pub qui s'ouvre des que j'ouvre une page web Résolu/Fermé

Question

Bonjour, 
Je vien soliciter votre aide afin de comprendre pourquoi j'ai des pages de pub de toute sorte souvre des que j'ouvre une page que se soit sur explorer ou chrome, il y a aussi le probleme de certain lien: des que je passe ma souris dessus une pub s'affiche et quand je clic cela m'auriente sur une pub evidement ainsi que facebook des mini pub se glisse entre les photo ect...

J'ai deja passé ccleaner et spybot ainsi que avast version gratuite mais rien n'y fait.
Merci d'avance pour votre aide car cela commence a m'énerver serieusement.

Cdt



Configuration: Windows Vista / Internet Explorer 9.0

g3n-h@ckm@n · Accepted Answer

salut desinstalle spybot search and destroy rien du tout

==

 Télécharge et enregistre ADWcleaner sur ton bureau :

ADWCleaner (Merci à Xplode)

Lance le,

(Pour vista et seven => clic droit "executer en tant qu'administrateur")

clique sur suppression et poste son rapport.

yann252 · Answer

Bonjour
 g3n-h@ckm@n je n'arrive pas a l'enregistré il est bloqué par SmartScreen j'ai essayé en desactivan avast et le parfeu mais rien n'y fait. Une solution s'il te plait?

g3n-h@ckm@n · Answer

desactive "smartscreen sert à rien"

https://support.microsoft.com/fr-fr/help/930168

yann252 · Answer

Je ne c'est pas si vous avez recu le rapport je le poste mais quand je rafraichit la page il n'apparais plus.

yann252 · Answer

voici le rapport # AdwCleaner v2.000 - Rapport créé le 09/09/2012 à 11:18:08 # Mis à jour le 30/08/2012 par Xplode # Système d'exploitation : Windows Vista (TM) Home Premium Service Pack 2 (32 bits) # Nom d'utilisateur : yannos - PC-DE-YANNOS # Mode de démarrage : Normal # Exécuté depuis : C:\Users\yannos\Tracing\Downloads\adwcleaner.exe # Option [Suppression] ***** [Services] ***** ***** [Fichiers / Dossiers] ***** Dossier Supprimé : C:\Users\yannos\AppData\Local\Google\Chrome\User Data\Default\Extensions\dednnpigldgdbpgcdpfppmlcnnbjciel Dossier Supprimé : C:\Users\yannos\AppData\Local\Google\Chrome\User Data\Default\Extensions\gaiilaahiahdejapggenmdmafpmbipje Dossier Supprimé : C:\Users\yannos\AppData\Local\Google\Chrome\User Data\Default\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn Dossier Supprimé : C:\Users\yannos\AppData\Local\Google\Chrome\User Data\Default\Extensions dkhncnongaclekkbelchmeafffimifj Dossier Supprimé : C:\Users\yannos\AppData\Roaming\HBLite Dossier Supprimé : C:\Users\yannos\AppData\Roaming\Media Finder Dossier Supprimé : C:\Users\yannos\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\gencrawler@some.com Dossier Supprimé : C:\Users\yannos\AppData\Roaming\Mozilla\Firefox\Profiles\sqt43kb3.default\extensions\{EB9394A3-4AD6-4918- 9537-31A1FD8E8EDF} Dossier Supprimé : C:\Users\yannos\AppData\Roaming\Mozilla\Firefox\Profiles\sqt43kb3.default\extensions\{EEE6C361-6118-11DC- 9C72-001320C79847} Dossier Supprimé : C:\Users\yannos\AppData\Roaming\Mozilla\Firefox\Profiles\sqt43kb3.default\extensions\crossriderapp4479@crossrider.com Dossier Supprimé : C:\Users\yannos\AppData\Roaming\Mozilla\Firefox\Profiles\sqt43kb3.default\extensions\ffxtlbr@babylon.com Dossier Supprimé : C:\Users\yannos\AppData\Roaming\Mozilla\Firefox\Profiles\sqt43kb3.default\SweetPacksToolbarData Dossier Supprimé : C:\Users\yannos\AppData\Roaming\OfferBox Fichier Supprimé : C:\Program Files\Mozilla Firefox\.autoreg Fichier Supprimé : C:\user.js Fichier Supprimé : C:\Users\yannos\AppData\Local\euyyg_navfx.dat Fichier Supprimé : C:\Users\yannos\AppData\Local\kifrolqn.bat Fichier Supprimé : C:\Users\yannos\AppData\Local\kifrolqn_navfx.dat Fichier Supprimé : C:\Users\yannos\AppData\Local\quqws.bat Fichier Supprimé : C:\Users\yannos\AppData\Local\quqws.dat Fichier Supprimé : C:\Users\yannos\AppData\Local\quqws_nav.dat Fichier Supprimé : C:\Users\yannos\AppData\Local\quqws_navps.dat Fichier Supprimé : C:\Users\yannos\AppData\Roaming\Microsoft\Windows\Start Menu\Chat-Land site de chat et de rencontre gratuit.URL Fichier Supprimé : C:\Users\yannos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chat-Land site de chat et de rencontre gratuit.URL Fichier Supprimé : C:\Users\yannos\AppData\Roaming\Mozilla\Firefox\Profiles\sqt43kb3.default\searchplugins\MyStart Search.xml Fichier Supprimé : C:\Users\yannos\AppData\Roaming\Mozilla\Firefox\Profiles\sqt43kb3.default\searchplugins\SweetIm.xml Fichier Supprimé : C:\Users\yannos\errorlog.tmp ***** [Registre] ***** Clé Supprimée : HKCU\Software\AppDataLow\Software\Crossrider Clé Supprimée : HKCU\Software\AppDataLow\Software\Giant Savings Clé Supprimée : HKCU\Software\AppDataLow\Software\ShoppingReport2 Clé Supprimée : HKCU\Software\BabylonToolbar Clé Supprimée : HKCU\Software\Cr_Installer Clé Supprimée : HKCU\Software\DealPly Clé Supprimée : HKCU\Software\Google\Chrome\Extensions\gaiilaahiahdejapggenmdmafpmbipje Clé Supprimée : HKCU\Software\hblitesa Clé Supprimée : HKCU\Software\Headlight Clé Supprimée : HKCU\Software\InstalledBrowserExtensions Clé Supprimée : HKCU\Software\MediaFinder Clé Supprimée : HKCU\Software\Microsoft\Internet Explorer\MenuExt\Download with &Media Finder Clé Supprimée : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847} Clé Supprimée : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EEE7E0A3-AE64-4DC8-84D1-F5D7BAF2DB0C} Clé Supprimée : HKCU\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\62119EF862C6B3A0D853419B87EB3E2F6C78640A Clé Supprimée : HKCU\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7EE743314C844C7F445B8B1D7617612DF1FDD50F Clé Supprimée : HKCU\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\E6A6A4A475FCE37F8B5AC2F1244DEB2BFCA5615A Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{79A765E1-C399-405B-85AF-466F52E918B0} Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{83AA2913-C123-4146-85BD-AD8F93971D39} Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\DealPly Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Giant Savings Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\hblitesa Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\ShoppingReport2 Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{11111111-1111-1111-1111-110011441179} Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2EECD738-5844-4A99-B4B6-146BF802613B} Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A6174F27-1FFF-E1D6-A93F-BA48AD5DD448} Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{CA4520F3-AE13-4FB1-A513-58E23991C86D} Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEE6C35B-6118-11DC-9C72-001320C79847} Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEE6C35C-6118-11DC-9C72-001320C79847} Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{11111111-1111-1111-1111-110011441179} Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B} Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A6174F27-1FFF-E1D6-A93F-BA48AD5DD448} Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CA4520F3-AE13-4FB1-A513-58E23991C86D} Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847} Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847} Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\chat-land.org Clé Supprimée : HKCU\Software\Offerbox Clé Supprimée : HKCU\Software\ShoppingReport2 Clé Supprimée : HKCU\Software\SweetIm Clé Supprimée : HKLM\Software\Babylon Clé Supprimée : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947} Clé Supprimée : HKLM\SOFTWARE\Classes\AppID\{A7DDCBDE-5C86-415c-8A37-763AE183E7E4} Clé Supprimée : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB} Clé Supprimée : HKLM\SOFTWARE\Classes\AppID\escort.DLL Clé Supprimée : HKLM\SOFTWARE\Classes\AppID\WMHelper.DLL Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110011441179} Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220022442279} Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B} Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{33333333-3333-3333-3333-330033443379} Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A} Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064} Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{A6174F27-1FFF-E1D6-A93F-BA48AD5DD448} Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{CA4520F3-AE13-4FB1-A513-58E23991C86D} Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{E1164984-B567-47BD-A7FF-240C2594404A} Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1} Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847} Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847} Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847} Clé Supprimée : HKLM\SOFTWARE\Classes\CrossriderApp0004479.BHO Clé Supprimée : HKLM\SOFTWARE\Classes\CrossriderApp0004479.BHO.1 Clé Supprimée : HKLM\SOFTWARE\Classes\CrossriderApp0004479.FBApi Clé Supprimée : HKLM\SOFTWARE\Classes\CrossriderApp0004479.FBApi.1 Clé Supprimée : HKLM\SOFTWARE\Classes\CrossriderApp0004479.Sandbox Clé Supprimée : HKLM\SOFTWARE\Classes\CrossriderApp0004479.Sandbox.1 Clé Supprimée : HKLM\SOFTWARE\Classes\gencrawler_gc.GenCrawler Clé Supprimée : HKLM\SOFTWARE\Classes\hbliteax.info Clé Supprimée : HKLM\SOFTWARE\Classes\hbliteax.info.1 Clé Supprimée : HKLM\SOFTWARE\Classes\hbliteax.userprofiles Clé Supprimée : HKLM\SOFTWARE\Classes\hbliteax.userprofiles.1 Clé Supprimée : HKLM\SOFTWARE\Classes\IMsiDe1egate.Application.1 Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{0EB3F101-224A-4B2B-9E5B-DF720857529C} Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550055445579} Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660066446679} Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{77777777-7777-7777-7777-770077447779} Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{A1F1ECD3-4806-44C6-A869-F0DADF11C57C} Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{A439801C-961D-452C-AB42-7848E9CBD289} Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{EEE6C358-6118-11DC-9C72-001320C79847} Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847} Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847} Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{F4EBB1E2-21F3-4786-8CF4-16EC5925867F} Clé Supprimée : HKLM\SOFTWARE\Classes\MediaPlayer.GraphicsUtils Clé Supprimée : HKLM\SOFTWARE\Classes\MediaPlayer.GraphicsUtils.1 Clé Supprimée : HKLM\SOFTWARE\Classes\MF Clé Supprimée : HKLM\SOFTWARE\Classes\MgMediaPlayer.GifAnimator Clé Supprimée : HKLM\SOFTWARE\Classes\MgMediaPlayer.GifAnimator.1 Clé Supprimée : HKLM\SOFTWARE\Classes\ShoppingReport2.HbAx Clé Supprimée : HKLM\SOFTWARE\Classes\ShoppingReport2.HbAx.1 Clé Supprimée : HKLM\SOFTWARE\Classes\ShoppingReport2.HbInfoBand Clé Supprimée : HKLM\SOFTWARE\Classes\ShoppingReport2.HbInfoBand.1 Clé Supprimée : HKLM\SOFTWARE\Classes\ShoppingReport2.IEButton Clé Supprimée : HKLM\SOFTWARE\Classes\ShoppingReport2.IEButton.1 Clé Supprimée : HKLM\SOFTWARE\Classes\ShoppingReport2.IEButtonA Clé Supprimée : HKLM\SOFTWARE\Classes\ShoppingReport2.IEButtonA.1 Clé Supprimée : HKLM\SOFTWARE\Classes\ShoppingReport2.RprtCtrl Clé Supprimée : HKLM\SOFTWARE\Classes\ShoppingReport2.RprtCtrl.1 Clé Supprimée : HKLM\SOFTWARE\Classes\sim-packages Clé Supprimée : HKLM\SOFTWARE\Classes\SWEETIE.IEToolbar Clé Supprimée : HKLM\SOFTWARE\Classes\SWEETIE.IEToolbar.1 Clé Supprimée : HKLM\SOFTWARE\Classes\sweetim_urlsearchhook.toolbarurlsearchhook Clé Supprimée : HKLM\SOFTWARE\Classes\sweetim_urlsearchhook.toolbarurlsearchhook.1 Clé Supprimée : HKLM\SOFTWARE\Classes\Toolbar3.sweetie Clé Supprimée : HKLM\SOFTWARE\Classes\Toolbar3.sweetie.1 Clé Supprimée : HKLM\SOFTWARE\Classes\TypeLib\{44444444-4444-4444-4444-440044444479} Clé Supprimée : HKLM\SOFTWARE\Classes\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19} Clé Supprimée : HKLM\SOFTWARE\Classes\TypeLib\{B035BA6B-57CD-4F72-B545-65BE465FCAF6} Clé Supprimée : HKLM\SOFTWARE\Classes\TypeLib\{D44FD6F0-9746-484E-B5C4-C66688393872} Clé Supprimée : HKLM\SOFTWARE\Classes\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847} Clé Supprimée : HKLM\SOFTWARE\Classes\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847} Clé Supprimée : HKLM\Software\DealPly Clé Supprimée : HKLM\SOFTWARE\Google\Chrome\Extensions\dednnpigldgdbpgcdpfppmlcnnbjciel Clé Supprimée : HKLM\SOFTWARE\Google\Chrome\Extensions\dhkplhfnhceodhffomolpfigojocbpcb Clé Supprimée : HKLM\SOFTWARE\Google\Chrome\Extensions\gaiilaahiahdejapggenmdmafpmbipje Clé Supprimée : HKLM\SOFTWARE\Google\Chrome\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn Clé Supprimée : HKLM\SOFTWARE\Google\Chrome\Extensions\lpmkgpnbiojfaoklbkpfneikocaobfai Clé Supprimée : HKLM\SOFTWARE\Google\Chrome\Extensions dkhncnongaclekkbelchmeafffimifj Clé Supprimée : HKLM\Software\HBLite Clé Supprimée : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110011441179} Clé Supprimée : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A078F691-9C07-4AF2-BF43-35E79EECF8B7} Clé Supprimée : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EEE6C367-6118-11DC-9C72-001320C79847} Clé Supprimée : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847} Clé Supprimée : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE7E0A3-AE64-4DC8-84D1-F5D7BAF2DB0C} Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111- 110011441179} Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A6174F27-1FFF-E1D6-A93F- BA48AD5DD448} Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CA4520F3-AE13-4FB1-A513- 58E23991C86D} Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72- 001320C79847} Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110011441179} Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{83AA2913-C123-4146-85BD-AD8F93971D39} Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DealPly Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Giant Savings Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ShoppingReport2 Clé Supprimée : HKLM\Software\Offerbox Clé Supprimée : HKLM\Software\ShoppingReport2 Clé Supprimée : HKLM\Software\SweetIm Valeur Supprimée : HKCU\Software\Microsoft\Internet Explorer\New Windows\Allow [*.chat-land.org] Valeur Supprimée : HKCU\Software\Microsoft\Internet Explorer\New Windows\Allow [*.crossrider.com] Valeur Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [Media Finder] Valeur Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [quqws] Valeur Supprimée : HKLM\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow [*.crossrider.com] Valeur Supprimée : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{EEE6C35B-6118-11DC-9C72-001320C79847}] Valeur Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [SweetIM] Valeur Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [Sweetpacks Communicator] Valeur Supprimée : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [hblite@hblite.com] ***** [Navigateurs] ***** -\ Internet Explorer v9.0.8112.16421 Restauré : [HKCU\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope] Restauré : [HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes - DefaultScope] Restauré : [HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope] Restauré : [HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope] Restauré : [HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope] Remplacé : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Main - Start Page] = hxxp://home.sweetim.com/?crg=3.26010003&st=12&barid= {746375C9-F908-11E1-8A07-001BFC1BAB23} --> hxxp://www.google.com Remplacé : [HKCU\Software\Microsoft\Internet Explorer\Main - Default_Page_URL] = hxxp://google.cherche.us/ --> hxxp://www.google.com -\ Mozilla Firefox v3.0.10 (fr) Nom du profil : default Fichier : C:\Users\yannos\AppData\Roaming\Mozilla\Firefox\Profiles\sqt43kb3.default\prefs.js C:\Users\yannos\AppData\Roaming\Mozilla\Firefox\Profiles\sqt43kb3.default\user.js ... Supprimé ! Supprimée : user_pref("browser.search.defaultengine", "Ask.com Search"); Supprimée : user_pref("browser.search.defaultenginename", "SweetIM Search"); Supprimée : user_pref("browser.search.order.1", "Ask.com Search"); Supprimée : user_pref("browser.search.selectedEngine", "SweetIM Search"); Supprimée : user_pref("browser.startup.homepage", "hxxp://home.sweetim.com/?crg=3.26010003&st=12&barid={746375C9[...] Supprimée : user_pref("extensions.BabylonToolbar.admin", false); Supprimée : user_pref("extensions.BabylonToolbar.aflt", "babsst"); Supprimée : user_pref("extensions.BabylonToolbar.babExt", ""); Supprimée : user_pref("extensions.BabylonToolbar.babTrack", "affID=113480"); Supprimée : user_pref("extensions.BabylonToolbar.bbDpng", 7); Supprimée : user_pref("extensions.BabylonToolbar.dfltLng", "en"); Supprimée : user_pref("extensions.BabylonToolbar.dfltSrch", true); Supprimée : user_pref("extensions.BabylonToolbar.hmpg", true); Supprimée : user_pref("extensions.BabylonToolbar.id", "301dd36f000000000000001bfc1bab23"); Supprimée : user_pref("extensions.BabylonToolbar.instlDay", "15534"); Supprimée : user_pref("extensions.BabylonToolbar.instlRef", "sst"); Supprimée : user_pref("extensions.BabylonToolbar.keyWordUrl", "hxxp://search.babylon.com/?affID=113480&babsrc=KW[...] Supprimée : user_pref("extensions.BabylonToolbar.lastDP", 7); Supprimée : user_pref("extensions.BabylonToolbar.lastVrsnTs", "1.5.3.1719:58:18"); Supprimée : user_pref("extensions.BabylonToolbar.mntrFFxVrsn", "3.0"); Supprimée : user_pref("extensions.BabylonToolbar.newTab", true); Supprimée : user_pref("extensions.BabylonToolbar.newTabUrl", "hxxp://search.babylon.com/?babsrc=NT_bb"); Supprimée : user_pref("extensions.BabylonToolbar.noFFXTlbr", false); Supprimée : user_pref("extensions.BabylonToolbar.prdct", "BabylonToolbar"); Supprimée : user_pref("extensions.BabylonToolbar.propectorlck", 85598909); Supprimée : user_pref("extensions.BabylonToolbar.prtkHmpg", 1); Supprimée : user_pref("extensions.BabylonToolbar.prtnrId", "babylon"); Supprimée : user_pref("extensions.BabylonToolbar.ptch_0717", true); Supprimée : user_pref("extensions.BabylonToolbar.smplGrp", "none"); Supprimée : user_pref("extensions.BabylonToolbar.srcExt", "ss"); Supprimée : user_pref("extensions.BabylonToolbar.tlbrId", "tb9"); Supprimée : user_pref("extensions.BabylonToolbar.vrsn", "1.5.3.17"); Supprimée : user_pref("extensions.BabylonToolbar.vrsnTs", "1.5.3.1719:58:18"); Supprimée : user_pref("extensions.BabylonToolbar.vrsni", "1.5.3.17"); Supprimée : user_pref("extensions.BabylonToolbar_i.aflt", "babsst"); Supprimée : user_pref("extensions.BabylonToolbar_i.babExt", ""); Supprimée : user_pref("extensions.BabylonToolbar_i.babTrack", "affID=113480"); Supprimée : user_pref("extensions.BabylonToolbar_i.hardId", "301dd36f000000000000001bfc1bab23"); Supprimée : user_pref("extensions.BabylonToolbar_i.id", "301dd36f000000000000001bfc1bab23"); Supprimée : user_pref("extensions.BabylonToolbar_i.instlDay", "15534"); Supprimée : user_pref("extensions.BabylonToolbar_i.instlRef", "sst"); Supprimée : user_pref("extensions.BabylonToolbar_i.newTab", false); Supprimée : user_pref("extensions.BabylonToolbar_i.prdct", "BabylonToolbar"); Supprimée : user_pref("extensions.BabylonToolbar_i.prtnrId", "babylon"); Supprimée : user_pref("extensions.BabylonToolbar_i.smplGrp", "none"); Supprimée : user_pref("extensions.BabylonToolbar_i.srcExt", "ss"); Supprimée : user_pref("extensions.BabylonToolbar_i.tlbrId", "tb9"); Supprimée : user_pref("extensions.BabylonToolbar_i.vrsn", "1.5.3.17"); Supprimée : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.5.3.1719:58:18"); Supprimée : user_pref("extensions.BabylonToolbar_i.vrsni", "1.5.3.17"); Supprimée : user_pref("extensions.crossriderapp4479.adsOldValue", -1); Supprimée : user_pref("keyword.URL", "hxxp://search.sweetim.com/search.asp?src=2&crg=3.1010000.10015&q="); Supprimée : user_pref("sweetim.toolbar.cargo", "3.1010000.10015"); Supprimée : user_pref("sweetim.toolbar.dialogs.0.enable", "true"); Supprimée : user_pref("sweetim.toolbar.dialogs.0.handler", "chrome://sim_toolbar_package/content/optionsdialog-h[...] Supprimée : user_pref("sweetim.toolbar.dialogs.0.height", "335"); Supprimée : user_pref("sweetim.toolbar.dialogs.0.id", "id_options_dialog"); Supprimée : user_pref("sweetim.toolbar.dialogs.0.title", "$string.config.label;"); Supprimée : user_pref("sweetim.toolbar.dialogs.0.url", "hxxp://www.sweetim.com/simffbar/options_remote_ff.html")[...] Supprimée : user_pref("sweetim.toolbar.dialogs.0.width", "761"); Supprimée : user_pref("sweetim.toolbar.dialogs.1.enable", "true"); Supprimée : user_pref("sweetim.toolbar.dialogs.1.handler", "chrome://sim_toolbar_package/content/exampledialog-h[...] Supprimée : user_pref("sweetim.toolbar.dialogs.1.height", "300"); Supprimée : user_pref("sweetim.toolbar.dialogs.1.id", "id_example_dialog"); Supprimée : user_pref("sweetim.toolbar.dialogs.1.title", "Example (unit-test) dialog"); Supprimée : user_pref("sweetim.toolbar.dialogs.1.url", "chrome://sim_toolbar_package/content/exampledialog.html"[...] Supprimée : user_pref("sweetim.toolbar.dialogs.1.width", "500"); Supprimée : user_pref("sweetim.toolbar.dnscatch.domain-blacklist", ".*.sweetim.com/.*|.*.facebook.com/.*|.*.goog[...] Supprimée : user_pref("sweetim.toolbar.highlight.colors", "#FFFF00,#00FFE4,#5AFF00,#0087FF,#FFCC00,#FF00F0"); Supprimée : user_pref("sweetim.toolbar.logger.ConsoleHandler.MinReportLevel", "7"); Supprimée : user_pref("sweetim.toolbar.logger.FileHandler.FileName", "ff-toolbar.log"); Supprimée : user_pref("sweetim.toolbar.logger.FileHandler.MaxFileSize", "200000"); Supprimée : user_pref("sweetim.toolbar.logger.FileHandler.MinReportLevel", "7"); Supprimée : user_pref("sweetim.toolbar.mode.debug", "false"); Supprimée : user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "Ask.com Search"); Supprimée : user_pref("sweetim.toolbar.previous.browser.search.defaulturl", "hxxp://www.bing.com/search?FORM=IEF[...] Supprimée : user_pref("sweetim.toolbar.previous.browser.search.selectedEngine", ""); Supprimée : user_pref("sweetim.toolbar.previous.browser.startup.homepage", "hxxp://search.babylon.com/?affID=113[...] Supprimée : user_pref("sweetim.toolbar.previous.keyword.URL", "hxxp://search.sweetim.com/search.asp?src=2&q="); Supprimée : user_pref("sweetim.toolbar.scripts.0.addcontextdiv", "true"); Supprimée : user_pref("sweetim.toolbar.scripts.0.callback", "simVerification"); Supprimée : user_pref("sweetim.toolbar.scripts.0.domain-blacklist", ""); Supprimée : user_pref("sweetim.toolbar.scripts.0.domain-whitelist", "hxxp://(www.|apps.)?facebook\.com.*"); Supprimée : user_pref("sweetim.toolbar.scripts.0.elementid", "id_script_sim_fb"); Supprimée : user_pref("sweetim.toolbar.scripts.0.enable", "true"); Supprimée : user_pref("sweetim.toolbar.scripts.0.id", "id_script_fb"); Supprimée : user_pref("sweetim.toolbar.scripts.0.url", "hxxp://sc.sweetim.com/apps/in/fb/infb.js"); Supprimée : user_pref("sweetim.toolbar.scripts.1.addcontextdiv", "false"); Supprimée : user_pref("sweetim.toolbar.scripts.1.callback", ""); Supprimée : user_pref("sweetim.toolbar.scripts.1.domain-blacklist", ".*.google..*|.*.bing..*|.*.live..*|.*.msn..[...] Supprimée : user_pref("sweetim.toolbar.scripts.1.domain-whitelist", ""); Supprimée : user_pref("sweetim.toolbar.scripts.1.elementid", "id_predict_include_script"); Supprimée : user_pref("sweetim.toolbar.scripts.1.enable", "false"); Supprimée : user_pref("sweetim.toolbar.scripts.1.id", "id_script_prad"); Supprimée : user_pref("sweetim.toolbar.scripts.1.url", "hxxp://cdn1.predictad.com/scripts/publishers/sweetim/pre[...] Supprimée : user_pref("sweetim.toolbar.search.external", "

yann252 · Answer

j'ai pu le poster en passant par chrome. encor un mystere!!

yann252 · Answer

Pour info les pub persiste!

g3n-h@ckm@n · Answer

re

Attention !!! : cet outil peut etre détecté à tort comme virus
Attention !!! : cet outil est puissant suivre scrupuleusement les instructions ci-dessous

tous les processus "non vitaux de windows" vont être coupés , enregistre ton travail.

Désactive toutes tes protections si possible , antivirus , sandbox , pare-feux , etc....

telecharge et enregistre Pre_Scan sur ton bureau :

http://forums-fec.be/gen-hackman/Pre_Scan.exe

mirroirs :

http://general-changelog-team.fr/fr/downloads/viewdownload/41-outils-de-gen-hackman/52-pre-scan
http://www.archive-host.com

Avertissement :Il y aura une extinction du bureau pendant le scan --> pas de panique.

une fois telechargé lance-le , laisse faire le scan jusqu'à l'apparition de "Pre_scan_la_date_et_l'heure.txt" sur le bureau.

si l'outil est relancé plusieurs fois , il te proposera un menu et qu'aucune option n'est demandée, lance l'option "Kill"

si l'outil est bloqué par l'infection utilise cette version avec extension .pif :

http://forums-fec.be/gen-hackman/Pre_Scan.pif

si l'outil detecte un proxy et que tu n'en as pas installé clique sur "supprimer le proxy"

Il se peut qu'une multitude de fenêtres noires clignotent , laisse-le travailler

Poste Pre_Scan_la_date_et_l'heure.txt qui apparaitra sur le bureau en fin de scan

Il est possible que l'outil fasse redemarrer ton pc , laisse-le faire

NE LE POSTE PAS SUR LE FORUM !!! (il est trop long)

Heberge le rapport sur http://pjjoint.malekal.com puis donne le lien obtenu en echange sur le forum où tu te fais aider

yann252 · Answer

http://forums-fec.be/gen-hackman/Pre_Scan.exe 

je clic sur le lien si dessus et une fenêtre s'ouvre en me disant que le logiciel est en cour de maintenance dois-je  utilisé le lien suivant?

http://forums-fec.be/gen-hackman/Pre_Scan.pif

g3n-h@ckm@n · Answer

hello non je suis en train de faire d'enormes modifs et comme il y avait une erreur de codage j'ai preferé le mettre en maintenance en attendant de renvoyer une version stable d'ici une ou deux heures

==

yann252 · Answer

Ok si c'est trop tard se soir je le lancerai demain.

Merci!!!

Cdt

g3n-h@ckm@n · Answer

hello c'est pas encore pret

==

<
fermer toutes les fenêtres et applications lors de l'installation et de l'analyse.


&#9654 Télécharge ici :

Malwarebytes  

&#9654 Installe le ( choisis bien "francais" ; ne modifie pas les paramètres d'installe ) et mets le à jour .

relance malwarebytes en suivant scrupuleusement ces consignes :

! Déconnecte toi et ferme toutes applications en cours !

&#9654 Lance Malwarebyte's .

Fais un examen dit "Complet" .

&#9654 Laisse le programme travailler ( et ne rien faire d'autre avec le PC durant le scan ).
&#9654 à la fin tu cliques sur "résultat" .
&#9654 Vérifie que tous les objets infectés soient validés, puis clique sur " suppression " .

