[infection] au secours Fermé

Question

Bonjour
je vous écris ce message dans l'espoir que quelq'un puisse m'aider. En effet, je ne suis pas une spécialiste de l'informatique et là je n'en peux plus...

Voilà mon problème :
Il y a deux jours on a telechargé un truc et depuis c'est le chaos. J'ai eu es fenetre internets qui s'ouvraient malgré moi (notamment serwab et sa soit disant solution.. Bon j'ai fait des recherches sur internet et j'ai téléchargé pas mal d'antivirus, antispywre pour assayer de faire le menage (notamment zone alarm qui a trouvé plus de630 et queques virus ou fichiers infectés.
bref, au final, j'ai perdu mes photos et pas mal de dossiers remplis de documents.
et quand je veux lancer spybot.. et fsecure blacklight que j'ai teléchargés, ca refuse.
bref je sais plus quoi faire pour retrouver un ordi sain.
Quelqu'un peut-il m'aider?
merci d'avance

^^Marie^^ · Answer

Slt,on a telechargé un truc   Quoi ???Tu ne peux pas le supprimer dans ajout/supp ???Fais ceci :F -  Hijackthis - Outil de diagnostic et réparation lire démo http://pageperso.aol.fr/balltrap34/Hijenr.gif http://pageperso.aol.fr/balltrap34/demohijack.htm Télécharge version française ici http://telechargement.zebulon.fr/160-patch-francais-pour-hijackthis-1991.html Copie/colle le rapport Bon courage A++

zouzou · Answer

merci de m'avoir répondu si vitej'ai teléchargé mais il ne veut pas se lancer...

zouzou · Answer

autre précision, quand je regarde dans le gestionnaire des taches, dans application, ya un truc qui se lance tout seul (meme si je stoppe réculièrement) et qui s'appelle project1.Kezako?

zouzou · Answer

bon j'ai finalement réussi voici ce que ca donne : Logfile of HijackThis v1.99.1Scan saved at 10:57:10, on 21/08/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\LEXBCES.EXEC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Alwil Software\Avast4\aswUpdSv.exeC:\Program Files\Alwil Software\Avast4\ashServ.exeC:\Program Files\ewido anti-spyware 4.0\guard.exeC:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exeC:\WINDOWS\System32
vsvc32.exeC:\WINDOWS\system32\pctspk.exeC:\WINDOWS\system32\SatSrv.exeC:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\ZoneLabs\vsmon.exeC:\Program Files\Alwil Software\Avast4\ashMaiSv.exeC:\Program Files\Alwil Software\Avast4\ashWebSv.exeC:\WINDOWS\system32\ZoneLabs\isafe.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Fichiers communs\Real\Update_OBealsched.exeC:\PROGRA~1\LEXMAR~1\ACMonitor_X73.exeC:\PROGRA~1\LEXMAR~1\AcBtnMgr_X73.exeC:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exeC:\WINDOWS\system32\sstray.exeC:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeC:\WINDOWS\system32\ctfmon.exeC:\WINDOWS\system32undll32.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Internet Explorer\iexplore.exeC:\WINDOWS\system32	askmgr.exeC:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXER1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.comR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.comR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.comR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://actus.sfr.frR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.comR0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.comR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer avec Club-InternetR1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensR3 - Default URLSearchHook is missingO2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dllO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dllO3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dllO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe" -osbootO4 - HKLM\..\Run: [Lexmark X73 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X73.exeO4 - HKLM\..\Run: [Lexmark X73 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X73.exeO4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exeO4 - HKLM\..\Run: [keyboard] C:\kybrdff_11a.exeO4 - HKLM\..\Run: [eav31ca1] RUNDLL32.EXE w2351762.dll,n 00331c9e0000000a2351762O4 - HKLM\..\Run: [newname] C:\nwnmff_11.exeO4 - HKLM\..\Run: [Workflow] D:\install\Workflow.exeO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initializeO4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /rO4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -kO4 - HKLM\..\Run: [Dit] Dit.exeO4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeO4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimizedO4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exeO4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exeO4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exeO4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exeO4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"O4 - HKLM\..\Run: [BtcMaestro] C:\Program Files\KMaestro\KMaestro.exeO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHookO4 - HKCU\..\Run: [SSS2006] "C:\Program Files\Steganos Security Suite 2006\SSS2006.exe" -bootO4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimizedO4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /backgroundO4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /cO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXEO8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.htmlO8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.htmlO8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.htmlO8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.htmlO8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar1.dll/cmcache.htmlO9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLLO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: teleir_cert - https://static.ir.dgi.minefi.gouv.fr/secure/connexion/archives/ie4n4/teleir_cert.cabO16 - DPF: {09C21411-B9A2-4DE6-8416-4E3B58577BE0} (France Telecom MDM ActiveX Control) - http://minitelweb.minitel.com/imin_data/ocx/MDM.cabO16 - DPF: {1F83CD9E-505E-4F87-BECE-0832A763E36F} (Image Uploader 3.0 Control) - http://www.mypixmania.com/fr/fr/importer/MypixUploader.cabO16 - DPF: {205FF73B-CA67-11D5-99DD-444553540000} (CInstall Class) - http://www.videossimo.com/videossimo/portail/cab/Install.cabO16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/026a092ea38db51fd106/netzip/RdxIE601_fr.cabO16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.htmlO16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cabO16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IP-Uploader Control) - http://asp03.photoprintit.de/microsite/1156/defaults/activex/ImageUploader3.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{8620F741-9FFE-43FE-A526-1C55ED88E46F}: NameServer = 194.17.200.10,194.117.200.15O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)O20 - AppInit_DLLs: repairs303169590.dllO20 - Winlogon Notify: DateTime - C:\WINDOWS\system32\udib.dll (file missing)O20 - Winlogon Notify: Extensions - C:\WINDOWS\system32\k2440chqef4e0.dll (file missing)O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dllO23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exeO23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exeO23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe.exeO23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exeO23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXEO23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exeO23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exeO23 - Service: Steganos AntiTheft (SatSrv) - Unknown owner - C:\WINDOWS\system32\SatSrv.exeO23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exealors, verdict?

zouzou · Answer

ya plus personne pour m'aider???HELP!!!Merci à qui répondra à ce sos...

^^Marie^^ · Answer

Heu !!!!!!!!!!! C'est le genre d'appel au secours que les Helpers n'aiment pas trop..............

D'autres part tu n'as pas répondu à ça ::

on a telechargé un truc ===> Quoi ???
Tu ne peux pas le supprimer dans ajout/supp ???

Salut

Telecharge la derniere version stp

http://siri.urz.free.fr/Fix/SmitfraudFix.zip
SMITFRAUD REGIS 30/07/2006
Télécharge ceci: (merci a S!RI pour ce programme).
http://siri.urz.free.fr/Fix/SmitfraudFix.zip
Exécute le, Double click sur Smitfraudfix.cmd choisit l’option 1, il va générer un rapport
Copie/colle le sur le poste stp.
----------------------------------------------------------------------------
Démarre en mode sans échec :
Pour cela, tu tapotes la touche F8 dès le début de l’allumage du pc sans t’arrêter
Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée.
Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal !
(Si F8 ne marche pas utilise la touche F5).
----------------------------------------------------------------------------
Relance le programme Smitfraud,
Cette fois choisit l’option 2, répond oui a tous ;
Sauvegarde le rapport, Redémarre en mode normal, copie/colle le rapport sauvegardé sur le forum

Et tu refais un Hitjackthis et tu nous dis koa 2 9...
========================================
A+

Prends patience un peu...........

zouzou · Answer

Ok, je m'excuse pour l'impatience...
Alors je vais faire tout ce que tu m'as dit et je reviens mettre ma réponse.
Ah oui pour ce que j'ai téléchargé, ou plutôt ce que mon chéri a téléchargé c'etait des épisodes de dessin animé japonais. Comme il s'y connait pas du tout en ordi et qu'il découvre le téléchargement, et que j'étais pas là quand il l'a ouvert..Bref après j'ai supprimé le truc, c'etait un truc exe, mais je me souviens pas du nom exact parce que je me suis justement empressée de le supprimer. Voilà pour les explications et encore merci.

