Rlvknlg.exe Comment le supprimer?
Pin-pin
Messages postés
42
Date d'inscription
Statut
Membre
Dernière intervention
-
Valuu Messages postés 2163 Date d'inscription Statut Contributeur Dernière intervention -
Valuu Messages postés 2163 Date d'inscription Statut Contributeur Dernière intervention -
Bonjour,
Aujourd'hui en faisant un petit tour sur le PC de ma mère, je me rends compte qu'au bout d'un certain temps il se met a rammer monstrueusement. Je regarde alors dans mon gestionaire de taches, et je vois UC 100%. Mais quel programme peut utiliser environ 88% de mon UC ? C'est bel et bien rlvknlg.exe, je ne sais pas comment il est arrivé la, mais je n'arrive pas a m'en défaire quelqu'un peut-il m'aider?
Merci d'avance.
Aujourd'hui en faisant un petit tour sur le PC de ma mère, je me rends compte qu'au bout d'un certain temps il se met a rammer monstrueusement. Je regarde alors dans mon gestionaire de taches, et je vois UC 100%. Mais quel programme peut utiliser environ 88% de mon UC ? C'est bel et bien rlvknlg.exe, je ne sais pas comment il est arrivé la, mais je n'arrive pas a m'en défaire quelqu'un peut-il m'aider?
Merci d'avance.
15 réponses
Bonjour bonjour :)
On va vérifier ça ;)
--------------------------------------------------------------------------------------
Utilise ce logiciel de diagnostic :
* Télécharge ZHPDiag (de Nicolas Coolman)
* Laisse toi guider lors de l'installation, il se lancera automatiquement à la fin.
* Sous Vista/Seven, si ça ne se lance pas --> Clic droit/Exécuter en tant qu'administrateur
* Clique sur l'icône représentant une loupe (« Lancer le diagnostic »)
* Enregistre le rapport sur ton Bureau à l'aide de l'icône représentant une disquette
* Héberge le rapport ZHPDiag.txt sur ce site, puis copie/colle le lien fourni dans ta prochaine réponse sur le forum.
On va vérifier ça ;)
--------------------------------------------------------------------------------------
Utilise ce logiciel de diagnostic :
* Télécharge ZHPDiag (de Nicolas Coolman)
* Laisse toi guider lors de l'installation, il se lancera automatiquement à la fin.
* Sous Vista/Seven, si ça ne se lance pas --> Clic droit/Exécuter en tant qu'administrateur
* Clique sur l'icône représentant une loupe (« Lancer le diagnostic »)
* Enregistre le rapport sur ton Bureau à l'aide de l'icône représentant une disquette
* Héberge le rapport ZHPDiag.txt sur ce site, puis copie/colle le lien fourni dans ta prochaine réponse sur le forum.
C'est mieux :P
--------------------------------------------------------------------------------------
Télécharge WinChk sur ton bureau.
Lance le et appuie sur le bouton [Exécuter]
Un rapport s'ouvrira. Il sera également enregistré sous C:\WinChk.txt
Rends toi sur pjjoint.
Clique sur [Parcourir] , navigue jusqu'au fichier C:\WinChk.txt puis clique sur [OK]
Clique enfin sur [Envoyer le fichier] puis copie/colle dans ta prochaine réponse le lien créé qui apparaitra à l'écran.
--------------------------------------------------------------------------------------
Télécharge WinChk sur ton bureau.
Lance le et appuie sur le bouton [Exécuter]
Un rapport s'ouvrira. Il sera également enregistré sous C:\WinChk.txt
Rends toi sur pjjoint.
Clique sur [Parcourir] , navigue jusqu'au fichier C:\WinChk.txt puis clique sur [OK]
Clique enfin sur [Envoyer le fichier] puis copie/colle dans ta prochaine réponse le lien créé qui apparaitra à l'écran.
Télécharge AdwCleaner ( d'Xplode ) sur ton bureau.
Lance le, clique sur [Recherche] puis patiente le temps du scan.
Une fois le scan fini, un rapport s'ouvrira. Poste moi son contenu dans ta prochaine réponse.
Note : Le rapport est également sauvegardé sous C:\AdwCleaner[R1].txt
Lance le, clique sur [Recherche] puis patiente le temps du scan.
Une fois le scan fini, un rapport s'ouvrira. Poste moi son contenu dans ta prochaine réponse.
Note : Le rapport est également sauvegardé sous C:\AdwCleaner[R1].txt
Bien, repasse le en mode suppression puis :
--------------------------------------------------------------------------------------
* Télécharge AD-Remover(de la TeamXscript) sur ton Bureau.
Déconnecte toi et ferme toutes les applications en cours
* Double-clique sur l'icône AD-Remover
* Au menu principal, clique sur Scanner
* Confirme le lancement de l'analyse et laisse l'outil travailler
* Poste le rapport qui apparait à la fin (il est aussi sauvegardé sous C:\Ad-report-CLEAN.txt )
--------------------------------------------------------------------------------------
* Télécharge AD-Remover(de la TeamXscript) sur ton Bureau.
Déconnecte toi et ferme toutes les applications en cours
* Double-clique sur l'icône AD-Remover
* Au menu principal, clique sur Scanner
* Confirme le lancement de l'analyse et laisse l'outil travailler
* Poste le rapport qui apparait à la fin (il est aussi sauvegardé sous C:\Ad-report-CLEAN.txt )
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
--------------------------------------------------------------------------------------
* Double-clique sur l'icône AD-Remover
Déconnecte toi et ferme toutes les applications en cours
* Au menu principal, clique sur Nettoyer
* Confirme le lancement de l'analyse et laisse l'outil travailler
* Poste le rapport qui apparait à la fin (il est aussi sauvegardé sous C:\Ad-report-CLEAN.txt )
--------------------------------------------------------------------------------------
* Télécharge RogueKiller sur le bureau
* Quitte tous les programmes en cours
* Sous Vista/Seven , clic droit -> lancer en tant qu'administrateur
* Sinon lance simplement RogueKiller.exe
* Lorsque demandé, tape 1 et valide
* Un rapport à dû s'ouvrir (RKreport.txt se trouve également à côté de l'exécutable), donne moi son contenu dans ta prochaine réponse.
* Si le programme a été bloqué, ne pas hésiter a essayer plusieurs fois. Si vraiment cela ne passe pas (ça peut arriver), le renommer en winlogon.exe
* Double-clique sur l'icône AD-Remover
Déconnecte toi et ferme toutes les applications en cours
* Au menu principal, clique sur Nettoyer
* Confirme le lancement de l'analyse et laisse l'outil travailler
* Poste le rapport qui apparait à la fin (il est aussi sauvegardé sous C:\Ad-report-CLEAN.txt )
--------------------------------------------------------------------------------------
* Télécharge RogueKiller sur le bureau
* Quitte tous les programmes en cours
* Sous Vista/Seven , clic droit -> lancer en tant qu'administrateur
* Sinon lance simplement RogueKiller.exe
* Lorsque demandé, tape 1 et valide
* Un rapport à dû s'ouvrir (RKreport.txt se trouve également à côté de l'exécutable), donne moi son contenu dans ta prochaine réponse.
* Si le programme a été bloqué, ne pas hésiter a essayer plusieurs fois. Si vraiment cela ne passe pas (ça peut arriver), le renommer en winlogon.exe
--------------------------------------------------------------------------------------
* Quitte tous les programmes en cours
* Sous Vista/Seven , clic droit -> lancer en tant qu'administrateur
* Sinon lance simplement RogueKiller.exe
* Lorsque demandé, tape 2 et valide
* Un rapport à dû s'ouvrir (RKreport.txt se trouve également à côté de l'exécutable), donne moi son contenu dans ta prochaine réponse
* Si le programme a été bloqué, ne pas hésiter a essayer plusieurs fois. Si vraiment cela ne passe pas (ça peut arriver), le renommer en winlogon.exe
--------------------------------------------------------------------------------------
MBAM
* Télécharge Malwarebytes' Anti-Malware
* Fais la mise à jour du logiciel (elle se fait normalement à l'installation)
* Lance une analyse complète en cliquant sur "Exécuter un examen complet"
* Sélectionne les disques que tu veux analyser et clique sur "Lancer l'examen"
* L'analyse peut durer un bon moment.....
* Une fois l'analyse terminée, clique sur "OK" puis sur "Afficher les résultats"
* Vérifie que tout est bien coché et clique sur "Supprimer la sélection" => et ensuite sur "OK"
* Il se pourrait que certains fichiers devront être supprimés au redémarrage du PC... Fais le en cliquant sur "oui" à la question posée
* Un rapport va s'ouvrir dans le bloc note... Fais un copié/collé du rapport dans ta prochaine réponse sur le forum
* Quitte tous les programmes en cours
* Sous Vista/Seven , clic droit -> lancer en tant qu'administrateur
* Sinon lance simplement RogueKiller.exe
* Lorsque demandé, tape 2 et valide
* Un rapport à dû s'ouvrir (RKreport.txt se trouve également à côté de l'exécutable), donne moi son contenu dans ta prochaine réponse
* Si le programme a été bloqué, ne pas hésiter a essayer plusieurs fois. Si vraiment cela ne passe pas (ça peut arriver), le renommer en winlogon.exe
--------------------------------------------------------------------------------------
MBAM
* Télécharge Malwarebytes' Anti-Malware
* Fais la mise à jour du logiciel (elle se fait normalement à l'installation)
* Lance une analyse complète en cliquant sur "Exécuter un examen complet"
* Sélectionne les disques que tu veux analyser et clique sur "Lancer l'examen"
* L'analyse peut durer un bon moment.....
* Une fois l'analyse terminée, clique sur "OK" puis sur "Afficher les résultats"
* Vérifie que tout est bien coché et clique sur "Supprimer la sélection" => et ensuite sur "OK"
* Il se pourrait que certains fichiers devront être supprimés au redémarrage du PC... Fais le en cliquant sur "oui" à la question posée
* Un rapport va s'ouvrir dans le bloc note... Fais un copié/collé du rapport dans ta prochaine réponse sur le forum
# AdwCleaner v1.304 - Rapport créé le 07/09/2011 à 18:06:20
# Mis à jour le 05/09/11 à 14h30 par Xplode
# Système d'exploitation : Microsoft Windows XP Service Pack 3 (32 bits)
# Nom d'utilisateur : HP_Administrateur - PINPINLELAPIN (Administrateur)
# Exécuté depuis : C:\Documents and Settings\HP_Administrateur\Bureau\adwcleaner.exe
# Option [Recherche]
***** [Processus] *****
***** [Services] *****
***** [Fichiers / Dossiers] *****
Dossier Présent : C:\Documents and Settings\HP_Administrateur\Application Data\advantage
Dossier Présent : C:\Documents and Settings\HP_Administrateur\Application Data\EoRezo
Dossier Présent : C:\Documents and Settings\HP_Administrateur\Application Data\PriceGong
Dossier Présent : C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\Conduit
Dossier Présent : C:\Program Files\ItsLabel
Dossier Présent : C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\vo8jbp6v.default\extensions\engine@conduit.com
***** [Registre] *****
Clé Présente : HKCU\Software\PriceGong
Clé Présente : HKLM\SOFTWARE\Conduit
Clé Présente : HKLM\SOFTWARE\Classes\Conduit.Engine
Clé Présente : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}
Clé Présente : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}
Clé Présente : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{30F9B915-B755-4826-820B-08FBA6BD249D}
Clé Présente : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}
Clé Présente : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{A078F691-9C07-4AF2-BF43-35E79EECF8B7}
Valeur Présente : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{EEE6C35D-6118-11DC-9C72-001320C79847}]
Valeur Présente : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [AdVantage]
***** [Navigateurs] *****
-\\ Internet Explorer v8.0.6001.18702
[OK] Le registre ne contient aucune entrée illégitime.
-\\ Mozilla Firefox v [Impossible d'obtenir la version]
Profil : vo8jbp6v.default
Fichier : C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\vo8jbp6v.default\prefs.js
[OK] Le fichier ne contient aucune entrée illégitime.
-\\ Google Chrome v [Impossible d'obtenir la version]
Fichier : C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences
[OK] Le fichier ne contient aucune entrée illégitime.
-\\ Opera v11.51.1087.0
Fichier : C:\Documents and Settings\HP_Administrateur\Application Data\Opera\Opera\operaprefs.ini
[OK] Le fichier ne contient aucune entrée illégitime.