&#9654 Note : si il faut redémarrer ton PC pour finir le nettoyage, fais le !


&#9654 Poste le rapport sauvegardé après la suppression des objets infectés (dans l'onglet "rapport/log"de Malwarebytes, le dernier en date)

yann252 · Answer

Bonjour!!

voici le premier rapport malwarebytes



Malwarebytes Anti-Malware (Essai) 1.65.0.1400
www.malwarebytes.org

Version de la base de données: v2012.09.13.07

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
yannos :: PC-DE-YANNOS [administrateur]

Protection: Activé

13/09/2012 17:02:41
mbam-log-2012-09-13 (17-02-41).txt

Type d'examen: Examen complet (C:\|D:\|)
Options d'examen activées: Mémoire | Démarrage | Registre | Système de fichiers | Heuristique/Extra | Heuristique/Shuriken | PUP | PUM
Options d'examen désactivées: P2P
Elément(s) analysé(s): 462527
Temps écoulé: 1 heure(s), 39 minute(s), 17 seconde(s)

Processus mémoire détecté(s): 0
(Aucun élément nuisible détecté)

Module(s) mémoire détecté(s): 0
(Aucun élément nuisible détecté)

Clé(s) du Registre détectée(s): 7
HKCR\CLSID\{43F7497C-7687-4DEA-A057-F21BD81BC896} (Trojan.BHO.SM) -> Mis en quarantaine et supprimé avec succès.
HKCR\TypeLib\{3A793B2A-0DD7-4C90-BA18-B92FA8EC0AF5} (Trojan.BHO.SM) -> Mis en quarantaine et supprimé avec succès.
HKCR\Interface\{28D2CE37-2D49-4011-B418-E9DD2FC75961} (Trojan.BHO.SM) -> Mis en quarantaine et supprimé avec succès.
HKCR\Microsoft.MSJava32.1 (Trojan.BHO.SM) -> Mis en quarantaine et supprimé avec succès.
HKCR\Microsoft.MSJava32 (Trojan.BHO.SM) -> Mis en quarantaine et supprimé avec succès.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{43F7497C-7687-4DEA-A057-F21BD81BC896} (Trojan.BHO.SM) -> Mis en quarantaine et supprimé avec succès.
HKCU\SOFTWARE\fcn (Rogue.Residue) -> Mis en quarantaine et supprimé avec succès.

Valeur(s) du Registre détectée(s): 0
(Aucun élément nuisible détecté)

Elément(s) de données du Registre détecté(s): 1
HKCR\regfile\shell\open\command| (Broken.OpenCommand) -> Mauvais: ("regedit.exe" "%1") Bon: (regedit.exe "%1") -> Mis en quarantaine et réparé avec succès

Dossier(s) détecté(s): 0
(Aucun élément nuisible détecté)

Fichier(s) détecté(s): 8
C:\Users\yannos\AppData\Local\Nokia\Nokia Music\20090619.log (Extension.Mismatch) -> Mis en quarantaine et supprimé avec succès.
C:\Users\yannos\Documents\dossier\SONY\ALL MUSIC PROGRAMS-FLSTUDIO-FRUITYLOOPS-ACID-SOUND FORGE-ACID-LOGIC-VST PLUGINS-DX PLUGINS-SOUND PACKS\Sonic-Foundry + Sony - Products - Keygens.exe (Trojan.Downloader) -> Mis en quarantaine et supprimé avec succès.
C:\Users\yannos\Documents\dossier\SONY\Sony Sound Forge v8.0 FULL with many plugins\Additional Plugins\Sonic Foundry MP3 Plugin v.2.0 [KEYGEN]\Keygen.exe (Trojan.Agent.CK) -> Mis en quarantaine et supprimé avec succès.
C:\Users\yannos\Documents\dossier\SONY\Sony Sound Forge v8.0 FULL with many plugins\Additional Plugins\Sonic Foundry Noise Reduction 2.0a\crack\damn_NoisePlugin_kg.exe (Trojan.Agent.CK) -> Mis en quarantaine et supprimé avec succès.
C:\Users\yannos\Documents\dossier\SONY\Sony Sound Forge v8.0 FULL with many plugins\Best Plugins\SF Noise Reduction DX Plugin 2.02a WORKS w keygen\SF Noise Reduction DX Plugin 2.02a Keygen.exe (Trojan.Agent.CK) -> Mis en quarantaine et supprimé avec succès.
C:\Users\yannos\Documents\dossier\SONY\Sony Sound Forge v8.0 FULL with many plugins\Crack\keygen.exe (Trojan.Downloader) -> Mis en quarantaine et supprimé avec succès.
C:\Users\yannos\Tracing\Downloads\bossofscandalzstrategyztorrent.exe (PUP.Adware.MediaGet) -> Mis en quarantaine et supprimé avec succès.
C:\Users\yannos\Tracing\Downloads\MusicConverterSetup.exe (Adware.Agent) -> Mis en quarantaine et supprimé avec succès.

(fin)

yann252 · Answer

le second rapport


2012/09/13 17:01:27 +0200	PC-DE-YANNOS	yannos	MESSAGE	Starting protection
2012/09/13 17:01:27 +0200	PC-DE-YANNOS	yannos	MESSAGE	Protection started successfully
2012/09/13 17:01:27 +0200	PC-DE-YANNOS	yannos	MESSAGE	Starting IP protection
2012/09/13 17:01:32 +0200	PC-DE-YANNOS	yannos	MESSAGE	IP Protection started successfully
2012/09/13 17:01:39 +0200	PC-DE-YANNOS	yannos	MESSAGE	Starting database refresh
2012/09/13 17:01:39 +0200	PC-DE-YANNOS	yannos	MESSAGE	Stopping IP protection
2012/09/13 17:01:40 +0200	PC-DE-YANNOS	yannos	MESSAGE	IP Protection stopped successfully
2012/09/13 17:01:42 +0200	PC-DE-YANNOS	yannos	MESSAGE	Database refreshed successfully
2012/09/13 17:01:42 +0200	PC-DE-YANNOS	yannos	MESSAGE	Starting IP protection
2012/09/13 17:01:47 +0200	PC-DE-YANNOS	yannos	MESSAGE	IP Protection started successfully
2012/09/13 18:19:24 +0200	PC-DE-YANNOS	yannos	MESSAGE	Executing scheduled update:  Daily
2012/09/13 18:19:25 +0200	PC-DE-YANNOS	yannos	ERROR	Scheduled update failed:  Host not found failed with error code 0
2012/09/13 18:47:53 +0200	PC-DE-YANNOS	yannos	MESSAGE	Starting protection
2012/09/13 18:47:53 +0200	PC-DE-YANNOS	yannos	MESSAGE	Protection started successfully
2012/09/13 18:47:53 +0200	PC-DE-YANNOS	yannos	MESSAGE	Starting IP protection
2012/09/13 18:47:57 +0200	PC-DE-YANNOS	yannos	MESSAGE	IP Protection started successfully

yann252 · Answer

Les pubs continue! 

Est ce que je doit utiliser pre scan?

g3n-h@ckm@n · Answer

tu peux maintenant oui

yann252 · Answer

salut
Problème avec pre scan que se soit en .exe ou .pif, j'ai bien désactivé par feu et avast, je clic sur le lien et l'installation se fait correctement puis la page de mon bureau apparais et tout est fermé comme tu me la indiqué mais quand il se lance tout seul ou que je le lance en cliquant sur "kill" il travail quelque seconde puis une fenêtre s'ouvre et me dit qu'il a cessé de fonctionner!
J'ai répété l'opération plusieurs fois et c'est le même résultat.

g3n-h@ckm@n · Answer

/!\ ATTENTION SUIVRE A LA LETTRE CES INDICATIONS/!\ __________________________________________________________ >Ce logiciel n'est à utiliser que prescrit par un helper qualifié et formé à l'outil.< >>>>>>>[u]Ne pas utiliser en dehors de ce cas de figure : dangereux<<<<<<<< ===================================================== Surtout , pense à l'enregistrement à renommer Combofix en "ton prenom.exe" avant qu'il soit enregistré sur ton disque dur Telecharge ici : http://download.bleepingcomputer.com/sUBs/ComboFix.exe Combofix Si tu utilises AVG, IL FAUT IMPERATIVEMENT LE DESINSTALLER avant d'utiliser Combofix car il peut causer des dégâts en interaction avec l'outil pouvant mener à la réinstallation totale du système. La simple désactivation du résident n'est pas suffisante. Télécharge le désinstalleur d'AVG sur ce lien : https://www.avg.com/fr-fr/avg-remover Choisis la version adéquate (32 ou 64 bits)/!\ _________________________________________________________ >> referme les fenêtres de tous les programmes en cours. >>Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, >>la protection en temps réel de ton Antivirus et de tes Antispywares, >>qui peuvent gêner fortement la procédure de recherche et de nettoyage de l'outil. °°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°° si tu as XP => double clique si tu as Vista ou windows 7 => clic droit "executer en tant que...." sur combofix renommé !!!!!NE TOUCHE A RIEN PENDANT LE TRAVAIL DE COMBOFIX (SOURIS/CLAVIER.....)!!!!! n'oublie pas de reactiver la garde de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet. Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.

yann252 · Answer

voici le rapport combofix

g3n-h@ckm@n · Answer

ah ouais !!! il est joli !!!

yann252 · Answer

impossible de poster le rapport!!!

quand je clic sur valider message rouge apparait  "titre non renseigné"

la jcomprend pas...

g3n-h@ckm@n · Answer

inscris-toi sur commentcamarche il passera

yann252 · Answer

ComboFix 12-09-14.03 - yannos 14/09/2012  17:13:51.1.2 - x86
Microsoft® Windows Vista(TM) Édition Familiale Premium   6.0.6002.2.1252.33.1036.18.1790.899 [GMT 2:00]
Lancé depuis: c:\users\yannos\Tracing\Downloads\yann.exe.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\yannos\AppData\Roaming\Rewire.dll
c:\users\yannos\AppData\Roaming\REX Shared Library.dll
c:\windows\iun6002.exe
c:\windows\system32\muzapp.exe
D:\Autorun.inf
.
.
(((((((((((((((((((((((((((((((((((((((   Pilotes/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_Boonty Games
.
.
(((((((((((((((((((((((((((((   Fichiers créés du 2012-08-14 au 2012-09-14  ))))))))))))))))))))))))))))))))))))
.
.
2012-09-14 15:21 . 2012-09-14 15:24	--------	d-----w-	c:\users\yannos\AppData\Local	emp
2012-09-14 14:39 . 2012-09-14 14:50	--------	d-----w-	C:\Pre_Scan
2012-09-14 14:39 . 2012-08-23 07:15	7022536	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{6AD44E9F-9B5D-4AEB-B4BC-D62F5AA14CD2}\mpengine.dll
2012-09-14 14:39 . 2012-09-14 14:39	--------	d-----w-	C:\4f59c56da0d10f85e97f6dd27763c376
2012-09-13 15:01 . 2012-09-13 15:01	--------	d-----w-	c:\users\yannos\AppData\Roaming\Malwarebytes
2012-09-13 15:01 . 2012-09-13 15:01	--------	d-----w-	c:\programdata\Malwarebytes
2012-09-13 15:01 . 2012-09-13 15:01	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2012-09-13 15:01 . 2012-09-07 15:04	22856	----a-w-	c:\windows\system32\drivers\mbam.sys
2012-09-11 15:32 . 2012-09-11 15:32	--------	d-----w-	c:\program files\Winamax Poker
2012-09-09 12:47 . 2012-09-09 12:47	--------	d-----w-	c:\program files\Canal+
2012-09-08 18:29 . 2012-09-08 18:29	--------	d-----w-	c:\program files\File Scanner Library (Spybot - Search & Destroy)
2012-09-07 17:38 . 2011-12-21 15:35	80488	----a-w-	c:\windows\system32\RtNicProp32.dll
2012-09-07 17:38 . 2011-09-08 14:40	100896	----a-w-	c:\windows\system32\RTNUninst32.dll
2012-09-07 17:38 . 2011-09-08 14:40	363112	----a-w-	c:\windows\system32\drivers\Rtlh86.sys
2012-09-07 17:38 . 2012-09-07 17:38	--------	d-----w-	c:\program files\Realtek
2012-09-07 17:26 . 2012-09-07 17:26	--------	d-----w-	c:\programdata\ATI
2012-09-07 17:22 . 2012-09-07 17:22	0	----a-w-	c:\windows\ativpsrm.bin
2012-09-07 17:03 . 2012-09-07 17:03	--------	d-----w-	c:\program files\ma-config.com
2012-09-07 17:03 . 2012-09-07 17:03	--------	d-----w-	c:\programdata\ma-config.com
2012-09-07 16:43 . 2012-09-07 16:43	--------	d-----w-	c:\program files\DriverTuner
2012-09-07 16:24 . 2012-09-07 16:24	--------	d-sh--w-	c:\windows\ftpcache
2012-09-07 16:24 . 2012-09-07 16:24	--------	d-----w-	c:\program files\FLV-Media Player
2012-09-07 16:23 . 2012-09-14 14:33	--------	d-----w-	c:\users\yannos\AppData\Local\Lollipop
2012-08-18 19:57 . 2012-08-18 19:57	--------	d-----w-	c:\users\yannos\AppData\Roaming\fr.barrierepoker.air.D043989C8F5E91300BF71855036B28F854BB8613.1
2012-08-18 19:56 . 2012-08-18 20:17	--------	d-----w-	c:\users\yannos\BarrierePoker.fr
2012-08-18 19:56 . 2012-08-18 19:56	--------	d-----w-	c:\program files\BarrierePoker.fr
2012-08-16 18:29 . 2012-08-16 18:29	--------	d-----w-	c:\program files\Windows Portable Devices
2012-08-16 18:23 . 2009-09-10 02:00	92672	----a-w-	c:\windows\system32\UIAnimation.dll
2012-08-16 18:23 . 2009-09-10 02:01	3023360	----a-w-	c:\windows\system32\UIRibbon.dll
2012-08-16 18:23 . 2009-09-10 02:00	1164800	----a-w-	c:\windows\system32\UIRibbonRes.dll
2012-08-16 18:08 . 2012-08-16 18:10	--------	d-----w-	c:\users\yannos\AppData\Local\Facebook
.
.
.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-09-08 18:42 . 2012-04-28 08:48	696520	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2012-09-08 18:42 . 2011-08-10 08:29	73416	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2012-08-21 09:13 . 2011-06-18 09:57	729752	----a-w-	c:\windows\system32\drivers\aswSnx.sys
2012-08-21 09:13 . 2009-09-19 13:59	54232	----a-w-	c:\windows\system32\drivers\aswTdi.sys
2012-08-21 09:13 . 2009-09-19 13:58	355632	----a-w-	c:\windows\system32\drivers\aswSP.sys
2012-08-21 09:13 . 2009-09-19 13:59	35928	----a-w-	c:\windows\system32\drivers\aswRdr.sys
2012-08-21 09:13 . 2009-09-19 13:58	58680	----a-w-	c:\windows\system32\drivers\aswMonFlt.sys
2012-08-21 09:13 . 2009-09-19 13:58	21256	----a-w-	c:\windows\system32\drivers\aswFsBlk.sys
2012-08-21 09:12 . 2011-01-03 15:50	41224	----a-w-	c:\windows\avastSS.scr
2012-08-21 09:12 . 2009-09-19 13:58	227648	----a-w-	c:\windows\system32\aswBoot.exe
2012-07-05 20:06 . 2012-07-15 16:22	772544	----a-w-	c:\windows\system32
pDeployJava1.dll
2012-07-05 20:06 . 2010-04-18 14:10	687544	----a-w-	c:\windows\system32\deployJava1.dll
2012-07-04 14:02 . 2012-08-15 09:22	2047488	----a-w-	c:\windows\system32\win32k.sys
2012-06-29 00:16 . 2012-08-15 09:23	1800704	----a-w-	c:\windows\system32\jscript9.dll
2012-06-29 00:09 . 2012-08-15 09:23	1129472	----a-w-	c:\windows\system32\wininet.dll
2012-06-29 00:08 . 2012-08-15 09:23	1427968	----a-w-	c:\windows\system32\inetcpl.cpl
2012-06-29 00:04 . 2012-08-15 09:23	142848	----a-w-	c:\windows\system32\ieUnatt.exe
2012-06-29 00:00 . 2012-08-15 09:23	2382848	----a-w-	c:\windows\system32\mshtml.tlb
2007-10-07 19:07 . 2007-10-07 19:07	4394	----a-w-	c:\program files\ffdssetts.reg
2007-10-07 19:07 . 2007-10-07 19:07	32208	----a-w-	c:\program files\ffdsvsetts.reg
2007-10-07 19:07 . 2007-10-07 19:07	2062	----a-w-	c:\program files\ffdsasetts.reg
.
.
(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0F6E720A-1A6B-40E1-A294-1D4D19F156C8}]
2010-07-19 16:32	165184	----a-w-	c:\program files\SFR\Kit\SFRNavErrorHelper.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-08-21 09:12	121528	----a-w-	c:\program files\Alwil Software\Avast5\ashShell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-15 00:32	94208	----a-w-	c:\users\yannos\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-15 00:32	94208	----a-w-	c:\users\yannos\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-15 00:32	94208	----a-w-	c:\users\yannos\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-09 39408]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"Facebook Update"="c:\users\yannos\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-08-16 138096]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-07-25 563984]
"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" [2007-07-25 2027792]
"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2007-08-07 200704]
"UMonit"="c:\windows\system32\UMonit.exe" [2007-06-18 200704]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-08-03 36352]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-04-20 58656]
"SMSTray"="c:\program files\Samsung\EmoDio\SMSTray.exe" [2009-04-16 479232]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-07-05 421888]
"TkBellExe"="c:\program filesealealplayer\Updateealsched.exe" [2012-05-23 296056]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-02-10 61440]
"CANAL+ CANALSAT A LA DEMANDE"="c:\program files\Canal+\CANAL+ CANALSAT A LA DEMANDE\Launcher.exe" [2011-10-20 163992]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2007-03-23 40072]
.
c:\users\yannos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
lollipop.lnk - c:\users\yannos\AppData\Local\Lollipop\Lollipop.exe [2012-9-7 799744]
ZooskMessenger.lnk - c:\program files\ZooskMessenger\ZooskMessenger.exe [N/A]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-18 65588]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"PromptOnSecureDesktop"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"
.
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [x]
.
.
--- Autres Services/Pilotes en mémoire ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation	REG_MULTI_SZ   	FontCache
.
Contenu du dossier 'Tâches planifiées'
.
2012-09-14 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-28 18:42]
.
2012-09-13 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1170913042-1277233965-3038881231-1000Core.job
- c:\users\yannos\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-08-16 18:07]
.
2012-09-14 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1170913042-1277233965-3038881231-1000UA.job
- c:\users\yannos\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-08-16 18:07]
.
2012-09-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-05 17:03]
.
2012-09-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-05 17:03]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
mStart Page = hxxp://www.google.com
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
IE: {{06568ceb-5721-47d4-9d93-7e604fcbaeab} - c:\programs\PMU\PMUPoker\RunApp.exe
TCP: DhcpNameServer = 192.168.1.1
DPF: {04CB5B64-5915-4629-B869-8945CEBADD21} - hxxps://static.impots.gouv.fr/abos/static/securite/certdgi1.cab
FF - ProfilePath - c:\users\yannos\AppData\Roaming\Mozilla\Firefox\Profiles\sqt43kb3.default\
FF - prefs.js: browser.search.defaulturl - 
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Google Toolbar for Firefox: {3112ca9c-de6d-4884-a869-9855de68056c} - %profile%\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
FF - Ext: CacheViewer: {71328583-3CA7-4809-B4BA-570A85818FBB} - %profile%\extensions\{71328583-3CA7-4809-B4BA-570A85818FBB}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: RealPlayer Browser Record Plugin: {97E22097-9A2F-45b1-8DAF-36AD648C7EF4} - c:\programdata\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF - Ext: avast! WebRep: wrc@avast.com - c:\program files\Alwil Software\Avast5\WebRep\FF
.
- - - - ORPHELINS SUPPRIMES - - - -
.
HKLM-Run-Nokia FastStart - c:\program files\Nokia\Nokia Music\NokiaMusic.exe
AddRemove-kifrolqn - c:\users\yannos\appdata\local\kifrolqn.bat
AddRemove-PKR - c:\program files\PKR\uninstall-pkr.exe
AddRemove-Steam App 320 - c:\program files\Steam\steam.exe
AddRemove-Steam App 340 - c:\program files\Steam\steam.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-09-14 17:25
Windows 6.0.6002 Service Pack 2 NTFS
.
Recherche de processus cachés ... 
.
Recherche d'éléments en démarrage automatique cachés ... 
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  UMonit = c:\windows\system32\UMonit.exe????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? 
.
Recherche de fichiers cachés ... 
.
Scan terminé avec succès
Fichiers cachés: 0
.
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- DLLs chargées dans les processus actifs ---------------------
.
- - - - - - - > 'Explorer.exe'(12044)
c:\program files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll
c:\users\yannos\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Lavasoft\Ad-Aware 2007\aawservice.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Canal+\CANAL+ CANALSAT A LA DEMANDE\VOD\CanalPlus.VOD.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe
c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe
c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe
c:\program files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
c:\windows\system32\WUDFHost.exe
c:\windows\system32\conime.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\Windows Media Player\wmpnetwk.exe
.
**************************************************************************
.
Heure de fin: 2012-09-14  17:32:37 - La machine a redémarré
ComboFix-quarantined-files.txt  2012-09-14 15:32
.
Avant-CF: 17 525 940 224 octets libres
Après-CF: 17 661 530 112 octets libres
.
- - End Of File - - C104D7F225745D215B6B7EA205B5260E

yann252 · Answer

Je doit bientôt partir merci pour ton temps et ton aide.
Indique moi la marche a suivre s'il te plait, dois-je relancer pre scan...

je finirai demain

Merci encore et bonne soirée

Cdt

g3n-h@ckm@n · Answer

desinstalle zooksmessenger si tu t'en sers pas desinstalle adawre il sert absolument à rien ^^ == __________________________________________________ =>/!\Le script qui suit a été écrit spécialement cet ordinateur/!\ <= =>il est fort déconseillé de le transposer sur un autre ordinateur !<= ---------------------------------------------------------------------------- Toujours avec toutes les protections désactivées, fais ceci : ▶ Ouvre le bloc-notes (Menu démarrer --> programmes --> accessoires --> bloc-notes) ▶ Copie/colle dans le bloc-notes ce qui entre les lignes ci dessous (sans les lignes) : ---------------------------------------------------------- KillAll:: ClearJavaCache:: File:: c:\users\yannos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZooskMessenger.lnk Registry:: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroFilterCheck"=- "PWRISOVM.EXE"=- "WinampAgent"=- "QuickTime Task"=- "TkBellExe"=- Firefox:: FF - Ext: Java Console: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} RegLock:: [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice] [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice] [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice] [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice] [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice] [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] ------------------------------------------------------------------ ▶ Enregistre ce fichier sur ton Bureau (et pas ailleurs !) sous le nom CFScript.txt ▶ Quitte le Bloc Notes ▶ Fais un glisser/déposer de ce fichier CFScript sur le fichier combofix comme sur cette : illustration ▶ Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal ! Ne touche à rien tant que le scan n'est pas terminé. ▶ Une fois le scan achevé, un rapport va s'afficher: poste son contenu. ▶ Si le fichier ne s'ouvre pas, il se trouve ici => C:\ComboFix.txt

yann252 · Answer

adaware viré mais zooksmessenger n'est pas instalé ou alors il n'apparaît pas dans "programme et fonctionnalité" ni dans "C: programmes" ni en recherche pc

g3n-h@ckm@n · Answer

pas grave la suite

H0enheim · Answer

Salut,

Pour répondre à ta question de départ, je suppose que tu n'as pas de module complémentaire.
petite info utile
https://www.commentcamarche.net/telecharger/web-internet/25023-adblock-plus/

pour IE et chrome , je ne sais pas si il existe un équivalent gratuit et complet tel que adblock plus

quel sont les sites où tu vas et que les pub s'ouvre automatique ?

yann252 · Answer

Salut c'est déjà mieux plus de pub facebook ni de page qui s'ouvre toute seule, cela m'arrivais sur n'importe quel site même sur la page de démarrage google.
Cela ma l'aire réglé pour le moment.

Ceci étant depuis avant hier quand j'allume mon pc une fenêtre s'ouvre et me dit"mcbgdbb.exe a cessé de fonctionner"
Qu'est ce que c'est que ce logiciel s'il te plait?

Je fais tout de suite se que tu m'a dit hier

yann252 · Answer

Bon je me suis emporté un peu vite les pubs s'ouvre toujours toute seule et combofix plante des que je fais la manip que tu m'as indiqué.

g3n-h@ckm@n · Answer

essaie en mode sans echec

yann252 · Answer

Comment passe tu en mode sans echec?

g3n-h@ckm@n · Answer

Comment aller en Mode sans échec :

Attention !!! : NE JAMAIS DEMARRER EN MODE SANS ECHEC AVEC L'UTILITAIRE MSCONFIG !!!!

&#9654 Redémarres ton ordi 
&#9654 Tapote la touche F8 immédiatement, (F5 sur certains PC) juste après le "Bip" 
&#9654 Tu verras un écran avec options de démarrage apparaître 
&#9654 Choisis la première option : Sans Échec, et valide avec "Entrée" 
&#9654 Choisis ton compte habituel

yann252 · Answer

Salut j'ai l'impression que combofix plante toujours même en mode sans échec une fenêtre s'ouvre le point de restauration se fait et puis il me dit que l'analyse du pc peut duré 10 minutes et la plus rien je l'ai laissé tourné plus de 30 minutes et toujours rien le pc ne répond plus la souris est active mes c 'est tout je suis obligé d'éteindre le pc manuellement.

Un autre petit problème avast se ferme a chaque fois que je redémarre le pc je suis obligé de le redémarre manuellement, a tu une idée s'il te plais?

Merci

yann252 · Answer

Pour mon problème d'avast est ce que cela vient de Malwarebyte?