zouzou · Answer

voilà le 1er rapport. Je fais le deuxième et je reviens. a tout a l'heure...SmitFraudFix v2.81Rapport fait à 13:13:24,17, 21/08/2006Executé à partir de C:\Documents and Settings\juliette\Mes documents\logiciels\SmitfraudFixOS: Microsoft Windows XP [version 5.1.2600] - Windows_NTFix executé en mode normal»»»»»»»»»»»»»»»»»»»»»»»» C:\»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWSC:\WINDOWS\drsmartload2.dat PRESENT !C:\WINDOWS\keyboard1.dat PRESENT !C:\WINDOWS
ewname.dat PRESENT !C:\WINDOWS	eller2.chk PRESENT !»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\juliette\Application Data»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\juliette\Favoris»»»»»»»»»»»»»»»»»»»»»»»» Bureau»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files »»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]"Source"="C:\Program Files\WindowsUpdate\kyfedy.html""SubscribedURL"="""FriendlyName"="" [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\1]"Source"="C:\Program Files\Services en ligne\hocyboxu.html""SubscribedURL"="""FriendlyName"=""[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\2]"Source"="About:Home""SubscribedURL"="About:Home""FriendlyName"="Ma page d'accueil"»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!SrchSTS.exe by S!RiSearch SharedTaskScheduler's .dll»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll»»»»»»»»»»»»»»»»»»»»»»»» Fin

zouzou · Answer

coucoualors voilà le deuxieme rapport avec mode sans echecSmitFraudFix v2.81Rapport fait à 13:21:11,12, 21/08/2006Executé à partir de C:\Documents and Settings\juliette\Mes documents\logiciels\SmitfraudFixOS: Microsoft Windows XP [version 5.1.2600] - Windows_NTFix executé en mode sans echec»»»»»»»»»»»»»»»»»»»»»»»» Avant SmitFraudFix!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!SrchSTS.exe by S!RiSearch SharedTaskScheduler's .dll»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos FixGenericRenosFix by S!Ri»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectésC:\WINDOWS\drsmartload2.dat suppriméC:\WINDOWS\keyboard1.dat suppriméC:\WINDOWS
ewname.dat suppriméC:\WINDOWS	eller2.chk supprimé»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre Nettoyage terminé.  »»»»»»»»»»»»»»»»»»»»»»»» Après SmitFraudFix!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!SrchSTS.exe by S!RiSearch SharedTaskScheduler's .dll»»»»»»»»»»»»»»»»»»»»»»»» Finet puis le deuxième rapport  hijackthisLogfile of HijackThis v1.99.1Scan saved at 13:32:13, on 21/08/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\LEXBCES.EXEC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Alwil Software\Avast4\aswUpdSv.exeC:\Program Files\Alwil Software\Avast4\ashServ.exeC:\Program Files\ewido anti-spyware 4.0\guard.exeC:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exeC:\WINDOWS\System32
vsvc32.exeC:\WINDOWS\system32\pctspk.exeC:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exeC:\WINDOWS\system32\SatSrv.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Alwil Software\Avast4\ashMaiSv.exeC:\Program Files\Alwil Software\Avast4\ashWebSv.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Fichiers communs\Real\Update_OBealsched.exeC:\PROGRA~1\LEXMAR~1\ACMonitor_X73.exeC:\PROGRA~1\LEXMAR~1\AcBtnMgr_X73.exeC:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exeC:\WINDOWS\system32\sstray.exeC:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeC:\Program Files\ewido anti-spyware 4.0\ewido.exeC:\Program Files\Winamp\winampa.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\KMaestro\KMaestro.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\iPod\bin\iPodService.exeC:\WINDOWS\system32undll32.exeC:\Program Files\Skype\Phone\Skype.exeC:\Program Files\MSN Messenger\MsnMsgr.ExeC:\Program Files\Steganos Security Suite 2006\SSS2006.exeC:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exeC:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXER1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.comR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.comR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.comR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://actus.sfr.frR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer avec Club-InternetR1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensR3 - Default URLSearchHook is missingO2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dllO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dllO3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dllO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe" -osbootO4 - HKLM\..\Run: [Lexmark X73 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X73.exeO4 - HKLM\..\Run: [Lexmark X73 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X73.exeO4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exeO4 - HKLM\..\Run: [eav31ca1] RUNDLL32.EXE w2351762.dll,n 00331c9e0000000a2351762O4 - HKLM\..\Run: [Workflow] D:\install\Workflow.exeO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initializeO4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /rO4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -kO4 - HKLM\..\Run: [Dit] Dit.exeO4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeO4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimizedO4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exeO4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exeO4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exeO4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exeO4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"O4 - HKLM\..\Run: [BtcMaestro] C:\Program Files\KMaestro\KMaestro.exeO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHookO4 - HKCU\..\Run: [SSS2006] "C:\Program Files\Steganos Security Suite 2006\SSS2006.exe" -bootO4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimizedO4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /backgroundO4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /cO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXEO8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.htmlO8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.htmlO8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.htmlO8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.htmlO8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar1.dll/cmcache.htmlO9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLLO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: teleir_cert - https://static.ir.dgi.minefi.gouv.fr/secure/connexion/archives/ie4n4/teleir_cert.cabO16 - DPF: {09C21411-B9A2-4DE6-8416-4E3B58577BE0} (France Telecom MDM ActiveX Control) - http://minitelweb.minitel.com/imin_data/ocx/MDM.cabO16 - DPF: {1F83CD9E-505E-4F87-BECE-0832A763E36F} (Image Uploader 3.0 Control) - http://www.mypixmania.com/fr/fr/importer/MypixUploader.cabO16 - DPF: {205FF73B-CA67-11D5-99DD-444553540000} (CInstall Class) - http://www.videossimo.com/videossimo/portail/cab/Install.cabO16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/026a092ea38db51fd106/netzip/RdxIE601_fr.cabO16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.htmlO16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cabO16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IP-Uploader Control) - http://asp03.photoprintit.de/microsite/1156/defaults/activex/ImageUploader3.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{8620F741-9FFE-43FE-A526-1C55ED88E46F}: NameServer = 194.17.200.10,194.117.200.15O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)O20 - AppInit_DLLs: repairs303169590.dllO20 - Winlogon Notify: DateTime - C:\WINDOWS\system32\udib.dll (file missing)O20 - Winlogon Notify: Extensions - C:\WINDOWS\system32\k2440chqef4e0.dll (file missing)O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dllO23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exeO23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exeO23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe.exeO23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exeO23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXEO23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exeO23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exeO23 - Service: Steganos AntiTheft (SatSrv) - Unknown owner - C:\WINDOWS\system32\SatSrv.exeO23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exeVoilà...Merci

^^Marie^^ · Answer

Bonjour,

Méthode à suivre dans l'ordre...
----------------------------------------------------------------------------
Télécharger ces logiciels (sauf si tu les as)
A utiliser plus tard

A - ad-aware version 1.06
(ici) http://www.florensac-chasse-trap.com/ section virus/logiciel de securite
voir demo
http://pageperso.aol.fr/balltrap34/adwseflash.zip

B - spybot version 1.4
(ici) http://www.florensac-chasse-trap.com/ section virus/logiciel de securite
voir demo d utilisation
http://pageperso.aol.fr/Balltrap34/demo%20spybot.htm

C - Ccleaner : ( nettoyeur de registre, cookies+temps+tempos+prefetch+historique+etc..)
Télécharge ici :
https://www.ccleaner.com/ccleaner/download
Tutorial ici:
https://www.vulgarisation-informatique.com/nettoyer-windows-ccleaner.php

D - Ewido
https://www.malekal.com/tutorial-et-guide-ewido-v4/
----------------------------------------------------------------------------
¤Affiche tous les fichiers et dossiers :
Clique sur démarrer/panneau de configuration/outil/option des dossiers/affichage

Coche « afficher les fichiers et dossiers cachés »

Décoche la case "Masquer les fichiers protégés du système d'exploitation (recommandé)"

Décoche « masquer les extensions dont le type est connu »
Puis fais «Ok» pour valider les changements.

Et appliquer !
=================================
Relance HijackThis, choisis " do a scan only" coche la case devant les lignes ci-dessous et clique en bas sur "fix checked"

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R3 - Default URLSearchHook is missing
O4 - HKLM\..\Run: [eav31ca1] RUNDLL32.EXE w2351762.dll,n 00331c9e0000000a2351762
O4 - HKLM\..\Run: [Workflow] D:\install\Workflow.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O16 - DPF: teleir_cert - https://static.ir.dgi.minefi.gouv.fr/secure/connexion/archives/ie4n4/teleir_cert.cab
O16 - DPF: {09C21411-B9A2-4DE6-8416-4E3B58577BE0} (France Telecom MDM ActiveX Control) - http://minitelweb.minitel.com/imin_data/ocx/MDM.cab
O16 - DPF: {1F83CD9E-505E-4F87-BECE-0832A763E36F} (Image Uploader 3.0 Control) - http://www.mypixmania.com/fr/fr/importer/MypixUploader.cab
O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540000} (CInstall Class) - http://www.videossimo.com/videossimo/portail/cab/Install.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/026a092ea38db51fd106/netzip/RdxIE601_fr.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IP-Uploader Control) - http://asp03.photoprintit.de/microsite/1156/defaults/activex/ImageUploader3.cab
O20 - AppInit_DLLs: repairs303169590.dll

O20 - Winlogon Notify: DateTime - C:\WINDOWS\system32\udib.dll (file missing)
O20 - Winlogon Notify: Extensions - C:\WINDOWS\system32\k2440chqef4e0.dll (file missing)

\Steganos Security Suite 2006 ===> Est-ce que tu t’en sert ?????

O4 - HKCU\..\Run: [SSS2006] "C:\Program Files\Steganos Security Suite 2006\SSS2006.exe" –boot
O23 - Service: Steganos AntiTheft (SatSrv) - Unknown owner - C:\WINDOWS\system32\SatSrv.exe

============ ============================
¤Démarre en mode sans échec :
Pour cela, tu tapotes la touche F8 dès le début de l’allumage du pc sans t’arrêter
Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée.
Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal !
(Si F8 ne marche pas utilise la touche F5).
----------------------------------------------------------------------------
¤Vide tes fichiers temps et temporary internet file:

Maintenant tu lances
A/ Ad-Aware supprime quarantaine
B/ Spybot Supprime quarantaine
C/ Ccleaner Ewido Copier/coller le rapport
D/
----------------------------------------------------------------------------
¤ Vide ta Corbeille.
----------------------------------------------------------------------------
¤ Redémarre en mode normal, relance Hijackthis et copie/colle un nouveau rapport sur le forum.