*************************
AdwCleaner[R1].txt - [2828 octets] - [07/09/2011 18:06:20]
########## EOF - C:\AdwCleaner[R1].txt - [2956 octets] ##########
# Mis à jour le 05/09/11 à 14h30 par Xplode
# Système d'exploitation : Microsoft Windows XP Service Pack 3 (32 bits)
# Nom d'utilisateur : HP_Administrateur - PINPINLELAPIN (Administrateur)
# Exécuté depuis : C:\Documents and Settings\HP_Administrateur\Bureau\adwcleaner.exe
# Option [Recherche]
***** [Processus] *****
***** [Services] *****
***** [Fichiers / Dossiers] *****
Dossier Présent : C:\Documents and Settings\HP_Administrateur\Application Data\advantage
Dossier Présent : C:\Documents and Settings\HP_Administrateur\Application Data\EoRezo
Dossier Présent : C:\Documents and Settings\HP_Administrateur\Application Data\PriceGong
Dossier Présent : C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\Conduit
Dossier Présent : C:\Program Files\ItsLabel
Dossier Présent : C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\vo8jbp6v.default\extensions\engine@conduit.com
***** [Registre] *****
Clé Présente : HKCU\Software\PriceGong
Clé Présente : HKLM\SOFTWARE\Conduit
Clé Présente : HKLM\SOFTWARE\Classes\Conduit.Engine
Clé Présente : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}
Clé Présente : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}
Clé Présente : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{30F9B915-B755-4826-820B-08FBA6BD249D}
Clé Présente : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}
Clé Présente : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{A078F691-9C07-4AF2-BF43-35E79EECF8B7}
Valeur Présente : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{EEE6C35D-6118-11DC-9C72-001320C79847}]
Valeur Présente : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [AdVantage]
***** [Navigateurs] *****
-\\ Internet Explorer v8.0.6001.18702
[OK] Le registre ne contient aucune entrée illégitime.
-\\ Mozilla Firefox v [Impossible d'obtenir la version]
Profil : vo8jbp6v.default
Fichier : C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\vo8jbp6v.default\prefs.js
[OK] Le fichier ne contient aucune entrée illégitime.
-\\ Google Chrome v [Impossible d'obtenir la version]
Fichier : C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences
[OK] Le fichier ne contient aucune entrée illégitime.
-\\ Opera v11.51.1087.0
Fichier : C:\Documents and Settings\HP_Administrateur\Application Data\Opera\Opera\operaprefs.ini
[OK] Le fichier ne contient aucune entrée illégitime.
*************************
AdwCleaner[R1].txt - [2828 octets] - [07/09/2011 18:06:20]
########## EOF - C:\AdwCleaner[R1].txt - [2956 octets] ##########
======= RAPPORT D'AD-REMOVER 2.0.0.2,G | UNIQUEMENT XP/VISTA/7 =======
Mis à jour par TeamXscript le 12/04/11
Contact: AdRemover[DOT]contact[AT]gmail[DOT]com
Site web: http://www.teamxscript.org
C:\Program Files\Ad-Remover\main.exe (SCAN [1]) -> Lancé à 18:13:17 le 07/09/2011, Mode normal
Microsoft Windows XP Professionnel Service Pack 3 (X86)
HP_Administrateur@PINPINLELAPIN ( )
============== RECHERCHE ==============
Dossier trouvé: C:\WINDOWS\Eurobarre
Dossier trouvé: C:\Program Files\GamesBar
Dossier trouvé: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\RelevantKnowledge
Dossier trouvé: C:\Program Files\RelevantKnowledge
Dossier trouvé: C:\Documents and Settings\HP_Administrateur\Application Data\Toolbar4
Dossier trouvé: C:\Documents and Settings\HP_Administrateur\Application Data\ItsLabel
Dossier trouvé: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\ItsLabel
Fichier trouvé: C:\Program Files\Windows Live\Messenger\Riched20.dll
Fichier trouvé: C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\ukais_nav.dat
Clé trouvée: HKLM\Software\Classes\Interface\{08AA0598-6A23-4364-9BF4-6D5F57F42993}
Clé trouvée: HKLM\Software\Classes\Interface\{B0E8C398-DABE-4CE1-B4D9-ED43B64923F5}
Clé trouvée: HKLM\Software\Classes\Interface\{C7F127DF-8877-4E1E-A196-FBBECBC5BC6D}
Clé trouvée: HKLM\Software\Classes\TypeLib\{2615F050-9C18-4267-B711-8E3687DC0145}
Clé trouvée: HKLM\Software\Classes\TypeLib\{CA295D63-514A-4ED0-9B5F-640890F2366B}
Clé trouvée: HKLM\Software\Classes\TypeLib\{CB0D9D8C-535E-4352-BA8F-65C3C8676612}
Clé trouvée: HKLM\Software\Classes\SearchBar.InitToolbarBHO
Clé trouvée: HKLM\Software\Classes\SearchBar.InstallerClass
Clé trouvée: HKLM\Software\Classes\SearchBar.Toolbar
Clé trouvée: HKLM\Software\Classes\Toolbar.CT2504091
Clé trouvée: HKLM\Software\Classes\Toolbar.CT2849852
Clé trouvée: HKLM\Software\GamesBarSetup
Clé trouvée: HKLM\Software\PopCap
Clé trouvée: HKCU\Software\fcn
Clé trouvée: HKCU\Software\Lanconfig
Clé trouvée: HKCU\Software\PopCap
Clé trouvée: HKU\.DEFAULT\Software\Conduit
Clé trouvée: HKU\S-1-5-18\Software\Conduit
Clé trouvée: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\ItsLabel
Clé trouvée: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59C7FC09-1C83-4648-B3E6-003D2BBC7481}
Clé trouvée: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170B96C-28D4-4626-8358-27E6CAEEF907}
Clé trouvée: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D1A71FA0-FF48-48dd-9B6D-7A13A3E42127}
Clé trouvée: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DDB1968E-EAD6-40fd-8DAE-FF14757F60C7}
Clé trouvée: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F138D901-86F0-4383-99B6-9CDD406036DA}
Clé trouvée: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{5549C19D-46FE-4975-AD54-5B37E87FF6E2}
Clé trouvée: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{D08D9F98-1C78-4704-87E6-368B0023D831}
Clé trouvée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CC3D8FE-F0E0-4DD1-A69A-8C56BCC7BEBF}
Clé trouvée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CC3D8FE-F0E0-4DD1-A69A-8C56BCC7BEC0}
Clé trouvée: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68AF847F-6E91-45DD-9B68-D6A12C30E5D7}
Clé trouvée: HKLM\Software\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll
Clé trouvée: HKLM\Software\Microsoft\Multimedia\WMPlayer\Schemes\f3pss
Clé trouvée: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\RelevantKnowledge
Clé trouvée: HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{25560540-9571-4D7B-9389-0F166788785A}
Clé trouvée: HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8}
Clé trouvée: HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C}
Clé trouvée: HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{98D9753D-D73B-42D5-8C85-4469CDA897AB}
Clé trouvée: HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9FF05104-B030-46FC-94B8-81276E4E27DF}
Valeur trouvée: HKLM\Software\Mozilla\Firefox\Extensions|{6E19037A-12E3-4295-8915-ED48BC341614}
Valeur trouvée: HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser|{90B8B761-DF2B-48AC-BBE0-BCC03A819B3B}
============== SCAN ADDITIONNEL ==============
-- C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\FireFox\Profiles\vo8jbp6v.default --
Extensions\cacaoweb@cacaoweb.org (cacaoweb)
Extensions\{3112ca9c-de6d-4884-a869-9855de68056c} (Google Toolbar for Firefox)
Extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc} (?)
Extensions\{ef79f67a-6ad7-4715-a0f8-932fca442023} (BittorrentBar_FR Community Toolbar)
User.js - keyword.URL, hxxp://redirecterror.sfr.fr/?q=
Prefs.js - browser.search.defaultenginename, Google
Prefs.js - browser.search.defaulturl, hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
Prefs.js - browser.search.selectedEngine, Google
Prefs.js - browser.startup.homepage_override.mstone, rv:1.9.0.8
-- C:\Documents and Settings\Patate-Boy\Application Data\Mozilla\FireFox\Profiles\kynrkty8.default --
Extensions\staged-xpis (?)
Extensions\{3112ca9c-de6d-4884-a869-9855de68056c} (?)
Prefs.js - browser.download.dir, C:\\Documents and Settings\\Patate-Boy\\Mes documents
Prefs.js - browser.search.defaultenginename, Google
Prefs.js - browser.search.defaulturl, hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
Prefs.js - browser.search.selectedEngine, Google
Prefs.js - browser.startup.homepage_override.mstone, rv:1.9.0.1
========================================
**** Internet Explorer Version [8.0.6001.18702] ****
HKCU_Main|Default_Page_URL - hxxp://81.29.214.174/Search.aspx
HKCU_Main|Default_Search_URL - hxxp://81.29.214.174/Search.aspx
HKCU_Main|Start Page - hxxp://www.google.fr/
HKLM_Main|Default_Page_URL - hxxp://go.microsoft.com/fwlink/?LinkId=69157
HKLM_Main|Default_Search_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM_Main|Search bar - hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=63&bd=PAVILION&pf=desktop
HKLM_Main|Search Page - hxxp://go.microsoft.com/fwlink/?LinkId=54896
HKLM_Main|Start Page - hxxp://www.bigseekpro.com/accmeware/{B1E7719A-8BE9-4E63-82DA-90509DAEDD75}
HKCU_URLSearchHooks|{ba14329e-9550-4989-b3f2-9732e92d17cc} (x)
HKCU_URLSearchHooks|{BC86E1AB-EDA5-4059-938F-CE307B0C6F0A} - "SearchHook Class" (C:\Program Files\DeviceVM\Browser Configuration Utility\AddressBarSearch.dll)
HKCU_SearchScopes\{18291348-B055-400E-8BCD-3B927FA9ED87} - "?" (hxxp://81.29.214.174/Search.aspx?ct=it&key={searchTerms}&ref=PGTB&cg=1423716fc35...)
HKCU_SearchScopes\{96bd48dd-741b-41ae-ac4a-aff96ba00f7e} - "Search" (hxxp://www.bigseekpro.com/search/browser/accmeware/{B1E7719A-8BE9-4E63-82DA-9050...)
HKCU_SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847} - "SweetIM Search" (hxxp://search.sweetim.com/search.asp?src=6&q={searchTerms})
HKLM_SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847} - "SweetIM Search" (hxxp://search.sweetim.com/search.asp?src=6&q={searchTerms})
HKCU_Toolbar\ShellBrowser|{C4069E3A-68F1-403E-B40E-20066696354B} (x)
HKCU_Toolbar\ShellBrowser|{90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} (x)
HKCU_Toolbar\WebBrowser|{A057A204-BACC-4D26-9990-79A187E2698E} (x)
HKCU_Toolbar\WebBrowser|{266FCDCA-7BB3-4DA7-B3BF-F845DEA2EBD6} (C:\Program Files\IsoBuster\tbIso0.dll) (x)
HKCU_Toolbar\WebBrowser|{EEE6C35B-6118-11DC-9C72-001320C79847} (x)
HKCU_Toolbar\WebBrowser|{CCC7A320-B3CA-4199-B1A6-9F516DD69829} (x)
HKLM_Toolbar|{266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} (C:\Program Files\IsoBuster\tbIso0.dll) (x)
HKLM_Toolbar|{CCC7A320-B3CA-4199-B1A6-9F516DD69829} (x)
HKLM_Toolbar|{c9a6357b-25cc-4bcf-96c1-78736985d412} (mscoree.dll) (x)
HKLM_ElevationPolicy\5eb3ef40-307d-42f9-96cf-1dc460d4bbf4 - C:\Program Files\Vuze_Remote\Vuze_RemoteToolbarHelper.exe (x)
HKLM_ElevationPolicy\{59C7FC09-1C83-4648-B3E6-003D2BBC7481} - C:\Program Files\MyWebSearch\bar\1.bin\m3impipe.exe (x)
HKLM_ElevationPolicy\{628F3201-34D0-49C0-BB9A-82A26AEFB291} - C:\Program Files\AccmeWare DB Toolbar\TbHelper2.exe (x)
HKLM_ElevationPolicy\{68AF847F-6E91-45dd-9B68-D6A12C30E5D7} - C:\WINDOWS\system32\f3PSSavr.scr (x)
HKLM_ElevationPolicy\{9170B96C-28D4-4626-8358-27E6CAEEF907} - C:\Program Files\MyWebSearch\bar\1.bin\m3SkPlay.exe (x)
HKLM_ElevationPolicy\{A6E2003F-95C5-4591-BA9A-0093080FDB5C} - C:\Program Files\Fichiers communs\Oberon Media\OberonBroker\1.0.0.63\OberonBroker.exe (?)