Il démarre en même temps que Windows.

g3n-h@ckm@n · Answer

suis ce tuto

https://forums.cnetfrance.fr/tutoriels-securite-informatique/179557-dr-web-cureit-le-tutoriel

yann252 · Answer

Salut après une très très longue analyse voici le rapport dr web


05488739.FIL;C:\$VAULT$.AVG;BackDoor.IRC.Sdbot.2058;Supprimé.;
05489175.FIL;C:\$VAULT$.AVG;BackDoor.IRC.Sdbot.2058;Supprimé.;
bb5c8d.rbf;C:\Config.Msi;Adware.SweetIM.2 - erreur de lecture;;
installer_magic_the_gathering_online_trial_3_0_French.exe;C:\Documents and Settings\yannos\Tracing\Downloads;Adware.Downware.23 - erreur de lecture;;
Vitalic_ok_cowboy_downloader (1).exe;C:\Documents and Settings\yannos\Tracing\Downloads;Adware.MediaFinder.2 - erreur de lecture;;
Vitalic_ok_cowboy_downloader.exe;C:\Documents and Settings\yannos\Tracing\Downloads;Adware.MediaFinder.2 - erreur de lecture;Chemin invalide pour le fichier ;

g3n-h@ckm@n · Answer

desinstalle avast , relance combofix

yann252 · Answer

Bonjour!! J'ai désinstallé avast et relancé combofix mais sans le script que tu ma posté vendredi, voici le rapport






ComboFix 12-09-18.07 - yannos 19/09/2012  17:02:56.2.2 - x86
Microsoft® Windows Vista(TM) Édition Familiale Premium   6.0.6002.2.1252.33.1036.18.1790.689 [GMT 2:00]
Lancé depuis: c:\users\yannos\Tracing\Downloads\Combofix.exe.exe
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\yann.exe
c:\yann.exe\PEV.exe
c:\yann.exe\snapshot.00.dat
.
.
(((((((((((((((((((((((((((((   Fichiers créés du 2012-08-19 au 2012-09-19  ))))))))))))))))))))))))))))))))))))
.
.
2012-09-19 15:13 . 2012-09-19 15:13	--------	d-----w-	c:\users\yannos\AppData\Local	emp
2012-09-19 15:13 . 2012-09-19 15:13	--------	d-----w-	c:\users\Mcx1\AppData\Local	emp
2012-09-19 15:13 . 2012-09-19 15:13	--------	d-----w-	c:\users\Default\AppData\Local	emp
2012-09-19 14:53 . 2012-08-23 07:15	7022536	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{91C7CD35-AAFF-4571-B0FD-8B9D76BBCDFC}\mpengine.dll
2012-09-18 03:37 . 2012-09-18 03:37	93672	----a-w-	c:\windows\system32\WindowsAccessBridge.dll
2012-09-17 15:55 . 2012-09-17 15:55	--------	d-----w-	c:\users\yannos\DoctorWeb
2012-09-15 12:11 . 2012-09-15 12:11	--------	d-----w-	c:\program files\BarrierePoker.fr
2012-09-14 14:39 . 2012-09-14 14:50	--------	d-----w-	C:\Pre_Scan
2012-09-14 14:39 . 2012-09-14 14:39	--------	d-----w-	C:\4f59c56da0d10f85e97f6dd27763c376
2012-09-13 15:01 . 2012-09-13 15:01	--------	d-----w-	c:\users\yannos\AppData\Roaming\Malwarebytes
2012-09-13 15:01 . 2012-09-13 15:01	--------	d-----w-	c:\programdata\Malwarebytes
2012-09-13 15:01 . 2012-09-13 15:01	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2012-09-13 15:01 . 2012-09-07 15:04	22856	----a-w-	c:\windows\system32\drivers\mbam.sys
2012-09-11 15:32 . 2012-09-11 15:32	--------	d-----w-	c:\program files\Winamax Poker
2012-09-09 12:47 . 2012-09-09 12:47	--------	d-----w-	c:\program files\Canal+
2012-09-08 18:29 . 2012-09-08 18:29	--------	d-----w-	c:\program files\File Scanner Library (Spybot - Search & Destroy)
2012-09-07 17:38 . 2011-12-21 15:35	80488	----a-w-	c:\windows\system32\RtNicProp32.dll
2012-09-07 17:38 . 2011-09-08 14:40	100896	----a-w-	c:\windows\system32\RTNUninst32.dll
2012-09-07 17:38 . 2011-09-08 14:40	363112	----a-w-	c:\windows\system32\drivers\Rtlh86.sys
2012-09-07 17:38 . 2012-09-07 17:38	--------	d-----w-	c:\program files\Realtek
2012-09-07 17:26 . 2012-09-07 17:26	--------	d-----w-	c:\programdata\ATI
2012-09-07 17:22 . 2012-09-07 17:22	0	----a-w-	c:\windows\ativpsrm.bin
2012-09-07 17:03 . 2012-09-07 17:03	--------	d-----w-	c:\program files\ma-config.com
2012-09-07 17:03 . 2012-09-07 17:03	--------	d-----w-	c:\programdata\ma-config.com
2012-09-07 16:43 . 2012-09-07 16:43	--------	d-----w-	c:\program files\DriverTuner
2012-09-07 16:24 . 2012-09-07 16:24	--------	d-sh--w-	c:\windows\ftpcache
2012-09-07 16:24 . 2012-09-07 16:24	--------	d-----w-	c:\program files\FLV-Media Player
2012-09-07 16:23 . 2012-09-19 14:43	--------	d-----w-	c:\users\yannos\AppData\Local\Lollipop
.
.
.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-09-18 03:37 . 2012-07-15 16:22	821736	----a-w-	c:\windows\system32
pDeployJava1.dll
2012-09-18 03:37 . 2010-04-18 14:10	746984	----a-w-	c:\windows\system32\deployJava1.dll
2012-09-08 18:42 . 2012-04-28 08:48	696520	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2012-09-08 18:42 . 2011-08-10 08:29	73416	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2012-07-04 14:02 . 2012-08-15 09:22	2047488	----a-w-	c:\windows\system32\win32k.sys
2012-06-29 00:16 . 2012-08-15 09:23	1800704	----a-w-	c:\windows\system32\jscript9.dll
2012-06-29 00:09 . 2012-08-15 09:23	1129472	----a-w-	c:\windows\system32\wininet.dll
2012-06-29 00:08 . 2012-08-15 09:23	1427968	----a-w-	c:\windows\system32\inetcpl.cpl
2012-06-29 00:04 . 2012-08-15 09:23	142848	----a-w-	c:\windows\system32\ieUnatt.exe
2012-06-29 00:00 . 2012-08-15 09:23	2382848	----a-w-	c:\windows\system32\mshtml.tlb
2007-10-07 19:07 . 2007-10-07 19:07	4394	----a-w-	c:\program files\ffdssetts.reg
2007-10-07 19:07 . 2007-10-07 19:07	32208	----a-w-	c:\program files\ffdsvsetts.reg
2007-10-07 19:07 . 2007-10-07 19:07	2062	----a-w-	c:\program files\ffdsasetts.reg
.
.
(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0F6E720A-1A6B-40E1-A294-1D4D19F156C8}]
2010-07-19 16:32	165184	----a-w-	c:\program files\SFR\Kit\SFRNavErrorHelper.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-15 00:32	94208	----a-w-	c:\users\yannos\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-15 00:32	94208	----a-w-	c:\users\yannos\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-15 00:32	94208	----a-w-	c:\users\yannos\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-09 39408]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"Facebook Update"="c:\users\yannos\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-08-16 138096]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
"erifbrgc"="c:\users\yannos\appdata\local\lollipop\erifbrgc.exe" [2012-09-15 680448]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-07-25 563984]
"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" [2007-07-25 2027792]
"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2007-08-07 200704]
"UMonit"="c:\windows\system32\UMonit.exe" [2007-06-18 200704]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-08-03 36352]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-04-20 58656]
"SMSTray"="c:\program files\Samsung\EmoDio\SMSTray.exe" [2009-04-16 479232]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-07-05 421888]
"TkBellExe"="c:\program filesealealplayer\Updateealsched.exe" [2012-05-23 296056]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-02-10 61440]
"CANAL+ CANALSAT A LA DEMANDE"="c:\program files\Canal+\CANAL+ CANALSAT A LA DEMANDE\Launcher.exe" [2011-10-20 163992]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2007-03-23 40072]
.
c:\users\yannos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
erifbrgc.lnk - c:\users\yannos\AppData\Local\Lollipop\erifbrgc.exe [2012-9-15 680448]
ZooskMessenger.lnk - c:\program files\ZooskMessenger\ZooskMessenger.exe [N/A]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-18 65588]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"PromptOnSecureDesktop"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [x]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation	REG_MULTI_SZ   	FontCache
.
Contenu du dossier 'Tâches planifiées'
.
2012-09-18 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-28 18:42]
.
2012-09-17 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1170913042-1277233965-3038881231-1000Core.job
- c:\users\yannos\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-08-16 18:07]
.
2012-09-19 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1170913042-1277233965-3038881231-1000UA.job
- c:\users\yannos\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-08-16 18:07]
.
2012-09-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-05 17:03]
.
2012-09-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-05 17:03]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
mStart Page = hxxp://www.google.com
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
IE: {{06568ceb-5721-47d4-9d93-7e604fcbaeab} - c:\programs\PMU\PMUPoker\RunApp.exe
TCP: DhcpNameServer = 192.168.1.1
DPF: {04CB5B64-5915-4629-B869-8945CEBADD21} - hxxps://static.impots.gouv.fr/abos/static/securite/certdgi1.cab
FF - ProfilePath - c:\users\yannos\AppData\Roaming\Mozilla\Firefox\Profiles\sqt43kb3.default\
FF - prefs.js: browser.search.defaulturl - 
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Google Toolbar for Firefox: {3112ca9c-de6d-4884-a869-9855de68056c} - %profile%\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
FF - Ext: CacheViewer: {71328583-3CA7-4809-B4BA-570A85818FBB} - %profile%\extensions\{71328583-3CA7-4809-B4BA-570A85818FBB}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: RealPlayer Browser Record Plugin: {97E22097-9A2F-45b1-8DAF-36AD648C7EF4} - c:\programdata\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
.
.
**************************************************************************
Recherche de processus cachés ... 
.
Recherche d'éléments en démarrage automatique cachés ... 
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  UMonit = c:\windows\system32\UMonit.exe????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? 
.
Recherche de fichiers cachés ... 
.
Scan terminé avec succès
Fichiers cachés: 
.
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Heure de fin: 2012-09-19  17:19:02
ComboFix-quarantined-files.txt  2012-09-19 15:18
ComboFix2.txt  2012-09-14 15:32
.
Avant-CF: 20 970 496 000 octets libres
Après-CF: 20 979 572 736 octets libres
.
- - End Of File - - 6F9E168B8E76626609AB113625965B0B

yann252 · Answer

J'ai retélechargé avast et réinstallé, est ce que je dois relancé combofix avec le script et est ce que je doit redésintallé avast avant?

g3n-h@ckm@n · Answer

ok des soucis restent ?

yann252 · Answer

Non plus de pub!!! Jte remercie beaucoup de ton coup de pouce!!!

Donc je n'est pas besoin de lancé pré scan ni combofix avec le scrip?
Et est ce que je pourrais me servir de c'est logiciel de temps en temps pour nettoyé mon pc?

g3n-h@ckm@n · Answer

non ce sont des outils à utiliser avec assistance fais ce menage :

 https://gen-hackman.kanak.fr/#1037

yann252 · Answer

Salut avant de nettoyé après la désinfection j'ai un petit problème depuis hier soir , voila j'ai fait le ménage dans le dossier "téléchargement" et lancé une défragmentation et depuis se matin le pc ne s'éteint plus de lui même.
J'ai restauré tous les fichier de la corbeille mais rien n'y fait.

Faut il que je fasse une restauration?

yann252 · Answer

rapport Delfix


# DelFix v8.9 - Rapport créé le 20/09/2012 à 17:21:08
# Mis à jour le 27/07/12 par Xplode
# Système d'exploitation : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Nom d'utilisateur : yannos - PC-DE-YANNOS (Administrateur)
# Exécuté depuis : C:\Users\yannos\Desktop\delfix.exe
# Option [Suppression]


~~~~~~ Dossiers(s) ~~~~~~

Supprimé : C:\Qoobox
Supprimé : C:\pre_scan
Supprimé : C:\Users\yannos\DoctorWeb

~~~~~~ Fichier(s) ~~~~~~

Supprimé : C:\AdwCleaner[S1].txt
Supprimé : C:\AdwCleaner[S2].txt
Supprimé : C:\ComboFix.txt
Supprimé : C:\JavaRa.log
Supprimé : C:\Users\yannos\Desktop\combofix.txt
Supprimé : C:\Windows\grep.exe
Supprimé : C:\Windows\PEV.exe
Supprimé : C:\Windows\NIRCMD.exe
Supprimé : C:\Windows\MBR.exe
Supprimé : C:\Windows\SED.exe
Supprimé : C:\Windows\SWREG.exe
Supprimé : C:\Windows\SWSC.exe
Supprimé : C:\Windows\SWXCACLS.exe
Supprimé : C:\Windows\Zip.exe

~~~~~~ Registre ~~~~~~

Clé Supprimée : HKCU\Software\g3n-h@ckm@n
Clé Supprimée : HKCU\Software\IDAVLab
Clé Supprimée : HKLM\SOFTWARE\AdwCleaner
Clé Supprimée : HKLM\SOFTWARE\IDAVLab
Clé Supprimée : HKLM\SOFTWARE\Swearware
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\combofix.exe
Clé Supprimée : HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DWPROT

~~~~~~ Autres ~~~~~~

-> Prefetch Vidé

*************************

DelFix[S1].txt - [1392 octets] - [20/09/2012 17:21:08]

########## EOF - C:\DelFix[S1].txt - [1516 octets] ##########

yann252 · Answer

rapport purera

RaProducts' PureRa v1.7
Log created at 17:23 on 20/09/2012 (yannos)

C:\Config.MSI emptied.
C:\Users\yannos\AppData\LocalLow\Microsoft\CryptNetURLCache\Content emptied.
C:\Users\yannos\AppData\LocalLow\Microsoft\CryptNetURLCache\MetaData emptied.
C:\Windows\system32\FNTCACHE.DAT <- Successfully deleted.
Recycle bin emptied.
C:\Windows\SoftwareDistribution\DataStore\Logs emptied.
C:\Windows\SoftwareDistribution\Download emptied.
C:\Windows\SoftwareDistribution\SelfUpdate\Default emptied.
C:\Windows\SoftwareDistribution\WuRedir emptied.
C:\Windows\SoftwareDistribution\ReportingEvents.log <- Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus. 
C:\Users\yannos\AppData\Local\Temp emptied.
C:\Windows\TEMP emptied.
C:\BACKUP\07-06-30 0448PM\Users\yann\AppData\Local\IconCache.db <- Successfully deleted.
C:\BACKUP\07-06-30 0448PM\Users\yann\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1024.db <- Successfully deleted.
C:\BACKUP\07-06-30 0448PM\Users\yann\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db <- Successfully deleted.
C:\BACKUP\07-06-30 0448PM\Users\yann\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db <- Successfully deleted.
C:\BACKUP\07-06-30 0448PM\Users\yann\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db <- Successfully deleted.
C:\BACKUP\07-06-30 0448PM\Users\yann\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db <- Successfully deleted.
C:\BACKUP\07-06-30 0448PM\Users\yann\AppData\Local\Microsoft\Windows\Explorer\thumbcache_sr.db <- Successfully deleted.
C:\BACKUP\07-06-30 0448PM\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Portable Devices\wpdlog00.sqm <- Successfully deleted.
C:\BACKUP\07-06-30 0448PM\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Portable Devices\wpdlog01.sqm <- Successfully deleted.
C:\BACKUP\07-06-30 0448PM\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Portable Devices\wpdlog02.sqm <- Successfully deleted.
C:\BACKUP\07-06-30 0448PM\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Portable Devices\wpdlog03.sqm <- Successfully deleted.
C:\BACKUP\07-06-30 0448PM\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Portable Devices\wpdlog04.sqm <- Successfully deleted.
C:\Manual-PCProgram\Resource\Thumbs.db <- Successfully deleted.
C:\Program Files\Adobe\Adobe Bridge\Resources\da\_media\Thumbs.db <- Successfully deleted.
C:\Program Files\Adobe\Adobe Bridge\Resources\de\_media\Thumbs.db <- Successfully deleted.
C:\Program Files\Adobe\Adobe Bridge\Resources\el\_media\Thumbs.db <- Successfully deleted.
C:\Program Files\Adobe\Adobe Bridge\Resources\en\_media\Thumbs.db <- Successfully deleted.
C:\Program Files\Adobe\Adobe Bridge\Resources\es\_media\Thumbs.db <- Successfully deleted.
C:\Program Files\Adobe\Adobe Bridge\Resources\fi\_media\Thumbs.db <- Successfully deleted.
C:\Program Files\Adobe\Adobe Bridge\Resources\fr\_media\Thumbs.db <- Successfully deleted.
C:\Program Files\Adobe\Adobe Bridge\Resources\hu\_media\Thumbs.db <- Successfully deleted.
C:\Program Files\Adobe\Adobe Bridge\Resources\it\_media\Thumbs.db <- Successfully deleted.
C:\Program Files\Adobe\Adobe Bridge\Resources\ja\_media\Thumbs.db <- Successfully deleted.
C:\Program Files\Adobe\Adobe Bridge\Resources\ko\_media\Thumbs.db <- Successfully deleted.
C:\Program Files\Adobe\Adobe Bridge\Resources\nl\_media\Thumbs.db <- Successfully deleted.
C:\Program Files\Adobe\Adobe Bridge\Resources\no\_media\Thumbs.db <- Successfully deleted.
C:\Program Files\Adobe\Adobe Bridge\Resources\pl\_media\Thumbs.db <- Successfully deleted.
C:\Program Files\Adobe\Adobe Bridge\Resources\pt\_media\Thumbs.db <- Successfully deleted.
C:\Program Files\Adobe\Adobe Bridge\Resources\ru\_media\Thumbs.db <- Successfully deleted.
C:\Program Files\Adobe\Adobe Bridge\Resources\sv\_media\Thumbs.db <- Successfully deleted.
C:\Program Files\Adobe\Adobe Bridge\Resources\tr\_media\Thumbs.db <- Successfully deleted.
C:\Program Files\Adobe\Adobe Bridge\Resources\zh_CN\_media\Thumbs.db <- Successfully deleted.
C:\Program Files\Adobe\Adobe Bridge\Resources\zh_TW\_media\Thumbs.db <- Successfully deleted.
C:\Users\yannos\AppData\Local\IconCache.db <- Successfully deleted.
C:\Users\yannos\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1024.db <- Successfully deleted.
C:\Users\yannos\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db <- Successfully deleted.
C:\Users\yannos\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db <- Successfully deleted.
C:\Users\yannos\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db <- Accès refusé. 
C:\Users\yannos\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db <- Successfully deleted.
C:\Users\yannos\AppData\Local\Microsoft\Windows\Explorer\thumbcache_sr.db <- Successfully deleted.
C:\Users\yannos\AppData\Local\Microsoft\Windows Live\Bici\Bici1_00.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Local\Microsoft\Windows Live\SqmApi\SqmData720896_00.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Local\Microsoft\Windows Live\SqmApi\SqmData720896_01.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Local\Microsoft\Windows Live\SqmApi\SqmData720896_02.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Local\Microsoft\Windows Live\SqmApi\SqmData720896_03.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Local\Microsoft\Windows Live\SqmApi\SqmData720896_04.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Local\Microsoft\Windows Live\SqmApi\SqmData720896_05.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Local\Microsoft\Windows Live\SqmApi\SqmData720896_06.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Local\Microsoft\Windows Live Mail\sqmnoopt00.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Roaming\Microsoft\MSN Messenger\sqmdata00.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Roaming\Microsoft\MSN Messenger\sqmdata01.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Roaming\Microsoft\MSN Messenger\sqmnoopt00.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Roaming\Microsoft\MSN Messenger\sqmnoopt01.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Roaming\Microsoft\MSN Messenger\sqmnoopt02.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Roaming\Microsoft\MSN Messenger\sqmnoopt03.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Roaming\Microsoft\MSN Messenger\sqmnoopt04.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Roaming\Microsoft\MSN Messenger\sqmnoopt05.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Roaming\Microsoft\MSN Messenger\sqmnoopt06.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Roaming\Microsoft\MSN Messenger\sqmnoopt07.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Roaming\Microsoft\MSN Messenger\sqmnoopt08.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Roaming\Microsoft\MSN Messenger\sqmnoopt09.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Roaming\Microsoft\MSN Messenger\sqmnoopt10.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Roaming\Microsoft\MSN Messenger\sqmnoopt11.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Roaming\Microsoft\MSN Messenger\sqmnoopt12.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Roaming\Microsoft\MSN Messenger\sqmnoopt13.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Roaming\Microsoft\MSN Messenger\sqmnoopt14.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Roaming\Microsoft\MSN Messenger\sqmnoopt15.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Roaming\Microsoft\MSN Messenger\sqmnoopt16.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Roaming\Microsoft\MSN Messenger\sqmnoopt17.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Roaming\Microsoft\MSN Messenger\sqmnoopt18.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Roaming\Microsoft\MSN Messenger\sqmnoopt19.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Roaming\Microsoft\MSN Messenger\1321023568\sqmnoopt00.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Roaming\Microsoft\MSN Messenger\2381170822\sqmnoopt00.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Roaming\Microsoft\MSN Messenger\2381170822\sqmnoopt01.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Roaming\Microsoft\MSN Messenger\2381170822\sqmnoopt02.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Roaming\Microsoft\MSN Messenger\2381170822\sqmnoopt03.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Roaming\Microsoft\MSN Messenger\2381170822\sqmnoopt04.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Roaming\Microsoft\MSN Messenger\2381170822\sqmnoopt05.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Roaming\Microsoft\MSN Messenger\2381170822\sqmnoopt06.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Roaming\Microsoft\MSN Messenger\2381170822\sqmnoopt07.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Roaming\Microsoft\MSN Messenger\2381170822\sqmnoopt08.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Roaming\Microsoft\MSN Messenger\2381170822\sqmnoopt09.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Roaming\Microsoft\MSN Messenger\636613426\sqmnoopt00.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Roaming\Microsoft\MSN Messenger\636613426\sqmnoopt01.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Roaming\Microsoft\MSN Messenger\636613426\sqmnoopt02.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Roaming\Microsoft\MSN Messenger\636613426\sqmnoopt03.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Roaming\Microsoft\MSN Messenger\636613426\sqmnoopt04.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Roaming\Microsoft\MSN Messenger\636613426\sqmnoopt05.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Roaming\Microsoft\MSN Messenger\636613426\sqmnoopt06.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Roaming\Microsoft\MSN Messenger\636613426\sqmnoopt07.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Roaming\Microsoft\MSN Messenger\636613426\sqmnoopt08.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Roaming\Microsoft\MSN Messenger\636613426\sqmnoopt09.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Roaming\Microsoft\MSN Messenger\636613426\sqmnoopt10.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Roaming\Microsoft\MSN Messenger\636613426\sqmnoopt11.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Roaming\Microsoft\MSN Messenger\636613426\sqmnoopt12.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Roaming\Microsoft\MSN Messenger\636613426\sqmnoopt13.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Roaming\Microsoft\MSN Messenger\636613426\sqmnoopt14.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Roaming\Microsoft\MSN Messenger\636613426\sqmnoopt15.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Roaming\Microsoft\MSN Messenger\636613426\sqmnoopt16.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Roaming\Microsoft\MSN Messenger\636613426\sqmnoopt17.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Roaming\Microsoft\MSN Messenger\636613426\sqmnoopt18.sqm <- Successfully deleted.
C:\Users\yannos\AppData\Roaming\Microsoft\MSN Messenger\636613426\sqmnoopt19.sqm <- Successfully deleted.
C:\Users\yannos\Desktop\Nouveau dossier\Nouveau dossier\1996 - All Eyez On Me\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Desktop\Nouveau dossier\Nouveau dossier\3eme Oeil\3eme Oeil - Avec le coeur ou rien\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Documents\logiciel\marteleur_pc\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\francois\Funky\Brass Construction - Golden Classics\Data\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\francois\Funky\Roger_Troutman\Roger Troutman - The Many Facets Of Roger\Roger Troutman - The Many Facets Of Roger\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\francois\Funky\Roger_Troutman\Roger Troutman II - The Second Coming -2000-\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\marteleur_pc\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\1.Bass test\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\al\AL - Histolyric 1998 - 2008\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\Buckshot LeFonque\Buckshot LeFonque\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\Crystal Castles - Crystal Castles [2008]\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\Damian 'Jr. Gong' Marley\Welcome to Jamrock\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\DJ Mehdi - Lucky boy\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\DJ SET\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\Dj Shadow - The Outsider (2006) - Hip Hop [www.torrentazos.com]\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\DJ Vadim - The SoundCatcher - 2007 [Advance] by Uruapan\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\Dr. Octagonecologyst\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\George Brassens - L'Intégrale en 15CDs\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\Hilight Tribe - maha wave\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\Hilight Tribe les 5 album en 128kbps\concept infaillible\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\Jeru The Damaja-1996-Wrath Of The Math-by turntablism-blacksounds.de.tf\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\Ken Ishii - Flatspin\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\krush\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\krush\Lyricism\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\Lady Sovereign - Public Warning [2006]\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\LCDremixed.com - Sounds Like Silver\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\LSD (La Souris Déglinguée) - Glaz'Art Live 25-01-2006\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\LSD - La Souris Deglinguée -2004- 25 Ans - L'Integrale des Sessions du Studio Casanova 1981 (224 Kbps By KaNaRCHYTe@M)\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\Manifeste electronique\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\MAP (Ministère des Affaires Populaires) - Debout La D'Dans (2006) (192 Kbps By KanarchyTe@m)\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\Massilia Sound System - Òai E Libertat -\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\Massive Attack - Discography\1991 - Blue Lines\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\Massive Attack - Discography\1994 - Protection\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\Massive Attack - Discography\1995 - No Protection\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\Massive Attack - Discography\1998 - Mezzanine\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\Massive Attack - Discography\1998 - Singles 90 98 (Box Set)\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\Massive Attack - Discography\2003 - 100th Window\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\Method Man\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\Method Man\Tical 2000- Judgement Day\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\Meï Teï Shô\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\Meï Teï Shô\Live\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\Meï Teï Shô\Lô Bâ\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\Meï Teï Shô - Copie\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\Meï Teï Shô - Copie\Live\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\Meï Teï Shô - Copie\Lô Bâ\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\Miss Kittin\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\Miss Kittin\A Bugged out Mix Disc 1\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\Miss Kittin\A Bugged out Mix Disc 2\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\Mix Master Mike - Return Of The Cyklops (2002)\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\Modeselektor\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\Modeselektor\Happy Birthday !\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\Motor\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\Motor\Klunk\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\MSTRKRFT - Remixes\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\MSTRKRFT - Remixes\CD2\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\Nathan Fake - Drowning In a Sea of Love\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\Original Soundtrack\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\Original Soundtrack\Trainspotting [Original Soundtrack]\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\Os Mutantes (1968)\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\Princess Superstar - My Machine\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\puppet\Puppetmastaz - Creature Shock Radio\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\QBERT\boucle sratch\dj craze Bully Breaks\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\QBERT\boucle sratch\DJ Flare Butt Ugly Breaks\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\QBERT\boucle sratch\DJ Flare hillbilly breaks\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\QBERT\boucle sratch\dj q bert Y\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\QBERT\boucle sratch\yogafrog\D-Styles Black Market\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\QBERT\boucle sratch\yogafrog\D-Styles Call Me! I'm Hot, Horny\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\QBERT\boucle sratch\yogafrog\dj q bert Needle Thrashers alpha\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\QBERT\boucle sratch\yogafrog\dj q bert Needle Thrashers Delta\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\QBERT\boucle sratch\yogafrog\dj q bert Needle Thrashers gamma\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\QBERT\boucle sratch\yogafrog\yogafrog warflex Level 1\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\QBERT\boucle sratch\yogafrog\yogafrog warflex level 2\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\rohff\rohff\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\rohff\rohff\10 ans d'avance\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\rohff\rohff\Au-Dela de Mes Limites Disc 1\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\rohff\rohff\Au-Dela de Mes Limites Disc 2\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\rohff\rohff\la fierte des notres\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\rohff\rohff\la vie avant la mort\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\rohff\rohff\le code l'honneur\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\Scratch Perverts - Watch The Ride\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\scratch peter\DJ_Muggs_Vs._GZA_The_Genius-Grandmasters_Remix_Album-2007-C4\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\scratch peter\Dj_Shadow-The_Outsider-Advance-CD-2006-DEF\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\Simian Mobile Disco - Attack Decay Sustain Release [2007]\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\Spank Rock - YoYoYoYoYo [2006]\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\Svinkels\Svinkels - Tapis Rouge (cover,photos) par michaelK\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\Swayzak - Snowboarding In Argentina (1998)\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\tadd mullinix - winking makes a face\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\Terranova - Close the door (1999)\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\Tiken Jah Fakoly\Cours D'histoire - An2002\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\trip-hop;jazz\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\trip-hop;jazz\Buckshot LeFonque\Buckshot LeFonque\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\trip-hop;jazz\Dark Trip-Hop\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\trip-hop;jazz\Dark Trip-Hop\Covers\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\trip-hop;jazz\portishead\Portishead - glory times (and bonus remix)[192 Vbr][shared by elektrodonkeyTeam]\covers\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\VA-Bugged_Out_Presents_Suck_My_Deck_Mixed_By_Simian_Mobile_Disco-CD-2007-eMF\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\VA-DEMI_PORTION-8_Titres_et__demi-EP_SOLO-2007\VA-DEMI_PORTION-8_Titres_et _demi-EP_SOLO-2007\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\VA-DEMI_PORTION-8_Titres_et__demi-EP_SOLO-2007\VA-DEMI_PORTION-8_Titres_et _demi-EP_SOLO-2007\(Covers & Styck)\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\VA-Lenny_Dee_Vs_Radium_Present_Beatz_Brulee-(PKGCD31)-2006-DEF\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\Vitalic\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\Vitalic\This Is the Sound of Citizen\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\Wax Tailor\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\Weeds - Music from the original series volume 2\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\Weeds - Original Soundtrack\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\musik\Wu-Tang Best Of\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Music\scrzatch\scratch\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Pictures\Mes images\Mes images\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Pictures\Mes images\Mes images\FANART\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Pictures\pat\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Pictures\pat\2006-12-29, IMAGE PERSO PAT\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Pictures\photo\perm mickao juillet 2008\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Videos\films,animé\Thumbs.db <- Successfully deleted.
C:\Users\yannos\Videos\films,animé\mini film\moto\Thumbs.db <- Successfully deleted.
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1024.db <- Successfully deleted.
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db <- Successfully deleted.
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db <- Successfully deleted.
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db <- Successfully deleted.
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db <- Successfully deleted.
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Explorer\thumbcache_sr.db <- Successfully deleted.
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Portable Devices\wpdlog00.sqm <- Successfully deleted.
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Portable Devices\wpdlog01.sqm <- Successfully deleted.
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Portable Devices\wpdlog02.sqm <- Successfully deleted.
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Portable Devices\wpdlog03.sqm <- Successfully deleted.
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Portable Devices\wpdlog04.sqm <- Successfully deleted.
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Portable Devices\wpdlog05.sqm <- Successfully deleted.
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Portable Devices\wpdlog06.sqm <- Successfully deleted.
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Portable Devices\wpdlog07.sqm <- Successfully deleted.
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Portable Devices\wpdlog08.sqm <- Successfully deleted.
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Portable Devices\wpdlog09.sqm <- Successfully deleted.
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Portable Devices\wpdlog10.sqm <- Successfully deleted.
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Portable Devices\wpdlog11.sqm <- Successfully deleted.
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Portable Devices\wpdlog12.sqm <- Successfully deleted.
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Portable Devices\wpdlog13.sqm <- Successfully deleted.
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Portable Devices\wpdlog14.sqm <- Successfully deleted.
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Portable Devices\wpdlog15.sqm <- Successfully deleted.
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Portable Devices\wpdlog16.sqm <- Successfully deleted.
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Portable Devices\wpdlog17.sqm <- Successfully deleted.
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Portable Devices\wpdlog18.sqm <- Successfully deleted.
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Portable Devices\wpdlog19.sqm <- Successfully deleted.