Tiens nous au courant

A+

zouzou · Answer

coucouOuf, ca m'a pris un temps fou... Alors voilà le rapport c cleanerWindows Registry Editor Version 5.00[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls]"C:\WINDOWS\Downloaded Program Files\RdxIE.dll"=dword:00000001[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls]"C:\WINDOWS\Downloaded Program Files\Install.dll"=dword:00000001[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls]"C:\WINDOWS\Downloaded Program Files\ImageUploader_3.ocx"=dword:00000001[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls]"C:\WINDOWS\Downloaded Program Files\MypixUploader.ocx"=dword:00000001[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls]"C:\WINDOWS\Downloaded Program Files\xscan53.ocx"=dword:00000001[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls]"C:\WINDOWS\Downloaded Program Files\asquared.ocx"=dword:00000001[HKEY_CLASSES_ROOT\urn:content-classes:contentclassdef][HKEY_CLASSES_ROOT\urn:content-classes:wizard/addcontentclass][HKEY_CLASSES_ROOT\AU_ISC]@="AU ISC Server Application"[HKEY_CLASSES_ROOT\AU_ISC\CLSID]@="{499C2688-85A5-41B5-B8A7-DCC8DCF797B4}"[HKEY_CLASSES_ROOT\AU_ISC\CurVer]@="AU_ISC.1"[HKEY_CLASSES_ROOT\AU_ISC.1]@="AU ISC Server Application"[HKEY_CLASSES_ROOT\AU_ISC.1\CLSID]@="{499C2688-85A5-41B5-B8A7-DCC8DCF797B4}"[HKEY_CLASSES_ROOT\CDDBControl.CDDB]@="CDDBControl.CDDB"[HKEY_CLASSES_ROOT\CDDBControl.CDDB\Clsid]@="{8B711BDF-005A-11D5-912C-CB19AE9BD205}"[HKEY_CLASSES_ROOT\Connection Manager Profile]@="Connection Manager Profile"[HKEY_CLASSES_ROOT\Connection Manager Profile\shell][HKEY_CLASSES_ROOT\Database.Document]@="Database Document"[HKEY_CLASSES_ROOT\Database.Document\shell][HKEY_CLASSES_ROOT\eD2KDownloadManager.object]@="eD2K downloadManager object"[HKEY_CLASSES_ROOT\eD2KDownloadManager.object\CLSID]@="{320154BB-D666-48F6-990E-172B32954620}"[HKEY_CLASSES_ROOT\eD2KDownloadManager.object\CurVer]@="eD2KDownloadManager.object.1"[HKEY_CLASSES_ROOT\eD2KDownloadManager.object.1]@="eD2K downloadManager object"[HKEY_CLASSES_ROOT\eD2KDownloadManager.object.1\CLSID]@="{320154BB-D666-48F6-990E-172B32954620}"[HKEY_CLASSES_ROOT\IncrediAnimation.AnimationPlayer]@="AnimationPlayer Class"[HKEY_CLASSES_ROOT\IncrediAnimation.AnimationPlayer\CLSID]@="{B5534644-E461-11D3-BBB2-0050DA276194}"[HKEY_CLASSES_ROOT\IncrediAnimation.AnimationPlayer\CurVer]@="IncrediAnimation.AnimationPlayer.1"[HKEY_CLASSES_ROOT\IncrediAnimation.AnimationPlayer.1]@="AnimationPlayer Class"[HKEY_CLASSES_ROOT\IncrediAnimation.AnimationPlayer.1\CLSID]@="{B5534644-E461-11D3-BBB2-0050DA276194}"[HKEY_CLASSES_ROOT\IncrediBook.AddressBook]@="AddressBook Class"[HKEY_CLASSES_ROOT\IncrediBook.AddressBook\CLSID]@="{BFCA32C0-E917-11D3-B720-005004C0C6BA}"[HKEY_CLASSES_ROOT\IncrediBook.AddressBook\CurVer]@="IncrediBook.AddressBook.1"[HKEY_CLASSES_ROOT\IncrediBook.AddressBook.1]@="AddressBook Class"[HKEY_CLASSES_ROOT\IncrediBook.AddressBook.1\CLSID]@="{BFCA32C0-E917-11D3-B720-005004C0C6BA}"[HKEY_CLASSES_ROOT\IncrediBook.Contact]@="Contact Class"[HKEY_CLASSES_ROOT\IncrediBook.Contact\CLSID]@="{BFCA32C2-E917-11D3-B720-005004C0C6BA}"[HKEY_CLASSES_ROOT\IncrediBook.Contact\CurVer]@="IncrediBook.Contact.1"[HKEY_CLASSES_ROOT\IncrediBook.Contact.1]@="Contact Class"[HKEY_CLASSES_ROOT\IncrediBook.Contact.1\CLSID]@="{BFCA32C2-E917-11D3-B720-005004C0C6BA}"[HKEY_CLASSES_ROOT\IncrediBook.Group]@="Group Class"[HKEY_CLASSES_ROOT\IncrediBook.Group\CLSID]@="{BFCA32C4-E917-11D3-B720-005004C0C6BA}"[HKEY_CLASSES_ROOT\IncrediBook.Group\CurVer]@="IncrediBook.Group.1"[HKEY_CLASSES_ROOT\IncrediBook.Group.1]@="Group Class"[HKEY_CLASSES_ROOT\IncrediBook.Group.1\CLSID]@="{BFCA32C4-E917-11D3-B720-005004C0C6BA}"[HKEY_CLASSES_ROOT\IncrediFeatures.AutoUpdate]@="AutoUpdate Class"[HKEY_CLASSES_ROOT\IncrediFeatures.AutoUpdate\CLSID]@="{9401BFDA-2F5C-4978-8075-7D8AFEC3AEE5}"[HKEY_CLASSES_ROOT\IncrediFeatures.AutoUpdate\CurVer]@="IncrediFeatures.AutoUpdate.1"[HKEY_CLASSES_ROOT\IncrediFeatures.AutoUpdate.1]@="AutoUpdate Class"[HKEY_CLASSES_ROOT\IncrediFeatures.AutoUpdate.1\CLSID]@="{9401BFDA-2F5C-4978-8075-7D8AFEC3AEE5}"[HKEY_CLASSES_ROOT\IncrediFeatures.CommonSettings]@="CommonSettings Class"[HKEY_CLASSES_ROOT\IncrediFeatures.CommonSettings\CLSID]@="{CBF9925D-3C19-4F33-9DE4-446978645EBB}"[HKEY_CLASSES_ROOT\IncrediFeatures.CommonSettings\CurVer]@="IncrediFeatures.CommonSettings.1"[HKEY_CLASSES_ROOT\IncrediFeatures.CommonSettings.1]@="CommonSettings Class"[HKEY_CLASSES_ROOT\IncrediFeatures.CommonSettings.1\CLSID]@="{CBF9925D-3C19-4F33-9DE4-446978645EBB}"[HKEY_CLASSES_ROOT\IncrediFeatures.EmoticonCenter]@="EmoticonCenter Class"[HKEY_CLASSES_ROOT\IncrediFeatures.EmoticonCenter\CLSID]@="{D0B6B45D-7BAF-4993-8EC2-F165BA440CD4}"[HKEY_CLASSES_ROOT\IncrediFeatures.EmoticonCenter\CurVer]@="IncrediFeatures.EmoticonCenter.1"[HKEY_CLASSES_ROOT\IncrediFeatures.EmoticonCenter.1]@="EmoticonCenter Class"[HKEY_CLASSES_ROOT\IncrediFeatures.EmoticonCenter.1\CLSID]@="{D0B6B45D-7BAF-4993-8EC2-F165BA440CD4}"[HKEY_CLASSES_ROOT\IncrediFeatures.IMMessage]@="IMMessage Class"[HKEY_CLASSES_ROOT\IncrediFeatures.IMMessage\CLSID]@="{07D03588-7B5E-11D5-8784-0050DA2761C4}"[HKEY_CLASSES_ROOT\IncrediFeatures.IMMessage\CurVer]@="IncrediFeatures.IMMessage.1"[HKEY_CLASSES_ROOT\IncrediFeatures.IMMessage.1]@="IMMessage Class"[HKEY_CLASSES_ROOT\IncrediFeatures.IMMessage.1\CLSID]@="{07D03588-7B5E-11D5-8784-0050DA2761C4}"[HKEY_CLASSES_ROOT\IncrediFeatures.LicenceManager]@="LicenceManager Class"[HKEY_CLASSES_ROOT\IncrediFeatures.LicenceManager\CLSID]@="{5862A1C2-7676-45AA-8C7D-2F803754D007}"[HKEY_CLASSES_ROOT\IncrediFeatures.LicenceManager\CurVer]@="IncrediFeatures.LicenceManager.1"[HKEY_CLASSES_ROOT\IncrediFeatures.LicenceManager.1]@="LicenceManager Class"[HKEY_CLASSES_ROOT\IncrediFeatures.LicenceManager.1\CLSID]@="{5862A1C2-7676-45AA-8C7D-2F803754D007}"[HKEY_CLASSES_ROOT\IncrediFeatures.MultiSignature]@="MultiSignature Class"[HKEY_CLASSES_ROOT\IncrediFeatures.MultiSignature\CLSID]@="{328CC455-1F5E-4F1A-A6B7-A888AA9C0289}"[HKEY_CLASSES_ROOT\IncrediFeatures.MultiSignature\CurVer]@="IncrediFeatures.MultiSignature.1"[HKEY_CLASSES_ROOT\IncrediFeatures.MultiSignature.1]@="MultiSignature Class"[HKEY_CLASSES_ROOT\IncrediFeatures.MultiSignature.1\CLSID]@="{328CC455-1F5E-4F1A-A6B7-A888AA9C0289}"[HKEY_CLASSES_ROOT\IncrediFeatures.ProfileManager]@="ProfileManager Class"[HKEY_CLASSES_ROOT\IncrediFeatures.ProfileManager\CLSID]@="{96D04D6A-7B1E-48A9-BEA6-99F9FE8341C7}"[HKEY_CLASSES_ROOT\IncrediFeatures.ProfileManager\CurVer]@="IncrediFeatures.ProfileManager.1"[HKEY_CLASSES_ROOT\IncrediFeatures.ProfileManager.1]@="ProfileManager Class"[HKEY_CLASSES_ROOT\IncrediFeatures.ProfileManager.1\CLSID]@="{96D04D6A-7B1E-48A9-BEA6-99F9FE8341C7}"[HKEY_CLASSES_ROOT\IncrediFeatures.Signature]@="Signature Class"[HKEY_CLASSES_ROOT\IncrediFeatures.Signature\CLSID]@="{DA12A268-0ACB-11D4-859D-0050DA2761C4}"[HKEY_CLASSES_ROOT\IncrediFeatures.Signature\CurVer]@="IncrediFeatures.Signature.1"[HKEY_CLASSES_ROOT\IncrediFeatures.Signature.1]@="Signature Class"[HKEY_CLASSES_ROOT\IncrediFeatures.Signature.1\CLSID]@="{DA12A268-0ACB-11D4-859D-0050DA2761C4}"[HKEY_CLASSES_ROOT\IncrediFeatures.Sound]@="Sound