HKLM_ElevationPolicy\{B2321D2F-1154-4d97-AD3E-2FE0BAE2897B} - C:\Program Files\SFR\Kit\9launch.exe (SFR)
HKLM_ElevationPolicy\{D1A71FA0-FF48-48dd-9B6D-7A13A3E42127} - C:\Program Files\MyWebSearch\bar\1.bin\m3medint.exe (x)
HKLM_ElevationPolicy\{DDB1968E-EAD6-40fd-8DAE-FF14757F60C7} - C:\Program Files\MyWebSearch\bar\1.bin\m3SlSrch.exe (x)
HKLM_ElevationPolicy\{F138D901-86F0-4383-99B6-9CDD406036DA} - C:\Program Files\MyWebSearch\bar\1.bin\m3SrchMn.exe (x)
HKLM_Extensions\{3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEBF} - "SmartShopper - Compare product prices" (C:\Program Files\SmartShopper\Bin\2.5.0\SmrtShpr.dll,203)
HKLM_Extensions\{3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEC0} - "SmartShopper - Compare travel rates" (C:\Program Files\SmartShopper\Bin\2.5.0\SmrtShpr.dll,201)
HKLM_Extensions\{d9288080-1baa-4bc4-9cf8-a92d743db949} - "Run IMVU" (C:\Documents and Settings\HP_Administrateur\Application Data\IMVUClient\imvu.ico)
HKLM_Extensions\{DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - "?" (?)
HKLM_Extensions\{E2D4D26B-0180-43a4-B05F-462D6D54C789} - "Aide à la connexion" (C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\conn_support.ico)
HKLM_Extensions\{e2e2dd38-d088-4134-82b7-f2ba38496583} - "?" (?)
BHO\83CED28E-B96A-43FC-A276-2AD7A48EB6BE (?)
BHO\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - "AcroIEHlprObj Class" (C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll)
BHO\{0F6E720A-1A6B-40E1-A294-1D4D19F156C8} - "Objet d'aide à la navigation SFR" (C:\Program Files\SFR\Kit\SFRNavErrorHelper.dll)
BHO\{1d970ed5-3eda-438d-bffd-715931e2775b} - "SearchBar.InitToolbarBHO" (mscoree.dll) (x)
BHO\{266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} - "IsoBuster Toolbar" (C:\Program Files\IsoBuster\tbIso0.dll) (x)
BHO\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} (?)
BHO\{4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} (?)
BHO\{5C255C8A-E604-49b4-9D64-90988571CECB} (?)
BHO\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - "Search Helper" (C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll)
BHO\{9030D464-4C02-4ABF-8ECC-5164760863C6} (?)
BHO\{A057A204-BACC-4D26-9990-79A187E2698E} (?)
BHO\{A3BC75A2-1F87-4686-AA43-5347D756017C} (?)
BHO\{AA58ED58-01DD-4d91-8333-CF10577473F7} (?)
BHO\{C84D72FE-E17D-4195-BB24-76C02E2E7C4E} (?)
BHO\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} (?)
BHO\{EEE6C35C-6118-11DC-9C72-001320C79847} (?)
BHO\{ef79f67a-6ad7-4715-a0f8-932fca442023} (?)
========================================
C:\Program Files\Ad-Remover\Quarantine: 0 Fichier(s)
C:\Program Files\Ad-Remover\Backup: 1 Fichier(s)
C:\Ad-Report-SCAN[1].txt - 07/09/2011 18:13:20 (9211 Octet(s))
Fin à: 18:14:03, 07/09/2011
============== E.O.F ==============
Mis à jour par TeamXscript le 12/04/11
Contact: AdRemover[DOT]contact[AT]gmail[DOT]com
Site web: http://www.teamxscript.org
C:\Program Files\Ad-Remover\main.exe (SCAN [1]) -> Lancé à 18:13:17 le 07/09/2011, Mode normal
Microsoft Windows XP Professionnel Service Pack 3 (X86)
HP_Administrateur@PINPINLELAPIN ( )
============== RECHERCHE ==============
Dossier trouvé: C:\WINDOWS\Eurobarre
Dossier trouvé: C:\Program Files\GamesBar
Dossier trouvé: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\RelevantKnowledge
Dossier trouvé: C:\Program Files\RelevantKnowledge
Dossier trouvé: C:\Documents and Settings\HP_Administrateur\Application Data\Toolbar4
Dossier trouvé: C:\Documents and Settings\HP_Administrateur\Application Data\ItsLabel
Dossier trouvé: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\ItsLabel
Fichier trouvé: C:\Program Files\Windows Live\Messenger\Riched20.dll
Fichier trouvé: C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\ukais_nav.dat
Clé trouvée: HKLM\Software\Classes\Interface\{08AA0598-6A23-4364-9BF4-6D5F57F42993}
Clé trouvée: HKLM\Software\Classes\Interface\{B0E8C398-DABE-4CE1-B4D9-ED43B64923F5}
Clé trouvée: HKLM\Software\Classes\Interface\{C7F127DF-8877-4E1E-A196-FBBECBC5BC6D}
Clé trouvée: HKLM\Software\Classes\TypeLib\{2615F050-9C18-4267-B711-8E3687DC0145}
Clé trouvée: HKLM\Software\Classes\TypeLib\{CA295D63-514A-4ED0-9B5F-640890F2366B}
Clé trouvée: HKLM\Software\Classes\TypeLib\{CB0D9D8C-535E-4352-BA8F-65C3C8676612}
Clé trouvée: HKLM\Software\Classes\SearchBar.InitToolbarBHO
Clé trouvée: HKLM\Software\Classes\SearchBar.InstallerClass
Clé trouvée: HKLM\Software\Classes\SearchBar.Toolbar
Clé trouvée: HKLM\Software\Classes\Toolbar.CT2504091
Clé trouvée: HKLM\Software\Classes\Toolbar.CT2849852
Clé trouvée: HKLM\Software\GamesBarSetup
Clé trouvée: HKLM\Software\PopCap
Clé trouvée: HKCU\Software\fcn
Clé trouvée: HKCU\Software\Lanconfig
Clé trouvée: HKCU\Software\PopCap
Clé trouvée: HKU\.DEFAULT\Software\Conduit
Clé trouvée: HKU\S-1-5-18\Software\Conduit
Clé trouvée: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\ItsLabel
Clé trouvée: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59C7FC09-1C83-4648-B3E6-003D2BBC7481}
Clé trouvée: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170B96C-28D4-4626-8358-27E6CAEEF907}
Clé trouvée: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D1A71FA0-FF48-48dd-9B6D-7A13A3E42127}
Clé trouvée: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DDB1968E-EAD6-40fd-8DAE-FF14757F60C7}
Clé trouvée: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F138D901-86F0-4383-99B6-9CDD406036DA}
Clé trouvée: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{5549C19D-46FE-4975-AD54-5B37E87FF6E2}
Clé trouvée: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{D08D9F98-1C78-4704-87E6-368B0023D831}
Clé trouvée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CC3D8FE-F0E0-4DD1-A69A-8C56BCC7BEBF}
Clé trouvée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CC3D8FE-F0E0-4DD1-A69A-8C56BCC7BEC0}
Clé trouvée: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68AF847F-6E91-45DD-9B68-D6A12C30E5D7}
Clé trouvée: HKLM\Software\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll
Clé trouvée: HKLM\Software\Microsoft\Multimedia\WMPlayer\Schemes\f3pss
Clé trouvée: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\RelevantKnowledge
Clé trouvée: HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{25560540-9571-4D7B-9389-0F166788785A}
Clé trouvée: HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8}
Clé trouvée: HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C}
Clé trouvée: HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{98D9753D-D73B-42D5-8C85-4469CDA897AB}
Clé trouvée: HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9FF05104-B030-46FC-94B8-81276E4E27DF}
Valeur trouvée: HKLM\Software\Mozilla\Firefox\Extensions|{6E19037A-12E3-4295-8915-ED48BC341614}
Valeur trouvée: HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser|{90B8B761-DF2B-48AC-BBE0-BCC03A819B3B}
============== SCAN ADDITIONNEL ==============
-- C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\FireFox\Profiles\vo8jbp6v.default --
Extensions\cacaoweb@cacaoweb.org (cacaoweb)
Extensions\{3112ca9c-de6d-4884-a869-9855de68056c} (Google Toolbar for Firefox)
Extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc} (?)
Extensions\{ef79f67a-6ad7-4715-a0f8-932fca442023} (BittorrentBar_FR Community Toolbar)
User.js - keyword.URL, hxxp://redirecterror.sfr.fr/?q=
Prefs.js - browser.search.defaultenginename, Google
Prefs.js - browser.search.defaulturl, hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
Prefs.js - browser.search.selectedEngine, Google
Prefs.js - browser.startup.homepage_override.mstone, rv:1.9.0.8
-- C:\Documents and Settings\Patate-Boy\Application Data\Mozilla\FireFox\Profiles\kynrkty8.default --
Extensions\staged-xpis (?)
Extensions\{3112ca9c-de6d-4884-a869-9855de68056c} (?)
Prefs.js - browser.download.dir, C:\\Documents and Settings\\Patate-Boy\\Mes documents
Prefs.js - browser.search.defaultenginename, Google
Prefs.js - browser.search.defaulturl, hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
Prefs.js - browser.search.selectedEngine, Google
Prefs.js - browser.startup.homepage_override.mstone, rv:1.9.0.1
========================================
**** Internet Explorer Version [8.0.6001.18702] ****
HKCU_Main|Default_Page_URL - hxxp://81.29.214.174/Search.aspx
HKCU_Main|Default_Search_URL - hxxp://81.29.214.174/Search.aspx
HKCU_Main|Start Page - hxxp://www.google.fr/
HKLM_Main|Default_Page_URL - hxxp://go.microsoft.com/fwlink/?LinkId=69157
HKLM_Main|Default_Search_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM_Main|Search bar - hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=63&bd=PAVILION&pf=desktop
HKLM_Main|Search Page - hxxp://go.microsoft.com/fwlink/?LinkId=54896
HKLM_Main|Start Page - hxxp://www.bigseekpro.com/accmeware/{B1E7719A-8BE9-4E63-82DA-90509DAEDD75}
HKCU_URLSearchHooks|{ba14329e-9550-4989-b3f2-9732e92d17cc} (x)
HKCU_URLSearchHooks|{BC86E1AB-EDA5-4059-938F-CE307B0C6F0A} - "SearchHook Class" (C:\Program Files\DeviceVM\Browser Configuration Utility\AddressBarSearch.dll)
HKCU_SearchScopes\{18291348-B055-400E-8BCD-3B927FA9ED87} - "?" (hxxp://81.29.214.174/Search.aspx?ct=it&key={searchTerms}&ref=PGTB&cg=1423716fc35...)
HKCU_SearchScopes\{96bd48dd-741b-41ae-ac4a-aff96ba00f7e} - "Search" (hxxp://www.bigseekpro.com/search/browser/accmeware/{B1E7719A-8BE9-4E63-82DA-9050...)
HKCU_SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847} - "SweetIM Search" (hxxp://search.sweetim.com/search.asp?src=6&q={searchTerms})
HKLM_SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847} - "SweetIM Search" (hxxp://search.sweetim.com/search.asp?src=6&q={searchTerms})
HKCU_Toolbar\ShellBrowser|{C4069E3A-68F1-403E-B40E-20066696354B} (x)
HKCU_Toolbar\ShellBrowser|{90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} (x)
HKCU_Toolbar\WebBrowser|{A057A204-BACC-4D26-9990-79A187E2698E} (x)
HKCU_Toolbar\WebBrowser|{266FCDCA-7BB3-4DA7-B3BF-F845DEA2EBD6} (C:\Program Files\IsoBuster\tbIso0.dll) (x)
HKCU_Toolbar\WebBrowser|{EEE6C35B-6118-11DC-9C72-001320C79847} (x)
HKCU_Toolbar\WebBrowser|{CCC7A320-B3CA-4199-B1A6-9F516DD69829} (x)
HKLM_Toolbar|{266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} (C:\Program Files\IsoBuster\tbIso0.dll) (x)
HKLM_Toolbar|{CCC7A320-B3CA-4199-B1A6-9F516DD69829} (x)
HKLM_Toolbar|{c9a6357b-25cc-4bcf-96c1-78736985d412} (mscoree.dll) (x)
HKLM_ElevationPolicy\5eb3ef40-307d-42f9-96cf-1dc460d4bbf4 - C:\Program Files\Vuze_Remote\Vuze_RemoteToolbarHelper.exe (x)
HKLM_ElevationPolicy\{59C7FC09-1C83-4648-B3E6-003D2BBC7481} - C:\Program Files\MyWebSearch\bar\1.bin\m3impipe.exe (x)
HKLM_ElevationPolicy\{628F3201-34D0-49C0-BB9A-82A26AEFB291} - C:\Program Files\AccmeWare DB Toolbar\TbHelper2.exe (x)
HKLM_ElevationPolicy\{68AF847F-6E91-45dd-9B68-D6A12C30E5D7} - C:\WINDOWS\system32\f3PSSavr.scr (x)
HKLM_ElevationPolicy\{9170B96C-28D4-4626-8358-27E6CAEEF907} - C:\Program Files\MyWebSearch\bar\1.bin\m3SkPlay.exe (x)
HKLM_ElevationPolicy\{A6E2003F-95C5-4591-BA9A-0093080FDB5C} - C:\Program Files\Fichiers communs\Oberon Media\OberonBroker\1.0.0.63\OberonBroker.exe (?)