Total space cleaned: 473.21 MB

-=E.O.F=-

g3n-h@ckm@n · Answer

formidable !! ^^

yann252 · Answer

et no!! la je pète les plomb!! une page de la redoute et une page de sécurité pc vienne de s'ouvrir!!

j'en peu plus de c'est merde!

DSL

g3n-h@ckm@n · Answer

finis le menage comme il le faut on avisera :)

yann252 · Answer

Je suis entrein de recréé un point de restauration du systeme et c'est bon j'ai suivi ton topic

yann252 · Answer

Terminé chef! :)

g3n-h@ckm@n · Answer

ok as-tu encore de ces pages qui s ouvrent ?

yann252 · Answer

Oui  a l'instant et des que j'ouvre une page web 
exemple    http://www.jeu-a-telecharger.com/mono-tuneup/?ptn=123456&t2c=a0ab4ddb99b54f8a70afb513adeae9f7874e

g3n-h@ckm@n · Answer

installe adblock plus pour firefox

https://addons.mozilla.org/fr/firefox/addon/adblock-plus/

yann252 · Answer

ok et j' installe firefox par la même occasion

g3n-h@ckm@n · Answer

ah ben oui c'est mieux

yann252 · Answer

C'est fait je suis firefox j'ai installé adblock et une pub meetik vient de s'o

g3n-h@ckm@n · Answer

&#9654 Télécharge ici : Ad-remover sur ton bureau : 


&#9654 Déconnecte toi et ferme toutes applications en cours ! 

si tu as XP => double clique
si tu as Vista ou windows 7 => clic droit "executer en tant que...." 

&#9654 sur "Ad-R.exe" pour lancer l'installation et laisse les paramètres d'installation par défaut . 

&#9654 clique le raccourci Ad-remover qui est sur ton bureau pour lancer l'outil .
 
&#9654 Au menu principal choisis "option Nettoyer" et tape sur [entrée] .

&#9654 Laisse travailler l'outil et ne touche à rien ... 

&#9654 Poste le rapport qui apparait à la fin , sur le forum ...

( Le rapport est sauvegardé aussi sous C:\Ad-report.log ) 
( CTRL+A Pour tout sélectionner , CTRL+C pour copier et CTRL+V pour coller )

yann252 · Answer

======= RAPPORT D'AD-REMOVER 2.0.0.2,G | UNIQUEMENT XP/VISTA/7 =======

Mis à jour par TeamXscript le 12/04/11
Contact: AdRemover[DOT]contact[AT]gmail[DOT]com
Site web: http://www.teamxscript.org

C:\Program Files\Ad-Remover\main.exe (CLEAN [1]) -> Lancé à 22:43:31 le 20/09/2012, Mode normal

Microsoft® Windows Vista(TM) Édition Familiale Premium  Service Pack 2 (X86) 
yannos@PC-DE-YANNOS (System manufacturer System Product Name) 
 
============== ACTION(S) ==============


Dossier supprimé: C:\Users\yannos\Documents\PacificPoker
Dossier supprimé: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Poker 770
Fichier supprimé: C:\Users\yannos\AppData\Local\aegcqms.bat

(!) -- Fichiers temporaires supprimés.


Clé supprimée: HKLM\Software\Poker 770
Clé supprimée: HKLM\Software\Trymedia Systems
Clé supprimée: HKCU\Software\pacificpoker
Clé supprimée: HKCU\Software\PartyGaming
Clé supprimée: HKCU\Software\Poker 770
Clé supprimée: HKCU\Software\pokerinstaller
Clé supprimée: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{76487FA0-9F08-4CC1-A510-544D5B6323F4}

Valeur supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\Trust Database\0|goicfboogidikkejccmclpieicihhlpo jimddp
Valeur supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\Trust Database\0|goicfboogidikkejccmclpieicihhlpo hpfanicgkffmccehnpkikogcffaepkfp
Valeur supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\Trust Database\0|goicfboogidikkejccmclpieicihhlpo dgnckdmmolaijpbbakmplfhlfpdhglgc


============== SCAN ADDITIONNEL ==============

**** Mozilla Firefox Version [15.0.1 (fr)] ****

Plugins
pBitCometAgent.dll (BitComet)
Plugins
prpplugin.dll (RealPlayer)
HKLM_MozillaPlugins\@canalplus.fr/Assistants VOD,version=1.0.0.0 (x)
HKLM_MozillaPlugins\@playstation.com/PsndlCheck,version=1.00 (x)
HKLM_MozillaPlugins\Adobe Reader (x)
HKLM_MozillaPlugins\yaxmpb@yahoo.com/YahooActiveXPluginBridge;version=1.0.0.1 (x)
HKCU_MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin (x)
Searchplugins\bing.xml (    hxxp://www.bing.com/search)
Components\browsercomps.dll (Mozilla Foundation)
Extensionsealplayer@partners.mozilla.com (Mozilla Firefox distributed by RealNetworks)
HKLM_Extensions|{97E22097-9A2F-45b1-8DAF-36AD648C7EF4} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext

-- C:\Users\yannos\AppData\Roaming\Mozilla\FireFox\Profiles\sqt43kb3.default --
Extensions\{3112ca9c-de6d-4884-a869-9855de68056c} (Google Toolbar for Firefox)
Extensions\{71328583-3CA7-4809-B4BA-570A85818FBB} (CacheViewer)
Searchplugins\askcomsearch.xml (?)
Prefs.js - browser.download.dir, C:\Users\yannos\Tracing\Downloads
Prefs.js - browser.download.lastDir, C:\Users\yannos\Desktop
Prefs.js - browser.search.defaulturl, 
Prefs.js - browser.startup.homepage_override.buildID, 20120905151427
Prefs.js - browser.startup.homepage_override.mstone, 15.0.1

========================================

**** Internet Explorer Version [9.0.8112.16421] ****

HKCU_Main|Default_Page_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKCU_Main|Default_Search_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU_Main|Search bar - hxxp://go.microsoft.com/fwlink/?linkid=54896
HKCU_Main|Start Page - hxxp://fr.msn.com/
HKLM_Main|Default_Page_URL - hxxp://go.microsoft.com/fwlink/?LinkId=54896
HKLM_Main|Default_Search_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM_Main|Search bar - hxxp://search.msn.com/spbasic.htm
HKLM_Main|Search Page - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM_Main|Start Page - hxxp://fr.msn.com/
HKCU_SearchScopes\{9B6103C1-F818-48a8-9683-314055BE6075} - "MyStart Search" (hxxp://mystart.hiyo.com/?search={searchTerms}&loc=ie_search)
HKCU_SearchScopes\{ED4BD629-C1B6-4399-8A34-02CCAA921DC9} - "Barre d'outils Alcohol Soft" (hxxp://search.alcohol-toolbar.com/search?p=Q&ts=ne&w={searchTerms}&csrc=search-f...)
HKCU_Toolbar\WebBrowser|{ED4BD629-C1B6-4399-8A34-02CCAA921DC9} (C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll) (x)
HKLM_Toolbar|{55BDF3B0-C0A8-481A-B8A6-01CD2BE0F3FD} (C:\Program Files\BarreConfCMCIC\TAPBar.dll)
HKCU_ElevationPolicy\{0562C0A2-E425-4F99-B194-C4D1FB3C3A16} - C:\Windows\System32\Macromed\Flash\FlashUtil9c.exe (x)
HKCU_ElevationPolicy\{1024F1BE-76DC-40d5-AB98-664A4185E5FA} - C:\Users\yannos\AppData\Local\Facebook\Video\Skype\FacebookVideoCalling.exe (Skype Limited)
HKCU_ElevationPolicy\{2A44969F-9D71-47FB-A845-ED81119917AF} - C:\Program Files\BitTorrent\bittorrent.exe (x)
HKCU_ElevationPolicy\{3E5F05FB-F259-4906-B7FA-E50D72F57528} - C:\Program Files\OpenOffice.org 3\program\simpress.exe (OpenOffice.org)
HKCU_ElevationPolicy\{604CB6C7-9EA9-4236-AE6A-D7A4600620B7} - C:\Program Files\OpenOffice.org 3\program\simpress.exe (OpenOffice.org)
HKCU_ElevationPolicy\{66E50C9A-52E3-40AB-8561-5AAF4960C5B0} - c:\program files\Google\googletoolbar1user.exe (x)
HKCU_ElevationPolicy\{97C32638-E2E6-4594-97ED-7FD1AA07A224} - C:\Program Files\OpenOffice.org 3\program\simpress.exe (OpenOffice.org)
HKCU_ElevationPolicy\{AFD47C0D-4E23-49E4-9670-A1730C35FCFB} - C:\Program Files\Winamp\winamp.exe (Nullsoft)
HKCU_ElevationPolicy\{CDAE3941-DDC3-40C2-B5AD-DD04BB6BC884} - C:\Program Files\BitComet\BitComet.exe (x)
HKCU_ElevationPolicy\{D18FD9F0-E210-4B56-8D5F-F5AFA6B46AF6} - c:\program files\Google\googletoolbar1user.exe (x)
HKCU_ElevationPolicy\{E0A900DF-9611-4446-86BD-4B1D47E7DB2A} - C:\Users\yannos\AppData\Local\Google\Chrome\Application\14.0.835.202\chrome_launcher.exe (x)
HKCU_ElevationPolicy\{F124E4F1-0575-4551-ABA5-F11EF14A1562} - C:\Program Files\OpenOffice.org 3\program\simpress.exe (OpenOffice.org)
HKCU_ElevationPolicy\{FEC329C5-97EB-46EE-B2C2-CD284438C3F1} - C:\Program Files\Azureus\Azureus.exe (Vuze Inc.)
HKLM_ElevationPolicy\{1024F1BE-76DC-40d5-AB98-664A4185E5FA} - C:\Users\yannos\AppData\Local\Facebook\Video\Skype\FacebookVideoCalling.exe (Skype Limited)
HKLM_ElevationPolicy\{3B9A6E32-36C9-4946-B78C-3F58E3785EC1} - C:\Program Files\Java\jre1.6.0_07\bin\unpack200.exe (x)
HKLM_ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7} - C:\Program Files\Java\jre7\bin\jp2launcher.exe (Oracle Corporation)
HKLM_ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284} - C:\Program Files\Java\jre7\bin\javaws.exe (Oracle Corporation)
HKLM_ElevationPolicy\{70f641fd-9ffc-4d5b-a4dc-962af4ed7999} - C:\Program Files\Internet Explorer\iedw.exe (x)
HKLM_ElevationPolicy\{B2321D2F-1154-4d97-AD3E-2FE0BAE2897B} - C:\Program Files\SFR\Kit\9launch.exe (SFR)
HKLM_ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A} - C:\Program Files\Java\jre7\bin\ssvagent.exe (Oracle Corporation)
HKLM_Extensions\{06568ceb-5721-47d4-9d93-7e604fcbaeab} - "PMU Poker" (C:\Programs\PMU\PMUPoker\images\ppicon.ico)
HKLM_Extensions\{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - "?" (?)
BHO\{0F6E720A-1A6B-40E1-A294-1D4D19F156C8} - "Objet d'aide à la navigation SFR" (C:\Program Files\SFR\Kit\SFRNavErrorHelper.dll)
BHO\{5C255C8A-E604-49b4-9D64-90988571CECB} (?)
BHO\{988B07F5-7392-455A-8A1F-64935CB8B6ED} - "BHO Barre de Confiance" (C:\Program Files\BarreConfCMCIC\TAPBar.dll)

========================================

C:\Program Files\Ad-Remover\Quarantine: 8 Fichier(s)
C:\Program Files\Ad-Remover\Backup: 15 Fichier(s)

C:\Ad-Report-CLEAN[1].txt - 20/09/2012 22:43:43 (7503 Octet(s)) 

Fin à: 22:44:38, 20/09/2012 
 
============== E.O.F ==============

yann252 · Answer

en instalent firefox adobe flash 11 c'est instalé avec McAfee securité scan, est il utile ou superflu?

g3n-h@ckm@n · Answer

fallait decocher la case ......vire-le

yann252 · Answer

c'est fait

yann252 · Answer

et malheureusement toujour des pub...

g3n-h@ckm@n · Answer

refais adwcleaner suppression  et desinstalle alcohol toolbar si installée
  
¤¤¤¤¤¤¤¤¤¤ Pre_Scan_Concept ¤¤¤¤¤¤¤¤¤¤

yann252 · Answer

Salut
aucune toolbar n'est installé

# AdwCleaner v2.000 - Rapport créé le 21/09/2012 à 05:53:49
# Mis à jour le 30/08/2012 par Xplode
# Système d'exploitation : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Nom d'utilisateur : yannos - PC-DE-YANNOS
# Mode de démarrage : Normal
# Exécuté depuis : C:\Users\yannos\Documents\logiciel\adwcleaner.exe
# Option [Suppression]


***** [Services] *****


***** [Fichiers / Dossiers] *****


***** [Registre] *****

Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{83AA2913-C123-4146-85BD-AD8F93971D39}

***** [Navigateurs] *****

-\ Internet Explorer v9.0.8112.16421

Restauré : [HKCU\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Restauré : [HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]

-\ Mozilla Firefox v15.0.1 (fr)

Nom du profil : default 
Fichier : C:\Users\yannos\AppData\Roaming\Mozilla\Firefox\Profiles\sqt43kb3.default\prefs.js

[OK] Le fichier ne contient aucune entrée illégitime.

-\ Google Chrome v [Impossible d'obtenir la version]

Fichier : C:\Users\yannos\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] Le fichier ne contient aucune entrée illégitime.

*************************

AdwCleaner[S1].txt - [1273 octets] - [21/09/2012 05:53:49]

########## EOF - C:\AdwCleaner[S1].txt - [1333 octets] ##########

yann252 · Answer

rien a faire sa persiste!

g3n-h@ckm@n · Answer

supprime pre_scan , retelecharge-le puis lance l'option kill

yann252 · Answer

Toujours impossible d' exécuter pre scan même en mode sans échec, l' installation se fait et je clic sur kill ensuite il travail 5 seconde et une fenêtre s'ouvre en me disant qu' il a cesser de fonctionner .
J'ai pourtant bien désactivé toute mes protections, je ne comprend pas...

g3n-h@ckm@n · Answer

bah refais ton système à neuf

yann252 · Answer

C'est dire? restauration??

yann252 · Answer

formatage???

g3n-h@ckm@n · Answer

est-ce qu'un diag passerait avec pre_scan ?

yann252 · Answer

diag?

yann252 · Answer

aaaaaaa un diagnostique 

mais comment tu fait?

g3n-h@ckm@n · Answer

bah tu le lances et tu cliques sur diag  ^^

yann252 · Answer

et sa va coupé mes appli en cour?

Si oui je le ferais plus tard, j'ai commencé un tournois de poker

g3n-h@ckm@n · Answer

non non pas ce scan là c'est juste une lecture

yann252 · Answer

ok je mi mais alor merci

yann252 · Answer

il a fallu que j'autorise la prévention de l'exécution des données se que je n'avais pas fais avant parce qu'il me l'avais pas demandé c'est peut être pour ça que ça ne marchais pas?

yann252 · Answer

c' est passé voila le rapport

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Pre_Diag | 2.0920 | g3n-h@ckm@n & Saachaa | ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

¤¤¤¤¤ XP | Vista | 7 | 8 - 32/64 bits ¤¤¤¤¤

~ Update on 20/09/2012 | 23.55 by g3n-h@ckm@n
~ Informations | Evolution : https://gen-hackman.kanak.fr/
~ Informations for the switches Pre_Script : https://gen-hackman.kanak.fr/
~ Feedback Pre_scan : https://gen-hackman.kanak.fr/#505
~ Thx to C_XX , Slyk for their help for the evolution of the tool

~ User : yannos (Administrateurs) | SID = S-1-5-21-1170913042-1277233965-3038881231-1000
~ Computer : PC-DE-YANNOS

~ System : Windows Vista (TM) Home Premium (32 bits) HomePremium Service Pack 2
~ RegisteredOwner : yannos
~ RegisteredOrganization : 
~ ProcessorNameString : AMD Athlon(tm) 64 X2 Dual Core Processor 5600+
~ Identifier : x86 Family 15 Model 67 Stepping 3
19:36:59

¤¤¤¤¤¤¤¤¤¤ | Run

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]|[NeroFilterCheck] : C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe   [12/01/2006 15:40:44]
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]|[LogitechCommunicationsManager] : "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"   
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]|[LogitechQuickCamRibbon] : "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide   
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]|[PWRISOVM.EXE] : C:\Program Files\PowerISO\PWRISOVM.EXE   [07/08/2007 02:05:46]
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]|[UMonit] : C:\Windows\system32\UMonit.exe   [27/12/2007 19:29:22]
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]|[WinampAgent] : "C:\Program Files\Winamp\winampa.exe"   
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]|[AppleSyncNotifier] : C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe   [20/04/2011 12:48:18]
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]|[SMSTray] : C:\Program Files\Samsung\EmoDio\SMSTray.exe   [16/04/2009 13:23:56]
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]|[Adobe ARM] : "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"   
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]|[QuickTime Task] : "C:\Program Files\QuickTime\QTTask.exe" -atboottime   
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]|[TkBellExe] : "C:\Program Files\Real\RealPlayer\updateealsched.exe"  -osboot   
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]|[StartCCC] : "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun   
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]|[SunJavaUpdateSched] : "C:\Program Files\Common Files\Java\Java Update\jusched.exe"   
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]|[MSC] : "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey   
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]|[Sidebar] : C:\Program Files\Windows Sidebar\sidebar.exe /autoRun  
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]|[ehTray.exe] : C:\Windows\ehome\ehTray.exe  [18/06/2008 13:47:16]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]|[Facebook Update] : "C:\Users\yannos\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver  
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]|[WMPNSCFG] : C:\Program Files\Windows Media Player\WMPNSCFG.exe  [18/06/2008 13:47:38]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]|[erifbrgc] : "c:\users\yannos\appdata\local\lollipop\erifbrgc.exe" erifbrgc  


¤¤¤¤¤¤¤¤¤¤ | Others 

[HKLM\System\CurrentControlSet\Control\SecurityProviders]|[SecurityProviders] : credssp.dll
[HKLM\System\CurrentControlSet\Control\Terminal Server]|[AllowRemoteRPC] : 0
[HKLM\System\CurrentControlSet\Control\Session Manager]|[BootExecute] : autocheck autochk *
[HKLM\System\ControlSet001\Control\Session Manager]|[SetupExecute] : 
[HKLM\System\ControlSet001\Control]|[FirmwareBootDevice] : multi(0)disk(0)rdisk(0)partition(1)
[HKLM\System\ControlSet001\Control]|[SystemBootDevice] : multi(0)disk(0)rdisk(0)partition(1)
[HKLM\system\currentcontrolset\control\lsa]|[SecureBoot] : 1
[HKLM | Winlogon]|[VMApplet] : rundll32 shell32,Control_RunDLL "sysdm.cpl"
[HKLM | Winlogon]|[SFCDisable] : 0
[HKLM | Winlogon]|[WinStationsDisabled] : 0



[HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]|[WebCheck] : {E6FB5E20-DE35-11CF-9C87-00AA005127ED}   

[HKU\S-1-5-19\Software\Microsoft\Internet Explorer\URLSearchHooks]|[{CFBFAE00-17A6-11D0-99CB-00C04FD64497}] :    
[HKU\S-1-5-20\Software\Microsoft\Internet Explorer\URLSearchHooks]|[{CFBFAE00-17A6-11D0-99CB-00C04FD64497}] :    
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Internet Explorer\URLSearchHooks]|[{CFBFAE00-17A6-11D0-99CB-00C04FD64497}] :    
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Internet Explorer\URLSearchHooks]|[{EF99BD32-C1FB-11D2-892F-0090271D4F88}] :    

[HKLM\Software\Microsoft\Internet Explorer\Toolbar]|[{55BDF3B0-C0A8-481A-B8A6-01CD2BE0F3FD}] : Barre de confiance   
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Internet Explorer\Toolbar]|[Locked] : 0   
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Internet Explorer\Toolbar]|[ShowDiscussionButton] : Yes   

[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]|[{8C7461EF-2B13-11d2-BE35-3078302C2030}] : Component Categories cache daemon   

[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Internet Explorer\SearchScopes\${searchCLSID}] -> (@ieframe.dll,-12512) -> https://www.bing.com/?scope=web&mkt=fr-FR{searchTerms}&src={referrer:source?}
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}] -> (Bing) -> https://www.bing.com/?scope=web&mkt=fr-FR{searchTerms}&src=IE-SearchBox&FORM=IE8SRC
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}] -> (Google) -> https://www.google.fr/webhp?gws_rd=ssl{searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7GGLL_fr
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Internet Explorer\SearchScopes\{9B6103C1-F818-48a8-9683-314055BE6075}] -> (MyStart Search) -> http://mystart.hiyo.com/?search={searchTerms}&loc=ie_search
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Internet Explorer\SearchScopes\{9D5BD211-422C-4164-9298-BB4186A30F31}] -> (Bing) -> https://www.bing.com/?scope=web&mkt=fr-FR{searchTerms}&mkt=fr-FR&form=IE0004
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Internet Explorer\SearchScopes\{E8838CF0-5A41-483D-881D-E1D54F705A52}] -> (Bing) -> https://www.bing.com/?scope=web&mkt=fr-FR&FORM=IEFM1{searchTerms}&src={referrer:source?}
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Internet Explorer\SearchScopes\{ED4BD629-C1B6-4399-8A34-02CCAA921DC9}] -> (Barre d'outils Alcohol Soft) -> http://search.alcohol-toolbar.com/search?p=Q&ts=ne&w={searchTerms}&csrc=search-field

[HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}] -> (@ieframe.dll,-12512) -> https://www.bing.com/?scope=web&mkt=fr-FR{searchTerms}&FORM=IE8SRC
[HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}] -> (Google) -> https://www.google.com/webhp?gws_rd=ssl{searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7

[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{024FE56A-FB63-4A9B-84CA-867A3B599861}] -> () -> 
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{0562C0A2-E425-4F99-B194-C4D1FB3C3A16}] -> () -> 
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1024F1BE-76DC-40d5-AB98-664A4185E5FA}] -> () -> 
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2A44969F-9D71-47FB-A845-ED81119917AF}] -> () -> 
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3E5F05FB-F259-4906-B7FA-E50D72F57528}] -> () -> 
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5CDAD991-E351-4D13-B313-8DF54C782CD9}] -> () -> 
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5D5DAE76-5142-4B56-9372-084E46028849}] -> () -> 
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{604CB6C7-9EA9-4236-AE6A-D7A4600620B7}] -> () -> 
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{66E50C9A-52E3-40AB-8561-5AAF4960C5B0}] -> () -> 
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{97C32638-E2E6-4594-97ED-7FD1AA07A224}] -> () -> 
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A2FECAA1-3C71-49F1-AC3F-E297DD91E9CD}] -> () -> 
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AFD47C0D-4E23-49E4-9670-A1730C35FCFB}] -> () -> 
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CDAE3941-DDC3-40C2-B5AD-DD04BB6BC884}] -> () -> 
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D18FD9F0-E210-4B56-8D5F-F5AFA6B46AF6}] -> () -> 
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0A900DF-9611-4446-86BD-4B1D47E7DB2A}] -> () -> 
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F124E4F1-0575-4551-ABA5-F11EF14A1562}] -> () -> 
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FEC329C5-97EB-46EE-B2C2-CD284438C3F1}] -> () -> 
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{0002df01-0000-0000-c000-000000000046}] -> (iexplore.exe) -> %ProgramFiles%\Internet Explorer
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{003B91A6-61E3-4591-891D-01E94C8CB11E}] -> (Silverlight.Configuration.exe) -> c:\Program Files\Microsoft Silverlight\4.1.10329.0\
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{054aae20-4bea-4347-8a35-64a533254a9d}] -> (tabtip.exe) -> %CommonProgramFiles%\Microsoft Shared\Ink
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{07d873dc-b9b9-44f5-af0b-fb59fa54fb7a}] -> (wpcer.exe) -> C:\Windows\system32
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{08f24d68-9087-4b24-81ad-7b34af3e3ed5}] -> (Acrobat Elements.exe) -> %ProgramFiles%\adobe\acrobat 6.0\Acrobat Elements
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{0a402d70-1f10-4ae7-bec9-286a98240695}] -> (winfxdocobj.exe) -> C:\Windows\system32
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1024F1BE-76DC-40d5-AB98-664A4185E5FA}] -> (FacebookVideoCalling.exe) -> C:\Users\yannos\AppData\Local\Facebook\Video\Skype\
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{10483e7e-0e8b-4e16-9e77-6be5d991683b}] -> (mstsc.exe) -> %systemroot%\system32
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1138506a-b949-46a7-b6c0-ee26499fdeaf}] -> (wuapp.exe) -> C:\Windows\system32
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{130c40f0-1bcb-4852-8b63-291cf90a600b}] -> (msdt.exe) -> C:\Windows\system32
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B3FB63-66F4-4EFC-B717-BB283B85E79B}] -> (AcroBroker.exe) -> C:\Program Files\Adobe\Reader 10.0\Reader\
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{186e0934-aee9-11da-961b-0014223d2a70}] -> (dfsvc.exe) -> C:\Windows\microsoft.net\framework\v2.0.50727
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1ec76a37-1762-46ff-9b14-765b3e6793be}] -> (agcp.exe) -> c:\Program Files\Microsoft Silverlight\4.1.10329.0\
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{26fe7361-bd5a-4dcb-b309-c6f42dde661c}] -> (ieinstal.exe) -> %ProgramFiles%\Internet Explorer
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{358E6F10-DE8A-4602-8424-179CA217F8EE}] -> (AcroRd32Info.exe) -> C:\Program Files\Adobe\Reader 10.0\Reader
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3B9A6E32-36C9-4946-B78C-3F58E3785EC1}] -> (unpack200.exe) -> C:\Program Files\Java\jre1.6.0_07\bin
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{43ABBB95-C0E9-497B-8BB9-B5FA08861705}] -> (wlmail.exe) -> C:\Program Files\Windows Live\Mail\
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}] -> (jp2launcher.exe) -> C:\Program Files\Java\jre7\bin
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4becf16c-74f0-429b-8d3e-4fba507ac661}] -> (acrord32.exe) -> %ProgramFiles%\adobe\acrobat 7.0eader
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4C0B7A7C-8ECF-422f-9448-0874C41D4532}] -> (WLLoginProxy.exe) -> %ProgramFiles%\Common Files\Microsoft Shared\Windows Live
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}] -> (javaws.exe) -> C:\Program Files\Java\jre7\bin
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{58F04068-17A5-41a3-B5B7-111004DDF5DC}] -> (realplay.exe) -> c:\program filesealealplayer\
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5A2777DF-310A-49ca-A9E8-6C9D608D257E}] -> (realupgrade.exe) -> C:\Program Files\Real\RealUpgrade\
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6bf52a52-394a-11d3-b153-00c04f79faa6}] -> (wmplayer.exe) -> %ProgramFiles%\Windows Media Player
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{70f641fd-9ffc-4d5b-a4dc-962af4ed7999}] -> (iedw.exe) -> %ProgramFiles%\Internet Explorer
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{76E2369A-75BA-41F9-8B9E-16059E5CF9A6}] -> (AdobeARM.exe) -> C:\Program Files\Common Files\Adobe\ARM\1.0\
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7aaae723-5fb5-4b2d-9327-75519f336825}] -> () -> 
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7B7FB824-0A43-4bc2-B58D-F6386FEEFD84}] -> (CGuard.exe) -> Choice Guard
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7eb01fb2-f185-445a-94e4-ec4e1ba2202c}] -> (verclsid.exe) -> C:\Windows\system32
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{85fc331e-bb64-4c53-ba25-3d8a956c02fd}] -> (ctfmon.exe) -> C:\Windows\system32
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8cec58ae-07a1-11d9-b15e-000d56bfe6ee}] -> (helppane.exe) -> C:\Windows
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E1F80F4-953F-41E7-8460-E64AE5BE4ED3}] -> (AdobeCollabSync.exe) -> C:\Program Files\Adobe\Reader 10.0\Reader
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{95a4104c-1c49-4c2a-9830-1be0f47e926c}] -> (acrobat.exe) -> %ProgramFiles%\adobe\acrobat 7.0\Acrobat
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C6A861C-B233-4994-AFB1-C158EE4FC578}] -> (AcroRd32.exe) -> C:\Program Files\Adobe\Reader 10.0\Reader
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9da1d2cb-796d-4bec-bbaa-0aa9ccd80e15}] -> (Acrobat Elements.exe) -> %ProgramFiles%\adobe\acrobat 7.0\Acrobat Elements
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{a5a2d52a-4944-47c4-a3e0-8bd92e14d953}] -> (xpsviewer.exe) -> C:\Windows\system32\xpsviewer
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5B020FD-E04B-4e67-B65A-E7DEED25B2CF}] -> (wisptis.exe) -> %SystemRoot%\System32
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AAD4AE2E-D834-46D4-8B09-490FAC9C722B}] -> () -> 
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{aff735eb-cdf9-4894-aa69-3e3131128618}] -> (cmd.exe) -> C:\Windows\system32
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B2321D2F-1154-4d97-AD3E-2FE0BAE2897B}] -> (9launch.exe) -> C:\Program Files\SFR\Kit
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}] -> (GoogleUpdateBroker.exe) -> C:\Program Files\Google\Update\1.3.21.123
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C442AC41-9200-4770-8CC0-7CDB4F245C55}] -> (GoogleUpdate.exe) -> C:\Program Files\Google\Update
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}] -> (ssvagent.exe) -> C:\Program Files\Java\jre7\bin
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D133B285-8A43-4EC7-93BE-9B909C2370F5}] -> (msnmsgr.exe) -> C:\Program Files\Windows Live\Messenger\
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d8a5d001-3352-40db-9d1c-ed46683193b5}] -> (WindowsLiveWriter.exe) -> C:\Program Files\Windows Live\Writer\
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{dc6bf185-7ae4-444e-8c35-e447b0d2bd1e}] -> (notepad.exe) -> C:\Windows\System32
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E56200D6-445E-45ce-89D8-E0EF39ECF849}] -> (RecordingManager.exe) -> c:\program filesealealplayer\
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{e5f90a07-7db7-4dcb-bd6d-d3fecd376ca3}] -> (acrord32.exe) -> %ProgramFiles%\adobe\acrobat 6.0eader
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{eee261cc-4b3e-46e7-affb-61f297155bf2}] -> (presentationhost.exe) -> C:\Windows\system32
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FAF199D2-BFA7-4394-A4DE-044A08E59B32}] -> (FlashUtil32_11_4_402_265_ActiveX.exe) -> C:\Windows\system32\Macromed\Flash
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{fb9e068b-c612-4fa8-bdb9-d728a716a420}] -> (acrobat.exe) -> %ProgramFiles%\adobe\acrobat 6.0\Acrobat