Class"[HKEY_CLASSES_ROOT\IncrediFeatures.Sound\CLSID]@="{0710C793-2117-11D5-B75D-005004C0C6BA}"[HKEY_CLASSES_ROOT\IncrediFeatures.Sound\CurVer]@="IncrediFeatures.Sound.1"[HKEY_CLASSES_ROOT\IncrediFeatures.Sound.1]@="Sound Class"[HKEY_CLASSES_ROOT\IncrediFeatures.Sound.1\CLSID]@="{0710C793-2117-11D5-B75D-005004C0C6BA}"[HKEY_CLASSES_ROOT\IncrediFeatures.Spelling]@="Spelling Class"[HKEY_CLASSES_ROOT\IncrediFeatures.Spelling\CLSID]@="{84566316-EC70-11D5-881D-0050DA2761C4}"[HKEY_CLASSES_ROOT\IncrediFeatures.Spelling\CurVer]@="IncrediFeatures.Spelling.1"[HKEY_CLASSES_ROOT\IncrediFeatures.Spelling.1]@="Spelling Class"[HKEY_CLASSES_ROOT\IncrediFeatures.Spelling.1\CLSID]@="{84566316-EC70-11D5-881D-0050DA2761C4}"[HKEY_CLASSES_ROOT\IncrediFeatures.StyleBox]@="StyleBox Class"[HKEY_CLASSES_ROOT\IncrediFeatures.StyleBox\CLSID]@="{C7681ACB-27AD-4025-8F53-643549159658}"[HKEY_CLASSES_ROOT\IncrediFeatures.StyleBox\CurVer]@="IncrediFeatures.StyleBox.1"[HKEY_CLASSES_ROOT\IncrediFeatures.StyleBox.1]@="StyleBox Class"[HKEY_CLASSES_ROOT\IncrediFeatures.StyleBox.1\CLSID]@="{C7681ACB-27AD-4025-8F53-643549159658}"[HKEY_CLASSES_ROOT\IncrediFeatures.TypeMessageTAF]@="TypeMessageTAF Class"[HKEY_CLASSES_ROOT\IncrediFeatures.TypeMessageTAF\CLSID]@="{FEBD6230-F4F6-4E79-89CD-4BEBDC4A96AE}"[HKEY_CLASSES_ROOT\IncrediFeatures.TypeMessageTAF\CurVer]@="IncrediFeatures.TypeMessageTAF.1"[HKEY_CLASSES_ROOT\IncrediFeatures.TypeMessageTAF.1]@="TypeMessageTAF Class"[HKEY_CLASSES_ROOT\IncrediFeatures.TypeMessageTAF.1\CLSID]@="{FEBD6230-F4F6-4E79-89CD-4BEBDC4A96AE}"[HKEY_CLASSES_ROOT\IncrediFeatures.TypeMessageVIP]@="TypeMessageVIP Class"[HKEY_CLASSES_ROOT\IncrediFeatures.TypeMessageVIP\CLSID]@="{47B10849-77FA-463b-8973-10241FF9DB37}"[HKEY_CLASSES_ROOT\IncrediFeatures.TypeMessageVIP\CurVer]@="IncrediFeatures.TypeMessageVIP.1"[HKEY_CLASSES_ROOT\IncrediFeatures.TypeMessageVIP.1]@="TypeMessageVIP Class"[HKEY_CLASSES_ROOT\IncrediFeatures.TypeMessageVIP.1\CLSID]@="{47B10849-77FA-463b-8973-10241FF9DB37}"[HKEY_CLASSES_ROOT\IncrediFeatures.WebNotification]@="WebNotification Class"[HKEY_CLASSES_ROOT\IncrediFeatures.WebNotification\CLSID]@="{1D2A25B6-20D1-4C5B-9E6A-4DC7906192B4}"[HKEY_CLASSES_ROOT\IncrediFeatures.WebNotification\CurVer]@="IncrediFeatures.WebNotification.1"[HKEY_CLASSES_ROOT\IncrediFeatures.WebNotification.1]@="WebNotification Class"[HKEY_CLASSES_ROOT\IncrediFeatures.WebNotification.1\CLSID]@="{1D2A25B6-20D1-4C5B-9E6A-4DC7906192B4}"[HKEY_CLASSES_ROOT\IncrediFeatures.WebViewer]@="WebViewer Class"[HKEY_CLASSES_ROOT\IncrediFeatures.WebViewer\CLSID]@="{4EAA7268-FC1E-47C6-87EF-8915475CBC88}"[HKEY_CLASSES_ROOT\IncrediFeatures.WebViewer\CurVer]@="IncrediFeatures.WebViewer.1"[HKEY_CLASSES_ROOT\IncrediFeatures.WebViewer.1]@="WebViewer Class"[HKEY_CLASSES_ROOT\IncrediFeatures.WebViewer.1\CLSID]@="{4EAA7268-FC1E-47C6-87EF-8915475CBC88}"[HKEY_CLASSES_ROOT\IncrediImport.AOLImporter]@="AOLImporter Class"[HKEY_CLASSES_ROOT\IncrediImport.AOLImporter\CLSID]@="{17513EFA-F27A-4781-B6A6-EE988D96E71C}"[HKEY_CLASSES_ROOT\IncrediImport.AOLImporter\CurVer]@="IncrediImport.AOLImporter.1"[HKEY_CLASSES_ROOT\IncrediImport.AOLImporter.1]@="AOLImporter Class"[HKEY_CLASSES_ROOT\IncrediImport.AOLImporter.1\CLSID]@="{17513EFA-F27A-4781-B6A6-EE988D96E71C}"[HKEY_CLASSES_ROOT\IncrediImport.EudoraImporter]@="EudoraImporter Class"[HKEY_CLASSES_ROOT\IncrediImport.EudoraImporter\CLSID]@="{EC8717C9-F660-11D3-ADE2-0050DA744DF1}"[HKEY_CLASSES_ROOT\IncrediImport.EudoraImporter\CurVer]@="IncrediImport.EudoraImporter.1"[HKEY_CLASSES_ROOT\IncrediImport.EudoraImporter.1]@="EudoraImporter Class"[HKEY_CLASSES_ROOT\IncrediImport.EudoraImporter.1\CLSID]@="{EC8717C9-F660-11D3-ADE2-0050DA744DF1}"[HKEY_CLASSES_ROOT\IncrediImport.ExpressImporter]@="ExpressImporter Class"[HKEY_CLASSES_ROOT\IncrediImport.ExpressImporter\CLSID]@="{EC8717B8-F660-11D3-ADE2-0050DA744DF1}"[HKEY_CLASSES_ROOT\IncrediImport.ExpressImporter\CurVer]@="IncrediImport.ExpressImporter.1"[HKEY_CLASSES_ROOT\IncrediImport.ExpressImporter.1]@="ExpressImporter Class"[HKEY_CLASSES_ROOT\IncrediImport.ExpressImporter.1\CLSID]@="{EC8717B8-F660-11D3-ADE2-0050DA744DF1}"[HKEY_CLASSES_ROOT\IncrediImport.HotmailImporter]@="HotmailImporter Class"[HKEY_CLASSES_ROOT\IncrediImport.HotmailImporter\CLSID]@="{F1B4B6F1-55D1-11d6-B7AD-005004C0C6BA}"[HKEY_CLASSES_ROOT\IncrediImport.HotmailImporter\CurVer]@="IncrediImport.HotmailImporter.1"[HKEY_CLASSES_ROOT\IncrediImport.HotmailImporter.1]@="HotmailImporter Class"[HKEY_CLASSES_ROOT\IncrediImport.HotmailImporter.1\CLSID]@="{F1B4B6F1-55D1-11d6-B7AD-005004C0C6BA}"[HKEY_CLASSES_ROOT\IncrediImport.Importer]@="Importer Class"[HKEY_CLASSES_ROOT\IncrediImport.Importer\CLSID]@="{E1B6DE2A-F997-11D3-BBDB-0050DA276194}"[HKEY_CLASSES_ROOT\IncrediImport.Importer\CurVer]@="IncrediImport.Importer.1"[HKEY_CLASSES_ROOT\IncrediImport.Importer.1]@="Importer Class"[HKEY_CLASSES_ROOT\IncrediImport.Importer.1\CLSID]@="{E1B6DE2A-F997-11D3-BBDB-0050DA276194}"[HKEY_CLASSES_ROOT\IncrediImport.IncrediMailImporter]@="IncrediMailImporter Class"[HKEY_CLASSES_ROOT\IncrediImport.IncrediMailImporter\CLSID]@="{44C8EC50-93BD-4633-9A82-CA0D4F1DD3A7}"[HKEY_CLASSES_ROOT\IncrediImport.IncrediMailImporter\CurVer]@="IncrediImport.IncrediMailImporter.1"[HKEY_CLASSES_ROOT\IncrediImport.IncrediMailImporter.1]@="IncrediMailImporter Class"[HKEY_CLASSES_ROOT\IncrediImport.IncrediMailImporter.1\CLSID]@="{44C8EC50-93BD-4633-9A82-CA0D4F1DD3A7}"[HKEY_CLASSES_ROOT\IncrediImport.IncrediMailImporter2]@="IncrediMailImporter2 Class"[HKEY_CLASSES_ROOT\IncrediImport.IncrediMailImporter2\CLSID]@="{00E9F275-1525-4fd3-8CEE-6BAF5B4A4B4A}"[HKEY_CLASSES_ROOT\IncrediImport.IncrediMailImporter2\CurVer]@="IncrediImport.IncrediMailImporter2.1"[HKEY_CLASSES_ROOT\IncrediImport.IncrediMailImporter2.1]@="IncrediMailImporter2 Class"[HKEY_CLASSES_ROOT\IncrediImport.IncrediMailImporter2.1\CLSID]@="{00E9F275-1525-4fd3-8CEE-6BAF5B4A4B4A}"[HKEY_CLASSES_ROOT\IncrediImport.NetscapeImporter]@="NetscapeImporter Class"[HKEY_CLASSES_ROOT\IncrediImport.NetscapeImporter\CLSID]@="{EC8717B4-F660-11D3-ADE2-0050DA744DF1}"[HKEY_CLASSES_ROOT\IncrediImport.NetscapeImporter\CurVer]@="IncrediImport.NetscapeImporter.1"[HKEY_CLASSES_ROOT\IncrediImport.NetscapeImporter.1]@="NetscapeImporter Class"[HKEY_CLASSES_ROOT\IncrediImport.NetscapeImporter.1\CLSID]@="{EC8717B4-F660-11D3-ADE2-0050DA744DF1}"[HKEY_CLASSES_ROOT\IncrediImport.OutlookImporter]@="OutlookImporter Class"[HKEY_CLASSES_ROOT\IncrediImport.OutlookImporter\CLSID]@="{EC8717B6-F660-11D3-ADE2-0050DA744DF1}"[HKEY_CLASSES_ROOT\IncrediImport.OutlookImporter\CurVer]@="IncrediImport.OutlookImporter.1"[HKEY_CLASSES_ROOT\IncrediImport.OutlookImporter.1]@="OutlookImporter Class"[HKEY_CLASSES_ROOT\IncrediImport.OutlookImporter.1\CLSID]@="{EC8717B6-F660-11D3-ADE2-0050DA744DF1}"[HKEY_CLASSES_ROOT\IncrediMail.Kernel]@="Kernel Class"[HKEY_CLASSES_ROOT\IncrediMail.Kernel\CLSID]@="{E9BC70A8-D70C-11D3-BBAE-0050DA276194}"[HKEY_CLASSES_ROOT\IncrediMail.Kernel\CurVer]@="IncrediMail.Kernel.1"[HKEY_CLASSES_ROOT\IncrediMail.Kernel.1]@="Kernel Class"[HKEY_CLASSES_ROOT\IncrediMail.Kernel.1\CLSID]@="{E9BC70A8-D70C-11D3-BBAE-0050DA276194}"[HKEY_CLASSES_ROOT\IncrediManager.CommandComponent]@="CommandComponent