mon ordinateur redémarre quand je scanne anti Résolu/Fermé

Question

Bonjour
mon ordi redémarre lorsque je veux faire un scan avec un anti-spyyware,ou avec avast, parfois il se bloque;
j'ai essayé les conseil du forum mais ca continue
si quelqu'un a une idée de ce qu'il m'arrive, merci
Logfile of HijackThis v1.99.1
Scan saved at 20:15:52, on 14/03/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Documents and Settings\Propriétaire.SERGE.001\Bureau\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -masquer
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?e5a4a23e5af94ac78d85653648984880
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?e5a4a23e5af94ac78d85653648984880
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase9602.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Kaspersky Anti-Virus 5.5  for Check Point™ FireWall-1® (kav4cpf1) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus for Check Point FireWall\Kav4cpf1.exe (file missing)
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe

Regis59 · Answer

Salut

Essaie en mode sans echec

a+

Regis59 · Answer

Salut

Installe AVG Anti-Spyware :

https://www.malekal.com/avg-antivirus-free-antivirus-gratuit-pour-proteger-son-pc-des-virus/

¤ Lance AVG Anti-Spyware

Clique sur le bouton Analyse (de la barre d'outils)

Puis sur l'onglets Comment réagir, clique sur Actions recommandées. Sélectionne Quarantaine.

Reviens à l'onglet Analyse. Clique sur Analyse complète du système.

A la fin du scan, choisis l'option 3

"Appliquer toutes les actions " en bas.

Clique sur "Enregistrer le rapport".

Copie/colle le rapport sur le forum.

Regis59 · Answer

Salut

Ton CPU monte a 100%?
Combien as tu de RAM?