¤¤¤¤¤¤¤¤¤¤ | BHO 

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0F6E720A-1A6B-40E1-A294-1D4D19F156C8}] -> (Objet d'aide à la navigation SFR) -> C:\Program Files\SFR\Kit\SFRNavErrorHelper.dll  [19/07/2010 18:32:02]
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}] -> (Adobe PDF Link Helper) -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll  [27/07/2012 22:51:32]
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}] -> (RealPlayer Download and Record Plugin for Internet Explorer) -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IEpbrowserrecordplugin.dll  [10/11/2011 16:48:45]
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}] -> () ->   
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}] -> (Java(tm) Plug-In SSV Helper) -> C:\Program Files\Java\jre7\bin\ssv.dll  [18/09/2012 05:37:10]
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}] -> (Programme d'aide de l'Assistant de connexion Windows Live) -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll  [22/01/2009 16:41:30]
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{988B07F5-7392-455A-8A1F-64935CB8B6ED}] -> (BHO Barre de Confiance) -> C:\Program Files\BarreConfCMCIC\TAPBar.dll  [14/09/2007 15:14:18]
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}] -> (Java(tm) Plug-In 2 SSV Helper) -> C:\Program Files\Java\jre7\bin\jp2ssv.dll  [18/09/2012 05:37:09]

¤¤¤¤¤¤¤¤¤¤ | ActiveX 

[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] -> (WMPACCESS) -> Microsoft Windows Media Player
[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}] -> (IEACCESS) -> Internet Explorer
[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] -> () -> 
[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS] -> (BRANDING.CAB) -> Personnalisation du navigateur
[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}] -> () -> 
[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] -> () -> Microsoft Windows Media Player 11.0
[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] -> (Theme Component) -> Themes Setup
[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{3af36230-a269-11d1-b5bf-0000f8051515}] -> (MobilePk) -> Offline Browsing Pack
[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] -> (MailNews) -> Microsoft Windows Mail 7
[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}] -> () -> 
[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}] -> (DirectDrawEx) -> DirectDrawEx
[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{45ea75a0-a269-11d1-b5bf-0000f8051515}] -> (HelpCont) -> Internet Explorer Help
[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{4f645220-306d-11d2-995d-00c04f98bbc9}] -> (MSVBScript) -> Microsoft Windows Script 5.8
[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}] -> (GenSetup) -> Internet Explorer Setup Tools
[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{630b1da0-b465-11d1-9948-00c04f98bbc9}] -> (ExtraPack) -> Browsing Enhancements
[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}] -> (Microsoft Windows Media Player) -> Microsoft Windows Media Player
[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}] -> (MSN_Auth) -> MSN Site Access
[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{73FA19D0-2D75-11D2-995D-00C04F98BBC9}] -> (WebFolders) -> Dossiers Web
[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}] -> () -> Address Book 7
[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{7C028AF8-F614-47B3-82DA-BA94E41B1089}] -> (.NETFramework) -> .NET Framework
[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}] -> (IE4_SHELLID) -> Windows Desktop Update
[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}] -> (BASEIE40_W2K) -> Web Platform Customizations
[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}] -> (DOTNETFRAMEWORKS) -> 
[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{9381D8F2-0288-11D0-9501-00AA00B911A5}] -> (Tridata) -> Dynamic HTML Data Binding
[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{C6BAF60B-6E91-453F-BFF9-D3789CFEFCDD}] -> (.NETFramework) -> .NET Framework
[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{C9E9A340-D1F1-11D0-821E-444553540600}] -> (Fontcore) -> Internet Explorer Core Fonts
[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{CB6EED45-86CD-B910-43C2-0197DC944489}] -> () -> DirectX
[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}] -> (Windows Movie Maker 2.6) -> 
[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{D27CDB6E-AE6D-11CF-96B8-444553540000}] -> (Flash) -> Adobe Flash Player
[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{D649C898-087A-06D2-570A-C10CC3E1B074}] -> () -> Microsoft Windows Media Player 11.0
[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}] -> (HTMLHelp) -> HTML Help
[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}] -> (ADSI) -> Active Directory Service Interface
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}] -> () -> 9,0,8112,16421
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] -> () -> 9,0,8112,16421
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS] -> () -> 5,0,2314,1003
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}] -> () -> 11,0,6000,6324
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] -> () -> 11,0,6000,6324
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] -> () -> 1,1,1,9
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] -> () -> 6,0,6002,18005
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}] -> () -> 11,0,6000,6324
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}] -> () -> 11,0,6000,6324
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}] -> () -> 6,0,6002,18646
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}] -> () -> 9,0,8112,16421
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}] -> () -> 
[HKU\S-1-5-18\SOFTWARE\Microsoft\Active Setup\Installed Components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}] -> () -> 11,0,6000,6324
[HKU\S-1-5-18\SOFTWARE\Microsoft\Active Setup\Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] -> () -> 11,0,6000,6324
[HKU\S-1-5-18\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}] -> () -> 11,0,6000,6324
[HKU\S-1-5-18\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}] -> () -> 11,0,6000,6324

[HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{02BF25D5-8C17-4B23-BC80-D3488ABDDC6B}] -> 
[HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{04CB5B64-5915-4629-B869-8945CEBADD21}] -> 
[HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{4F1E5B1A-2A80-42CA-8532-2D05CB959537}] -> 
[HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{867E13F2-7F31-44FB-AC97-CD38E0DC46EF}] -> 
[HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}] -> Java Runtime Environment 1.6.0
[HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}] -> 
[HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{C3F79A2B-B9B4-4A66-B012-3EE46475B072}] -> 
[HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}] -> Java Runtime Environment 1.6.0
[HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{D27CDB6E-AE6D-11CF-96B8-444553540000}] -> 
[HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6}] -> 

19:37:04

¤¤¤¤¤¤¤¤¤¤ | HKCR\Applications

[HKCR\Applications\BackItUp.exe\Shell\open\command] -> "C:\Program Files\Nero\Nero 7\Nero BackItUp\BackItUp.exe" "%1"
[HKCR\Applications\BitComet.exe\Shell\open\command] -> "C:\Program Files\BitComet\BitComet.exe" "%1"
[HKCR\Applications\bittorrent.exe\Shell\open\command] -> "C:\Program Files\BitTorrent\bittorrent.exe" "%1"
[HKCR\Applications\CoverDes.exe\Shell\open\command] -> "C:\Program Files\Nero\Nero 7\Nero CoverDesigner\CoverDes.exe" "%1"
[HKCR\Applications\ehshell.exe\Shell\open\command] -> "C:\Windows\eHome\ehshell.exe" "%1"
[HKCR\Applications\GoldWave.exe\Shell\open\command] -> "C:\Program Files\GoldWave\GoldWave.exe" "%1"
[HKCR\Applications\gwave523.exe\Shell\open\command] -> "C:\Documents\GoldWave.v.5.23.Key-maz\gwave523.exe" "%1"
[HKCR\Applications\hl2.exe\Shell\open\command] -> "c:\program files\steam\steamapps\yann230\half-life 2 deathmatch\hl2.exe" "%1"
[HKCR\Applications\iexplore.exe\Shell\open\command] -> "C:\Program Files\Internet Explorer\iexplore.exe" %1
[HKCR\Applications\MovieMaker.exe\Shell\open\command] -> "C:\Program Files\Windows Live\Photo Gallery\MovieMaker.exe" "%1"
[HKCR\Applications\mplayerc.exe\Shell\open\command] -> "C:\Program Files\Real Alternative\Media Player Classic\mplayerc.exe" "%1"
[HKCR\Applications
ero.exe\Shell\open\command] -> "C:\Program Files\Nero\Nero 7\Core
ero.exe" "%1"
[HKCR\Applications\NokiaMMSViewer.exe\Shell\open\command] -> "C:\Program Files\Nokia\Nokia Multimedia Player\NokiaMMSViewer.exe" "%1"
[HKCR\Applications
otepad.exe\Shell\open\command] -> %SystemRoot%\system32\NOTEPAD.EXE %1
[HKCR\Applications\PhotoSnapViewer.exe\Shell\open\command] -> "C:\Program Files\Nero\Nero 7\Nero PhotoSnap\PhotoSnapViewer.exe" "%1"
[HKCR\Applications\photoviewer.dll\Shell\open\command] -> %SystemRoot%\System32undll32.exe "%ProgramFiles%\Windows Photo Gallery\PhotoViewer.dll", ImageView_Fullscreen %1
[HKCR\Applications\RealPlay.exe\Shell\open\command] -> "c:\program filesealealplayerealplay.exe" "%1"
[HKCR\Applications\winamp.exe\Shell\open\command] -> "C:\Program Files\Winamp\winamp.exe" "%1"
[HKCR\Applications\WinCal.exe\Shell\open\command] -> "%ProgramFiles%\Windows Calendar\wincal.exe" "%1"
[HKCR\Applications\WLXPhotoViewer.dll\Shell\open\command] -> C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe /LaunchPhotoViewer /v "%1"
[HKCR\Applications\wmplayer.exe\Shell\open\command] -> "%ProgramFiles%\Windows Media Player\wmplayer.exe" /Open "%L" 
[HKCR\Applications\wordpad.exe\Shell\open\command] -> "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"

¤¤¤¤¤¤¤¤¤¤ | Svchost - Netsvc


19:37:05


¤¤¤¤¤¤¤¤¤¤ | HKU\S-1-5-21-1170913042-1277233965-3038881231-1000

[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\AC3filter]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\ACE Compression Software]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Ad-Remover]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Adobe]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\ahead]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\ALWIL Software]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\AppDataLow]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Apple Computer, Inc.]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Apple Inc.]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\ASProtect]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\ATI]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\ATI Technologies Inc.]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\AVAST Software]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\AVS4YOU]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Azureus]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Battle.net]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\BitComet]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\BitTorrent]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Blizzard Entertainment]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Boonty]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Bugsplat]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\BVRP Software]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\CDDB]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Clients]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\CoreVorbis]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\COWON]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\cybelsoft]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Cyberlink]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\DivXNetworks]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Dropbox]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\DSP-worx]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\ej-technologies]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Electronic Arts]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Facebook]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Freeware]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Full Tilt Poker]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\g3n-h@ckm@n]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Gabest]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\GeoVid]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\GNU]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\GoldWave]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Google]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Grisoft]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\GSpot Appliance Corp]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Haali]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\HaaliMkx]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\HookNetwork]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\IE]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\IGA]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\IM Providers]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Image-Line]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\InstallCore]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\JavaSoft]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\JEDI-VCL]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\kde.org]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Lavalys]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Lavasoft]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Licenses]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Local AppWizard-Generated Applications]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Logitech]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\lollipop]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Macromedia]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Macrovision]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Magicbit]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\MainConcept]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Malwarebytes' Anti-Malware]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\MediaInfo]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Mozilla]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\MozillaPlugins]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\MySpace]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Netscape]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Neuf]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Nokia]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\ODBC]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\OpenOffice.org]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Orange]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Outspark.com]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Pando Networks]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\PartyFrance]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\PCSync5300v1]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\PepiMK Software]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Piriform]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\PistonSoft]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\PMU]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Policies]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\PowerISO]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Propellerhead Software]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\RealNetworks]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\RegisteredApplications]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Replay AV 8]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\SampleView]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Samsung]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Samsung Media Studio]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\skype]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\SkypeRS]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\SOCID]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\SoftVoice]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Sony Ericsson]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\SoundDownloader]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\StarSynergy]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\SWISSKNIFE]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Sysinternals]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Titan Casino]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Trolltech]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Ultimate Arena]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Valve]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\VB and VBA Program Settings]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\VirtualDJ]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Wget]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Winamp]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\WinRAR]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\WinRAR SFX]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Wow6432Node]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Yahoo]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\YahooPartnerToolbar]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Zyrax Software]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Classes]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Active Setup]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\ActiveMovie]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\AntiPhishing]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Assistance]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Babylon]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Calc]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\ClipArt Gallery]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Command Processor]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\ComPstUI]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\ConferencingRTC]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\CTF]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Direct3D]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\DirectInput]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\DVR]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Ease of Access]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\EventSystem]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Feeds]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\FTP]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\GDIPlus]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\HMREngine]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\IAM]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\IdentityCRL]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Ieak]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\IME]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\IMEJP]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\IMEMIP]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\InkBall]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\InputPersonalization]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Installer]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Internet Connection Wizard]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Internet Explorer]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Java VM]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Journal]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Keyboard]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\MediaCenterPeripheral]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\MediaPlayer]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Microsoft Agent]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Microsoft DVD Wizard Settings]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Microsoft Management Console]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\MM20]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\MobilePC]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\MPEG2Demultiplexer]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\MS Design Tools]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\MSDAIPP]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\MSNMessenger]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Multimedia]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Net]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\NetShow]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Notepad]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Office]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\OLE]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Osk]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\PeerNet]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Plus!]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\PowerPoint Viewer]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Protected Storage System Provider]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\RAS AutoDial]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\RAS Phonebook]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Remote Assistance]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\RTC]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Security Center]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Shared Tools]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\SideShow]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Speech]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\SQMClient]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\SystemCertificates]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\TabletTip]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\TPG]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Tracing]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\UCCPlatform]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\VBA]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Visual Basic]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\VisualStudio]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\WAB]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Windows]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Windows Collaboration]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Windows Defender]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Windows Live]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Windows Live Contacts]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Windows Live Mail]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Windows Mail]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Windows Media]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Windows Media Foundation]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Windows Media Player NSS]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Windows NT]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Windows Photo Gallery]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Windows Script]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Windows Script Host]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Windows Sidebar]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Wisp]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Works]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Windows\CurrentVersion]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Windows\DWM]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Windows\Shell]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Windows\ShellNoRoam]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Windows\TabletPC]
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Windows\Windows Error Reporting]


¤¤¤¤¤¤¤¤¤¤ | HKCU\Software\M$\Windows NT\CurrentVersion

[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Accessibility]
[HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags]
[HKCU\Software\Microsoft\Windows NT\CurrentVersion\devices]
[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Drivers32]
[HKCU\Software\Microsoft\Windows NT\CurrentVersion\EFS]
[HKCU\Software\Microsoft\Windows NT\CurrentVersion\ICM]
[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Network]
[HKCU\Software\Microsoft\Windows NT\CurrentVersion\PeerNet]
[HKCU\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts]
[HKCU\Software\Microsoft\Windows NT\CurrentVersion\TaskManager]
[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Terminal Server]
[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows]
[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]

¤¤¤¤¤¤¤¤¤¤ | HKLM\Software

[HKLM\Software\AbiSuite]
[HKLM\Software\ACE Compression Software]
[HKLM\Software\Adobe]
[HKLM\Software\Adobe Systems]
[HKLM\Software\Adobe Systems Incorporated]
[HKLM\Software\AdwCleaner]
[HKLM\Software\AGEIA Technologies]
[HKLM\Software\ahead]
[HKLM\Software\Alcohol Soft]
[HKLM\Software\ALWIL Software]
[HKLM\Software\AMD]
[HKLM\Software\America Online]
[HKLM\Software\AOL]
[HKLM\Software\Apple Computer, Inc.]
[HKLM\Software\Apple Inc.]
[HKLM\Software\Applian]
[HKLM\Software\ASUS]
[HKLM\Software\ATI]
[HKLM\Software\ATI Technologies]
[HKLM\Software\AVAST Software]
[HKLM\Software\AviSynth]
[HKLM\Software\AVS4YOU]
[HKLM\Software\Azureus]
[HKLM\Software\BitTorrent]
[HKLM\Software\Blizzard Entertainment]
[HKLM\Software\Boonty]
[HKLM\Software\C07ft5Y]
[HKLM\Software\CDDB]
[HKLM\Software\Classes]
[HKLM\Software\Clients]
[HKLM\Software\Codec tweak Tool]
[HKLM\Software\cybelsoft]
[HKLM\Software\Cyberlink]
[HKLM\Software\Cygnus Solutions]
[HKLM\Software\DivXNetworks]
[HKLM\Software\DriverTuner]
[HKLM\Software\DriverTuner_Init]
[HKLM\Software\Dropbox]
[HKLM\Software\EA GAMES]
[HKLM\Software\EID]
[HKLM\Software\Eidos Interactive]
[HKLM\Software\ej-technologies]
[HKLM\Software\Electronic Arts]
[HKLM\Software\FRANCE TELECOM]
[HKLM\Software\Full Tilt Poker]
[HKLM\Software\GEAR Software]
[HKLM\Software\Genesys Logic]
[HKLM\Software\GNU]
[HKLM\Software\Google]
[HKLM\Software\Grisoft]
[HKLM\Software\HaaliMkx]
[HKLM\Software\Hewlett-Packard]
[HKLM\Software\id]
[HKLM\Software\InstallShield]
[HKLM\Software\Intel]
[HKLM\Software\Inventel]
[HKLM\Software\JavaSoft]
[HKLM\Software\JreMetrics]
[HKLM\Software\KLCodecPack]
[HKLM\Software\Lanovation]
[HKLM\Software\LEAD Technologies, Inc.]
[HKLM\Software\Licenses]
[HKLM\Software\LightScribe]
[HKLM\Software\Logitech]
[HKLM\Software\Macromedia]
[HKLM\Software\magnet]
[HKLM\Software\Malwarebytes' Anti-Malware]
[HKLM\Software\Malwarebytes' Anti-Malware (Trial)]
[HKLM\Software\MarkAny]
[HKLM\Software\McAfee.com]
[HKLM\Software\Microsoft]
[HKLM\Software\Mozilla]
[HKLM\Software\mozilla.org]
[HKLM\Software\MozillaPlugins]
[HKLM\Software\Mpath]
[HKLM\Software\MusicNet]
[HKLM\Software\MySpace]
[HKLM\Software\Nero]
[HKLM\Software\Neuf]
[HKLM\Software\Nokia]
[HKLM\Software\Notepad]
[HKLM\Software\Nullsoft]
[HKLM\Software\ODBC]
[HKLM\Software\OMSI]
[HKLM\Software\OpenOffice.org]
[HKLM\Software\Oracle]
[HKLM\Software\Orb Networks]
[HKLM\Software\Outspark.com]
[HKLM\Software\Pando Networks]
[HKLM\Software\PC Connectivity Solution]
[HKLM\Software\PCSuite]
[HKLM\Software\PepiMK Software]
[HKLM\Software\Piriform]
[HKLM\Software\PKR]
[HKLM\Software\PocketSoft]
[HKLM\Software\Policies]
[HKLM\Software\PowerISO]
[HKLM\Software\Propellerhead Software]
[HKLM\Software\PTECH]
[HKLM\Software\RealAlternative]
[HKLM\Software\RealNetworks]
[HKLM\Software\Realtek]
[HKLM\Software\RegisteredApplications]
[HKLM\Software\RTLSetup]
[HKLM\Software\S3R521]
[HKLM\Software\SECURITOO]
[HKLM\Software\SoftRM]
[HKLM\Software\SoftShape]
[HKLM\Software\SoftThinks]
[HKLM\Software\SoftVoice]
[HKLM\Software\Sonic]
[HKLM\Software\Sony Ericsson]
[HKLM\Software\SRS Labs]
[HKLM\Software\Sun Microsystems]
[HKLM\Software\TENCENT]
[HKLM\Software\Titan Casino]
[HKLM\Software\Valve]
[HKLM\Software\VideoLAN]
[HKLM\Software\VirtualDJ]
[HKLM\Software\Vittalia]
[HKLM\Software\VobEdit 0.6 Fr]
[HKLM\Software\Volatile]
[HKLM\Software\VST]
[HKLM\Software\Wow6432Node]
[HKLM\Software\Xerox]
[HKLM\Software\Xing Technology Corp.]
[HKLM\Software\Yahoo]
[HKLM\Software\ZSMC]
[HKLM\Software\Microsoft\.NETFramework]
[HKLM\Software\Microsoft\Active Setup]
[HKLM\Software\Microsoft\ADs]
[HKLM\Software\Microsoft\Advanced INF Setup]
[HKLM\Software\Microsoft\ALG]
[HKLM\Software\Microsoft\ASP.NET]
[HKLM\Software\Microsoft\Assistance]
[HKLM\Software\Microsoft\AudioCompressionManager]
[HKLM\Software\Microsoft\BidInterface]
[HKLM\Software\Microsoft\BRCpl]
[HKLM\Software\Microsoft\CameraControl]
[HKLM\Software\Microsoft\ClipArt Gallery]
[HKLM\Software\Microsoft\Code Store Database]
[HKLM\Software\Microsoft\COM3]
[HKLM\Software\Microsoft\Command Processor]
[HKLM\Software\Microsoft\Cryptography]
[HKLM\Software\Microsoft\CTF]
[HKLM\Software\Microsoft\DataAccess]
[HKLM\Software\Microsoft\DataFactory]
[HKLM\Software\Microsoft\DevDiv]
[HKLM\Software\Microsoft\Dfrg]
[HKLM\Software\Microsoft\Direct3D]
[HKLM\Software\Microsoft\DirectDraw]
[HKLM\Software\Microsoft\DirectInput]
[HKLM\Software\Microsoft\DirectMusic]
[HKLM\Software\Microsoft\DirectPlay]
[HKLM\Software\Microsoft\DirectPlay8]
[HKLM\Software\Microsoft\DirectPlayNATHelp]
[HKLM\Software\Microsoft\DirectShow]
[HKLM\Software\Microsoft\DirectX]
[HKLM\Software\Microsoft\DownloadManager]
[HKLM\Software\Microsoft\Driver Signing]
[HKLM\Software\Microsoft\DRM]
[HKLM\Software\Microsoft\EnterpriseCertificates]
[HKLM\Software\Microsoft\EventSystem]
[HKLM\Software\Microsoft\Exchange]
[HKLM\Software\Microsoft\Feeds]
[HKLM\Software\Microsoft\FlashConfig]
[HKLM\Software\Microsoft\Function Discovery]
[HKLM\Software\Microsoft\Fusion]
[HKLM\Software\Microsoft\Genuine Advantage]
[HKLM\Software\Microsoft\GPUPipeline]
[HKLM\Software\Microsoft\Home Publishing]
[HKLM\Software\Microsoft\HTMLHelp]
[HKLM\Software\Microsoft\IdentityCRL]
[HKLM\Software\Microsoft\IE Setup]
[HKLM\Software\Microsoft\IE4]
[HKLM\Software\Microsoft\IMAPI]
[HKLM\Software\Microsoft\IMEJP]
[HKLM\Software\Microsoft\IMEKR]
[HKLM\Software\Microsoft\IMETC]
[HKLM\Software\Microsoft\Internet Account Manager]
[HKLM\Software\Microsoft\Internet Domains]
[HKLM\Software\Microsoft\Internet Explorer]
[HKLM\Software\Microsoft\Jet]
[HKLM\Software\Microsoft\MediaCenterPeripheral]
[HKLM\Software\Microsoft\MediaPlayer]
[HKLM\Software\Microsoft\MessengerService]
[HKLM\Software\Microsoft\Microsoft Antimalware]
[HKLM\Software\Microsoft\Microsoft Security Client]
[HKLM\Software\Microsoft\Microsoft SQL Server Compact Edition]
[HKLM\Software\Microsoft\Microsoft Sync Framework Native]
[HKLM\Software\Microsoft\Microsoft Sync Services Native]
[HKLM\Software\Microsoft\MigWiz]
[HKLM\Software\Microsoft\MMC]
[HKLM\Software\Microsoft\Mobile]
[HKLM\Software\Microsoft\MpSigStub]
[HKLM\Software\Microsoft\MSBuild]
[HKLM\Software\Microsoft\MSDTC]
[HKLM\Software\Microsoft\MSE]
[HKLM\Software\Microsoft\MSLicensing]
[HKLM\Software\Microsoft\MSN Apps]
[HKLM\Software\Microsoft\MSNMessenger]
[HKLM\Software\Microsoft\MSSQLServer]
[HKLM\Software\Microsoft\Multimedia]
[HKLM\Software\Microsoft\NapServer]
[HKLM\Software\Microsoft\NET Framework Setup]
[HKLM\Software\Microsoft\NetSh]
[HKLM\Software\Microsoft\NetShow]
[HKLM\Software\Microsoft\Network]
[HKLM\Software\Microsoft\NetworkAccessProtection]
[HKLM\Software\Microsoft\Non-Driver Signing]
[HKLM\Software\Microsoft\Notepad]
[HKLM\Software\Microsoft\ODBC]
[HKLM\Software\Microsoft\Office]
[HKLM\Software\Microsoft\Ole]
[HKLM\Software\Microsoft\Outlook Express]
[HKLM\Software\Microsoft\PCHealth]
[HKLM\Software\Microsoft\PLA]
[HKLM\Software\Microsoft\PlayReady]
[HKLM\Software\Microsoft\Preinstall]
[HKLM\Software\Microsoft\Print]
[HKLM\Software\Microsoft\RADAR]
[HKLM\Software\Microsoft\Ras]
[HKLM\Software\Microsoft\RAS AutoDial]
[HKLM\Software\Microsoft\Reliability Analysis]
[HKLM\Software\Microsoft\RemovalTools]
[HKLM\Software\Microsoft\RendezvousApps]
[HKLM\Software\Microsoft\RFC1156Agent]
[HKLM\Software\Microsoft\Router]
[HKLM\Software\Microsoft\Rpc]
[HKLM\Software\Microsoft\SchedulingAgent]
[HKLM\Software\Microsoft\Search Enhancement Pack]
[HKLM\Software\Microsoft\Security Center]
[HKLM\Software\Microsoft\Shared]
[HKLM\Software\Microsoft\Shared Tools]
[HKLM\Software\Microsoft\Shared Tools Location]
[HKLM\Software\Microsoft\SideShow]
[HKLM\Software\Microsoft\Silverlight]
[HKLM\Software\Microsoft\Speech]
[HKLM\Software\Microsoft\SQMClient]
[HKLM\Software\Microsoft\Sysprep]
[HKLM\Software\Microsoft\SystemCertificates]
[HKLM\Software\Microsoft\TableTextService]
[HKLM\Software\Microsoft\TabletTip]
[HKLM\Software\Microsoft\Tcpip]
[HKLM\Software\Microsoft\Terminal Server Client]
[HKLM\Software\Microsoft\TIP Shared]
[HKLM\Software\Microsoft\TMM]
[HKLM\Software\Microsoft\TPG]
[HKLM\Software\Microsoft\Tpm]
[HKLM\Software\Microsoft\Tracing]
[HKLM\Software\Microsoft\Transaction Server]
[HKLM\Software\Microsoft\TV System Services]
[HKLM\Software\Microsoft\UCCPlatform]
[HKLM\Software\Microsoft\uDRM]
[HKLM\Software\Microsoft\Updates]
[HKLM\Software\Microsoft\UPnP D

yann252 · Answer

c bon pre scan kill est passé!
 