HKLM_ElevationPolicy\{B2321D2F-1154-4d97-AD3E-2FE0BAE2897B} - C:\Program Files\SFR\Kit\9launch.exe (SFR)
HKLM_ElevationPolicy\{D1A71FA0-FF48-48dd-9B6D-7A13A3E42127} - C:\Program Files\MyWebSearch\bar\1.bin\m3medint.exe (x)
HKLM_ElevationPolicy\{DDB1968E-EAD6-40fd-8DAE-FF14757F60C7} - C:\Program Files\MyWebSearch\bar\1.bin\m3SlSrch.exe (x)
HKLM_ElevationPolicy\{F138D901-86F0-4383-99B6-9CDD406036DA} - C:\Program Files\MyWebSearch\bar\1.bin\m3SrchMn.exe (x)
HKLM_Extensions\{3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEBF} - "SmartShopper - Compare product prices" (C:\Program Files\SmartShopper\Bin\2.5.0\SmrtShpr.dll,203)
HKLM_Extensions\{3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEC0} - "SmartShopper - Compare travel rates" (C:\Program Files\SmartShopper\Bin\2.5.0\SmrtShpr.dll,201)
HKLM_Extensions\{d9288080-1baa-4bc4-9cf8-a92d743db949} - "Run IMVU" (C:\Documents and Settings\HP_Administrateur\Application Data\IMVUClient\imvu.ico)
HKLM_Extensions\{DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - "?" (?)
HKLM_Extensions\{E2D4D26B-0180-43a4-B05F-462D6D54C789} - "Aide à la connexion" (C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\conn_support.ico)
HKLM_Extensions\{e2e2dd38-d088-4134-82b7-f2ba38496583} - "?" (?)
BHO\83CED28E-B96A-43FC-A276-2AD7A48EB6BE (?)
BHO\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - "AcroIEHlprObj Class" (C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll)
BHO\{0F6E720A-1A6B-40E1-A294-1D4D19F156C8} - "Objet d'aide à la navigation SFR" (C:\Program Files\SFR\Kit\SFRNavErrorHelper.dll)
BHO\{1d970ed5-3eda-438d-bffd-715931e2775b} - "SearchBar.InitToolbarBHO" (mscoree.dll) (x)
BHO\{266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} - "IsoBuster Toolbar" (C:\Program Files\IsoBuster\tbIso0.dll) (x)
BHO\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} (?)
BHO\{4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} (?)
BHO\{5C255C8A-E604-49b4-9D64-90988571CECB} (?)
BHO\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - "Search Helper" (C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll)
BHO\{9030D464-4C02-4ABF-8ECC-5164760863C6} (?)
BHO\{A057A204-BACC-4D26-9990-79A187E2698E} (?)
BHO\{A3BC75A2-1F87-4686-AA43-5347D756017C} (?)
BHO\{AA58ED58-01DD-4d91-8333-CF10577473F7} (?)
BHO\{C84D72FE-E17D-4195-BB24-76C02E2E7C4E} (?)
BHO\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} (?)
BHO\{EEE6C35C-6118-11DC-9C72-001320C79847} (?)
BHO\{ef79f67a-6ad7-4715-a0f8-932fca442023} (?)
========================================
C:\Program Files\Ad-Remover\Quarantine: 0 Fichier(s)
C:\Program Files\Ad-Remover\Backup: 1 Fichier(s)
C:\Ad-Report-SCAN[1].txt - 07/09/2011 18:13:20 (9211 Octet(s))
Fin à: 18:14:03, 07/09/2011
============== E.O.F ==============
Voila le rapport rogue killer:
RogueKiller V5.3.4 [30/08/2011] par Tigzy
contact sur https://www.luanagames.com/index.fr.html
mail: tigzyRK<at>gmail<dot>com
Remontees: https://www.luanagames.com/index.fr.html
Systeme d'exploitation: Windows XP (5.1.2600 Service Pack 3) 32 bits version
Demarrage : Mode normal
Utilisateur: HP_Administrateur [Droits d'admin]
Mode: Recherche -- Date : 07/09/2011 18:59:29
Processus malicieux: 2
[SUSP PATH] arservice.exe -- c:\windows\arservice.exe -> KILLED [TermProc]
[SUSP PATH] arpwrmsg.exe -- c:\windows\arpwrmsg.exe -> KILLED [TermProc]
Entrees de registre: 5
[SUSP PATH] {BB65B0FB-5712-401b-B616-E69AC55E2757}.job : C:\DOCUME~1\PATATE~1\LOCALS~1\Temp\a.exe -> FOUND
[SUSP PATH] {7B02EF0B-A410-4938-8480-9BA26420A627}.job : C:\WINDOWS\msa.exe -> FOUND
[SUSP PATH] IMVU.lnk : C:\Documents and Settings\HP_Administrateur\Application Data\IMVUClient\IMVUClient.exe -> FOUND
[SUSP PATH] Notification de cadeaux MSN.lnk : C:\Documents and Settings\HP_Administrateur\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe -> FOUND
[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
Fichiers / Dossiers particuliers:
Fichier HOSTS:
127.0.0.1 localhost
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
127.0.0.1 10sek.com
127.0.0.1 www.10sek.com
127.0.0.1 123topsearch.com
[...]
Termine : << RKreport[1].txt >>
RKreport[1].txt
RogueKiller V5.3.4 [30/08/2011] par Tigzy
contact sur https://www.luanagames.com/index.fr.html
mail: tigzyRK<at>gmail<dot>com
Remontees: https://www.luanagames.com/index.fr.html
Systeme d'exploitation: Windows XP (5.1.2600 Service Pack 3) 32 bits version
Demarrage : Mode normal
Utilisateur: HP_Administrateur [Droits d'admin]
Mode: Recherche -- Date : 07/09/2011 18:59:29
Processus malicieux: 2
[SUSP PATH] arservice.exe -- c:\windows\arservice.exe -> KILLED [TermProc]
[SUSP PATH] arpwrmsg.exe -- c:\windows\arpwrmsg.exe -> KILLED [TermProc]
Entrees de registre: 5
[SUSP PATH] {BB65B0FB-5712-401b-B616-E69AC55E2757}.job : C:\DOCUME~1\PATATE~1\LOCALS~1\Temp\a.exe -> FOUND
[SUSP PATH] {7B02EF0B-A410-4938-8480-9BA26420A627}.job : C:\WINDOWS\msa.exe -> FOUND
[SUSP PATH] IMVU.lnk : C:\Documents and Settings\HP_Administrateur\Application Data\IMVUClient\IMVUClient.exe -> FOUND
[SUSP PATH] Notification de cadeaux MSN.lnk : C:\Documents and Settings\HP_Administrateur\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe -> FOUND
[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
Fichiers / Dossiers particuliers:
Fichier HOSTS:
127.0.0.1 localhost
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
127.0.0.1 10sek.com
127.0.0.1 www.10sek.com
127.0.0.1 123topsearch.com
[...]
Termine : << RKreport[1].txt >>
RKreport[1].txt
Rapport de rogue killer :
RogueKiller V5.3.4 [30/08/2011] par Tigzy
contact sur https://www.luanagames.com/index.fr.html
mail: tigzyRK<at>gmail<dot>com
Remontees: https://www.luanagames.com/index.fr.html
Systeme d'exploitation: Windows XP (5.1.2600 Service Pack 3) 32 bits version
Demarrage : Mode normal
Utilisateur: HP_Administrateur [Droits d'admin]
Mode: Suppression -- Date : 07/09/2011 19:03:50
Processus malicieux: 0
Entrees de registre: 5
[SUSP PATH] {BB65B0FB-5712-401b-B616-E69AC55E2757}.job : C:\DOCUME~1\PATATE~1\LOCALS~1\Temp\a.exe -> DELETED
[SUSP PATH] {7B02EF0B-A410-4938-8480-9BA26420A627}.job : C:\WINDOWS\msa.exe -> DELETED
[SUSP PATH] IMVU.lnk : C:\Documents and Settings\HP_Administrateur\Application Data\IMVUClient\IMVUClient.exe -> DELETED
[SUSP PATH] Notification de cadeaux MSN.lnk : C:\Documents and Settings\HP_Administrateur\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe -> DELETED
[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)
Fichiers / Dossiers particuliers:
Fichier HOSTS:
127.0.0.1 localhost
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
127.0.0.1 10sek.com
127.0.0.1 www.10sek.com
127.0.0.1 123topsearch.com
[...]
Termine : << RKreport[2].txt >>
RKreport[1].txt ; RKreport[2].txt
RogueKiller V5.3.4 [30/08/2011] par Tigzy
contact sur https://www.luanagames.com/index.fr.html
mail: tigzyRK<at>gmail<dot>com
Remontees: https://www.luanagames.com/index.fr.html
Systeme d'exploitation: Windows XP (5.1.2600 Service Pack 3) 32 bits version
Demarrage : Mode normal
Utilisateur: HP_Administrateur [Droits d'admin]
Mode: Suppression -- Date : 07/09/2011 19:03:50
Processus malicieux: 0
Entrees de registre: 5
[SUSP PATH] {BB65B0FB-5712-401b-B616-E69AC55E2757}.job : C:\DOCUME~1\PATATE~1\LOCALS~1\Temp\a.exe -> DELETED
[SUSP PATH] {7B02EF0B-A410-4938-8480-9BA26420A627}.job : C:\WINDOWS\msa.exe -> DELETED
[SUSP PATH] IMVU.lnk : C:\Documents and Settings\HP_Administrateur\Application Data\IMVUClient\IMVUClient.exe -> DELETED
[SUSP PATH] Notification de cadeaux MSN.lnk : C:\Documents and Settings\HP_Administrateur\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe -> DELETED
[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)
Fichiers / Dossiers particuliers:
Fichier HOSTS:
127.0.0.1 localhost
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
127.0.0.1 10sek.com
127.0.0.1 www.10sek.com
127.0.0.1 123topsearch.com
[...]
Termine : << RKreport[2].txt >>
RKreport[1].txt ; RKreport[2].txt
Rapport de MBAM :
Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org
Version de la base de données: 7672
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
07/09/2011 19:29:31
mbam-log-2011-09-07 (19-29-31).txt
Type d'examen: Examen rapide
Elément(s) analysé(s): 220337
Temps écoulé: 9 minute(s), 20 seconde(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 1
Clé(s) du Registre infectée(s): 51
Valeur(s) du Registre infectée(s): 7
Elément(s) de données du Registre infecté(s): 2
Dossier(s) infecté(s): 27
Fichier(s) infecté(s): 54
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
c:\program files\relevantknowledge\rlls.dll (Adware.RelevantKnowledge) -> Delete on reboot.
Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\RelevantKnowledge (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\243B60DF-796C-409E-BE55-0AD5C9710BA4 (Adware.Platrium) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{2615F050-9C18-4267-B711-8E3687DC0145} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{5D2631E5-8696-7543-50B2-F674CD4308EB} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{CA295D63-514A-4ED0-9B5F-640890F2366B} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{B0E8C398-DABE-4CE1-B4D9-ED43B64923F5} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{CB0D9D8C-535E-4352-BA8F-65C3C8676612} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{08AA0598-6A23-4364-9BF4-6D5F57F42993} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{137E6E5E-A205-4657-A49F-1AB865787089} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{137E6E5E-A205-4657-A49F-1AB865787089} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{137E6E5E-A205-4657-A49F-1AB865787089} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{83CED28E-B96A-43FC-A276-2AD7A48EB6BE} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{83CED28E-B96A-43FC-A276-2AD7A48EB6BE} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CC3D8FE-F0E0-4DD1-A69A-8C56BCC7BEBF} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{3CC3D8FE-F0E0-4DD1-A69A-8C56BCC7BEBF} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CC3D8FE-F0E0-4DD1-A69A-8C56BCC7BEC0} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{3CC3D8FE-F0E0-4DD1-A69A-8C56BCC7BEC0} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59C7FC09-1C83-4648-B3E6-003D2BBC7481} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68AF847F-6E91-45dd-9B68-D6A12C30E5D7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170B96C-28D4-4626-8358-27E6CAEEF907} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D1A71FA0-FF48-48dd-9B6D-7A13A3E42127} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DDB1968E-EAD6-40fd-8DAE-FF14757F60C7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F138D901-86F0-4383-99B6-9CDD406036DA} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{25560540-9571-4D7B-9389-0F166788785A} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{98D9753D-D73B-42D5-8C85-4469CDA897AB} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9FF05104-B030-46FC-94B8-81276E4E27DF} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\glaide32 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\SmartShopper.HbAx (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\SmartShopper.HbAx.1 (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\SmartShopper.HbInfoBand (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\SmartShopper.HbInfoBand.1 (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\SmartShopper.IEButton (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\SmartShopper.IEButton.1 (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\SmartShopper.IEButtonA (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\SmartShopper.IEButtonA.1 (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\SmartShopper.IEButtonB (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\SmartShopper.IEButtonB.1 (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\SmartShopper.SmrtShprCtl (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\SmartShopper.SmrtShprCtl.1 (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\bc.DLL (Adware.Platrium) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\fcn (Rogue.Residue) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\SmartShopper (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\SmartShopper (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\xpreapp (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831} (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SmartShopper (Adware.SmartShopper) -> Quarantined and deleted successfully.
Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{3CC3D8FE-F0E0-4DD1-A69A-8C56BCC7BEBF} (Adware.SmartShopper) -> Value: {3CC3D8FE-F0E0-4DD1-A69A-8C56BCC7BEBF} -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{3CC3D8FE-F0E0-4DD1-A69A-8C56BCC7BEC0} (Adware.SmartShopper) -> Value: {3CC3D8FE-F0E0-4DD1-A69A-8C56BCC7BEC0} -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEC0} (Adware.SmartShopper) -> Value: {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEC0} -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEBF} (Adware.SmartShopper) -> Value: {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEBF} -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} (Adware.Zango) -> Value: {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} (Adware.Zango) -> Value: {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RList (Malware.Trace) -> Value: RList -> Quarantined and deleted successfully.
Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\BITS\ImagePath (Hijack.WindowsUpdates) -> Bad: (%fystemRoot%\system32\svchost.exe -k netsvcs) Good: (%SystemRoot%\System32\svchost.exe -k netsvcs) -> Delete on reboot.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\wuauserv\ImagePath (Hijack.WindowsUpdates) -> Bad: (%fystemroot%\system32\svchost.exe -k netsvcs) Good: (%SystemRoot%\System32\svchost.exe -k netsvcs) -> Delete on reboot.
Dossier(s) infecté(s):
c:\documents and settings\all users\application data\10692344 (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\documents and settings\patate-boy\application data\hotbar_icons (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\hp_administrateur\application data\smartshopper (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\hp_administrateur\application data\smartshopper\cs (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\hp_administrateur\application data\smartshopper\cs\db (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\hp_administrateur\application data\smartshopper\cs\dwld (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\hp_administrateur\application data\smartshopper\cs\report (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\hp_administrateur\application data\smartshopper\cs\res1 (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\patate-boy\application data\smartshopper (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\patate-boy\application data\smartshopper\cs (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\patate-boy\application data\smartshopper\cs\db (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\patate-boy\application data\smartshopper\cs\dwld (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\patate-boy\application data\smartshopper\cs\report (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\patate-boy\application data\smartshopper\cs\res1 (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\program files\relevantknowledge (Spyware.MarketScore) -> Delete on reboot.
c:\program files\relevantknowledge\components (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\program files\smartshopper (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\program files\smartshopper\Bin (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\program files\smartshopper\Bin\2.5.0 (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\program files\smartshopper\cs (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\program files\smartshopper\cs\antiphishing (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\all users\menu démarrer\programmes\relevantknowledge (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\documents and settings\all users\menu démarrer\programmes\smartshopper (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\Pin-pin\application data\EoRezo (Adware.EoRezo) -> Quarantined and deleted successfully.
c:\documents and settings\Pin-pin\application data\EoRezo\db (Adware.EoRezo) -> Quarantined and deleted successfully.
c:\documents and settings\Pin-pin\application data\EoRezo\eodesktop (Adware.EoRezo) -> Quarantined and deleted successfully.
c:\documents and settings\Pin-pin\application data\EoRezo\eoStats (Adware.EoRezo) -> Quarantined and deleted successfully.
Fichier(s) infecté(s):
c:\program files\relevantknowledge\rlls.dll (Adware.RelevantKnowledge) -> Delete on reboot.
c:\documents and settings\hp_administrateur\application data\wiaserva.log (Malware.Trace) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\i85o3wrf.exe.a_a (Trojan.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\drivers\glaide32.sys (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\patate-boy\application data\hotbar_icons\3bsoftware_icon_1.ico (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\hp_administrateur\application data\smartshopper\cs\Config.xml (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\hp_administrateur\application data\smartshopper\cs\db\Aliases.dbs (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\hp_administrateur\application data\smartshopper\cs\db\Sites.dbs (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\hp_administrateur\application data\smartshopper\cs\dwld\phishinglist.xip (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\hp_administrateur\application data\smartshopper\cs\dwld\whitelist.xip (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\hp_administrateur\application data\smartshopper\cs\report\aggr_storage.xml (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\hp_administrateur\application data\smartshopper\cs\report\send_storage.xml (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\hp_administrateur\application data\smartshopper\cs\res1\whitelist.dbs (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\patate-boy\application data\smartshopper\cs\Config.xml (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\patate-boy\application data\smartshopper\cs\db\Aliases.dbs (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\patate-boy\application data\smartshopper\cs\db\Sites.dbs (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\patate-boy\application data\smartshopper\cs\dwld\phishinglist.xip (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\patate-boy\application data\smartshopper\cs\dwld\whitelist.xip (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\patate-boy\application data\smartshopper\cs\report\aggr_storage.xml (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\patate-boy\application data\smartshopper\cs\report\send_storage.xml (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\patate-boy\application data\smartshopper\cs\res1\whitelist.dbs (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\program files\relevantknowledge\chrome.manifest (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\program files\relevantknowledge\install.rdf (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\program files\relevantknowledge\ncncf.dat (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\program files\relevantknowledge\nscf.dat (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\program files\relevantknowledge\rlls64.dll (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\program files\relevantknowledge\rloci.bin (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\program files\relevantknowledge\rlph.dll (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\program files\relevantknowledge\rlservice.exe (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\program files\relevantknowledge\rlvknlg.exe (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\program files\relevantknowledge\rlvknlg64.exe (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\program files\relevantknowledge\rlxf.dll (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\program files\relevantknowledge\components\rlxg.dll (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\program files\smartshopper\Uninst.exe (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\program files\smartshopper\cs\antiphishing\antiphishing.html (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\program files\smartshopper\cs\antiphishing\phishalert.gif (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\program files\smartshopper\cs\antiphishing\x.gif (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\program files\smartshopper\cs\antiphishing\xActive.gif (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\all users\menu démarrer\programmes\relevantknowledge\about relevantknowledge.lnk (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\documents and settings\all users\menu démarrer\programmes\relevantknowledge\privacy policy and user license agreement.lnk (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\documents and settings\all users\menu démarrer\programmes\relevantknowledge\Support.lnk (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\documents and settings\all users\menu démarrer\programmes\relevantknowledge\uninstall instructions.lnk (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\documents and settings\all users\menu démarrer\programmes\smartshopper\smartshopper - comapre product prices.lnk (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\all users\menu démarrer\programmes\smartshopper\smartshopper - compare travel rate.lnk (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\all users\menu démarrer\programmes\smartshopper\smartshopper help.lnk (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\all users\menu démarrer\programmes\smartshopper\uninstall smartshopper.lnk (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\Pin-pin\application data\EoRezo\cmhost.cyp (Adware.EoRezo) -> Quarantined and deleted successfully.
c:\documents and settings\Pin-pin\application data\EoRezo\confmedia.cyp (Adware.EoRezo) -> Quarantined and deleted successfully.
c:\documents and settings\Pin-pin\application data\EoRezo\host.cyp (Adware.EoRezo) -> Quarantined and deleted successfully.
c:\documents and settings\Pin-pin\application data\EoRezo\user.cyp (Adware.EoRezo) -> Quarantined and deleted successfully.
c:\documents and settings\Pin-pin\application data\EoRezo\db\cat.cyp (Adware.EoRezo) -> Quarantined and deleted successfully.
c:\documents and settings\Pin-pin\application data\EoRezo\eodesktop\config.xml (Adware.EoRezo) -> Quarantined and deleted successfully.
c:\documents and settings\Pin-pin\application data\EoRezo\eodesktop\eodesktop.html (Adware.EoRezo) -> Quarantined and deleted successfully.
c:\documents and settings\Pin-pin\application data\EoRezo\eodesktop\userconfig.xml (Adware.EoRezo) -> Quarantined and deleted successfully.
Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org
Version de la base de données: 7672
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
07/09/2011 19:29:31
mbam-log-2011-09-07 (19-29-31).txt
Type d'examen: Examen rapide
Elément(s) analysé(s): 220337
Temps écoulé: 9 minute(s), 20 seconde(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 1
Clé(s) du Registre infectée(s): 51
Valeur(s) du Registre infectée(s): 7
Elément(s) de données du Registre infecté(s): 2
Dossier(s) infecté(s): 27
Fichier(s) infecté(s): 54
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
c:\program files\relevantknowledge\rlls.dll (Adware.RelevantKnowledge) -> Delete on reboot.
Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\RelevantKnowledge (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\243B60DF-796C-409E-BE55-0AD5C9710BA4 (Adware.Platrium) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{2615F050-9C18-4267-B711-8E3687DC0145} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{5D2631E5-8696-7543-50B2-F674CD4308EB} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{CA295D63-514A-4ED0-9B5F-640890F2366B} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{B0E8C398-DABE-4CE1-B4D9-ED43B64923F5} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{CB0D9D8C-535E-4352-BA8F-65C3C8676612} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{08AA0598-6A23-4364-9BF4-6D5F57F42993} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{137E6E5E-A205-4657-A49F-1AB865787089} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{137E6E5E-A205-4657-A49F-1AB865787089} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{137E6E5E-A205-4657-A49F-1AB865787089} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{83CED28E-B96A-43FC-A276-2AD7A48EB6BE} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{83CED28E-B96A-43FC-A276-2AD7A48EB6BE} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CC3D8FE-F0E0-4DD1-A69A-8C56BCC7BEBF} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{3CC3D8FE-F0E0-4DD1-A69A-8C56BCC7BEBF} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CC3D8FE-F0E0-4DD1-A69A-8C56BCC7BEC0} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{3CC3D8FE-F0E0-4DD1-A69A-8C56BCC7BEC0} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59C7FC09-1C83-4648-B3E6-003D2BBC7481} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68AF847F-6E91-45dd-9B68-D6A12C30E5D7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170B96C-28D4-4626-8358-27E6CAEEF907} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D1A71FA0-FF48-48dd-9B6D-7A13A3E42127} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DDB1968E-EAD6-40fd-8DAE-FF14757F60C7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F138D901-86F0-4383-99B6-9CDD406036DA} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{25560540-9571-4D7B-9389-0F166788785A} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{98D9753D-D73B-42D5-8C85-4469CDA897AB} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9FF05104-B030-46FC-94B8-81276E4E27DF} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\glaide32 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\SmartShopper.HbAx (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\SmartShopper.HbAx.1 (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\SmartShopper.HbInfoBand (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\SmartShopper.HbInfoBand.1 (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\SmartShopper.IEButton (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\SmartShopper.IEButton.1 (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\SmartShopper.IEButtonA (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\SmartShopper.IEButtonA.1 (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\SmartShopper.IEButtonB (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\SmartShopper.IEButtonB.1 (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\SmartShopper.SmrtShprCtl (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\SmartShopper.SmrtShprCtl.1 (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\bc.DLL (Adware.Platrium) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\fcn (Rogue.Residue) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\SmartShopper (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\SmartShopper (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\xpreapp (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831} (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SmartShopper (Adware.SmartShopper) -> Quarantined and deleted successfully.
Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{3CC3D8FE-F0E0-4DD1-A69A-8C56BCC7BEBF} (Adware.SmartShopper) -> Value: {3CC3D8FE-F0E0-4DD1-A69A-8C56BCC7BEBF} -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{3CC3D8FE-F0E0-4DD1-A69A-8C56BCC7BEC0} (Adware.SmartShopper) -> Value: {3CC3D8FE-F0E0-4DD1-A69A-8C56BCC7BEC0} -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEC0} (Adware.SmartShopper) -> Value: {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEC0} -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEBF} (Adware.SmartShopper) -> Value: {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEBF} -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} (Adware.Zango) -> Value: {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} (Adware.Zango) -> Value: {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RList (Malware.Trace) -> Value: RList -> Quarantined and deleted successfully.
Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\BITS\ImagePath (Hijack.WindowsUpdates) -> Bad: (%fystemRoot%\system32\svchost.exe -k netsvcs) Good: (%SystemRoot%\System32\svchost.exe -k netsvcs) -> Delete on reboot.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\wuauserv\ImagePath (Hijack.WindowsUpdates) -> Bad: (%fystemroot%\system32\svchost.exe -k netsvcs) Good: (%SystemRoot%\System32\svchost.exe -k netsvcs) -> Delete on reboot.