Class"[HKEY_CLASSES_ROOT\IncrediManager.CommandComponent\CLSID]@="{5FAEF4A9-C5D0-11D4-BCC1-0050DA276194}"[HKEY_CLASSES_ROOT\IncrediManager.CommandComponent\CurVer]@="IncrediManager.CommandComponent.1"[HKEY_CLASSES_ROOT\IncrediManager.CommandComponent.1]@="CommandComponent Class"[HKEY_CLASSES_ROOT\IncrediManager.CommandComponent.1\CLSID]@="{5FAEF4A9-C5D0-11D4-BCC1-0050DA276194}"[HKEY_CLASSES_ROOT\IncrediManager.FindMessage]@="FindMessage Class"[HKEY_CLASSES_ROOT\IncrediManager.FindMessage\CLSID]@="{3762BAB7-8E00-4B51-AA7E-E57ED7552794}"[HKEY_CLASSES_ROOT\IncrediManager.FindMessage\CurVer]@="IncrediManager.FindMessage.1"[HKEY_CLASSES_ROOT\IncrediManager.FindMessage.1]@="FindMessage Class"[HKEY_CLASSES_ROOT\IncrediManager.FindMessage.1\CLSID]@="{3762BAB7-8E00-4B51-AA7E-E57ED7552794}"[HKEY_CLASSES_ROOT\IncrediManager.Manager]@="Manager Class"[HKEY_CLASSES_ROOT\IncrediManager.Manager\CLSID]@="{CB073682-BD1F-11D3-BB90-0050DA276194}"[HKEY_CLASSES_ROOT\IncrediManager.Manager\CurVer]@="IncrediManager.Manager.1"[HKEY_CLASSES_ROOT\IncrediManager.Manager.1]@="Manager Class"[HKEY_CLASSES_ROOT\IncrediManager.Manager.1\CLSID]@="{CB073682-BD1F-11D3-BB90-0050DA276194}"[HKEY_CLASSES_ROOT\IncrediManager.Premium]@="Premium Class"[HKEY_CLASSES_ROOT\IncrediManager.Premium\CLSID]@="{E6253BEA-C3B2-4FB0-8F7F-B5B8C83674E5}"[HKEY_CLASSES_ROOT\IncrediManager.Premium\CurVer]@="IncrediManager.Premium.1"[HKEY_CLASSES_ROOT\IncrediManager.Premium.1]@="Premium Class"[HKEY_CLASSES_ROOT\IncrediManager.Premium.1\CLSID]@="{E6253BEA-C3B2-4FB0-8F7F-B5B8C83674E5}"[HKEY_CLASSES_ROOT\IncrediManager.VipSupport]@="VipSupport Class"[HKEY_CLASSES_ROOT\IncrediManager.VipSupport\CLSID]@="{A43BC58F-4453-49FF-9929-9D1E78D90062}"[HKEY_CLASSES_ROOT\IncrediManager.VipSupport\CurVer]@="IncrediManager.VipSupport.1"[HKEY_CLASSES_ROOT\IncrediManager.VipSupport.1]@="VipSupport Class"[HKEY_CLASSES_ROOT\IncrediManager.VipSupport.1\CLSID]@="{A43BC58F-4453-49FF-9929-9D1E78D90062}"[HKEY_CLASSES_ROOT\IncrediMessage]@="IncrediMail Internet Mail Message"[HKEY_CLASSES_ROOT\IncrediMessage\shell][HKEY_CLASSES_ROOT\IncrediNotifier.CoNotifierPlayer]@="CoNotifierPlayer Class"[HKEY_CLASSES_ROOT\IncrediNotifier.CoNotifierPlayer\CLSID]@="{181C43E6-AF9E-46EA-A51E-2D63B975A15D}"[HKEY_CLASSES_ROOT\IncrediNotifier.CoNotifierPlayer\CurVer]@="IncrediNotifier.CoNotifierPlayer.1"[HKEY_CLASSES_ROOT\IncrediNotifier.CoNotifierPlayer.1]@="CoNotifierPlayer Class"[HKEY_CLASSES_ROOT\IncrediNotifier.CoNotifierPlayer.1\CLSID]@="{181C43E6-AF9E-46EA-A51E-2D63B975A15D}"[HKEY_CLASSES_ROOT\IncrediNotifier.Notifier]@="Notifier Class"[HKEY_CLASSES_ROOT\IncrediNotifier.Notifier\CLSID]@="{80BCA063-A0D1-4F29-888C-6B67C392F5DA}"[HKEY_CLASSES_ROOT\IncrediNotifier.Notifier\CurVer]@="IncrediNotifier.Notifier.1"[HKEY_CLASSES_ROOT\IncrediNotifier.Notifier.1]@="Notifier Class"[HKEY_CLASSES_ROOT\IncrediNotifier.Notifier.1\CLSID]@="{80BCA063-A0D1-4F29-888C-6B67C392F5DA}"[HKEY_CLASSES_ROOT\IncrediParser.BodyPart]@="BodyPart Class"[HKEY_CLASSES_ROOT\IncrediParser.BodyPart\CLSID]@="{087EF34C-BBC4-11D3-BB8D-0050DA276194}"[HKEY_CLASSES_ROOT\IncrediParser.BodyPart\CurVer]@="IncrediParser.BodyPart.1"[HKEY_CLASSES_ROOT\IncrediParser.BodyPart.1]@="BodyPart Class"[HKEY_CLASSES_ROOT\IncrediParser.BodyPart.1\CLSID]@="{087EF34C-BBC4-11D3-BB8D-0050DA276194}"[HKEY_CLASSES_ROOT\IncrediParser.ContainerShell]@="ContainerShell Class"[HKEY_CLASSES_ROOT\IncrediParser.ContainerShell\CLSID]@="{25D41C19-246A-4643-B0CA-08F5D1D07EE6}"[HKEY_CLASSES_ROOT\IncrediParser.ContainerShell\CurVer]@="IncrediParser.ContainerShell.1"[HKEY_CLASSES_ROOT\IncrediParser.ContainerShell.1]@="ContainerShell Class"[HKEY_CLASSES_ROOT\IncrediParser.ContainerShell.1\CLSID]@="{25D41C19-246A-4643-B0CA-08F5D1D07EE6}"[HKEY_CLASSES_ROOT\IncrediParser.Encoder]@="Encoder Class"[HKEY_CLASSES_ROOT\IncrediParser.Encoder\CLSID]@="{28D1EE40-E73D-422D-A2AC-D23F8D3071B2}"[HKEY_CLASSES_ROOT\IncrediParser.Encoder\CurVer]@="IncrediParser.Encoder.1"[HKEY_CLASSES_ROOT\IncrediParser.Encoder.1]@="Encoder Class"[HKEY_CLASSES_ROOT\IncrediParser.Encoder.1\CLSID]@="{28D1EE40-E73D-422D-A2AC-D23F8D3071B2}"[HKEY_CLASSES_ROOT\IncrediParser.Header]@="Header Class"[HKEY_CLASSES_ROOT\IncrediParser.Header\CLSID]@="{7A2E77CA-BDE2-11D3-BB91-0050DA276194}"[HKEY_CLASSES_ROOT\IncrediParser.Header\CurVer]@="IncrediParser.Header.1"[HKEY_CLASSES_ROOT\IncrediParser.Header.1]@="Header Class"[HKEY_CLASSES_ROOT\IncrediParser.Header.1\CLSID]@="{7A2E77CA-BDE2-11D3-BB91-0050DA276194}"[HKEY_CLASSES_ROOT\IncrediParser.MailMessage]@="MailMessage Class"[HKEY_CLASSES_ROOT\IncrediParser.MailMessage\CLSID]@="{50E5E612-B7DD-11D3-BB7F-0050DA276194}"[HKEY_CLASSES_ROOT\IncrediParser.MailMessage\CurVer]@="IncrediParser.MailMessage.1"[HKEY_CLASSES_ROOT\IncrediParser.MailMessage.1]@="MailMessage Class"[HKEY_CLASSES_ROOT\IncrediParser.MailMessage.1\CLSID]@="{50E5E612-B7DD-11D3-BB7F-0050DA276194}"[HKEY_CLASSES_ROOT\IncrediParser.MessageFinderShell]@="MessageFinderShell Class"[HKEY_CLASSES_ROOT\IncrediParser.MessageFinderShell\CLSID]@="{734D218A-B5AA-4A73-BE14-B5F9411EBA45}"[HKEY_CLASSES_ROOT\IncrediParser.MessageFinderShell\CurVer]@="IncrediParser.MessageFinderShell.1"[HKEY_CLASSES_ROOT\IncrediParser.MessageFinderShell.1]@="MessageFinderShell Class"[HKEY_CLASSES_ROOT\IncrediParser.MessageFinderShell.1\CLSID]@="{734D218A-B5AA-4A73-BE14-B5F9411EBA45}"[HKEY_CLASSES_ROOT\IncrediParser.MessageStoreShell]@="MessageStoreShell Class"[HKEY_CLASSES_ROOT\IncrediParser.MessageStoreShell\CLSID]@="{A0C301D9-59A5-45eb-90E8-D60D8149F5A5}"[HKEY_CLASSES_ROOT\IncrediParser.MessageStoreShell\CurVer]@="IncrediParser.MessageStoreShell.1"[HKEY_CLASSES_ROOT\IncrediParser.MessageStoreShell.1]@="MessageStoreShell Class"[HKEY_CLASSES_ROOT\IncrediParser.MessageStoreShell.1\CLSID]@="{A0C301D9-59A5-45eb-90E8-D60D8149F5A5}"[HKEY_CLASSES_ROOT\IncrediShellExt.IMMenuShellExt]@="IMMenuShellExt Class"[HKEY_CLASSES_ROOT\IncrediShellExt.IMMenuShellExt\CLSID]@="{F8984111-38B6-11D5-8725-0050DA2761C4}"[HKEY_CLASSES_ROOT\IncrediShellExt.IMMenuShellExt\CurVer]@="IncrediShellExt.IMMenuShellExt.1"[HKEY_CLASSES_ROOT\IncrediShellExt.IMMenuShellExt.1]@="IMMenuShellExt Class"[HKEY_CLASSES_ROOT\IncrediShellExt.IMMenuShellExt.1\CLSID]@="{F8984111-38B6-11D5-8725-0050DA2761C4}"[HKEY_CLASSES_ROOT\IncrediSupport.AccountsManager]@="AccountsManager Class"[HKEY_CLASSES_ROOT\IncrediSupport.AccountsManager\CLSID]@="{2EE7969F-6FC8-4D04-89AC-5109298ABC39}"[HKEY_CLASSES_ROOT\IncrediSupport.AccountsManager\CurVer]@="IncrediSupport.AccountsManager.1"[HKEY_CLASSES_ROOT\IncrediSupport.AccountsManager.1]@="AccountsManager Class"[HKEY_CLASSES_ROOT\IncrediSupport.AccountsManager.1\CLSID]@="{2EE7969F-6FC8-4D04-89AC-5109298ABC39}"[HKEY_CLASSES_ROOT\IncrediSupport.JunkFilterManager]@="JunkFilterManager Class"[HKEY_CLASSES_ROOT\IncrediSupport.JunkFilterManager\CLSID]@="{37DD327E-8A52-448d-9072-BBADFC62DDC4}"[HKEY_CLASSES_ROOT\IncrediSupport.JunkFilterManager\CurVer]@="IncrediSupport.JunkFilterManager.1"[HKEY_CLASSES_ROOT\IncrediSupport.JunkFilterManager.1]@="JunkFilterManager