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Pre_Scan | 2.0920 | g3n-h@ckm@n & Saachaa | ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

¤¤¤¤¤ XP | Vista | 7 | 8 - 32/64 bits ¤¤¤¤¤

~ Update on 20/09/2012 | 23.55 by g3n-h@ckm@n
~ Informations | Evolution : https://gen-hackman.kanak.fr/
~ Informations for the switches Pre_Script : https://gen-hackman.kanak.fr/
~ Feedback Pre_scan : https://gen-hackman.kanak.fr/#505
~ Thx to C_XX , Slyk for their help for the evolution of the tool

~ User : yannos (Administrateurs) | SID = S-1-5-21-1170913042-1277233965-3038881231-1000
~ Computer : PC-DE-YANNOS

~ System : Windows Vista (TM) Home Premium (32 bits) HomePremium Service Pack 2
~ RegisteredOwner : yannos
~ RegisteredOrganization : 
~ ProcessorNameString : AMD Athlon(tm) 64 X2 Dual Core Processor 5600+
~ Identifier : x86 Family 15 Model 67 Stepping 3

~ Mémory RAM = Total (KB) : 1832720 | Used (%) : 38 | Free (KB) : 1133510
~ Pagefile = Total (KB) : 3921470 | Free (KB) : 3105560
~ Virtual = Total (KB) : 2097020 | Free (KB) : 1921370

¤¤¤¤¤¤¤¤¤¤ | Boot's scripts

C:\Windows\Setup\Scripts\setupcomplete.cmd

¤¤¤¤¤¤¤¤¤¤ | Drives

c:\ -> [Fixed] | [Systeme] | Total : 229720 Mo | Free : 30830 Mo -> NTFS
d:\ -> [Fixed] | [RECOVERY] | Total : 8750 Mo | Free : 4470 Mo -> NTFS

Scan : 20:14:11 | 21/09/2012

¤¤¤¤¤¤¤¤¤¤ | Windows Updates

Last(s) détection(s) : 2012-09-20 12:23:45
Last(s) download(s) : 2012-09-19 14:47:22
Last(s) installation(s) : 2012-09-19 14:53:56
Next search : 2012-09-21 19:59:16


~ C:\Windows\system32\config\systemprofile
~ C:\Windows\ServiceProfiles\LocalService
~ C:\Windows\ServiceProfiles\NetworkService
~ C:\Users\yannos
~ C:\Users\Mcx1

New restorepoint created


¤¤¤¤¤¤¤¤¤¤ | MD5 Control

[MD5.F42035F832413D6BCC40EA3B636E2907] - [21/09/2012 20:14:12] - [0.5 Ko] - C:\Pre_Scan\MBR.bin
[MD5.D07D4C3038F3578FFCE1C0237F2A1253] - [11/09/2009 16:07:44] - (.© Microsoft Corporation. - Explorateur Windows.) - [2858 Ko] - (6.0.6002.18005) - C:\Windows\explorer.exe
[MD5.D07D4C3038F3578FFCE1C0237F2A1253] - [14/09/2012 17:29:02] - (.© Microsoft Corporation. - Explorateur Windows.) - [2858 Ko] - (6.0.6002.18005) - C:\Windows\erdnt\cache\explorer.exe
[MD5.FD8C53FB002217F6F888BCF6F5D7084D] - [02/11/2006 10:47:18] - (.© Microsoft Corporation. - Explorateur Windows.) - [2855 Ko] - (6.0.6000.16386) - C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16386_none_4f7de5167cd15deb\explorer.exe
[MD5.6D06CD98D954FE87FB2DB8108793B399] - [12/12/2007 13:41:18] - (.© Microsoft Corporation. - Explorateur Windows.) - [2855 Ko] - (6.0.6000.16549) - C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16549_none_4fac29707cae347a\explorer.exe
[MD5.37440D09DEAE0B672A04DCCF7ABF06BE] - [12/12/2008 18:40:51] - (.© Microsoft Corporation. - Explorateur Windows.) - [2855 Ko] - (6.0.6000.16771) - C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[MD5.BD06F0BF753BC704B653C3A50F89D362] - [12/12/2007 13:41:17] - (.© Microsoft Corporation. - Explorateur Windows.) - [2855 Ko] - (6.0.6000.20668) - C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20668_none_501f261995dcf2cf\explorer.exe
[MD5.E7156B0B74762D9DE0E66BDCDE06E5FB] - [12/12/2008 18:40:51] - (.© Microsoft Corporation. - Explorateur Windows.) - [2855 Ko] - (6.0.6000.20947) - C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[MD5.FFA764631CB70A30065C12EF8E174F9F] - [18/06/2008 13:49:09] - (.© Microsoft Corporation. - Explorateur Windows.) - [2858.5 Ko] - (6.0.6001.18000) - C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe
[MD5.4F554999D7D5F05DAAEBBA7B5BA1089D] - [12/12/2008 18:40:52] - (.© Microsoft Corporation. - Explorateur Windows.) - [2858.5 Ko] - (6.0.6001.18164) - C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[MD5.50BA5850147410CDE89C523AD3BC606E] - [12/12/2008 18:40:52] - (.© Microsoft Corporation. - Explorateur Windows.) - [2859 Ko] - (6.0.6001.22298) - C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[MD5.D07D4C3038F3578FFCE1C0237F2A1253] - [11/09/2009 16:07:44] - (.© Microsoft Corporation. - Explorateur Windows.) - [2858 Ko] - (6.0.6002.18005) - C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
[MD5.ABCA209EBA02CB59233614DB83B4F50D] - [18/06/2008 13:46:27] - (.© Microsoft Corporation. - Processus d'exécuttion client-serveur.) - [6 Ko] - (6.0.6001.18000) - C:\Windows\System32\csrss.exe
[MD5.117B7C8A8B026A5DCE5E3180ED05E823] - [02/11/2006 10:33:03] - (.© Microsoft Corporation. - Processus d'exécuttion client-serveur.) - [7.5 Ko] - (6.0.6000.16386) - C:\Windows\winsxs\x86_microsoft-windows-csrss_31bf3856ad364e35_6.0.6000.16386_none_56ad21dbe72a9d78\csrss.exe
[MD5.ABCA209EBA02CB59233614DB83B4F50D] - [18/06/2008 13:46:27] - (.© Microsoft Corporation. - Client Server Runtime Process.) - [6 Ko] - (6.0.6001.18000) - C:\Windows\winsxs\x86_microsoft-windows-csrss_31bf3856ad364e35_6.0.6001.18000_none_58e3e3d7e415ae4c\csrss.exe
[MD5.D4E6D91C1349B7BFB3599A6ADA56851B] - [14/09/2012 17:29:01] - (.© Microsoft Corporation. - Applications Services et Contrôleur.) - [273 Ko] - (6.0.6002.18005) - C:\Windows\erdnt\cache\services.exe
[MD5.D4E6D91C1349B7BFB3599A6ADA56851B] - [11/09/2009 16:07:15] - (.© Microsoft Corporation. - Applications Services et Contrôleur.) - [273 Ko] - (6.0.6002.18005) - C:\Windows\System32\services.exe
[MD5.329CF3C97CE4C19375C8ABCABAE258B0] - [02/11/2006 10:35:31] - (.© Microsoft Corporation. - Applications Services et Contrôleur.) - [273 Ko] - (6.0.6000.16386) - C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6000.16386_none_cd28fe6bd05df036\services.exe
[MD5.2B336AB6286D6C81FA02CBAB914E3C6C] - [18/06/2008 13:48:36] - (.© Microsoft Corporation. - Applications Services et Contrôleur.) - [272.5 Ko] - (6.0.6001.18000) - C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6001.18000_none_cf5fc067cd49010a\services.exe
[MD5.D4E6D91C1349B7BFB3599A6ADA56851B] - [11/09/2009 16:07:15] - (.© Microsoft Corporation. - Applications Services et Contrôleur.) - [273 Ko] - (6.0.6002.18005) - C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6002.18005_none_d14b3973ca6acc56\services.exe
[MD5.98AF15A94CD6AC37248E72E5FE789B35] - [11/09/2009 16:06:13] - (.© Microsoft Corporation. - Windows Session Manager.) - [62.5 Ko] - (6.0.6002.18005) - C:\Windows\System32\smss.exe
[MD5.CAA75757BB3695478C23CB0624342A61] - [02/11/2006 10:33:05] - (.© Microsoft Corporation. - Windows Session Manager.) - [61.5 Ko] - (6.0.6000.16386) - C:\Windows\winsxs\x86_microsoft-windows-smss_31bf3856ad364e35_6.0.6000.16386_none_aa03e6011c468ee6\smss.exe
[MD5.6701DDAF68BEDE6BBEEA9D514D73A35B] - [18/06/2008 13:47:49] - (.© Microsoft Corporation. - Windows Session Manager.) - [62.5 Ko] - (6.0.6001.18000) - C:\Windows\winsxs\x86_microsoft-windows-smss_31bf3856ad364e35_6.0.6001.18000_none_ac3aa7fd19319fba\smss.exe
[MD5.98AF15A94CD6AC37248E72E5FE789B35] - [11/09/2009 16:06:13] - (.© Microsoft Corporation. - Windows Session Manager.) - [62.5 Ko] - (6.0.6002.18005) - C:\Windows\winsxs\x86_microsoft-windows-smss_31bf3856ad364e35_6.0.6002.18005_none_ae26210916536b06\smss.exe
[MD5.0E135526E9785D085BCD9AEDE6FBCBF9] - [14/09/2012 17:29:02] - (.© Microsoft Corporation. - Application d'ouverture de session Userinit.) - [24.5 Ko] - (6.0.6001.18000) - C:\Windows\erdnt\cache\userinit.exe
[MD5.0E135526E9785D085BCD9AEDE6FBCBF9] - [18/06/2008 13:46:58] - (.© Microsoft Corporation. - Application d'ouverture de session Userinit.) - [24.5 Ko] - (6.0.6001.18000) - C:\Windows\System32\userinit.exe
[MD5.22027835939F86C3E47AD8E3FBDE3D11] - [02/11/2006 10:43:52] - (.© Microsoft Corporation. - Application d'ouverture de session Userinit.) - [24 Ko] - (6.0.6000.16386) - C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe
[MD5.0E135526E9785D085BCD9AEDE6FBCBF9] - [18/06/2008 13:46:58] - (.© Microsoft Corporation. - Application d'ouverture de session Userinit.) - [24.5 Ko] - (6.0.6001.18000) - C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
[MD5.101BA3EA053480BB5D957EF37C06B5ED] - [14/09/2012 17:29:03] - (.© Microsoft Corporation. - Application de démarrage de Windows.) - [94.5 Ko] - (6.0.6001.18000) - C:\Windows\erdnt\cache\wininit.exe
[MD5.101BA3EA053480BB5D957EF37C06B5ED] - [18/06/2008 13:48:25] - (.© Microsoft Corporation. - Application de démarrage de Windows.) - [94.5 Ko] - (6.0.6001.18000) - C:\Windows\System32\wininit.exe
[MD5.D4385B03E8CCCEE6F0EE249F827C1F3E] - [02/11/2006 10:44:42] - (.© Microsoft Corporation. - Application de démarrage de Windows.) - [93.5 Ko] - (6.0.6000.16386) - C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6000.16386_none_2ebbf6d3076595ce\wininit.exe
[MD5.101BA3EA053480BB5D957EF37C06B5ED] - [18/06/2008 13:48:25] - (.© Microsoft Corporation. - Application de démarrage de Windows.) - [94.5 Ko] - (6.0.6001.18000) - C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe
[MD5.898E7C06A350D4A1A64A9EA264D55452] - [14/09/2012 17:29:01] - (.© Microsoft Corporation. - Application d'ouverture de session Windows.) - [307 Ko] - (6.0.6002.18005) - C:\Windows\erdnt\cache\winlogon.exe
[MD5.898E7C06A350D4A1A64A9EA264D55452] - [11/09/2009 16:06:57] - (.© Microsoft Corporation. - Application d'ouverture de session Windows.) - [307 Ko] - (6.0.6002.18005) - C:\Windows\System32\winlogon.exe
[MD5.9F75392B9128A91ABAFB044EA350BAAD] - [02/11/2006 10:44:42] - (.© Microsoft Corporation. - Windows Logon Application.) - [301 Ko] - (6.0.6000.16386) - C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe
[MD5.C2610B6BDBEFC053BBDAB4F1B965CB24] - [18/06/2008 13:48:45] - (.© Microsoft Corporation. - Application d'ouverture de session Windows.) - [307.5 Ko] - (6.0.6001.18000) - C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
[MD5.898E7C06A350D4A1A64A9EA264D55452] - [11/09/2009 16:06:57] - (.© Microsoft Corporation. - Application d'ouverture de session Windows.) - [307 Ko] - (6.0.6002.18005) - C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[MD5.3911B972B55FEA0478476B2E777B29FA] - [17/06/2011 18:50:55] - (.© Microsoft Corporation. - Ancillary Function Driver for WinSock.) - [267 Ko] - (6.0.6002.18457) - C:\Windows\System32\drivers\afd.sys
[MD5.5D24CAF8EFD924A875698FF28384DB8B] - [02/11/2006 10:58:43] - (.© Microsoft Corporation. - Ancillary Function Driver for WinSock.) - [264 Ko] - (6.0.6000.16386) - C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6000.16386_none_d5b1809661820e7c\afd.sys
[MD5.763E172A55177E478CB419F88FD0BA03] - [18/06/2008 13:48:43] - (.© Microsoft Corporation. - Ancillary Function Driver for WinSock.) - [267.5 Ko] - (6.0.6001.18000) - C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6001.18000_none_d7e842925e6d1f50\afd.sys
[MD5.48EB99503533C27AC6135648E5474457] - [17/06/2011 18:50:54] - (.© Microsoft Corporation. - Ancillary Function Driver for WinSock.) - [267 Ko] - (6.0.6001.18639) - C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6001.18639_none_d7d0e0cc5e7d461c\afd.sys
[MD5.C8AF25017CECB75906A571AC70D2D306] - [17/06/2011 18:50:55] - (.© Microsoft Corporation. - Ancillary Function Driver for WinSock.) - [267.5 Ko] - (6.0.6001.22905) - C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6001.22905_none_d876efff77862705\afd.sys
[MD5.A201207363AA900ABF1A388468688570] - [11/09/2009 16:06:17] - (.© Microsoft Corporation. - Ancillary Function Driver for WinSock.) - [267.5 Ko] - (6.0.6002.18005) - C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6002.18005_none_d9d3bb9e5b8eea9c\afd.sys
[MD5.3911B972B55FEA0478476B2E777B29FA] - [17/06/2011 18:50:55] - (.© Microsoft Corporation. - Ancillary Function Driver for WinSock.) - [267 Ko] - (6.0.6002.18457) - C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6002.18457_none_d99fb42e5bb59d9b\afd.sys
[MD5.70EE0FC7A0F384DBD929A01384AEEB4B] - [17/06/2011 18:50:55] - (.© Microsoft Corporation. - Ancillary Function Driver for WinSock.) - [267.5 Ko] - (6.0.6002.22629) - C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6002.22629_none_da4bc33774b91967\afd.sys
[MD5.1F05B78AB91C9075565A9D8A4B880BC4] - [14/09/2012 17:29:01] - (.© Microsoft Corporation. - ATAPI IDE Miniport Driver.) - [19.48 Ko] - (6.0.6002.18005) - C:\Windows\erdnt\cache\atapi.sys
[MD5.1F05B78AB91C9075565A9D8A4B880BC4] - [11/09/2009 16:06:48] - (.© Microsoft Corporation. - ATAPI IDE Miniport Driver.) - [19.48 Ko] - (6.0.6002.18005) - C:\Windows\System32\drivers\atapi.sys
[MD5.2D9C903DC76A66813D350A562DE40ED9] - [18/06/2008 13:47:45] - (.© Microsoft Corporation. - ATAPI IDE Miniport Driver.) - [21.05 Ko] - (6.0.6001.18000) - C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[MD5.1F05B78AB91C9075565A9D8A4B880BC4] - [11/09/2009 16:06:48] - (.© Microsoft Corporation. - ATAPI IDE Miniport Driver.) - [19.48 Ko] - (6.0.6002.18005) - C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
[MD5.6B4BFFB9BECD728097024276430DB314] - [11/09/2009 16:06:03] - (.© Microsoft Corporation. - SCSI CD-ROM Driver.) - [65.5 Ko] - (6.0.6002.18005) - C:\Windows\System32\drivers\cdrom.sys
[MD5.1EC25CEA0DE6AC4718BF89F9E1778B57] - [18/06/2008 13:46:32] - (.© Microsoft Corporation. - SCSI CD-ROM Driver.) - [65.5 Ko] - (6.0.6001.18000) - C:\Windows\winsxs\x86_cdrom.inf_31bf3856ad364e35_6.0.6001.18000_none_5fa95be2a3c76a4a\cdrom.sys
[MD5.6B4BFFB9BECD728097024276430DB314] - [11/09/2009 16:06:03] - (.© Microsoft Corporation. - SCSI CD-ROM Driver.) - [65.5 Ko] - (6.0.6002.18005) - C:\Windows\winsxs\x86_cdrom.inf_31bf3856ad364e35_6.0.6002.18005_none_6194d4eea0e93596\cdrom.sys
[MD5.ECD64230A59CBD93C85F1CD1CAB9F3F6] - [11/09/2009 16:06:47] - (.© Microsoft Corporation. - MBT Transport driver.) - [181.5 Ko] - (6.0.6002.18005) - C:\Windows\System32\drivers
etbt.sys
[MD5.E3A168912E7EEFC3BD3B814720D68B41] - [02/11/2006 10:57:20] - (.© Microsoft Corporation. - MBT Transport driver.) - [180 Ko] - (6.0.6000.16386) - C:\Windows\winsxs\x86_microsoft-windows-netbt_31bf3856ad364e35_6.0.6000.16386_none_5e2e0665fa591691
etbt.sys
[MD5.7C5FEE5B1C5728507CD96FB4A13E7A02] - [18/06/2008 13:47:31] - (.© Microsoft Corporation. - MBT Transport driver.) - [180 Ko] - (6.0.6001.18000) - C:\Windows\winsxs\x86_microsoft-windows-netbt_31bf3856ad364e35_6.0.6001.18000_none_6064c861f7442765
etbt.sys
[MD5.ECD64230A59CBD93C85F1CD1CAB9F3F6] - [11/09/2009 16:06:47] - (.© Microsoft Corporation. - MBT Transport driver.) - [181.5 Ko] - (6.0.6002.18005) - C:\Windows\winsxs\x86_microsoft-windows-netbt_31bf3856ad364e35_6.0.6002.18005_none_6250416df465f2b1
etbt.sys
[MD5.76B06EB8A01FC8624D699E7045303E54] - [14/09/2012 17:29:01] - (.© Microsoft Corporation. - TDI Translation Driver.) - [70.5 Ko] - (6.0.6002.18005) - C:\Windows\erdnt\cache	dx.sys
[MD5.76B06EB8A01FC8624D699E7045303E54] - [11/09/2009 16:06:15] - (.© Microsoft Corporation. - TDI Translation Driver.) - [70.5 Ko] - (6.0.6002.18005) - C:\Windows\System32\drivers	dx.sys
[MD5.AB4FDE8AF4A0270A46A001C08CBCE1C2] - [02/11/2006 10:57:35] - (.© Microsoft Corporation. - TDI Translation Driver.) - [66.5 Ko] - (6.0.6000.16386) - C:\Windows\winsxs\x86_microsoft-windows-tdi-over-tcpip_31bf3856ad364e35_6.0.6000.16386_none_e807064fdf2a97e3	dx.sys
[MD5.D09276B1FAB033CE1D40DCBDF303D10F] - [18/06/2008 13:47:58] - (.© Microsoft Corporation. - TDI Translation Driver.) - [70 Ko] - (6.0.6001.18000) - C:\Windows\winsxs\x86_microsoft-windows-tdi-over-tcpip_31bf3856ad364e35_6.0.6001.18000_none_ea3dc84bdc15a8b7	dx.sys
[MD5.76B06EB8A01FC8624D699E7045303E54] - [11/09/2009 16:06:15] - (.© Microsoft Corporation. - TDI Translation Driver.) - [70.5 Ko] - (6.0.6002.18005) - C:\Windows\winsxs\x86_microsoft-windows-tdi-over-tcpip_31bf3856ad364e35_6.0.6002.18005_none_ec294157d9377403	dx.sys
[MD5.147281C01FCB1DF9252DE2A10D5E7093] - [11/09/2009 16:06:51] - (.© Microsoft Corporation. - Pilote de cliché instantané du volume.) - [220.98 Ko] - (6.0.6002.18005) - C:\Windows\System32\drivers\volsnap.sys
[MD5.D8B4A53DD2769F226B3EB374374987C9] - [18/06/2008 13:49:13] - (.© Microsoft Corporation. - Volume Shadow Copy Driver.) - [222.55 Ko] - (6.0.6001.18000) - C:\Windows\winsxs\x86_volume.inf_31bf3856ad364e35_6.0.6001.18000_none_15b6b780fc14facd\volsnap.sys
[MD5.147281C01FCB1DF9252DE2A10D5E7093] - [11/09/2009 16:06:51] - (.© Microsoft Corporation. - Volume Shadow Copy Driver.) - [220.98 Ko] - (6.0.6002.18005) - C:\Windows\winsxs\x86_volume.inf_31bf3856ad364e35_6.0.6002.18005_none_17a2308cf936c619\volsnap.sys

20:15:50

¤¤¤¤¤¤¤¤¤¤ | Processes stopped

MsMpEng.exe (1040) -> Process stopped !
Ati2evxx.exe (1128) -> Process stopped !
LVPrcSrv.exe (1200) -> Process stopped !
SLsvc.exe (1412) -> Process stopped !
spoolsv.exe (1828) -> Process stopped !
Ati2evxx.exe (1892) -> Process stopped !
armsvc.exe (560) -> Process stopped !
AppleMobileDeviceService.exe (1684) -> Process stopped !
taskeng.exe (576) -> Process stopped !
taskeng.exe (2092) -> Process stopped !
explorer.exe (2200) -> Process stopped !
mDNSResponder.exe (2240) -> Process stopped !
LSSrvc.exe (2292) -> Process stopped !
LVComSer.exe (2400) -> Process stopped !
mbamscheduler.exe (2464) -> Process stopped !
LVComSer.exe (2488) -> Process stopped !
mbamgui.exe (2668) -> Process stopped !
PRISMXL.SYS (2744) -> Process stopped !
SearchIndexer.exe (2908) -> Process stopped !
Communications_Helper.exe (3016) -> Process stopped !
Quickcam.exe (3064) -> Process stopped !
PWRISOVM.EXE (3204) -> Process stopped !
UMonit.exe (3256) -> Process stopped !
WUDFHost.exe (3276) -> Process stopped !
winampa.exe (3416) -> Process stopped !
SMSTray.exe (3636) -> Process stopped !
realsched.exe (2980) -> Process stopped !
jusched.exe (3120) -> Process stopped !
MOM.exe (2088) -> Process stopped !
msseces.exe (3452) -> Process stopped !
sidebar.exe (3616) -> Process stopped !
ehtray.exe (3680) -> Process stopped !
wmpnscfg.exe (2932) -> Process stopped !
erifbrgc.exe (3964) -> Process stopped !
mobsync.exe (3792) -> Process stopped !
ehmsas.exe (2428) -> Process stopped !
wmplayer.exe (3348) -> Process stopped !
wmpnetwk.exe (2160) -> Process stopped !
COCIManager.exe (4988) -> Process stopped !
CCC.exe (3192) -> Process stopped !
conime.exe (7528) -> Process stopped !
conime.exe (8016) -> Process stopped !
conime.exe (9276) -> Process stopped !
conime.exe (9400) -> Process stopped !
conime.exe (12768) -> Process stopped !
conime.exe (14176) -> Process stopped !
conime.exe (12492) -> Process stopped !
taskeng.exe (6768) -> Process stopped !