Dossier(s) infecté(s):
c:\documents and settings\all users\application data\10692344 (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\documents and settings\patate-boy\application data\hotbar_icons (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\hp_administrateur\application data\smartshopper (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\hp_administrateur\application data\smartshopper\cs (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\hp_administrateur\application data\smartshopper\cs\db (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\hp_administrateur\application data\smartshopper\cs\dwld (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\hp_administrateur\application data\smartshopper\cs\report (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\hp_administrateur\application data\smartshopper\cs\res1 (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\patate-boy\application data\smartshopper (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\patate-boy\application data\smartshopper\cs (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\patate-boy\application data\smartshopper\cs\db (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\patate-boy\application data\smartshopper\cs\dwld (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\patate-boy\application data\smartshopper\cs\report (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\patate-boy\application data\smartshopper\cs\res1 (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\program files\relevantknowledge (Spyware.MarketScore) -> Delete on reboot.
c:\program files\relevantknowledge\components (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\program files\smartshopper (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\program files\smartshopper\Bin (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\program files\smartshopper\Bin\2.5.0 (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\program files\smartshopper\cs (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\program files\smartshopper\cs\antiphishing (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\all users\menu démarrer\programmes\relevantknowledge (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\documents and settings\all users\menu démarrer\programmes\smartshopper (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\Pin-pin\application data\EoRezo (Adware.EoRezo) -> Quarantined and deleted successfully.
c:\documents and settings\Pin-pin\application data\EoRezo\db (Adware.EoRezo) -> Quarantined and deleted successfully.
c:\documents and settings\Pin-pin\application data\EoRezo\eodesktop (Adware.EoRezo) -> Quarantined and deleted successfully.
c:\documents and settings\Pin-pin\application data\EoRezo\eoStats (Adware.EoRezo) -> Quarantined and deleted successfully.
Fichier(s) infecté(s):
c:\program files\relevantknowledge\rlls.dll (Adware.RelevantKnowledge) -> Delete on reboot.
c:\documents and settings\hp_administrateur\application data\wiaserva.log (Malware.Trace) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\i85o3wrf.exe.a_a (Trojan.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\drivers\glaide32.sys (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\patate-boy\application data\hotbar_icons\3bsoftware_icon_1.ico (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\hp_administrateur\application data\smartshopper\cs\Config.xml (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\hp_administrateur\application data\smartshopper\cs\db\Aliases.dbs (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\hp_administrateur\application data\smartshopper\cs\db\Sites.dbs (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\hp_administrateur\application data\smartshopper\cs\dwld\phishinglist.xip (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\hp_administrateur\application data\smartshopper\cs\dwld\whitelist.xip (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\hp_administrateur\application data\smartshopper\cs\report\aggr_storage.xml (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\hp_administrateur\application data\smartshopper\cs\report\send_storage.xml (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\hp_administrateur\application data\smartshopper\cs\res1\whitelist.dbs (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\patate-boy\application data\smartshopper\cs\Config.xml (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\patate-boy\application data\smartshopper\cs\db\Aliases.dbs (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\patate-boy\application data\smartshopper\cs\db\Sites.dbs (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\patate-boy\application data\smartshopper\cs\dwld\phishinglist.xip (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\patate-boy\application data\smartshopper\cs\dwld\whitelist.xip (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\patate-boy\application data\smartshopper\cs\report\aggr_storage.xml (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\patate-boy\application data\smartshopper\cs\report\send_storage.xml (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\patate-boy\application data\smartshopper\cs\res1\whitelist.dbs (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\program files\relevantknowledge\chrome.manifest (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\program files\relevantknowledge\install.rdf (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\program files\relevantknowledge\ncncf.dat (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\program files\relevantknowledge\nscf.dat (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\program files\relevantknowledge\rlls64.dll (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\program files\relevantknowledge\rloci.bin (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\program files\relevantknowledge\rlph.dll (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\program files\relevantknowledge\rlservice.exe (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\program files\relevantknowledge\rlvknlg.exe (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\program files\relevantknowledge\rlvknlg64.exe (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\program files\relevantknowledge\rlxf.dll (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\program files\relevantknowledge\components\rlxg.dll (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\program files\smartshopper\Uninst.exe (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\program files\smartshopper\cs\antiphishing\antiphishing.html (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\program files\smartshopper\cs\antiphishing\phishalert.gif (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\program files\smartshopper\cs\antiphishing\x.gif (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\program files\smartshopper\cs\antiphishing\xActive.gif (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\all users\menu démarrer\programmes\relevantknowledge\about relevantknowledge.lnk (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\documents and settings\all users\menu démarrer\programmes\relevantknowledge\privacy policy and user license agreement.lnk (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\documents and settings\all users\menu démarrer\programmes\relevantknowledge\Support.lnk (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\documents and settings\all users\menu démarrer\programmes\relevantknowledge\uninstall instructions.lnk (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\documents and settings\all users\menu démarrer\programmes\smartshopper\smartshopper - comapre product prices.lnk (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\all users\menu démarrer\programmes\smartshopper\smartshopper - compare travel rate.lnk (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\all users\menu démarrer\programmes\smartshopper\smartshopper help.lnk (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\all users\menu démarrer\programmes\smartshopper\uninstall smartshopper.lnk (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\Pin-pin\application data\EoRezo\cmhost.cyp (Adware.EoRezo) -> Quarantined and deleted successfully.
c:\documents and settings\Pin-pin\application data\EoRezo\confmedia.cyp (Adware.EoRezo) -> Quarantined and deleted successfully.
c:\documents and settings\Pin-pin\application data\EoRezo\host.cyp (Adware.EoRezo) -> Quarantined and deleted successfully.
c:\documents and settings\Pin-pin\application data\EoRezo\user.cyp (Adware.EoRezo) -> Quarantined and deleted successfully.
c:\documents and settings\Pin-pin\application data\EoRezo\db\cat.cyp (Adware.EoRezo) -> Quarantined and deleted successfully.
c:\documents and settings\Pin-pin\application data\EoRezo\eodesktop\config.xml (Adware.EoRezo) -> Quarantined and deleted successfully.
c:\documents and settings\Pin-pin\application data\EoRezo\eodesktop\eodesktop.html (Adware.EoRezo) -> Quarantined and deleted successfully.
c:\documents and settings\Pin-pin\application data\EoRezo\eodesktop\userconfig.xml (Adware.EoRezo) -> Quarantined and deleted successfully.
Arf, tu n'avais pas passé le mode suppression d'Ad-Remover comme demandé, d'où le long rapport ^^ Passe le quand même voir si il restait des trucs.
Ensuite refait moi un ZHPDiag stp (et héberge le)
Ensuite refait moi un ZHPDiag stp (et héberge le)
Le rapport de nettoyage d'ad-remover:
======= RAPPORT D'AD-REMOVER 2.0.0.2,G | UNIQUEMENT XP/VISTA/7 =======
Mis à jour par TeamXscript le 12/04/11
Contact: AdRemover[DOT]contact[AT]gmail[DOT]com
Site web: http://www.teamxscript.org
C:\Program Files\Ad-Remover\main.exe (CLEAN [1]) -> Lancé à 20:15:36 le 07/09/2011, Mode normal
Microsoft Windows XP Professionnel Service Pack 3 (X86)
HP_Administrateur@PINPINLELAPIN ( )
============== ACTION(S) ==============
Dossier supprimé: C:\WINDOWS\Eurobarre
Dossier supprimé: C:\Program Files\GamesBar
Dossier supprimé: C:\Documents and Settings\HP_Administrateur\Application Data\Toolbar4
Dossier supprimé: C:\Documents and Settings\HP_Administrateur\Application Data\ItsLabel
Dossier supprimé: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\ItsLabel
Fichier supprimé: C:\Program Files\Windows Live\Messenger\Riched20.dll
Fichier supprimé: C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\ukais_nav.dat
(!) -- Fichiers temporaires supprimés.
Clé supprimée: HKLM\Software\Classes\Interface\{C7F127DF-8877-4E1E-A196-FBBECBC5BC6D}
Clé supprimée: HKLM\Software\Classes\SearchBar.InitToolbarBHO
Clé supprimée: HKLM\Software\Classes\SearchBar.InstallerClass
Clé supprimée: HKLM\Software\Classes\SearchBar.Toolbar
Clé supprimée: HKLM\Software\Classes\Toolbar.CT2504091
Clé supprimée: HKLM\Software\Classes\Toolbar.CT2849852
Clé supprimée: HKLM\Software\GamesBarSetup
Clé supprimée: HKLM\Software\PopCap
Clé supprimée: HKCU\Software\Lanconfig
Clé supprimée: HKCU\Software\PopCap
Clé supprimée: HKU\.DEFAULT\Software\Conduit
Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\ItsLabel
Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{5549C19D-46FE-4975-AD54-5B37E87FF6E2}
Valeur supprimée: HKLM\Software\Mozilla\Firefox\Extensions|{6E19037A-12E3-4295-8915-ED48BC341614}
============== SCAN ADDITIONNEL ==============
-- C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\FireFox\Profiles\vo8jbp6v.default --
Extensions\cacaoweb@cacaoweb.org (cacaoweb)
Extensions\{3112ca9c-de6d-4884-a869-9855de68056c} (Google Toolbar for Firefox)
Extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc} (?)
Extensions\{ef79f67a-6ad7-4715-a0f8-932fca442023} (BittorrentBar_FR Community Toolbar)
User.js - keyword.URL, hxxp://redirecterror.sfr.fr/?q=
Prefs.js - browser.search.defaultenginename, Google
Prefs.js - browser.search.defaulturl, hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
Prefs.js - browser.search.selectedEngine, Google
Prefs.js - browser.startup.homepage_override.mstone, rv:1.9.0.8
-- C:\Documents and Settings\Patate-Boy\Application Data\Mozilla\FireFox\Profiles\kynrkty8.default --
Extensions\staged-xpis (?)
Extensions\{3112ca9c-de6d-4884-a869-9855de68056c} (?)
Prefs.js - browser.download.dir, C:\\Documents and Settings\\Patate-Boy\\Mes documents
Prefs.js - browser.search.defaultenginename, Google
Prefs.js - browser.search.defaulturl, hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
Prefs.js - browser.search.selectedEngine, Google
Prefs.js - browser.startup.homepage_override.mstone, rv:1.9.0.1
========================================
**** Internet Explorer Version [8.0.6001.18702] ****
HKCU_Main|Default_Page_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKCU_Main|Default_Search_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU_Main|Search bar - hxxp://go.microsoft.com/fwlink/?linkid=54896
HKCU_Main|Start Page - hxxp://fr.msn.com/
HKLM_Main|Default_Page_URL - hxxp://go.microsoft.com/fwlink/?LinkId=54896
HKLM_Main|Default_Search_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM_Main|Search bar - hxxp://search.msn.com/spbasic.htm
HKLM_Main|Search Page - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM_Main|Start Page - hxxp://fr.msn.com/
HKCU_URLSearchHooks|{ba14329e-9550-4989-b3f2-9732e92d17cc} (x)
HKCU_URLSearchHooks|{BC86E1AB-EDA5-4059-938F-CE307B0C6F0A} - "SearchHook Class" (C:\Program Files\DeviceVM\Browser Configuration Utility\AddressBarSearch.dll)
HKCU_SearchScopes\{18291348-B055-400E-8BCD-3B927FA9ED87} - "?" (hxxp://81.29.214.174/Search.aspx?ct=it&key={searchTerms}&ref=PGTB&cg=1423716fc35...)
HKCU_SearchScopes\{96bd48dd-741b-41ae-ac4a-aff96ba00f7e} - "Search" (hxxp://www.bigseekpro.com/search/browser/accmeware/{B1E7719A-8BE9-4E63-82DA-9050...)