Class"[HKEY_CLASSES_ROOT\IncrediSupport.JunkFilterManager.1\CLSID]@="{37DD327E-8A52-448d-9072-BBADFC62DDC4}"[HKEY_CLASSES_ROOT\IncrediSupport.Settings]@="Settings Class"[HKEY_CLASSES_ROOT\IncrediSupport.Settings\CLSID]@="{A8D94870-BEA6-11D3-BB92-0050DA276194}"[HKEY_CLASSES_ROOT\IncrediSupport.Settings\CurVer]@="IncrediSupport.Settings.1"[HKEY_CLASSES_ROOT\IncrediSupport.Settings.1]@="Settings Class"[HKEY_CLASSES_ROOT\IncrediSupport.Settings.1\CLSID]@="{A8D94870-BEA6-11D3-BB92-0050DA276194}"[HKEY_CLASSES_ROOT\IncrediSupport.Viewers]@="Viewers Class"[HKEY_CLASSES_ROOT\IncrediSupport.Viewers\CLSID]@="{805FB5B9-6344-11D6-B7AF-005004C0C6BA}"[HKEY_CLASSES_ROOT\IncrediSupport.Viewers\CurVer]@="IncrediSupport.Viewers.1"[HKEY_CLASSES_ROOT\IncrediSupport.Viewers.1]@="Viewers Class"[HKEY_CLASSES_ROOT\IncrediSupport.Viewers.1\CLSID]@="{805FB5B9-6344-11D6-B7AF-005004C0C6BA}"[HKEY_CLASSES_ROOT\IncrediTools.ContentPlugProtocol]@="ContentPlugProtocol Class"[HKEY_CLASSES_ROOT\IncrediTools.ContentPlugProtocol\CLSID]@="{8BACC255-A3CF-4e27-BAF1-D531B1AE02FD}"[HKEY_CLASSES_ROOT\IncrediTools.ContentPlugProtocol\CurVer]@="IncrediTools.ContentPlugProtocol.1"[HKEY_CLASSES_ROOT\IncrediTools.ContentPlugProtocol.1]@="ContentPlugProtocol Class"[HKEY_CLASSES_ROOT\IncrediTools.ContentPlugProtocol.1\CLSID]@="{8BACC255-A3CF-4e27-BAF1-D531B1AE02FD}"[HKEY_CLASSES_ROOT\IncrediTools.Magic]@="Magic Class"[HKEY_CLASSES_ROOT\IncrediTools.Magic\CLSID]@="{B84092B9-8658-11D5-8793-0050DA2761C4}"[HKEY_CLASSES_ROOT\IncrediTools.Magic\CurVer]@="IncrediTools.Magic.1"[HKEY_CLASSES_ROOT\IncrediTools.Magic.1]@="Magic Class"[HKEY_CLASSES_ROOT\IncrediTools.Magic.1\CLSID]@="{B84092B9-8658-11D5-8793-0050DA2761C4}"[HKEY_CLASSES_ROOT\IncrediTools.SoundManager]@="SoundManager Class"[HKEY_CLASSES_ROOT\IncrediTools.SoundManager\CLSID]@="{0B9A0840-1EC3-11D5-B75C-005004C0C6BA}"[HKEY_CLASSES_ROOT\IncrediTools.SoundManager\CurVer]@="IncrediTools.SoundManager.1"[HKEY_CLASSES_ROOT\IncrediTools.SoundManager.1]@="SoundManager Class"[HKEY_CLASSES_ROOT\IncrediTools.SoundManager.1\CLSID]@="{0B9A0840-1EC3-11D5-B75C-005004C0C6BA}"[HKEY_CLASSES_ROOT\IncrediTools.ThumbnailCreator]@="ThumbnailCreator Class"[HKEY_CLASSES_ROOT\IncrediTools.ThumbnailCreator\CLSID]@="{140BBD3E-C68E-4077-B7EC-D4DC46242EF5}"[HKEY_CLASSES_ROOT\IncrediTools.ThumbnailCreator\CurVer]@="IncrediTools.ThumbnailCreator.1"[HKEY_CLASSES_ROOT\IncrediTools.ThumbnailCreator.1]@="ThumbnailCreator Class"[HKEY_CLASSES_ROOT\IncrediTools.ThumbnailCreator.1\CLSID]@="{140BBD3E-C68E-4077-B7EC-D4DC46242EF5}"[HKEY_CLASSES_ROOT\IncrediView.AttachPlugProt]@="AttachPlugProt Class"[HKEY_CLASSES_ROOT\IncrediView.AttachPlugProt\CLSID]@="{57DE7416-A3EB-47C8-B44D-72F79539A360}"[HKEY_CLASSES_ROOT\IncrediView.AttachPlugProt\CurVer]@="IncrediView.AttachPlugProt.1"[HKEY_CLASSES_ROOT\IncrediView.AttachPlugProt.1]@="AttachPlugProt Class"[HKEY_CLASSES_ROOT\IncrediView.AttachPlugProt.1\CLSID]@="{57DE7416-A3EB-47C8-B44D-72F79539A360}"[HKEY_CLASSES_ROOT\IncrediView.FieldsEditDesigner]@="FieldsEditDesigner Class"[HKEY_CLASSES_ROOT\IncrediView.FieldsEditDesigner\CLSID]@="{CB382C7A-8852-458A-8900-C456C96FDB8C}"[HKEY_CLASSES_ROOT\IncrediView.FieldsEditDesigner\CurVer]@="IncrediView.FieldsEditDesigner.1"[HKEY_CLASSES_ROOT\IncrediView.FieldsEditDesigner.1]@="FieldsEditDesigner Class"[HKEY_CLASSES_ROOT\IncrediView.FieldsEditDesigner.1\CLSID]@="{CB382C7A-8852-458A-8900-C456C96FDB8C}"[HKEY_CLASSES_ROOT\IncrediView.MsgView]@="MsgView Class"[HKEY_CLASSES_ROOT\IncrediView.MsgView\CLSID]@="{7E58CC0F-BC50-11D3-855B-0050DA2761C4}"[HKEY_CLASSES_ROOT\IncrediView.MsgView\CurVer]@="IncrediView.MsgView.1"[HKEY_CLASSES_ROOT\IncrediView.MsgView.1]@="MsgView Class"[HKEY_CLASSES_ROOT\IncrediView.MsgView.1\CLSID]@="{7E58CC0F-BC50-11D3-855B-0050DA2761C4}"[HKEY_CLASSES_ROOT\IncrediView.ViewEditDesigner]@="ViewEditDesigner Class"[HKEY_CLASSES_ROOT\IncrediView.ViewEditDesigner\CLSID]@="{11B72805-205F-11D6-8855-0050DA2761C4}"[HKEY_CLASSES_ROOT\IncrediView.ViewEditDesigner\CurVer]@="IncrediView.ViewEditDesigner.1"[HKEY_CLASSES_ROOT\IncrediView.ViewEditDesigner.1]@="ViewEditDesigner Class"[HKEY_CLASSES_ROOT\IncrediView.ViewEditDesigner.1\CLSID]@="{11B72805-205F-11D6-8855-0050DA2761C4}"[HKEY_CLASSES_ROOT\IncrediView.ViewShowDesigner]@="ViewShowDesigner Class"[HKEY_CLASSES_ROOT\IncrediView.ViewShowDesigner\CLSID]@="{4750EC81-293B-11D6-885E-0050DA2761C4}"[HKEY_CLASSES_ROOT\IncrediView.ViewShowDesigner\CurVer]@="IncrediView.ViewShowDesigner.1"[HKEY_CLASSES_ROOT\IncrediView.ViewShowDesigner.1]@="ViewShowDesigner Class"[HKEY_CLASSES_ROOT\IncrediView.ViewShowDesigner.1\CLSID]@="{4750EC81-293B-11D6-885E-0050DA2761C4}"[HKEY_CLASSES_ROOT\Microsoft.ActiveXPlugin]@="ActiveXPlugin Object"[HKEY_CLASSES_ROOT\Microsoft.ActiveXPlugin\CLSID]@="{06DD38D3-D187-11CF-A80D-00C04FD74AD8}"[HKEY_CLASSES_ROOT\Microsoft.ActiveXPlugin\CurVer]@="Microsoft.ActiveXPlugin.1"[HKEY_CLASSES_ROOT\Microsoft.ActiveXPlugin\NotInsertable][HKEY_CLASSES_ROOT\Microsoft.ActiveXPlugin.1]@="ActiveXPlugin Object"[HKEY_CLASSES_ROOT\Microsoft.ActiveXPlugin.1\CLSID]@="{06DD38D3-D187-11CF-A80D-00C04FD74AD8}"[HKEY_CLASSES_ROOT\Microsoft.ActiveXPlugin.1\NotInsertable][HKEY_CLASSES_ROOT\Minitel.Document][HKEY_CLASSES_ROOT\Minitel.Document\shell][HKEY_CLASSES_ROOT\movfile][HKEY_CLASSES_ROOT\movfile\shell][HKEY_CLASSES_ROOT\OfficePrinter.Document]@="OfficePrinter Document"[HKEY_CLASSES_ROOT\OfficePrinter.Document\shell][HKEY_CLASSES_ROOT\ppifile]@="Fichier de configuration du Passeport Microsoft"[HKEY_CLASSES_ROOT\ppifile\shell][HKEY_CLASSES_ROOT\QuickTimeMovie]@="QuickTime Movie"[HKEY_CLASSES_ROOT\QuickTimeMovie\shell][HKEY_CLASSES_ROOT\RealDownloadExpress.InfoWindow]@="RealDownload Express InfoWindow Class"[HKEY_CLASSES_ROOT\RealDownloadExpress.InfoWindow\CLSID]@="{56336BCA-3D8A-11d6-A00B-0050DA18DE71}"[HKEY_CLASSES_ROOT\RealDownloadExpress.InfoWindow\CurVer]@="RealDownloadExpress.InfoWindow.1"[HKEY_CLASSES_ROOT\RealDownloadExpress.InfoWindow.1]@="RealDownload Express InfoWindow Class"[HKEY_CLASSES_ROOT\RealDownloadExpress.InfoWindow.1\CLSID]@="{56336BCA-3D8A-11d6-A00B-0050DA18DE71}"[HKEY_CLASSES_ROOT\RTCIMSP.RTCIMService]@="RTCIMService Class"[HKEY_CLASSES_ROOT\RTCIMSP.RTCIMService\CLSID]@="{83D4679F-B6D7-11D2-BF36-00C04FB90A03}"[HKEY_CLASSES_ROOT\RTCIMSP.RTCIMService\CurVer]@="RTCIMSP.RTCIMService.1"[HKEY_CLASSES_ROOT\RTCIMSP.RTCIMService.1]@="RTCIMService Class"[HKEY_CLASSES_ROOT\RTCIMSP.RTCIMService.1\CLSID]@="{83D4679F-B6D7-11D2-BF36-00C04FB90A03}"[HKEY_CLASSES_ROOT\TIMFile][HKEY_CLASSES_ROOT\TIMFile\Shell][HKEY_CLASSES_ROOT\VTXFile][HKEY_CLASSES_ROOT\VTXFile\Shell][HKEY_CLASSES_ROOT\Applications\Heredis8.exe][HKEY_CLASSES_ROOT\Applications\Heredis8.exe\shell][HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\HijackThis.exe]@="C:\Program Files\Hijackthis Version Française\hijackthis.exe""Path"="C:\Program Files\Hijackthis Version Française"[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\HijackThis]"DisplayName"="HijackThis 1.99.1""UninstallString"="C:\Program Files\Hijackthis Version Française\HijackThis.exe /uninstall""DisplayIcon"="C:\Program Files\Hijackthis Version Française\HijackThis.exe""DisplayVersion"="1.99.1""Publisher"="Soeperman Enterprises