¤¤¤¤¤¤¤¤¤¤ | Running processes

Boot : Normal  

[MD5.98AF15A94CD6AC37248E72E5FE789B35] - [11/09/2009 16:06:13] - 468 | C:\Windows\System32\smss.exe (.Microsoft Corporation - Windows Session Manager.) - (6.0.6002.18005) -> \SystemRoot\System32\smss.exe   [64000 Ko]
[MD5.ABCA209EBA02CB59233614DB83B4F50D] - [18/06/2008 13:46:27] - 600 | C:\Windows\system32\csrss.exe (.Microsoft Corporation - Processus d'exécuttion client-serveur.) - (6.0.6001.18000) -> C:\Windows\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16   [6144 Ko]
[MD5.101BA3EA053480BB5D957EF37C06B5ED] - [18/06/2008 13:48:25] - 664 | C:\Windows\system32\wininit.exe (.Microsoft Corporation - Application de démarrage de Windows.) - (6.0.6001.18000) -> wininit.exe   [96768 Ko]
[MD5.ABCA209EBA02CB59233614DB83B4F50D] - [18/06/2008 13:46:27] - 676 | C:\Windows\system32\csrss.exe (.Microsoft Corporation - Processus d'exécuttion client-serveur.) - (6.0.6001.18000) -> C:\Windows\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16   [6144 Ko]
[MD5.17FFE3A6642B5DE7E93DBC21E124FA19] - [11/09/2009 16:07:15] - 712 | C:\Windows\system32\services.exe (.Microsoft Corporation - Applications Services et Contrôleur.) - (6.0.6002.18005) -> C:\Windows\system32\services.exe   [279552 Ko]
[MD5.A3E186B4B935905B829219502557314E] - [16/01/2012 16:57:33] - 728 | C:\Windows\system32\lsass.exe (.Microsoft Corporation - Processus de l'autorité de sécurité locale.) - (6.0.6002.18541) -> C:\Windows\system32\lsass.exe   [9728 Ko]
[MD5.7564348D8F099A4441C1A71875E104B5] - [18/06/2008 13:49:07] - 736 | C:\Windows\system32\lsm.exe (.Microsoft Corporation - Service du gestionnaire de session locale.) - (6.0.6001.18000) -> C:\Windows\system32\lsm.exe   [229888 Ko]
[MD5.7A556AB2E204BF52993C0C56B61064C5] - [11/09/2009 16:06:57] - 852 | C:\Windows\system32\winlogon.exe (.Microsoft Corporation - Application d'ouverture de session Windows.) - (6.0.6002.18005) -> winlogon.exe   [314368 Ko]
[MD5.3794B461C45882E06856F282EEF025AF] - [18/06/2008 13:47:10] - 920 | C:\Windows\system32\svchost.exe (.Microsoft Corporation - Processus hôte pour les services Windows.) - (6.0.6001.18000) -> C:\Windows\system32\svchost.exe -k DcomLaunch   [21504 Ko]
[MD5.3794B461C45882E06856F282EEF025AF] - [18/06/2008 13:47:10] - 984 | C:\Windows\system32\svchost.exe (.Microsoft Corporation - Processus hôte pour les services Windows.) - (6.0.6001.18000) -> C:\Windows\system32\svchost.exe -k rpcss   [21504 Ko]
[MD5.3794B461C45882E06856F282EEF025AF] - [18/06/2008 13:47:10] - 1148 | C:\Windows\System32\svchost.exe (.Microsoft Corporation - Processus hôte pour les services Windows.) - (6.0.6001.18000) -> C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted   [21504 Ko]
[MD5.3794B461C45882E06856F282EEF025AF] - [18/06/2008 13:47:10] - 1188 | C:\Windows\System32\svchost.exe (.Microsoft Corporation - Processus hôte pour les services Windows.) - (6.0.6001.18000) -> C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted   [21504 Ko]
[MD5.3794B461C45882E06856F282EEF025AF] - [18/06/2008 13:47:10] - 1316 | C:\Windows\system32\svchost.exe (.Microsoft Corporation - Processus hôte pour les services Windows.) - (6.0.6001.18000) -> C:\Windows\system32\svchost.exe -k netsvcs   [21504 Ko]
[MD5.3794B461C45882E06856F282EEF025AF] - [18/06/2008 13:47:10] - 1392 | C:\Windows\system32\svchost.exe (.Microsoft Corporation - Processus hôte pour les services Windows.) - (6.0.6001.18000) -> C:\Windows\system32\svchost.exe -k GPSvcGroup   [21504 Ko]
[MD5.3794B461C45882E06856F282EEF025AF] - [18/06/2008 13:47:10] - 1456 | C:\Windows\system32\svchost.exe (.Microsoft Corporation - Processus hôte pour les services Windows.) - (6.0.6001.18000) -> C:\Windows\system32\svchost.exe -k LocalService   [21504 Ko]
[MD5.3794B461C45882E06856F282EEF025AF] - [18/06/2008 13:47:10] - 1592 | C:\Windows\system32\svchost.exe (.Microsoft Corporation - Processus hôte pour les services Windows.) - (6.0.6001.18000) -> C:\Windows\system32\svchost.exe -k NetworkService   [21504 Ko]
[MD5.3794B461C45882E06856F282EEF025AF] - [18/06/2008 13:47:10] - 1856 | C:\Windows\system32\svchost.exe (.Microsoft Corporation - Processus hôte pour les services Windows.) - (6.0.6001.18000) -> C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork   [21504 Ko]
[MD5.BBA31B625E7B1BCAFE4A30387E9E8238] - [30/06/2007 17:55:26] - 1892 | C:\Windows\system32\Ati2evxx.exe (.ATI Technologies Inc. - ATI External Event Utility EXE Module.) - (6.14.10.4222) -> Ati2evxx.exe -Client   [733184 Ko]
[MD5.AC0429539F33CEE12CD626CDCB5C9301] - [14/12/2010 22:54:39] - 2092 | C:\Windows\system32	askeng.exe (.Microsoft Corporation - Moteur du Planificateur de tâches.) - (6.0.6002.18342) -> taskeng.exe {3A23D013-942B-4679-A50D-C0DC598DFEE3}   [171520 Ko]
[MD5.01DD1004181FD46ECDC3628228EB269D] - [11/09/2009 16:06:52] - 2128 | C:\Windows\system32\Dwm.exe (.Microsoft Corporation - Gestionnaire de fenêtres du Bureau.) - (6.0.6002.18005) -> "C:\Windows\system32\Dwm.exe"   [81920 Ko]
[MD5.1BCF1988220D69B48B41290351D4C847] - [20/07/2007 00:38:54] - 2488 | C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe (.Logitech Inc. - Logitech Video COM Service.) - (1.0.1.2021) -> "C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe" /keymon   [186904 Ko]
[MD5.5F72F7B89D2FFFF87786231DB9F92BCF] - [13/09/2012 17:01:02] - 2568 | C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) - (1.65.0.0) -> "C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe"   [676936 Ko]
[MD5.3794B461C45882E06856F282EEF025AF] - [18/06/2008 13:47:10] - 2700 | C:\Windows\system32\svchost.exe (.Microsoft Corporation - Processus hôte pour les services Windows.) - (6.0.6001.18000) -> C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted   [21504 Ko]
[MD5.3794B461C45882E06856F282EEF025AF] - [18/06/2008 13:47:10] - 2776 | C:\Windows\system32\svchost.exe (.Microsoft Corporation - Processus hôte pour les services Windows.) - (6.0.6001.18000) -> C:\Windows\system32\svchost.exe -k imgsvc   [21504 Ko]
[MD5.3794B461C45882E06856F282EEF025AF] - [18/06/2008 13:47:10] - 2820 | C:\Windows\System32\svchost.exe (.Microsoft Corporation - Processus hôte pour les services Windows.) - (6.0.6001.18000) -> C:\Windows\System32\svchost.exe -k WerSvcGroup   [21504 Ko]
[MD5.8274C87726D4561EE8750D883764ACC1] - [11/09/2009 16:06:08] - 888 | C:\Windows\system32\wbem\unsecapp.exe (.Microsoft Corporation - Sink to receive asynchronous callbacks for WMI client application.) - (6.0.6002.18005) -> C:\Windows\system32\wbem\unsecapp.exe -Embedding   [37888 Ko]
[MD5.9E69F26034694A7FD5F1596A71F60DD1] - [11/09/2009 16:07:31] - 2652 | C:\Windows\system32\wbem\wmiprvse.exe (.Microsoft Corporation - WMI Provider Host.) - (6.0.6002.18005) -> C:\Windows\system32\wbem\wmiprvse.exe   [247296 Ko]
[MD5.3794B461C45882E06856F282EEF025AF] - [18/06/2008 13:47:10] - 4524 | C:\Windows\system32\svchost.exe (.Microsoft Corporation - Processus hôte pour les services Windows.) - (6.0.6001.18000) -> C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation   [21504 Ko]
[MD5.AC0429539F33CEE12CD626CDCB5C9301] - [14/12/2010 22:54:39] - 6768 | C:\Windows\system32	askeng.exe (.Microsoft Corporation - Moteur du Planificateur de tâches.) - (6.0.6002.18342) -> taskeng.exe {532BB841-8449-4D3B-93E7-09FE084925AC}   [171520 Ko]
[MD5.9E69F26034694A7FD5F1596A71F60DD1] - [11/09/2009 16:07:31] - 7020 | C:\Windows\system32\wbem\wmiprvse.exe (.Microsoft Corporation - WMI Provider Host.) - (6.0.6002.18005) -> C:\Windows\system32\wbem\wmiprvse.exe   [247296 Ko]
[MD5.F150883C9D31A352A05362AFDF2F161C] - [21/09/2012 17:17:51] - 14608 | C:\Users\yannos\Desktop\winlogon.exe (. - g3n-h@ckm@n.) - (2.0.9.20) -> "C:\Users\yannos\Desktop\winlogon.exe"    [1762422 Ko]
[MD5.BD8235468636C0336809E02870F6A9F4] - [18/06/2008 13:48:15] - 14704 | C:\Windows\system32\WUDFHost.exe (.Microsoft Corporation - Windows Driver Foundation - Processus hôte de l'infrastructure de pilotes en mode utilisateur.) - (6.0.6001.18000) -> "C:\Windows\system32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-463e8399-9f42-46fc-927b-469be53c320b -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-59a48917-b528-4b54-aa89-6a584a076bae -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-66266776-aefd-418f-9de0-d9821b2e0e08 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:c33daea3-25b3-4745-bbf9-f5f56607ddd2   [142336 Ko]
[MD5.90DC23D940551DB35367FB1E40575B25] - [11/11/2010 12:26:40] - 14948 | c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (.Microsoft Corporation - Antimalware Service Executable.) - (3.0.8107.0) -> "c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe"   [11736 Ko]
[MD5.6080A176D09435FC8E6E800996656E18] - [11/09/2009 16:06:17] - 14456 | C:\Windows\system32\conime.exe (.Microsoft Corporation - Console IME.) - (6.0.6002.18005) -> C:\Windows\system32\conime.exe   [69120 Ko]
[MD5.701AAD2C6A028D1A53F15B904E78218A] - [11/09/2009 16:08:09] - 2632 | C:\Windows\system32\SearchIndexer.exe (.Microsoft Corporation - Indexeur Microsoft Windows Search.) - (7.0.6002.18005) -> C:\Windows\system32\SearchIndexer.exe /Embedding   [441344 Ko]
[MD5.DEA3C2999A915F45B2F17A825226B80E] - [18/06/2008 13:48:38] - 4168 | C:\Program Files\Windows Media Player\wmpnetwk.exe (.Microsoft Corporation - Service Partage réseau du Lecteur Windows Media.) - (11.0.6001.7000) -> "C:\Program Files\Windows Media Player\wmpnetwk.exe"   [896512 Ko]
[MD5.AC0429539F33CEE12CD626CDCB5C9301] - [14/12/2010 22:54:39] - 7280 | C:\Windows\system32	askeng.exe (.Microsoft Corporation - Moteur du Planificateur de tâches.) - (6.0.6002.18342) -> taskeng.exe {50F93F23-B2E2-4B81-8D6C-351D23CC042C}   [171520 Ko]
[MD5.8554097E5136C3BF9F69FE578A1B35F4] - [16/09/2010 17:54:47] - 7740 | C:\Windows\System32\spoolsv.exe (.Microsoft Corporation - Application sous-système spouleur.) - (6.0.6002.18294) -> C:\Windows\System32\spoolsv.exe   [128000 Ko]
[MD5.20F6F19FE9E753F2780DC2FA083AD597] - [25/05/2011 14:06:20] - 7040 | C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (.Apple Inc. - MobileDeviceService.) - (17.66.0.47) -> "C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe"   [37664 Ko]
[MD5.1DEBC8BCFDEFF1DC081B9C3D339681F0] - [11/09/2009 16:07:55] - 6160 | C:\Windows\system32\SearchProtocolHost.exe (.Microsoft Corporation - Microsoft Windows Search Protocol Host.) - (7.0.6002.18005) -> "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"    [185344 Ko]
[MD5.C9EE7FF225EAC1CB9C78C413667CDB80] - [11/09/2009 16:07:55] - 4416 | C:\Windows\system32\SearchFilterHost.exe (.Microsoft Corporation - Microsoft Windows Search Filter Host.) - (7.0.6002.18005) -> "C:\Windows\system32\SearchFilterHost.exe" 0 620 624 632 65536 628    [87552 Ko]

¤¤¤¤¤¤¤¤¤¤ | Winlogon


¤

[HKLM | Winlogon]|[Shell] : Explorer.exe
[HKLM | Winlogon]|[AutoRestartShell] : 0
[HKLM | Winlogon]|[userinit] : C:\Windows\system32\userinit.exe,
[HKLM | Winlogon]|[PowerDownAfterShutdown] : 0 -> 1
[HKLM | Winlogon]|[System] : 

¤¤¤¤¤¤¤¤¤¤ | Associations

[.exe] : exefile
[exefile | command] : "%1" %*
[.com] : ComFile
[comfile | command] : "%1" %*
[.reg] : regfile
[regfile | command] : regedit.exe "%1"
[.scr] : scrfile
[scrfile | command] : "%1" /S
[.bat] : batfile
[batfile | command] : "%1" %*
[.cmd] : cmdfile
[cmdfile | command] : "%1" %*
[.pif] : piffile
[piffile | command] : "%1" %*
[.url] : InternetShortcut
[InternetShortcut | command] : "C:\Windows\System32undll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l
[Application.Manifest | command] : rundll32.exe dfshim.dll,ShOpenVerbApplication %1
[Application.Reference | command] : rundll32.exe dfshim.dll,ShOpenVerbShortcut %1|%2
[Folder | command] : C:\Windows\explorer.exe

¤

[Firefox | Command] | @ : C:\Program Files\Mozilla Firefox\firefox.exe -> "C:\Program Files\Mozilla Firefox\Firefox.exe"
[Firefox - Safemode | Command] | @ : "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode
[IE | Command] | @ : "C:\Program Files\Internet Explorer\iexplore.exe"
[Applications | IE | Command] | @ : "C:\Program Files\Internet Explorer\iexplore.exe" %1
[Assoc | Applications] | @ : http://go.microsoft.com/fwlink/?LinkId=57426&Ext=%s -> http://shell.windows.com/fileassoc/%04x/xml/redir.asp?Ext=%s

¤¤¤¤¤¤¤¤¤¤ | Corrections diverses

[HKLM | Advanced\Folder\Hidden\SHOWALL]|[CheckedValue] : 1
[HKLM | CurrentVersion\Explorer]|[AlwaysUnloadDll] :  -> 1
[HKU\S-1-5-19 | Desktop]|[Wallpaper] : C:\windows\Web\Wallpaper\img24.jpg
[HKU\S-1-5-20 | Desktop]|[Wallpaper] : C:\windows\Web\Wallpaper\img24.jpg
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000 | Desktop]|[Wallpaper] : C:\Users\yannos\Pictures\Mes images\Mes images\300799_10150365221549411_567069410_8099136_1478819840_n.jpg
[HKU\S-1-5-18 | Desktop]|[Wallpaper] : (None)
[HKU\S-1-5-19 | Explorer\Advanced]|[Hidden] :  -> 0
[HKU\S-1-5-20 | Explorer\Advanced]|[Hidden] :  -> 0
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000 | Explorer\Advanced]|[Hidden] : 2 -> 0
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000_Classes | Explorer\Advanced]|[Hidden] :  -> 0
[HKU\S-1-5-18 | Explorer\Advanced]|[Hidden] :  -> 0
[HKLM | Policies\System]|[DisableRegistryTools] : 0
[HKLM | Control\SafeBoot]|[AlternateShell] : cmd.exe
[HKLM | HideDesktopIcons\NewStartPanel]|[{9343812e-1c37-4a49-a12e-4b2d810d956b}] : 1 -> 0
[HKLM | HideDesktopIcons\NewStartPanel]|[{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}] : 1 -> 0
[HKLM | HideDesktopIcons\NewStartPanel]|[{20D04FE0-3AEA-1069-A2D8-08002B30309D}] : 1 -> 0
[HKLM | HideDesktopIcons\NewStartPanel]|[{208D2C60-3AEA-1069-A2D7-08002B30309D}] : 1 -> 0
[HKLM | HideDesktopIcons\NewStartPanel]|[{871C5380-42A0-1069-A2EA-08002B30309D}] : 1 -> 0
[HKLM | HideDesktopIcons\NewStartPanel]|[{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}] : 1 -> 0
[HKLM | HideDesktopIcons\NewStartPanel]|[{59031a47-3f72-44a7-89c5-5595fe6b30ee}] : 1 -> 0

20:15:54

¤¤¤¤¤¤¤¤¤¤ | SafeBoot | Control | Repair

[HKLM | Safeboot] -> OK
[HKLM | Safeboot\Minimal] -> OK
[HKLM | Safeboot\Network] -> OK

¤

[HKLM | Minimal\Base] : Driver Group -> OK
[HKLM | Minimal\Boot Bus Extender] : Driver Group -> OK
[HKLM | Minimal\Boot file system] : Driver Group -> OK
[HKLM | Minimal\File system] : Driver Group -> OK
[HKLM | Minimal\Filter] : Driver Group -> OK
[HKLM | Minimal\PCI Configuration] : Driver Group -> OK
[HKLM | Minimal\PNP Filter] : Driver Group -> OK
[HKLM | Minimal\Primary disk] : Driver Group -> OK
[HKLM | Minimal\SCSI Class] : Driver Group -> OK
[HKLM | Minimal\System Bus Extender] : Driver Group -> OK
[HKLM | Minimal\AppMgmt] : Service -> OK
[HKLM | Minimal\CryptSvc] : Service -> OK
[HKLM | Minimal\DcomLaunch] : Service -> OK
[HKLM | Minimal\dmadmin] :  -> Service
[HKLM | Minimal\dmserver] :  -> Service
[HKLM | Minimal\EventLog] : Service -> OK
[HKLM | Minimal\HelpSvc] : Service -> OK
[HKLM | Minimal\Netlogon] : Service -> OK
[HKLM | Minimal\PlugPlay] : Service -> OK
[HKLM | Minimal\RpcSs] : Service -> OK
[HKLM | Minimal\SRService] :  -> Service
[HKLM | Minimal\vds] : Service -> OK
[HKLM | Minimal\WinMgmt] : Service -> OK
[HKLM | Minimal\dmboot.sys] :  -> Driver
[HKLM | Minimal\dmio.sys] :  -> Driver
[HKLM | Minimal\dmload.sys] :  -> Driver
[HKLM | Minimal\sermouse.sys] : Driver -> OK
[HKLM | Minimal\vga.sys] : Driver -> OK
[HKLM | Minimal\vgasave.sys] : Driver -> OK
[HKLM | Minimal\sr.sys] :  -> FSFilter System Recovery
[HKLM | Minimal\{36FC9E60-C465-11CF-8056-444553540000}] : Universal Serial Bus controllers -> OK
[HKLM | Minimal\{4D36E965-E325-11CE-BFC1-08002BE10318}] : CD-ROM Drive -> OK
[HKLM | Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}] : DiskDrive -> OK
[HKLM | Minimal\{4D36E969-E325-11CE-BFC1-08002BE10318}] : Standard floppy disk controller -> OK
[HKLM | Minimal\{4D36E96A-E325-11CE-BFC1-08002BE10318}] : Hdc -> OK
[HKLM | Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}] : Keyboard -> OK
[HKLM | Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}] : Mouse -> OK
[HKLM | Minimal\{4D36E977-E325-11CE-BFC1-08002BE10318}] : PCMCIA Adapters -> OK
[HKLM | Minimal\{4D36E97B-E325-11CE-BFC1-08002BE10318}] : SCSIAdapter -> OK
[HKLM | Minimal\{4D36E97D-E325-11CE-BFC1-08002BE10318}] : System -> OK
[HKLM | Minimal\{4D36E980-E325-11CE-BFC1-08002BE10318}] : Floppy disk drive -> OK
[HKLM | Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] : Volume shadow copy -> OK
[HKLM | Minimal\{71A27CDD-812A-11D0-BEC7-08002BE2092F}] : Volume -> OK
[HKLM | Minimal\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}] : Human Interface Devices -> OK

¤

[HKLM | Network\Base] : Driver Group -> OK
[HKLM | Network\Boot Bus Extender] : Driver Group -> OK
[HKLM | Network\Boot file system] : Driver Group -> OK
[HKLM | Network\File system] : Driver Group -> OK
[HKLM | Network\Filter] : Driver Group -> OK
[HKLM | Network\NDIS] : Driver Group -> OK
[HKLM | Network\NDIS Wrapper] : Driver Group -> OK
[HKLM | Network\NetBIOSGroup] : Driver Group -> OK
[HKLM | Network\NetDDEGroup] : Driver Group -> OK
[HKLM | Network\Network] : Driver Group -> OK
[HKLM | Network\NetworkProvider] : Driver Group -> OK
[HKLM | Network\PCI Configuration] : Driver Group -> OK
[HKLM | Network\PNP Filter] : Driver Group -> OK
[HKLM | Network\PNP_TDI] : Driver Group -> OK
[HKLM | Network\Primary disk] : Driver Group -> OK
[HKLM | Network\SCSI Class] : Driver Group -> OK
[HKLM | Network\Streams Drivers] : Driver Group -> OK
[HKLM | Network\System Bus Extender] : Driver Group -> OK
[HKLM | Network\TDI] : Driver Group -> OK
[HKLM | Network\AFD] : Service -> OK
[HKLM | Network\AppMgmt] : Service -> OK
[HKLM | Network\Browser] : Service -> OK
[HKLM | Network\CryptSvc] : Service -> OK
[HKLM | Network\DcomLaunch] : Service -> OK
[HKLM | Network\Dhcp] : Service -> OK
[HKLM | Network\dmadmin] :  -> Service
[HKLM | Network\dmserver] :  -> Service
[HKLM | Network\DnsCache] : Service -> OK
[HKLM | Network\EventLog] : Service -> OK
[HKLM | Network\HelpSvc] : Service -> OK
[HKLM | Network\LanmanServer] : Service -> OK
[HKLM | Network\LanmanWorkstation] : Service -> OK
[HKLM | Network\LmHosts] : Service -> OK
[HKLM | Network\Messenger] : Service -> OK
[HKLM | Network\Ndisuio] : Service -> OK
[HKLM | Network\NetBIOS] : Service -> OK
[HKLM | Network\NetBT] : Service -> OK
[HKLM | Network\Netlogon] : Service -> OK
[HKLM | Network\NetMan] : Service -> OK
[HKLM | Network\NtLmSsp] :  -> Service
[HKLM | Network\PlugPlay] : Service -> OK
[HKLM | Networkdsessmgr] : Service -> OK
[HKLM | Network\RpcSs] : Service -> OK
[HKLM | Network\sharedaccess] : Service -> OK
[HKLM | Network\SRService] :  -> Service
[HKLM | Network\Tcpip] : Service -> OK
[HKLM | Network	ermservice] :  -> Service
[HKLM | Network\vds] : Service -> OK
[HKLM | Network\WinMgmt] : Service -> OK
[HKLM | Network\Wlansvc] : Service -> OK
[HKLM | Network\dmboot.sys] :  -> Driver
[HKLM | Network\dmio.sys] :  -> Driver
[HKLM | Network\dmload.sys] :  -> Driver
[HKLM | Network\ipnat.sys] : Driver -> OK
[HKLM | Network\ip6fw.sys] :  -> Driver
[HKLM | Networkdpcdd.sys] :  -> Driver
[HKLM | Network\sr.sys] :  -> FSFilter System Recovery
[HKLM | Network\{36FC9E60-C465-11CF-8056-444553540000}] : Universal Serial Bus controllers -> OK
[HKLM | Network\{4D36E965-E325-11CE-BFC1-08002BE10318}] : CD-ROM Drive -> OK
[HKLM | Network\{4D36E967-E325-11CE-BFC1-08002BE10318}] : DiskDrive -> OK
[HKLM | Network\{4D36E969-E325-11CE-BFC1-08002BE10318}] : Standard floppy disk controller -> OK
[HKLM | Network\{4D36E96A-E325-11CE-BFC1-08002BE10318}] : Hdc -> OK
[HKLM | Network\{4D36E96B-E325-11CE-BFC1-08002BE10318}] : Keyboard -> OK
[HKLM | Network\{4D36E96F-E325-11CE-BFC1-08002BE10318}] : Mouse -> OK
[HKLM | Network\{4D36E972-E325-11CE-BFC1-08002BE10318}] : Net -> OK
[HKLM | Network\{4D36E973-E325-11CE-BFC1-08002BE10318}] : NetClient -> OK
[HKLM | Network\{4D36E974-E325-11CE-BFC1-08002BE10318}] : NetService -> OK
[HKLM | Network\{4D36E975-E325-11CE-BFC1-08002BE10318}] : NetTrans -> OK
[HKLM | Network\{4D36E977-E325-11CE-BFC1-08002BE10318}] : PCMCIA Adapters -> OK
[HKLM | Network\{4D36E97B-E325-11CE-BFC1-08002BE10318}] : SCSIAdapter -> OK
[HKLM | Network\{4D36E97D-E325-11CE-BFC1-08002BE10318}] : System -> OK
[HKLM | Network\{4D36E980-E325-11CE-BFC1-08002BE10318}] : Floppy disk drive -> OK
[HKLM | Network\{71A27CDD-812A-11D0-BEC7-08002BE2092F}] : Volume -> OK
[HKLM | Network\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}] : Human Interface Devices -> OK

¤¤¤¤¤¤¤¤¤¤ | IFEO


¤¤¤¤¤¤¤¤¤¤ | Mountpoints2



¤¤¤¤¤¤¤¤¤¤ | Windows

[HKLM | Session Manager\SubSystems]|[Windows] : winsrv : %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]|[AppInit_DLLS] : 

[HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]|[Programs] : com exe bat pif cmd

¤¤¤¤¤¤¤¤¤¤ | Security Center

[HKLM | Security Center]|[AntiVirusDisableNotify] : 0
[HKLM | Security Center]|[FirewallDisableNotify] : 0
[HKLM | Security Center]|[UpdatesDisableNotify] : 0
[HKLM | Security Center\svc]|[AntispywareOverride] : 0
[HKLM | Security Center\svc]|[AntiVirusOverride] : 0
[HKLM | Security Center\svc]|[FirewallOverride] : 0


[HKLM | FirewallPolicy\DomainProfile]|[DisableNotifications] : 0
[HKLM | FirewallPolicy\StandardProfile]|[DisableNotifications] : 0

¤¤¤¤¤¤¤¤¤¤ | Services Corrections

[Compbatt] : 4 -> 0 : Inactif
[RPCSS] : 2 : Actif
[Profsvc] : 2 : Actif
[PlugPlay] : 2 : Actif
[PEAUTH] : 2 : Actif
[Parvdm] : 2 : Actif
[nsi] : 2 : Actif
[NLASvc] : 2 : Actif
[MPSsvc] : 2 : Actif
[MMCSS] : 2 : Actif
[luafv] : 2 : Actif
[lltdio] : 2 : Actif
[Iphlpsvc] : 2 : Actif
[IKEEXT] : 2 : Actif
[gpsvc] : 2 : Actif
[lmhosts] : 2 : Actif
[LanmanWorkstation] : 2 : Actif
[LanmanServer] : 2 : Actif
[agp440] : 3 -> 2 : Inactif
[AudioEndpointBuilder] : 2 : Actif
[Audiosrv] : 2 : Actif
[BFE] : 2 : Actif
[Bits] : 3 -> 2 : Inactif
[CryptSvc] : 2 : Actif
[EapHost] : 3 -> 2 : Inactif
[Wlansvc] : 3 -> 2 : Inactif
[SharedAccess] : 2 : Inactif
[windefend] : 3 -> 2 : Inactif
[winmgmt] : 2 : Actif
[wuauserv] : 2 : Actif
[wudfsvc] : 2 : Actif
[WerSvc] : 2 : Actif
[wscsvc] : 2 : Actif
[Ndisuio] : 3 : Inactif

20:15:55

¤¤¤¤¤¤¤¤¤¤ | Internet Explorer

[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000 | Main]|[Start Page] : https://www.msn.com/fr-fr -> https://www.google.com/?gws_rd=ssl
[HKU\S-1-5-18 | Main]|[Start Page] : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome -> https://www.google.com/?gws_rd=ssl
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000 | Main]|[Local Page] : C:\Windows\system32\blank.htm
[HKU\S-1-5-18 | Main]|[Search Page] : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

[HKLM | Search]|[SearchAssistant] :  -> http://www.google.com/toolbar/ie8/sidebar.html
[HKLM | Main]|[Start Page] : https://www.msn.com/fr-fr -> https://www.msn.com/fr-fr/?ocid=iehp
[HKLM | Main]|[Local Page] : C:\Windows\System32\blank.htm
[HKLM | Main]|[Default_Search_URL] : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
[HKLM | Main]|[Default_Page_URL] : https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF -> https://www.msn.com/fr-fr/?ocid=iehp
[HKLM | Main]|[Search Page] : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
[HKLM | AboutURLs]|[Tabs] : res://ieframe.dll/tabswelcome.htm

¤

[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000 | PhishingFilter]|[Enabled] : 2
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000 | PhishingFilter]|[EnabledV8] : 1
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000 | Internet settings]|[ProxyOverride] : *.local
[HKU\S-1-5-19 | Internet settings]|[EnableHttp1_1] : 1
[HKU\S-1-5-20 | Internet settings]|[EnableHttp1_1] : 1
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000 | Internet settings]|[EnableHttp1_1] : 1
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000 | Internet settings]|[MigrateProxy] : 1
[HKU\S-1-5-18 | Internet settings]|[MigrateProxy] : 1
[HKU\S-1-5-19 | Internet settings]|[AutoConfigProxy] : wininet.dll
[HKU\S-1-5-20 | Internet settings]|[AutoConfigProxy] : wininet.dll
[HKU\S-1-5-21-1170913042-1277233965-3038881231-1000 | Internet settings]|[AutoConfigProxy] : wininet.dll


¤¤¤¤¤¤¤¤¤¤ | Firefox


Profile : sqt43kb3.default

user_pref("browser.download.dir", "C:\Users\yannos\Tracing\Downloads");
user_pref("browser.download.lastDir", "C:\Users\yannos\Desktop");
user_pref("browser.startup.homepage_override.buildID", "20120905151427");
user_pref("browser.startup.homepage_override.mstone", "15.0.1");
line Deleted : user_pref("extensions.enabledItems", "{71328583-3CA7-4809-B4BA-570A85818FBB}:0.5b4,{3112ca9c-de6d-4884-a869-9855de68056c}:7.1.20101113Wb1,{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}:6.0.07,{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}:6.0.11,{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}:6.0.13,{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}:6.0.15,{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}:6.0.16,{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}:6.0.17,{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}:6.0.19,{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20,{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21,{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22,{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23,{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24,{20a82645-c095-46ed-80e3-08825760534b}:1.1,{ABDE892B-13A8-4d1b-88E6-365A6E755758}:14.0.1,{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26,HBLite@HBLite.com:11.0.0.0,{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}:15.0.4,wrc@avast.com:7.0.1466,ffxtlbr@babylon.com:1.2.0,{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF}:2.0,{EEE6C361-6118-11DC-9C72-001320C79847}:1.5.0.2,gencrawler@some.com:2.6,{972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.10");

¤¤¤¤¤¤¤¤¤¤ | Extensions | Plugins

C:\Users\yannos\AppData\Roaming\Mozilla\Firefox\Profiles\sqt43kb3.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
C:\Users\yannos\AppData\Roaming\Mozilla\Firefox\Profiles\sqt43kb3.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
C:\Users\yannos\AppData\Roaming\Mozilla\Firefox\Profiles\sqt43kb3.default\searchplugins\askcomsearch.xml
C:\Users\yannos\AppData\Roaming\Mozilla\Firefox\Profiles\sqt43kb3.default\searchplugins\bing.xml
C:\Program Files\Mozilla Firefox\extensionsealplayer@partners.mozilla.com
C:\Program Files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
C:\Program Files\Mozilla Firefox\searchplugins\amazon-france.xml
C:\Program Files\Mozilla Firefox\searchplugins\bing.xml
C:\Program Files\Mozilla Firefox\searchplugins\cnrtl-tlfi-fr.xml
C:\Program Files\Mozilla Firefox\searchplugins\eBay-france.xml
C:\Program Files\Mozilla Firefox\searchplugins\google.xml
C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-fr.xml
C:\Program Files\Mozilla Firefox\searchplugins\yahoo-france.xml