HKCU_SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847} - "SweetIM Search" (hxxp://search.sweetim.com/search.asp?src=6&q={searchTerms})
HKLM_SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847} - "SweetIM Search" (hxxp://search.sweetim.com/search.asp?src=6&q={searchTerms})
HKCU_Toolbar\ShellBrowser|{C4069E3A-68F1-403E-B40E-20066696354B} (x)
HKCU_Toolbar\WebBrowser|{A057A204-BACC-4D26-9990-79A187E2698E} (x)
HKCU_Toolbar\WebBrowser|{266FCDCA-7BB3-4DA7-B3BF-F845DEA2EBD6} (C:\Program Files\IsoBuster\tbIso0.dll) (x)
HKCU_Toolbar\WebBrowser|{EEE6C35B-6118-11DC-9C72-001320C79847} (x)
HKCU_Toolbar\WebBrowser|{CCC7A320-B3CA-4199-B1A6-9F516DD69829} (x)
HKLM_Toolbar|{266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} (C:\Program Files\IsoBuster\tbIso0.dll) (x)
HKLM_Toolbar|{CCC7A320-B3CA-4199-B1A6-9F516DD69829} (x)
HKLM_Toolbar|{c9a6357b-25cc-4bcf-96c1-78736985d412} (mscoree.dll) (x)
HKLM_ElevationPolicy\5eb3ef40-307d-42f9-96cf-1dc460d4bbf4 - C:\Program Files\Vuze_Remote\Vuze_RemoteToolbarHelper.exe (x)
HKLM_ElevationPolicy\{628F3201-34D0-49C0-BB9A-82A26AEFB291} - C:\Program Files\AccmeWare DB Toolbar\TbHelper2.exe (x)
HKLM_ElevationPolicy\{A6E2003F-95C5-4591-BA9A-0093080FDB5C} - C:\Program Files\Fichiers communs\Oberon Media\OberonBroker\1.0.0.63\OberonBroker.exe (?)
HKLM_ElevationPolicy\{B2321D2F-1154-4d97-AD3E-2FE0BAE2897B} - C:\Program Files\SFR\Kit\9launch.exe (SFR)
HKLM_Extensions\{d9288080-1baa-4bc4-9cf8-a92d743db949} - "Run IMVU" (C:\Documents and Settings\HP_Administrateur\Application Data\IMVUClient\imvu.ico)
HKLM_Extensions\{DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - "?" (?)
HKLM_Extensions\{E2D4D26B-0180-43a4-B05F-462D6D54C789} - "Aide à la connexion" (C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\conn_support.ico)
HKLM_Extensions\{e2e2dd38-d088-4134-82b7-f2ba38496583} - "?" (?)
BHO\83CED28E-B96A-43FC-A276-2AD7A48EB6BE (?)
BHO\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - "AcroIEHlprObj Class" (C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll)
BHO\{0F6E720A-1A6B-40E1-A294-1D4D19F156C8} - "Objet d'aide à la navigation SFR" (C:\Program Files\SFR\Kit\SFRNavErrorHelper.dll)
BHO\{1d970ed5-3eda-438d-bffd-715931e2775b} - "SearchBar.InitToolbarBHO" (mscoree.dll) (x)
BHO\{266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} - "IsoBuster Toolbar" (C:\Program Files\IsoBuster\tbIso0.dll) (x)
BHO\{30F9B915-B755-4826-820B-08FBA6BD249D} (?)
BHO\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} (?)
BHO\{4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} (?)
BHO\{5C255C8A-E604-49b4-9D64-90988571CECB} (?)
BHO\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - "Search Helper" (C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll)
BHO\{9030D464-4C02-4ABF-8ECC-5164760863C6} (?)
BHO\{A057A204-BACC-4D26-9990-79A187E2698E} (?)
BHO\{A3BC75A2-1F87-4686-AA43-5347D756017C} (?)
BHO\{AA58ED58-01DD-4d91-8333-CF10577473F7} (?)
BHO\{C84D72FE-E17D-4195-BB24-76C02E2E7C4E} (?)
BHO\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} (?)
BHO\{EEE6C35C-6118-11DC-9C72-001320C79847} (?)
BHO\{ef79f67a-6ad7-4715-a0f8-932fca442023} (?)
========================================
C:\Program Files\Ad-Remover\Quarantine: 6 Fichier(s)
C:\Program Files\Ad-Remover\Backup: 15 Fichier(s)
C:\Ad-Report-CLEAN[1].txt - 07/09/2011 20:15:43 (1935 Octet(s))
C:\Ad-Report-SCAN[1].txt - 07/09/2011 18:13:20 (11468 Octet(s))
C:\Ad-Report-SCAN[2].txt - 07/09/2011 20:14:43 (7880 Octet(s))
Fin à: 20:16:33, 07/09/2011
============== E.O.F ==============
Le ZHPdiag arrive dans 5 minutes. En tout cas Rlvknlg a disparu de mon gestionnaire de taches. =)
======= RAPPORT D'AD-REMOVER 2.0.0.2,G | UNIQUEMENT XP/VISTA/7 =======
Mis à jour par TeamXscript le 12/04/11
Contact: AdRemover[DOT]contact[AT]gmail[DOT]com
Site web: http://www.teamxscript.org
C:\Program Files\Ad-Remover\main.exe (CLEAN [1]) -> Lancé à 20:15:36 le 07/09/2011, Mode normal
Microsoft Windows XP Professionnel Service Pack 3 (X86)
HP_Administrateur@PINPINLELAPIN ( )
============== ACTION(S) ==============
Dossier supprimé: C:\WINDOWS\Eurobarre
Dossier supprimé: C:\Program Files\GamesBar
Dossier supprimé: C:\Documents and Settings\HP_Administrateur\Application Data\Toolbar4
Dossier supprimé: C:\Documents and Settings\HP_Administrateur\Application Data\ItsLabel
Dossier supprimé: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\ItsLabel
Fichier supprimé: C:\Program Files\Windows Live\Messenger\Riched20.dll
Fichier supprimé: C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\ukais_nav.dat
(!) -- Fichiers temporaires supprimés.
Clé supprimée: HKLM\Software\Classes\Interface\{C7F127DF-8877-4E1E-A196-FBBECBC5BC6D}
Clé supprimée: HKLM\Software\Classes\SearchBar.InitToolbarBHO
Clé supprimée: HKLM\Software\Classes\SearchBar.InstallerClass
Clé supprimée: HKLM\Software\Classes\SearchBar.Toolbar
Clé supprimée: HKLM\Software\Classes\Toolbar.CT2504091
Clé supprimée: HKLM\Software\Classes\Toolbar.CT2849852
Clé supprimée: HKLM\Software\GamesBarSetup
Clé supprimée: HKLM\Software\PopCap
Clé supprimée: HKCU\Software\Lanconfig
Clé supprimée: HKCU\Software\PopCap
Clé supprimée: HKU\.DEFAULT\Software\Conduit
Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\ItsLabel
Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{5549C19D-46FE-4975-AD54-5B37E87FF6E2}
Valeur supprimée: HKLM\Software\Mozilla\Firefox\Extensions|{6E19037A-12E3-4295-8915-ED48BC341614}
============== SCAN ADDITIONNEL ==============
-- C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\FireFox\Profiles\vo8jbp6v.default --
Extensions\cacaoweb@cacaoweb.org (cacaoweb)
Extensions\{3112ca9c-de6d-4884-a869-9855de68056c} (Google Toolbar for Firefox)
Extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc} (?)
Extensions\{ef79f67a-6ad7-4715-a0f8-932fca442023} (BittorrentBar_FR Community Toolbar)
User.js - keyword.URL, hxxp://redirecterror.sfr.fr/?q=
Prefs.js - browser.search.defaultenginename, Google
Prefs.js - browser.search.defaulturl, hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
Prefs.js - browser.search.selectedEngine, Google
Prefs.js - browser.startup.homepage_override.mstone, rv:1.9.0.8
-- C:\Documents and Settings\Patate-Boy\Application Data\Mozilla\FireFox\Profiles\kynrkty8.default --
Extensions\staged-xpis (?)
Extensions\{3112ca9c-de6d-4884-a869-9855de68056c} (?)
Prefs.js - browser.download.dir, C:\\Documents and Settings\\Patate-Boy\\Mes documents
Prefs.js - browser.search.defaultenginename, Google
Prefs.js - browser.search.defaulturl, hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
Prefs.js - browser.search.selectedEngine, Google
Prefs.js - browser.startup.homepage_override.mstone, rv:1.9.0.1
========================================
**** Internet Explorer Version [8.0.6001.18702] ****
HKCU_Main|Default_Page_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKCU_Main|Default_Search_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU_Main|Search bar - hxxp://go.microsoft.com/fwlink/?linkid=54896
HKCU_Main|Start Page - hxxp://fr.msn.com/
HKLM_Main|Default_Page_URL - hxxp://go.microsoft.com/fwlink/?LinkId=54896
HKLM_Main|Default_Search_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM_Main|Search bar - hxxp://search.msn.com/spbasic.htm
HKLM_Main|Search Page - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM_Main|Start Page - hxxp://fr.msn.com/
HKCU_URLSearchHooks|{ba14329e-9550-4989-b3f2-9732e92d17cc} (x)
HKCU_URLSearchHooks|{BC86E1AB-EDA5-4059-938F-CE307B0C6F0A} - "SearchHook Class" (C:\Program Files\DeviceVM\Browser Configuration Utility\AddressBarSearch.dll)
HKCU_SearchScopes\{18291348-B055-400E-8BCD-3B927FA9ED87} - "?" (hxxp://81.29.214.174/Search.aspx?ct=it&key={searchTerms}&ref=PGTB&cg=1423716fc35...)
HKCU_SearchScopes\{96bd48dd-741b-41ae-ac4a-aff96ba00f7e} - "Search" (hxxp://www.bigseekpro.com/search/browser/accmeware/{B1E7719A-8BE9-4E63-82DA-9050...)
HKCU_SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847} - "SweetIM Search" (hxxp://search.sweetim.com/search.asp?src=6&q={searchTerms})
HKLM_SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847} - "SweetIM Search" (hxxp://search.sweetim.com/search.asp?src=6&q={searchTerms})
HKCU_Toolbar\ShellBrowser|{C4069E3A-68F1-403E-B40E-20066696354B} (x)
HKCU_Toolbar\WebBrowser|{A057A204-BACC-4D26-9990-79A187E2698E} (x)
HKCU_Toolbar\WebBrowser|{266FCDCA-7BB3-4DA7-B3BF-F845DEA2EBD6} (C:\Program Files\IsoBuster\tbIso0.dll) (x)
HKCU_Toolbar\WebBrowser|{EEE6C35B-6118-11DC-9C72-001320C79847} (x)
HKCU_Toolbar\WebBrowser|{CCC7A320-B3CA-4199-B1A6-9F516DD69829} (x)
HKLM_Toolbar|{266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} (C:\Program Files\IsoBuster\tbIso0.dll) (x)
HKLM_Toolbar|{CCC7A320-B3CA-4199-B1A6-9F516DD69829} (x)
HKLM_Toolbar|{c9a6357b-25cc-4bcf-96c1-78736985d412} (mscoree.dll) (x)
HKLM_ElevationPolicy\5eb3ef40-307d-42f9-96cf-1dc460d4bbf4 - C:\Program Files\Vuze_Remote\Vuze_RemoteToolbarHelper.exe (x)
HKLM_ElevationPolicy\{628F3201-34D0-49C0-BB9A-82A26AEFB291} - C:\Program Files\AccmeWare DB Toolbar\TbHelper2.exe (x)
HKLM_ElevationPolicy\{A6E2003F-95C5-4591-BA9A-0093080FDB5C} - C:\Program Files\Fichiers communs\Oberon Media\OberonBroker\1.0.0.63\OberonBroker.exe (?)
HKLM_ElevationPolicy\{B2321D2F-1154-4d97-AD3E-2FE0BAE2897B} - C:\Program Files\SFR\Kit\9launch.exe (SFR)
HKLM_Extensions\{d9288080-1baa-4bc4-9cf8-a92d743db949} - "Run IMVU" (C:\Documents and Settings\HP_Administrateur\Application Data\IMVUClient\imvu.ico)
HKLM_Extensions\{DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - "?" (?)
HKLM_Extensions\{E2D4D26B-0180-43a4-B05F-462D6D54C789} - "Aide à la connexion" (C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\conn_support.ico)
HKLM_Extensions\{e2e2dd38-d088-4134-82b7-f2ba38496583} - "?" (?)
BHO\83CED28E-B96A-43FC-A276-2AD7A48EB6BE (?)
BHO\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - "AcroIEHlprObj Class" (C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll)
BHO\{0F6E720A-1A6B-40E1-A294-1D4D19F156C8} - "Objet d'aide à la navigation SFR" (C:\Program Files\SFR\Kit\SFRNavErrorHelper.dll)
BHO\{1d970ed5-3eda-438d-bffd-715931e2775b} - "SearchBar.InitToolbarBHO" (mscoree.dll) (x)
BHO\{266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} - "IsoBuster Toolbar" (C:\Program Files\IsoBuster\tbIso0.dll) (x)
BHO\{30F9B915-B755-4826-820B-08FBA6BD249D} (?)
BHO\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} (?)
BHO\{4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} (?)
BHO\{5C255C8A-E604-49b4-9D64-90988571CECB} (?)
BHO\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - "Search Helper" (C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll)
BHO\{9030D464-4C02-4ABF-8ECC-5164760863C6} (?)
BHO\{A057A204-BACC-4D26-9990-79A187E2698E} (?)
BHO\{A3BC75A2-1F87-4686-AA43-5347D756017C} (?)
