55-B78A-4CD0-A2BB-DA7F52D9D25F}
        HKLM\Software\Classes\Interface\{E79DFBC9-5697-4FBD-94E5-5B2A9C7C1612}
        HKLM\Software\Classes\Interface\{E79DFBCB-5697-4FBD-94E5-5B2A9C7C1612}
        HKLM\Software\Classes\Interface\{EB9E5C1C-B1F9-4C2B-BE8A-27D6446FDAF8}
        HKLM\Software\Classes\Interface\{F87D7FB5-9DC5-4C8C-B998-D8DFE02E2978}
        HKLM\software\classes\MyWebSearch.ChatSessionPlugin
        HKLM\software\classes\MyWebSearch.ChatSessionPlugin.1
        HKLM\software\classes\MyWebSearch.HTMLPanel
        HKLM\software\classes\MyWebSearch.HTMLPanel.1
        0
    6. supergeronimo44 Contributeur sécurité
      re- !

      mais tous les jeux que tu as d'installé, tu as les CD d'installation ou tu les a télécharger avec emule ?
      pour le p2p : à lire => https://forum.malekal.com/viewtopic.php?t=893&start=

      Ton PC est infecté par l'ad-aware Navipromo/Magic Control qui affiche des publicités intempestives.
      Il s'installe via certains programmes, dont ceux-ci :

      * Funky Emoticons
      * go-astro
      * GoRecord
      * HotTVPlayer / HotTVPlayer & Paris Hilton
      * Live-Player
      * MailSkinner
      * Messenger Skinner
      * Instant Access
      * InternetGameBox
      * Officiale Emule (Version d'Emule modifiée)
      * Original Solitaire
      * SuperSexPlayer
      * Speed Downloading
      * Sudoplanet
      * Webmediaplayer

      * Télécharge sur le bureau Navilog1
      * (c est le numéro 1 en bas de la page) :https://www.androidworld.fr/
      * Si ton antivirus s'affole , le désactiver
      * double-clic dessus pour le lancer
      * taper F
      * Appuyer sur une touche jusqu'à arriver aux options
      * Choisir Recherche/Désinfection automatique ( = taper 1 )
      * un rapport : fixnavi.txt dans ==> C :
      * le copier et le coller dans la réponse

      ++
      0
      1. supergeronimo44 Contributeur sécurité
        Salut !

        ....merci de ne pas partir sans prévenir....
        0

        Discussions similaires

        Impossible de joindre Avast
        soleil12

        8 réponses
        cheval dans oblivion
        sernaldo53

        12 réponses
        arnaque de avast prelevement sans autorisation
        petit

        15 réponses
        Phishing faux mail d'avast
        Colette34

        2 réponses
        envahissement par pop up avast
        Cubrik

        15 réponses