¤¤¤¤¤¤¤¤¤¤ | DNS

[HKLM\SYSTEM\CCS | Tcpip\Parameters]|[DhcpNameServer] : 192.168.1.1
[HKLM\SYSTEM\ControlSet001 | Interfaces\{43CB6297-8F46-435E-9C59-4DED67A999A4}]|[DhcpNameServer] : 192.168.42.129
[HKLM\SYSTEM\ControlSet001 | Interfaces\{EBD095F4-2C29-4821-A1FE-C9DBFA915040}]|[DhcpNameServer] : 192.168.1.1
[HKLM\SYSTEM\ControlSet003 | Interfaces\{43CB6297-8F46-435E-9C59-4DED67A999A4}]|[DhcpNameServer] : 192.168.42.129
[HKLM\SYSTEM\ControlSet003 | Interfaces\{EBD095F4-2C29-4821-A1FE-C9DBFA915040}]|[DhcpNameServer] : 192.168.1.1
[HKLM\SYSTEM\CurrentControlSet | Interfaces\{43CB6297-8F46-435E-9C59-4DED67A999A4}]|[DhcpNameServer] : 192.168.42.129
[HKLM\SYSTEM\CurrentControlSet | Interfaces\{EBD095F4-2C29-4821-A1FE-C9DBFA915040}]|[DhcpNameServer] : 192.168.1.1

¤¤¤¤¤¤¤¤¤¤ | Hosts

C:\Windows\System32\Drivers\etc\hosts : Cleaned :) 

¤¤¤¤¤¤¤¤¤¤ | Files | Folders | Registry

Quarantined and deleted Successfully :  C:\$Recycle.bin\S-1-5-21-1170913042-1277233965-3038881231-1000\$IJJIC07.exe
Quarantined and deleted Successfully :  C:\$Recycle.bin\S-1-5-21-1170913042-1277233965-3038881231-1000\$RJJIC07.exe

Quarantined and deleted Successfully :  C:\Windows\flow.tmp
Impossible to move :  C:\Windows\msdownld.tmp
Quarantined and deleted Successfully :  C:\Windows\mozver.dat
Quarantined and deleted Successfully :  C:\Users\yannos\AppData\Local\Temp\AdobeARM.log
Quarantined and deleted Successfully :  C:\Users\yannos\AppData\Local\Temp\chrome_installer.log
Quarantined and deleted Successfully :  C:\Users\yannos\AppData\Local\Temp\GoogleToolbarInstaller1.log
Quarantined and deleted Successfully :  C:\Users\yannos\AppData\Local\Temp\jusched.log
Quarantined and deleted Successfully :  C:\Users\yannos\AppData\Local\Temp\LVCOMSX.LOG
Quarantined and deleted Successfully :  C:\Users\yannos\AppData\Local\Temp\MSIcda76.LOG
Quarantined and deleted Successfully :  C:\Users\yannos\AppData\Local\Temp\{B6FE6EEC-7E78-4644-9BF5-A10199943D06}\fpb.tmp
Impossible to move :  C:\Users\yannos\AppData\Local\Temp\~DF9E44.tmp
Quarantined and deleted Successfully :  C:\Users\yannos\AppData\Local\Temp\~DF9F9A.tmp
Quarantined and deleted Successfully :  C:\Users\yannos\AppData\Local\Temp\~DFBAF9.tmp
Quarantined and deleted Successfully :  C:\Users\yannos\AppData\Local\Temp\~DFFBF4.tmp
Quarantined and deleted Successfully :  C:\Windows\Temp\LVCOMSX.LOG
Quarantined and deleted Successfully :  C:\Windows\Temp\MpCmdRun.log
Quarantined and deleted Successfully :  C:\Windows\Temp\MpSigStub.log
Quarantined and deleted Successfully :  C:\Users\yannos\AppData\Roaming\AVG7\l_000101.log
Quarantined and deleted Successfully :  C:\Users\yannos\AppData\Roaming\AVG7\l_000102.log
Quarantined and deleted Successfully :  C:\Users\yannos\AppData\Roaming\Azureusestart.bat
Quarantined and deleted Successfully :  C:\Users\yannos\AppData\Local\awaycyq.bat
Quarantined and deleted Successfully :  C:\Users\yannos\AppData\Local\cikcaye.bat
Quarantined and deleted Successfully :  C:\Users\yannos\AppData\Local\ecucaeu.bat
Quarantined and deleted Successfully :  C:\Users\yannos\AppData\Local\eugkc.bat
Quarantined and deleted Successfully :  C:\Users\yannos\AppData\Local\gimwk.bat
Quarantined and deleted Successfully :  C:\Users\yannos\AppData\Local\gkays.bat
Quarantined and deleted Successfully :  C:\Users\yannos\AppData\Local\iayao.bat
Quarantined and deleted Successfully :  C:\Users\yannos\AppData\Local\igcqe.bat
Quarantined and deleted Successfully :  C:\Users\yannos\AppData\Local\imaqeei.bat
Quarantined and deleted Successfully :  C:\Users\yannos\AppData\Local\kgwqwco.bat
Quarantined and deleted Successfully :  C:\Users\yannos\AppData\Local\Lollipop\erifbrgc.bat
Quarantined and deleted Successfully :  C:\Users\yannos\AppData\Local\Lollipop\erifbrgc.exe
Quarantined and deleted Successfully :  C:\Users\yannos\AppData\Local\Lollipop\lollipop.bat
Quarantined and deleted Successfully :  C:\Users\yannos\AppData\Local\Lollipop\mcbgdbb.exe
Quarantined and deleted Successfully :  C:\Users\yannos\AppData\Local\Lollipop\mlkiogm.exe
Quarantined and deleted Successfully :  C:\Users\yannos\AppData\Local\Lollipop	rxvei.exe
Quarantined and deleted Successfully :  C:\Users\yannos\AppData\Local\mqysuyo.bat
Quarantined and deleted Successfully :  C:\Users\yannos\AppData\Local\PokerStars\PokerStars.log.0
Quarantined and deleted Successfully :  C:\Users\yannos\AppData\Local\PokerStars\PokerStarsUpdate.log.0
Quarantined and deleted Successfully :  C:\Users\yannos\AppData\Local\PokerStars\PokerStarsUpdateE.log.0
Quarantined and deleted Successfully :  C:\Users\yannos\AppData\Local\PokerStars\_update2.dat
Quarantined and deleted Successfully :  C:\Users\yannos\AppData\Local\PokerStars\_updcache.dat
Quarantined and deleted Successfully :  C:\Users\yannos\AppData\Local\PokerStars.FR\PokerStars.log.0
Quarantined and deleted Successfully :  C:\Users\yannos\AppData\Local\PokerStars.FR\PokerStars.log.1
Quarantined and deleted Successfully :  C:\Users\yannos\AppData\Local\PokerStars.FR\PokerStarsUpdate.log.0
Quarantined and deleted Successfully :  C:\Users\yannos\AppData\Local\PokerStars.FR\PokerStarsUpdate.log.1
Quarantined and deleted Successfully :  C:\Users\yannos\AppData\Local\PokerStars.FR\PokerStarsUpdateE.log.0
Quarantined and deleted Successfully :  C:\Users\yannos\AppData\Local\PokerStars.FR\PokerStarsUpdateE.log.1
Quarantined and deleted Successfully :  C:\Users\yannos\AppData\Local\PokerStars.FR\Stub.log.0
Quarantined and deleted Successfully :  C:\Users\yannos\AppData\Local\PokerStars.FR\_update2.dat
Quarantined and deleted Successfully :  C:\Users\yannos\AppData\Local\PokerStars.FR\_updcache.dat
Quarantined and deleted Successfully :  C:\Users\yannos\AppData\Local\qoyoi.bat
Quarantined and deleted Successfully :  C:\Users\yannos\AppData\Local\siies.bat
Quarantined and deleted Successfully :  C:\Users\yannos\AppData\Local\waausou.bat
Quarantined and deleted Successfully :  C:\Users\yannos\AppData\Local\wagmyce.bat
Quarantined and deleted Successfully :  C:\Users\yannos\AppData\Local\wwiqs.bat
Quarantined and deleted Successfully :  C:\Users\yannos\AppData\Local\ysawk.bat
Quarantined and deleted Successfully :  C:\Users\yannos\AppData\Local\microsoft\windows\WindowsUpdate.log
Quarantined and deleted Successfully :  C:\ProgramData\avg7\AVG7QT.DAT
Quarantined and deleted Successfully :  C:\ProgramData\ma-config.com\mcbase.db
Impossible to move :  C:\ProgramData\ma-config.com
Quarantined and deleted Successfully :  C:\Users\yannos\jagex_runescape_preferences.dat
Deleted : [HKU\S-1-5-21-1170913042-1277233965-3038881231-1000 | Run]|[erifbrgc] : "c:\users\yannos\appdata\local\lollipop\erifbrgc.exe" erifbrgc

20:35:45

Impossible to move :  C:\ProgramData\Installations
Impossible to move :  C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Catalyst Install Manager
Impossible to move :  C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SoundDownloader
Quarantined and deleted Successfully :  C:\Users\yannos\AppData\Roaming\Microsoft\Windows\Start Menu\Installation du Contrôle Parental.lnk
Quarantined and deleted Successfully :  C:\Users\yannos\Desktop\PONE - In my eyes 3.0.mp3
Quarantined and deleted Successfully :  C:\Users\yannos\Desktop\SoundDownloader - Raccourci.lnk
Quarantined and deleted Successfully :  C:\Users\yannos\AppData\Local\d3d9caps.dat
Quarantined and deleted Successfully :  |D| - C:\Windows\System32\%APPDATA%

¤¤¤¤¤¤¤¤¤¤ | quarantined at reboot

Not quarantined at Reboot : C:\Windows\msdownld.tmp
Not quarantined at Reboot : C:\Users\yannos\AppData\Local\Temp\~DF9E44.tmp
Not quarantined at Reboot : C:\ProgramData\ma-config.com
Not quarantined at Reboot : C:\ProgramData\Installations
Not quarantined at Reboot : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Catalyst Install Manager
Not quarantined at Reboot : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SoundDownloader
Not quarantined at Reboot : C:\Users\yannos\Modèles\H
Not quarantined at Reboot : C:\Users\yannos\AppData\Roaming\Microsoft\Windows\Templates\H

¤¤¤¤¤

20:42:08

¤¤¤¤¤¤¤¤¤¤ | Listing Partition(s)

 Disk: 0   Size=238G
 Pos MBRndx Type/Name  Size Active Hide Start Sector   Sectors
 --- ------ ---------- ---- ------ ---- ------------ ------------
  0    1    07-NTFS    8.8G   No    No            63   17,928,477
  1    0    07-NTFS    230G   Yes   No    17,928,540  470,463,525

¤¤¤¤¤¤¤¤¤¤ | MBR Control

MBR code signature : C9 6A F9 B0


Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 6.0.6002 Disk: SAMSUNG_SP2504C rev.VT100-50 -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 

device: opened successfully
user: MBR read successfully

Disk trace:
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll ataport.SYS pciide.sys PCIIDEX.SYS atapi.sys 
1 ntkrnlpa!IofCallDriver[8308E936] -> \Device\Harddisk0\DR0[85B14030]
3 CLASSPNP[885A68B3] -> ntkrnlpa!IofCallDriver[8308E936] -> [85B78918]
5 acpi[806106BC] -> ntkrnlpa!IofCallDriver[8308E936] -> \Device\Ide\IdeDeviceP0T0L0-0[85B05B98]
kernel: MBR read successfully
_asm { XOR DI, DI; MOV SS, DI; MOV SP, 7a00; MOV BX, 7a0; MOV DS, BX; MOV ES, BX; MOV SI, 200; MOV CX, SI; CLD ; REP MOVSB ; JMP FAR 7a0:a3;  }
user & kernel MBR OK 

20:42:24

[HKLM | Winlogon] | AutoRestartShell : 0 -> 1

¤¤¤¤¤¤¤¤¤¤ | Hidden files

~ [Disque d:] Folders : 1 | Files : 77 ¤¤¤¤¤ Unhide ¤¤¤¤¤ Folders : 0 | Files : 77
~ [Disque C:] Folders : 1 | Files : 1 ¤¤¤¤¤ Unhide ¤¤¤¤¤ Folders : 1 | Files : 1
~ [ProgramFiles] Folders : 1 | Files : 3 ¤¤¤¤¤ Unhide ¤¤¤¤¤ Folders : 1 | Files : 3
~ [Utilisateurs] Folders : 2 | Files : 0 ¤¤¤¤¤ Unhide ¤¤¤¤¤ Folders : 2 | Files : 0
~ [Music] Folders : 4 | Files : 4 ¤¤¤¤¤ Unhide ¤¤¤¤¤ Folders : 4 | Files : 4
~ [Pictures] Folders : 1 | Files : 0 ¤¤¤¤¤ Unhide ¤¤¤¤¤ Folders : 1 | Files : 0
~ [Videos] Folders : 0 | Files : 1 ¤¤¤¤¤ Unhide ¤¤¤¤¤ Folders : 0 | Files : 1
~ [Downloads] Folders : 0 | Files : 0
~ [Desktop] Folders : 1 | Files : 3 ¤¤¤¤¤ Unhide ¤¤¤¤¤ Folders : 1 | Files : 3
~ [Links] Folders : 0 | Files : 0
~ [Searches] Folders : 0 | Files : 2 ¤¤¤¤¤ Unhide ¤¤¤¤¤ Folders : 0 | Files : 2
~ [Contacts] Folders : 9 | Files : 0 ¤¤¤¤¤ Unhide ¤¤¤¤¤ Folders : 9 | Files : 0
~ [Saved_Games] Folders : 0 | Files : 0
~ [Favorites] Folders : 0 | Files : 0
~ [Documents] Folders : 4 | Files : 0 ¤¤¤¤¤ Unhide ¤¤¤¤¤ Folders : 4 | Files : 0
~ [Windows] Folders : 62 | Files : 203 ¤¤¤¤¤ Unhide ¤¤¤¤¤ Folders : 62 | Files : 203
~ [Start_Menu] Folders : 1 | Files : 0 ¤¤¤¤¤ Unhide ¤¤¤¤¤ Folders : 1 | Files : 0
~ [Libraries] Folders : 0 | Files : 0
~ [quick launch] Folders : 0 | Files : 0
~ [AppData] Folders : 1 | Fil

g3n-h@ckm@n · Answer

heberge-le stp c'est la misère à lire là

yann252 · Answer

c'est fait

g3n-h@ckm@n · Answer

ben il me faut le lien sinon je fais comment pour le consulter ?

yann252 · Answer

excuse mon incompétence c'est la première fois que je le fais.

https://pjjoint.malekal.com/files.php?id=20120921_b8c7n8w12h14

g3n-h@ckm@n · Answer

va peut etre falloir calmer les sites pornos tu crois pas ?

yann252 · Answer

lol a se point!!!!!

g3n-h@ckm@n · Answer

franchement tu bombardes !!!!! ^^

yann252 · Answer

mes com n' a paresse plus!!

yann252 · Answer

a si bisard ca encor donc je disais que j'en utilisais qu'un seul mes regulierement et c'est gratuit!

g3n-h@ckm@n · Answer

ouaip ben les liens sur lesquels tu cliques sur le site sont quant-à eux  bien pourris

=============

Télécharge ici : Navilog1 depuis-ce lien

&#9654 Enregistrer la cible (du lien) sous... et enregistre-le sur ton bureau.
&#9654 Ensuite double clique sur navilog1.exe pour lancer l'installation.

Une fois l'installation terminée, le fix s'exécutera automatiquement.

&#9654 Au menu principal, Fais le choix 1 >>  Recherche / suppression automatique 

Patiente jusqu'au message :
*** Analyse Termine le ..... *** 

>>>>> Le fix peut durer une dizaine de minutes ;)

&#9654 Appuie sur une touche le bloc note va s'ouvrir.

&#9654 Copie-colle le rapport ici.

yann252 · Answer

Fix Navipromo version 4.1.1 commencé le 21/09/2012 22:00:52,31

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!

Outil exécuté depuis C:
avilog1

Mise à jour le 07.04.2012 à 20h00 par IL-MAFIOSO

Microsoft® Windows Vista(TM) Édition Familiale Premium  ( v6.0.6002 ) Service Pack 2
X86-based PC ( Multiprocessor Free : AMD Athlon(tm) 64 X2 Dual Core Processor 5600+ )
BIOS : Phoenix - AwardBIOS v6.00PG
USER : yannos ( Administrator )
BOOT : Normal boot

Antivirus : AVG 7.5.488 7.5.488 (Activated)


C:\ (Local Disk) - NTFS - Total:224 Go (Free:30 Go)
D:\ (Local Disk) - NTFS - Total:8 Go (Free:4 Go)
E:\ (CD or DVD)
F:\ (CD or DVD)
G:\ (USB)
J:\ (USB)
L:\ (USB)
O:\ (USB)


Recherche executée en mode normal 

Nettoyage exécuté au redémarrage de l'ordinateur


c:\users\yannos\appdata\local\virtua~1\progra~1\InternetGamebox supprimé !


Nettoyage contenu C:\Windows\Temp effectué !
Nettoyage contenu C:\Users\yannos\AppData\Local\Temp effectué !


*** Sauvegarde du Registre vers dossier Safebackup ***

sauvegarde du Registre réalisée avec succès !

*** Nettoyage Registre ***

Nettoyage Registre Ok




*** Scan terminé 21/09/2012 22:15:43,61 ***

yann252 · Answer

j'atire ton attention sur l' antivirus detecté et activé AVG 7.5.488, ce n'est pas celui qui tourne sur mon pc celui ci il a du etre viré par ccleaner normalement.

g3n-h@ckm@n · Answer

aide toi de  cette page pour virer les restes alors :

https://www.commentcamarche.net/faq/7367-desinstaller-proprement-liens-et-astuces#mcafee-virusscan-8-ou-9

yann252 · Answer

c'est fait merci!!

g3n-h@ckm@n · Answer

heberge le rapport de Diag stp via cjoint.com ou autre et donne le lien

yann252 · Answer

Je suppose que mon pc est tout neuf maintenant

yann252 · Answer

https://www.cjoint.com/?BIvwIJfb5lu

g3n-h@ckm@n · Answer

nan pas celui-là , Pre_Diag_etc......txt qui est sur ton bureau

yann252 · Answer

https://www.cjoint.com/?3IvwOU9aDy9

g3n-h@ckm@n · Answer

ah mais non mais faut que t'en refasse un neuf , celui-ci date d'avant la suppression du coup je sais pas ce qu'il reste !

yann252 · Answer

c 'est bien se que jme disait ;)

yann252 · Answer

https://www.cjoint.com/?3IvxnoutcD2

g3n-h@ckm@n · Answer

desinstalle ca :

Update Manager for SweetPacks 1.1

===

Attention !!! pense à re-désactiver tes protections

Clique sur ce lien : https://www.cjoint.com/?BIvx2NmPlWT

Selectionne tout le texte qui s'y trouve CTRL+A puis CTRL+C ou clic droit/copier

Relance Pre_scan puis choisis l'option "Script"

une page va s'ouvrir

logiquement le texte que tu as sélectionné s'y trouve déjà , donc tu fermes et le programme va travailler.

sinon colle-le (clic droit/coller ou ctrl+V) dans la page vierge.

puis onglet fichier => enregistrer (pas enregistrer sous...) , puis ferme le texte

des fenetres noires risquent de clignoter , c'est normal , c'est le programme qui travaille 

poste Pre_Script.txt qui apparaitra sur le bureau en fin de travail

yann252 · Answer

bon pre scan est resté bloqué sur msiexe.exe alors j'ai du redémarrer manuellement et remplacé le texte déjà présent par celui que tu ma donné, je l'ai relancé et il est resté bloqué sur wuauclt.exe alors redémarrage manuel et le rapport script est sur mon bureau, le voici

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Pre_Script | 2.0920 ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

yannos : Windows Vista (TM) Home Premium (32 bits)

Switchs : https://gen-hackman.kanak.fr/

Script : 10:11:25

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

¤¤¤¤¤¤¤¤¤¤ | Registry Deletions

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Pre_Script | 2.0921 ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

yannos : Windows Vista (TM) Home Premium (32 bits)

Switchs : https://gen-hackman.kanak.fr/

Script : 10:29:01

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

¤¤¤¤¤¤¤¤¤¤ | Registry Deletions

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Pre_Script | 2.0921 ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

yannos : Windows Vista (TM) Home Premium (32 bits)

Switchs : https://gen-hackman.kanak.fr/

Script : 10:36:26

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤


Fin : 10:36:26

¤¤¤¤¤¤¤¤¤¤ ( EOF ) ¤¤¤¤¤¤¤¤¤¤

g3n-h@ckm@n · Answer

fais le en mode sans echec

yann252 · Answer

c' est passé!! :)

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Pre_Script | 2.0921 ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

yannos : Windows Vista (TM) Home Premium (32 bits)

Switchs : https://gen-hackman.kanak.fr/

Script : 10:54:11

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

¤¤¤¤¤¤¤¤¤¤ | Registry Deletions

Value Deleted : [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:NeroFilterCheck
Value Deleted : [HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Internet Explorer\URLSearchHooks]:{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Internet Explorer\SearchScopes\{9B6103C1-F818-48a8-9683-314055BE6075}
Key Deleted : HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Internet Explorer\SearchScopes\{ED4BD629-C1B6-4399-8A34-02CCAA921DC9}
Key Deleted : HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{024FE56A-FB63-4A9B-84CA-867A3B599861}
Key Deleted : HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{0562C0A2-E425-4F99-B194-C4D1FB3C3A16}
Key Deleted : HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2A44969F-9D71-47FB-A845-ED81119917AF}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{08f24d68-9087-4b24-81ad-7b34af3e3ed5}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3B9A6E32-36C9-4946-B78C-3F58E3785EC1}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4becf16c-74f0-429b-8d3e-4fba507ac661}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{95a4104c-1c49-4c2a-9830-1be0f47e926c}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9da1d2cb-796d-4bec-bbaa-0aa9ccd80e15}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{e5f90a07-7db7-4dcb-bd6d-d3fecd376ca3}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{fb9e068b-c612-4fa8-bdb9-d728a716a420}
Key Deleted : HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}
Key Deleted : HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
Key Deleted : HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\lollipop
Key Deleted : HKU\S-1-5-21-1170913042-1277233965-3038881231-1000\Software\Microsoft\Babylon    
Key Deleted : HKLM\Software\TENCENT    
Key Deleted : HKCU\Software\Microsoft\windows\CurrentVersion\Uninstall\erifbrgc

¤

File Deleted :  |AS| - d:\Info.exe     
File Deleted :  |A| - C:\Users\yannos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZooskMessenger.lnk 
File Deleted :  |A| - C:\Users\yannos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\erifbrgc.lnk 
Folder Deleted : |D| - C:\Users\yannos\AppData\Local\Lollipop 
Folder Deleted : |D| - C:\Program Files\Spybot - Search & Destroy     

¤¤¤¤¤¤¤¤¤¤ | MBR

Windows Version:		Windows Vista Home Premium Edition
Windows Information:		Service Pack 2 (build 6002), 32-bit
Base Board Manufacturer:	ASUSTeK Computer INC.
BIOS Manufacturer:		Phoenix Technologies, LTD
System Manufacturer:		System manufacturer
System Product Name:		System Product Name
Logical Drives Mask:		0x00004a7c

Analysis of file "C:\Pre_Scan\MBR.bin":
Unknown MBR code

¤


¤¤¤¤¤¤¤¤¤¤ | Nettoyage disque

Nettoyage du disque effectué

¤


explorer.exe -> Process re-started

Fin : 10:59:44

¤¤¤¤¤¤¤¤¤¤ ( EOF ) ¤¤¤¤¤¤¤¤¤¤

g3n-h@ckm@n · Answer

les soucis persistent ?

yann252 · Answer

pour le moment c' est nickel!!!

je te remercie de ton temps et de ta patience :))

fini les porno a moins que tu est une petite astuce pour ne plus re chopper c'est merde???

yann252 · Answer

Au-fait avec les rapports posté, est ce que je risque quelque chose? faut il effacer ce topic?

g3n-h@ckm@n · Answer

fini les porno a moins que tu est une petite astuce pour ne plus re chopper c'est merde???

n'installe aucun plug-in proposé ou lecteur venant du net soi disant necessaire pour regarder tel ou tel truc

========

 
 Au-fait avec les rapports posté, est ce que je risque quelque chose? faut il effacer ce topic?

pas un brin...

refais un nettoyage ccleaner comme indiqué sur mon lien plus haut

mets malwarebytes à jour et fais un scan complet par securité

yann252 · Answer

ok merci pour tout et je viens de me souvenir que les pub on commencé quand j'ai commencé a regarder des film en streaming et que avast n'arrêtais pas de bloqué des trojan, me conseil tu de ne plus utilisé se site?

g3n-h@ckm@n · Answer

le principal est de toujours avoir Java à jour et Adobe Flash Player aussi

yann252 · Answer

Ok encor merci de nous aider nous les naz du net  :)

Bonne continuation!!!!!

g3n-h@ckm@n · Answer

:)

yann252 · Answer

Bonjour,
Une petite question me turlupine cher ami, en visitant quelques page sur les virus et compagnie j'ai lu qu'on pouvais les bloquer en fermant les ports!
Vu mon niveau très faible en informatique je voulais connaître ton avis la dessus et m'orienter si cela est valable.

Merci

g3n-h@ckm@n · Answer

re

le parefeu windows joue ce rôle depuis vista :)

yann252 · Answer

ok merci

g3n-h@ckm@n · Answer

:)

Aragonheim · Answer

[-] Fichier supprimé : C:\Users\Asus\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_search.searchinsocial.com_0.localstorage
[-] Fichier supprimé : C:\Users\Asus\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_search.searchinsocial.com_0.localstorage-journal
[-] Fichier supprimé : C:\Users\Asus\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_search.searchnewtabtv.com_0.localstorage
[-] Fichier supprimé : C:\Users\Asus\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_search.searchnewtabtv.com_0.localstorage-journal
[-] Fichier supprimé : C:\Users\Asus\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_st.chatango.com_0.localstorage
[-] Fichier supprimé : C:\Users\Asus\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_st.chatango.com_0.localstorage-journal

 [ DLLs ] *****
 [ WMI ] *****
 [ Raccourcis ] *****
 [ Tâches planifiées ] *****
 [ Registre ] *****

[-] Clé supprimée : HKLM\SOFTWARE\Classes\AppID\YMERemote.DLL
[-] Clé supprimée : HKLM\SOFTWARE\Classes\YBrowserToolbar.YBrowserToolbar
[-] Clé supprimée : HKLM\SOFTWARE\Classes\YBrowserToolbar.YBrowserToolbar.1
[-] Clé supprimée : HKLM\SOFTWARE\Classes\YMERemote.YMECompPlugin
[-] Clé supprimée : HKLM\SOFTWARE\Classes\YMERemote.YMECompPlugin.1
[-] Clé supprimée : HKLM\SOFTWARE\Classes\AppID\{7D831388-D405-4272-9511-A07440AD2927}
[-] Clé supprimée : HKLM\SOFTWARE\Classes\CLSID\{3CCC052E-BDEE-408A-BEA7-90914EF2964B}
[-] Clé supprimée : HKLM\SOFTWARE\Classes\CLSID\{61F47056-E400-43D3-AF1E-AB7DFFD4C4AD}
[-] Clé supprimée : HKLM\SOFTWARE\Classes\CLSID\{E2B98EEA-EE55-4E9B-A8C1-6E5288DF785A}
[-] Clé supprimée : HKLM\SOFTWARE\Classes\CLSID\{F51C15D4-3D0A-4DBA-A095-EBCC09F24DA2}
[-] Clé supprimée : HKLM\SOFTWARE\Classes\Interface\{8233093C-178B-484B-979E-3C6B5B147DBC}
[-] Clé supprimée : HKLM\SOFTWARE\Classes\TypeLib\{B722ED8B-0B38-408E-BB89-260C73BCF3D4}
[-] Clé supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
[-] Clé supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
[-] Clé supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
[-] Clé supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}
[-] Clé supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
[-] Clé supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
[-] Clé supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}
[-] Clé supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
[-] Clé supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
[-] Clé supprimée : HKCU\Software\Yahoo\Companion
[-] Clé supprimée : HKCU\Software\Yahoo\YFriendsBar
[-] Clé supprimée : HKCU\Software\AppDataLow\Software\Yahoo\Companion
[-] Clé supprimée : HKLM\SOFTWARE\Yahoo\Companion

 [ Navigateurs ] *****


:: Clés "Tracing" supprimées
:: Paramètres Winsock réinitialisés



C:\AdwCleaner\AdwCleaner[C1].txt - [5714 octets] - [11/06/2016 14:41:43]
C:\AdwCleaner\AdwCleaner[S1].txt - [5797 octets] - [11/06/2016 14:40:38]

########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [5862 octets] ##########

Pub qui s'ouvre des que j'ouvre une page web

120 réponses

Discussions similaires