BHO\{AA58ED58-01DD-4d91-8333-CF10577473F7} (?)
BHO\{C84D72FE-E17D-4195-BB24-76C02E2E7C4E} (?)
BHO\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} (?)
BHO\{EEE6C35C-6118-11DC-9C72-001320C79847} (?)
BHO\{ef79f67a-6ad7-4715-a0f8-932fca442023} (?)
========================================
C:\Program Files\Ad-Remover\Quarantine: 6 Fichier(s)
C:\Program Files\Ad-Remover\Backup: 15 Fichier(s)
C:\Ad-Report-CLEAN[1].txt - 07/09/2011 20:15:43 (1935 Octet(s))
C:\Ad-Report-SCAN[1].txt - 07/09/2011 18:13:20 (11468 Octet(s))
C:\Ad-Report-SCAN[2].txt - 07/09/2011 20:14:43 (7880 Octet(s))
Fin à: 20:16:33, 07/09/2011
============== E.O.F ==============
Le ZHPdiag arrive dans 5 minutes. En tout cas Rlvknlg a disparu de mon gestionnaire de taches. =)
Voila le ZHPdiag :
https://pjjoint.malekal.com/files.php?id=ZHPDiag_c10h10h12f10l10c15o11n15t7r12k12l12v12o7i11s15y15e10t66
En tout cas merci bien pour ton aide ;)
https://pjjoint.malekal.com/files.php?id=ZHPDiag_c10h10h12f10l10c15o11n15t7r12k12l12v12o7i11s15y15e10t66
En tout cas merci bien pour ton aide ;)
Yop c'est pas fini :)
--------------------------------------------------------------------------------------
* Télécharge UsbFix (créé par El Desaparecido & C_XX) sur ton Bureau. Si ton antivirus affiche une alerte, ignore le et désactive le temporairement.
* Branche tes sources de données externes à ton PC (clé USB, disque dur externe, etc...) sans les ouvrir
* Double clique sur le raccourci UsbFix sur ton Bureau, l'installation se fera automatiquement
* Clique sur "Recherche"
* Laisse travailler l'outil
* A la fin, le rapport va s'afficher : poste le dans ta prochaine réponse (il est aussi sauvegardé a la racine du disque dur)
Aide en images : Tutoriel "Recherche"
--------------------------------------------------------------------------------------
* Lance ZHPFix (si tu es sous Windows Vista ou Windows 7, lance le par un clic-droit dessus --> exécuter en temps qu'administrateur).
* Copie les lignes suivantes :
---------------------------------------------------
M2 - MFEP: prefs.js [HP_Administrateur - vo8jbp6v.default\cacaoweb@cacaoweb.org] [] cacaoweb v1.0.17 (.http://www.cacaoweb.org/
M2 - MFEP: prefs.js [HP_Administrateur - vo8jbp6v.default\{ef79f67a-6ad7-4715-a0f8-932fca442023}] [] BittorrentBar_FR Community Toolbar v3.2.5.2 (.Conduit Ltd..)
R3 - URLSearchHook: (no name) - {ba14329e-9550-4989-b3f2-9732e92d17cc} . (...) (No version) -- (.not file.)
O2 - BHO: (no name) - 83CED28E-B96A-43FC-A276-2AD7A48EB6BE Clé orpheline
O2 - BHO: (no name) - {30F9B915-B755-4826-820B-08FBA6BD249D} Clé orpheline
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} Clé orpheline
O2 - BHO: (no name) - {9030D464-4C02-4ABF-8ECC-5164760863C6} Clé orpheline
O2 - BHO: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} Clé orpheline
O2 - BHO: (no name) - {A3BC75A2-1F87-4686-AA43-5347D756017C} Clé orpheline
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} Clé orpheline
O2 - BHO: (no name) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} Clé orpheline
O2 - BHO: (no name) - {EEE6C35C-6118-11DC-9C72-001320C79847} Clé orpheline
O2 - BHO: (no name) - {ef79f67a-6ad7-4715-a0f8-932fca442023} Clé orpheline
O3 - Toolbar: IsoBuster Toolbar - {266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} . (...) -- C:\Program Files\IsoBuster\tbIso0.dll
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} . (...) -- (.not file.)
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} . (...) -- (.not file.)
O4 - HKLM\..\Run: [PCDrProfiler] Clé orpheline
O4 - HKLM\..\Run: [NPSStartup] Clé orpheline
O4 - HKLM\..\Run: [DriverCD] E:\Run.exe (.not file.)
O4 - HKLM\..\Run: [KernelFaultCheck] Clé orpheline
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} -- C:\Documents and Settings\HP_Administrateur\Application Data\IMVUClient\imvu.ico (.not file.)
O15 - Trusted Zone: [HKLM\...\Domains] *.antimalwareguard.com
O23 - Service: (BITS) - Clé orpheline
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At1.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At10.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At11.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At12.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At13.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At14.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At15.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At16.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At17.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At18.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At19.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At2.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At20.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At21.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At22.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At23.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At24.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At25.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At26.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At27.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At28.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At29.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At3.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At30.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At31.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At32.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At33.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At34.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At35.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At36.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At37.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At38.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At39.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At4.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At40.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At41.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At42.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At43.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At44.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At45.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At46.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At47.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At48.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At5.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At6.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At7.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At8.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At9.job
[MD5.00000000000000000000000000000000] [APT] [At1] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At10] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At11] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At12] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At13] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At14] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At15] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At16] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At17] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At18] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At19] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At2] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At20] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At21] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At22] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At23] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At24] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At25] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At26] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At27] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At28] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At29] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At3] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At30] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At31] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At32] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At33] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At34] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At35] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At36] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At37] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At38] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At39] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At4] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At40] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At41] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At42] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At43] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At44] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At45] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At46] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At47] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At48] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At5] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At6] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At7] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At8] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At9] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
O41 - Driver: (aswSnx) . (. - .) - aswSnx.sys (.not file.)
O42 - Logiciel: SearchToolbar - (.Pas de propriétaire.) [HKLM] -- SearchToolbar
[HKCU\Software\BittorrentBar_FR]
[HKCU\Software\SweetIM]
[HKCU\Software\cacaoweb]
[HKLM\Software\supersexplayer]
O43 - CFD: 24/12/2009 - 14:11:24 - [400624] ----D- C:\Program Files\cacaoweb
O43 - CFD: 04/01/2009 - 17:35:30 - [3639313] ----D- C:\Program Files\SweetIM
O43 - CFD: 07/09/2011 - 13:06:24 - [331373255] ----D- C:\Documents and Settings\HP_Administrateur\Application Data\cacaoweb
O67 - Shell Spawning: <.html> <htmlfile>[HKCU\..\open\Command] (.Not Key.)
O67 - Shell Spawning: <.com> <>[HKU\..\open\Command] (.Not Key.)
O67 - Shell Spawning: <.exe> <>[HKU\..\open\Command] (.Not Key.)
---------------------------------------------------
* Clique sur l'icône représentant la lettre H (« coller les lignes Helper »)
* Les lignes se collent automatiquement dans ZHPFix.
* Clique sur le bouton « GO » pour lancer le nettoyage,
* Colle le contenu du rapport dans ta prochaine réponse.
--------------------------------------------------------------------------------------
* Télécharge UsbFix (créé par El Desaparecido & C_XX) sur ton Bureau. Si ton antivirus affiche une alerte, ignore le et désactive le temporairement.
* Branche tes sources de données externes à ton PC (clé USB, disque dur externe, etc...) sans les ouvrir
* Double clique sur le raccourci UsbFix sur ton Bureau, l'installation se fera automatiquement
* Clique sur "Recherche"
* Laisse travailler l'outil
* A la fin, le rapport va s'afficher : poste le dans ta prochaine réponse (il est aussi sauvegardé a la racine du disque dur)
Aide en images : Tutoriel "Recherche"
--------------------------------------------------------------------------------------
* Lance ZHPFix (si tu es sous Windows Vista ou Windows 7, lance le par un clic-droit dessus --> exécuter en temps qu'administrateur).
* Copie les lignes suivantes :
---------------------------------------------------
M2 - MFEP: prefs.js [HP_Administrateur - vo8jbp6v.default\cacaoweb@cacaoweb.org] [] cacaoweb v1.0.17 (.http://www.cacaoweb.org/
M2 - MFEP: prefs.js [HP_Administrateur - vo8jbp6v.default\{ef79f67a-6ad7-4715-a0f8-932fca442023}] [] BittorrentBar_FR Community Toolbar v3.2.5.2 (.Conduit Ltd..)
R3 - URLSearchHook: (no name) - {ba14329e-9550-4989-b3f2-9732e92d17cc} . (...) (No version) -- (.not file.)
O2 - BHO: (no name) - 83CED28E-B96A-43FC-A276-2AD7A48EB6BE Clé orpheline
O2 - BHO: (no name) - {30F9B915-B755-4826-820B-08FBA6BD249D} Clé orpheline
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} Clé orpheline
O2 - BHO: (no name) - {9030D464-4C02-4ABF-8ECC-5164760863C6} Clé orpheline
O2 - BHO: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} Clé orpheline
O2 - BHO: (no name) - {A3BC75A2-1F87-4686-AA43-5347D756017C} Clé orpheline
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} Clé orpheline
O2 - BHO: (no name) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} Clé orpheline
O2 - BHO: (no name) - {EEE6C35C-6118-11DC-9C72-001320C79847} Clé orpheline
O2 - BHO: (no name) - {ef79f67a-6ad7-4715-a0f8-932fca442023} Clé orpheline
O3 - Toolbar: IsoBuster Toolbar - {266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} . (...) -- C:\Program Files\IsoBuster\tbIso0.dll
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} . (...) -- (.not file.)
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} . (...) -- (.not file.)
O4 - HKLM\..\Run: [PCDrProfiler] Clé orpheline
O4 - HKLM\..\Run: [NPSStartup] Clé orpheline
O4 - HKLM\..\Run: [DriverCD] E:\Run.exe (.not file.)
O4 - HKLM\..\Run: [KernelFaultCheck] Clé orpheline
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} -- C:\Documents and Settings\HP_Administrateur\Application Data\IMVUClient\imvu.ico (.not file.)
O15 - Trusted Zone: [HKLM\...\Domains] *.antimalwareguard.com
O23 - Service: (BITS) - Clé orpheline
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At1.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At10.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At11.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At12.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At13.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At14.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At15.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At16.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At17.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At18.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At19.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At2.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At20.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At21.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At22.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At23.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At24.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At25.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At26.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At27.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At28.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At29.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At3.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At30.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At31.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At32.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At33.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At34.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At35.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At36.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At37.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At38.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At39.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At4.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At40.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At41.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At42.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At43.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At44.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At45.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At46.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At47.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At48.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At5.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At6.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At7.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At8.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At9.job
[MD5.00000000000000000000000000000000] [APT] [At1] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At10] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At11] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At12] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At13] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At14] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At15] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At16] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At17] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At18] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At19] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At2] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At20] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At21] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At22] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At23] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At24] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At25] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At26] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At27] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At28] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At29] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At3] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At30] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At31] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At32] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At33] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At34] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At35] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At36] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At37] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At38] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At39] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At4] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At40] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At41] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At42] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At43] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At44] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At45] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At46] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At47] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At48] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At5] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At6] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At7] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At8] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [At9] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.)
O41 - Driver: (aswSnx) . (. - .) - aswSnx.sys (.not file.)
O42 - Logiciel: SearchToolbar - (.Pas de propriétaire.) [HKLM] -- SearchToolbar
[HKCU\Software\BittorrentBar_FR]
[HKCU\Software\SweetIM]
[HKCU\Software\cacaoweb]
[HKLM\Software\supersexplayer]
O43 - CFD: 24/12/2009 - 14:11:24 - [400624] ----D- C:\Program Files\cacaoweb
O43 - CFD: 04/01/2009 - 17:35:30 - [3639313] ----D- C:\Program Files\SweetIM
O43 - CFD: 07/09/2011 - 13:06:24 - [331373255] ----D- C:\Documents and Settings\HP_Administrateur\Application Data\cacaoweb
O67 - Shell Spawning: <.html> <htmlfile>[HKCU\..\open\Command] (.Not Key.)
O67 - Shell Spawning: <.com> <>[HKU\..\open\Command] (.Not Key.)
O67 - Shell Spawning: <.exe> <>[HKU\..\open\Command] (.Not Key.)
---------------------------------------------------
* Clique sur l'icône représentant la lettre H (« coller les lignes Helper »)
* Les lignes se collent automatiquement dans ZHPFix.
* Clique sur le bouton « GO » pour lancer le nettoyage,
* Colle le contenu du rapport dans ta prochaine réponse.
https://pjjoint.malekal.com/files.php?id=ZHPDiag_w9i11b12z9c11s9h8b14g11t14d11h7f12n10h12t9z12x9n6w7