Ltd.""URLInfoAbout"="http://ww11.spywareinfo.com/~merijn/"[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{3877C2CD-F137-4144-BDB2-0A811492F920}]"SlowInfoCache"=hex:28,02,00,00,00,00,00,00,ff,ff,ff,ff,ff,ff,ff,ff,00,00,00,\  00,00,00,00,00,ff,ff,ff,ff,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00"Changed"=dword:00000000[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{A394E835-C8D6-4B4B-884B-D2709059F3BE}]"SlowInfoCache"=hex:28,02,00,00,01,00,00,00,00,70,01,00,00,00,00,00,52,8a,c2,\  8d,0b,c3,c6,01,00,00,00,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,\  61,00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,4e,00,65,00,74,00,77,\  00,6f,00,72,00,6b,00,20,00,4d,00,6f,00,6e,00,69,00,74,00,6f,00,72,00,5c,00,\  6e,00,65,00,74,00,6d,00,6f,00,6e,00,2e,00,65,00,78,00,65,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00"Changed"=dword:00000000[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]"C:\Program Files\CyberLink\PowerDVD\PowerDVD.exe"="PowerDVD"[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]"C:\sysprep\factory.exe"="Utilitaire de pré installation d'usine"[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]"C:\sysprep\sysprep.exe"="utilitaire sysprep"[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]"C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\Y7QDWTQZ\setupfre[1].exe"="setupfre[1]"[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\_av_sfx.tm~a00564\avast.setup"="avast! antivirus Update"[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]"C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\Y7QDWTQZ\aswclnr[1].exe"="Virus/Worm Cleaner Application"[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]"C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\Y7QDWTQZ\aswclnr[1].tmp"="Virus/Worm Cleaner Application"[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]"C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\S32JKLSX\FxLodear[1].exe"="Symantec Trojan.Lodear/Trojan.Lodav Removal Tool"[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]"C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\S32JKLSX\trsetup[1].exe"="Trojan Remover Setup                                        "[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\is-NOCBP.tmp\is-EU6RP.tmp"="Setup/Uninstall"[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\is-C4ENP.tmp\is-UEDUJ.tmp"="Setup/Uninstall"le rapport ewidoowido anti-spyware - Scan Report--------------------------------------------------------- + Created at:	19:34:06 21/08/2006 + Scan result:	HKLM\SOFTWARE\Classes\AppID\Altnet Signing Module.EXE -> Adware.Altnet : Cleaned.HKLM\SOFTWARE\Classes\AppID\adm.EXE -> Adware.Altnet : Cleaned.HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Hotbarb -> Adware.HotBar : Cleaned.HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Hotbarc -> Adware.HotBar : Cleaned.C:\Documents and Settings\juliette\Cookies\juliette@247realmedia[2].txt -> TrackingCookie.247realmedia : Cleaned.C:\Documents and Settings\juliette\Cookies\juliette@adtech[1].txt -> TrackingCookie.Adtech : Cleaned.C:\Documents and Settings\juliette\Cookies\juliette@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.C:\Documents and Settings\juliette\Cookies\juliette@bluestreak[2].txt -> TrackingCookie.Bluestreak : Cleaned.C:\Documents and Settings\juliette\Cookies\juliette@estat[1].txt -> TrackingCookie.Estat : Cleaned.C:\Documents and Settings\juliette\Cookies\juliette@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned.C:\Documents and Settings\juliette\Cookies\juliette@www.smartadserver[2].txt -> TrackingCookie.Smartadserver : Cleaned.C:\Documents and Settings\juliette\Cookies\juliette@weborama[2].txt -> TrackingCookie.Weborama : Cleaned.::Report end puis le hijackthisLogfile of HijackThis v1.99.1Scan saved at 20:33:32, on 21/08/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\LEXBCES.EXEC:\WINDOWS\system32\spoolsv.exeC:\Program Files\ewido anti-spyware 4.0\guard.exeC:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exeC:\WINDOWS\System32
vsvc32.exeC:\WINDOWS\system32\pctspk.exeC:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exeC:\WINDOWS\system32\SatSrv.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\ZoneLabs\vsmon.exeC:\WINDOWS\system32\ZoneLabs\isafe.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Fichiers communs\Real\Update_OBealsched.exeC:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exeC:\WINDOWS\system32\sstray.exeC:\Program Files\ewido anti-spyware 4.0\ewido.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Skype\Phone\Skype.exeC:\WINDOWS\system32undll32.exeC:\Program Files\MSN Messenger\MsnMsgr.ExeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXER0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://actus.sfr.frR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer avec Club-InternetR1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dllO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe" -osbootO4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exeO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initializeO4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /rO4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -kO4 - HKLM\..\Run: [Dit] Dit.exeO4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeO4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimizedO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHookO4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimizedO4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /backgroundO4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /cO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXEO8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.htmlO8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.htmlO8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.htmlO8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.htmlO8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar1.dll/cmcache.htmlO9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLLO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO17 - HKLM\System\CCS\Services\Tcpip\..\{8620F741-9FFE-43FE-A526-1C55ED88E46F}: NameServer = 194.17.200.10,194.117.200.15O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dllO23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exeO23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exeO23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe.exeO23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exeO23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXEO23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exeO23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exeO23 - Service: Steganos AntiTheft (SatSrv) - Unknown owner - C:\WINDOWS\system32\SatSrv.exeO23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exeje dois te dire que pour spybot en mode sans echec, il arrivait pas à retirer 1 truc (bearshare je crois) et donc il m'a proposé de un scan au démarrage. il l'a fait et a encore trouvé d'autrestrucs;;Voilà Hou la la, heureusement que vous êtes là pour nous guider parceque c'est de la folie...Bon ben à tout à l'heure...

zouzou · Answer

Par contre il me refusait d'ouvrir avast parcequil y avit undll manquant alors je suis allée le télécharger sur internet. Avast est bien là mais il n'est plus en bas à droite, comme d'habitude et Kerio n'est plus là non plus il me dit "cannot connect to service"
Je les retélecharge?

^^Marie^^ · Answer

Je répète

\Steganos Security Suite 2006 ===> Est-ce que tu t’en sert ?????

O4 - HKCU\..\Run: [SSS2006] "C:\Program Files\Steganos Security Suite 2006\SSS2006.exe" –boot
O23 - Service: Steganos AntiTheft (SatSrv) - Unknown owner - C:\WINDOWS\system32\SatSrv.exe

zouzou · Answer

a vrai dire non, je sais même pas ce que c'est... Désolée

^^Marie^^ · Answer

SupprimeRegarde dans ajout supp des programme ====>supprimeet tu supprimes les lignesA+++++++++++++

zouzou · Answer

ca y est mais par contre, ca veut dire quoi supprimer les lignes?En tout cas merci  infinimentde m'avoir prise en charge...

^^Marie^^ · Answer

Re,Vérifie dans ajout/supp des programmes si tu as Steganos Security Suite 2006 Si oui, supprime le complètement.Tiens nous au courantA++

zouzou · Answer

Bonjour Marie, me revoilà!!

Ben en fait, non je n'ai plus Steganos security.
Mais je pense que ya toujours des problemes, car quand je démarre des programmes ils semblent s'executer, ya le sablier puis plus rien...

Par contre, j'ai Kério et Avast qui refonctionnent correctement.

Voilà les news.
Merci de ton aide!!

zouzou · Answer

je confirme que quekquechose doit encore clocher tant mon ordi rame; et quand je l'ai fermé tout à l'heure(il ramait trop) alors que dans la fenetre appilcation yavait rien du tout pourtant ca m'a mis un ou deux messages comme quoii je sais plus quelle appliction était en cours..
penses tu que ce soit grave ?

^^Marie^^ · Answer

Slt,Remets un Hitjackthis, j'ai pu faire des impasses aussi.Fait pas trop chaud chez toi ?As-tu penser à défragmenter un peu ton PC ??A++

zouzou · Answer

rebonjour!!je te mets le nouveau rapport.En attendant quand ca rame trop, je suis obligée d'étaincdre mon ordi. mais une fois sur deux j'ai kerio; et une fois sur deux ma messagerie outlook ne fonctionne pas.. Très étrangePour te répondre, il ne fait pas trop chaud chez moi. Et défragmenter mon pc, j'ai jamais fait..Bon avant de faire n'importe quoi, j'attends tes nouvelles indications.merci, merci, merci!!!!!Logfile of HijackThis v1.99.1Scan saved at 15:01:58, on 23/08/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Windows Defender\MsMpEng.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\LEXBCES.EXEC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Alwil Software\Avast4\aswUpdSv.exeC:\Program Files\Alwil Software\Avast4\ashServ.exeC:\WINDOWS\System32
vsvc32.exeC:\WINDOWS\system32\pctspk.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\ZoneLabs\vsmon.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Fichiers communs\Real\Update_OBealsched.exeC:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exeC:\WINDOWS\system32\sstray.exeC:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeC:\Program Files\ewido anti-spyware 4.0\ewido.exeC:\WINDOWS\system32\ctfmon.exeC:\WINDOWS\system32undll32.exeC:\WINDOWS\system32\wuauclt.exeC:\Program Files\Alwil Software\Avast4\ashMaiSv.exeC:\Program Files\Alwil Software\Avast4\ashWebSv.exeC:\WINDOWS\system32\ZoneLabs\isafe.exeC:\Program Files\Messenger\msmsgs.exeC:\WINDOWS\system32	askmgr.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXER0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://actus.sfr.frR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer avec Club-InternetR1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dllO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe" -osbootO4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exeO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initializeO4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /rO4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -kO4 - HKLM\..\Run: [Dit] Dit.exeO4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeO4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimizedO4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hideO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHookO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXEO8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.htmlO8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.htmlO8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.htmlO8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.htmlO8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar1.dll/cmcache.htmlO9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLLO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO17 - HKLM\System\CCS\Services\Tcpip\..\{8620F741-9FFE-43FE-A526-1C55ED88E46F}: NameServer = 194.17.200.10,194.117.200.15O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dllO23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exeO23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exeO23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe.exeO23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXEO23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exeO23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exeO23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

zouzou · Answer

Et là j'essaie de desinstaller zonealarm antivirus et il refuse...pff que c'est lourd!!

^^Marie^^ · Answer

Salut,Regarde ici,Désinstallation en  imagehttp://forum.telecharger.01net.com/forum/high-tech/PRODUITS/Questions-techniques/zonealarm-tutorial-sujet_169658_1.htm#post5519083A++

zouzou · Answer

c'est ce que je fais mais il refuse!  "zone labs ...a rencontré un problème et doit fermer..."

[infection] au secours

24 réponses

Discussions similaires