A+

sergino17 · Answer

Salut j'ai trouvé ceci au sujet du processeur:EVEREST Ultimate Edition 2006 © 2003-2006 Lavalys, Inc. Version EVEREST v3.50.761/fr Module de benchmark 2.1.169.0 Site web http://www.lavalys.com/ Type de rapport Rapport rapide [ TRIAL VERSION ] Ordinateur SERGE Générateur Propriétaire Système d'exploitation Microsoft Windows XP Home Edition 5.1.2600 (WinXP Retail) Date 2007-03-21 Heure 18:07 Processeur Propriétés du processeur: Type de processeur AMD Athlon XP, 2100 MHz (12.5 x 168) 2600+ Alias du processeur Thoroughbred-B Stepping du processeur B0 Jeu d'instructions x86, MMX, 3DNow!, SSE Cache de code de niveau 1 64 Ko Cache de données de niveau 1 [ TRIAL VERSION ] Cache de niveau 2 256 Ko (On-Die, Full-Speed) Informations physiques: Forme du composant 453 Pin PGA Taille du composant 4.95 cm x 4.95 cm Transistors [ TRIAL VERSION ] million(s) Technologie utilisée 6Mi, 0.13 um, CMOS, Cu Taille interne [ TRIAL VERSION ] mm2 Voltage au coeur 1.50 - 1.65 V Voltage d'entrée/sortie 1.6 V Puissance typique 44.0 - 64.0 W (dépendant de la vitesse d'horloge) Puissance maximale 48.5 - 74.3 W (dépendant de la vitesse d'horloge) Fabricant du processeur: Nom de l'entreprise Advanced Micro Devices, Inc. Information sur le produit http://www.amd.com/us-en/Processors/ProductInformation/0,,30_118,00.html Utilisation du processeur: Processeur nº1 0 % Debug - PCI B00 D00 F00: VIA VT8377A Apollo KT400A Chipset - System Controller Offset 00: 06 11 89 31 06 00 30 22 80 00 00 06 00 08 00 00 Offset 10: 08 00 00 D0 00 00 00 00 00 00 00 00 00 00 00 00 Offset 20: 00 00 00 00 00 00 00 00 00 00 00 00 06 11 89 31 Offset 30: 00 00 00 00 80 00 00 00 00 00 00 00 00 00 00 00 Offset 40: 00 19 88 80 82 44 01 00 1B 19 88 80 82 44 00 00 Offset 50: C0 00 00 00 C0 85 30 30 EE 00 10 10 30 30 30 30 Offset 60: 40 AA 00 20 26 99 00 1C D7 ED 43 D0 01 D0 00 00 Offset 70: 82 C8 00 01 41 09 50 00 01 00 00 00 00 00 00 02 Offset 80: 02 C0 35 00 0B 0A 00 1F 00 00 00 00 00 00 00 00 Offset 90: 00 00 00 00 20 0F 01 00 00 00 00 00 00 00 00 00 Offset A0: 00 00 00 00 00 00 00 00 00 00 00 00 21 98 00 C8 Offset B0: 7F 00 02 02 24 00 00 02 48 00 00 01 00 00 00 8C Offset C0: 01 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset D0: 17 A3 6B EA 0F 1C F1 19 21 FF 00 00 61 32 74 00 Offset E0: 00 00 00 00 00 FF 01 00 9A 77 CC 00 04 9A 23 00 Offset F0: 00 00 00 00 00 80 83 00 00 00 30 00 01 04 89 31 B00 D01 F00: VIA VT8377A Apollo KT400A Chipset - AGP Controller Offset 00: 06 11 98 B1 07 01 30 22 00 00 04 06 00 00 01 00 Offset 10: 00 00 00 00 00 00 00 00 00 01 01 00 90 90 20 22 Offset 20: 00 E0 F0 E1 00 D8 F0 DF 00 00 00 00 00 00 00 00 Offset 30: 00 00 00 00 80 00 00 00 00 00 00 00 00 00 0C 00 Offset 40: 81 C0 80 44 35 72 98 B1 00 00 00 00 00 00 00 00 Offset 50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 80: 01 00 02 02 00 00 00 00 00 00 00 00 00 00 00 00 Offset 90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B00 D09 F00: VIA Vectro VT6212 PCI-USB Universal Host Controller Offset 00: 06 11 38 30 07 00 10 02 61 00 03 0C 08 20 80 00 Offset 10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 20: 01 A0 00 00 00 00 00 00 00 00 00 00 06 11 38 30 Offset 30: 00 00 00 00 80 00 00 00 00 00 00 00 10 01 00 00 Offset 40: 40 10 03 00 00 00 00 00 00 0B 00 00 00 00 00 00 Offset 50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 60: 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 80: 01 00 C2 FF 00 00 00 00 00 00 00 00 00 00 00 00 Offset 90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset C0: 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset F0: 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 00 B00 D09 F01: VIA Vectro VT6212 PCI-USB Universal Host Controller Offset 00: 06 11 38 30 07 00 10 02 61 00 03 0C 08 20 80 00 Offset 10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 20: 01 A4 00 00 00 00 00 00 00 00 00 00 06 11 38 30 Offset 30: 00 00 00 00 80 00 00 00 00 00 00 00 11 02 00 00 Offset 40: 40 10 03 00 00 00 00 00 00 0B 00 00 00 00 00 00 Offset 50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 60: 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 80: 01 00 C2 FF 00 00 00 00 00 00 00 00 00 00 00 00 Offset 90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset C0: 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset F0: 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 00 B00 D09 F02: VIA Vectro VT6212 USB 2.0 Enhanced Host Controller Offset 00: 06 11 04 31 07 00 10 02 63 20 03 0C 08 20 80 00 Offset 10: 00 20 00 E3 00 00 00 00 00 00 00 00 00 00 00 00 Offset 20: 00 00 00 00 00 00 00 00 00 00 00 00 06 11 04 31 Offset 30: 00 00 00 00 80 00 00 00 00 00 00 00 12 03 00 00 Offset 40: 00 00 0B 00 00 00 00 00 A0 20 00 09 00 00 FF FF Offset 50: 00 5A 00 80 00 00 00 00 04 0B 88 88 33 00 00 00 Offset 60: 20 20 01 00 00 00 00 00 01 00 00 00 00 00 00 C0 Offset 70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 80: 01 00 C2 FF 00 00 00 00 00 00 00 00 00 00 00 00 Offset 90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset F0: 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 00 B00 D0A F00: VIA VT6306 Fire II IEEE1394 Host Controller Offset 00: 06 11 44 30 07 00 10 02 46 10 00 0C 08 20 00 00 Offset 10: 00 00 00 E3 01 A8 00 00 00 00 00 00 00 00 00 00 Offset 20: 00 00 00 00 00 00 00 00 00 00 00 00 06 11 44 30 Offset 30: 00 00 00 00 50 00 00 00 00 00 00 00 11 01 00 20 Offset 40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 50: 01 00 02 E4 00 00 00 00 00 00 00 00 00 00 00 00 Offset 60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B00 D0B F00: PCtel HSP MicroModem 56 Offset 00: 4D 13 92 78 00 00 10 02 02 04 03 07 00 00 00 00 Offset 10: 01 AC 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 20: 00 00 00 00 00 00 00 00 80 02 00 00 4D 13 01 00 Offset 30: 00 00 00 00 40 00 00 00 00 00 00 00 12 01 00 00 Offset 40: 01 00 62 EC 03 01 00 00 00 00 00 00 00 00 00 00 Offset 50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B00 D0C F00: Realtek RTL8139 PCI Fast Ethernet Adapter [A/B/C] Offset 00: EC 10 39 81 05 00 90 02 10 00 00 02 00 80 00 00 Offset 10: 01 B0 00 00 00 10 00 E3 00 00 00 00 00 00 00 00 Offset 20: 00 00 00 00 00 00 00 00 00 00 00 00 EC 10 39 81 Offset 30: 00 00 00 00 50 00 00 00 00 00 00 00 13 01 20 40 Offset 40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 50: 01 00 C2 F7 00 00 00 00 00 00 00 00 00 00 00 00 Offset 60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B00 D10 F00: VIA VT8235 USB Universal Host Controller Offset 00: 06 11 38 30 07 00 10 02 80 00 03 0C 08 20 80 00 Offset 10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 20: 01 B4 00 00 00 00 00 00 00 00 00 00 06 11 38 30 Offset 30: 00 00 00 00 80 00 00 00 00 00 00 00 15 01 00 00 Offset 40: 40 10 03 00 00 00 00 00 00 0B 00 00 00 00 00 00 Offset 50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 60: 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 80: 01 00 C2 FF 00 00 00 00 00 00 00 00 00 00 00 00 Offset 90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset C0: 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset F0: 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 00 B00 D10 F01: VIA VT8235 USB Universal Host Controller Offset 00: 06 11 38 30 07 00 10 02 80 00 03 0C 08 20 80 00 Offset 10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 20: 01 B8 00 00 00 00 00 00 00 00 00 00 06 11 38 30 Offset 30: 00 00 00 00 80 00 00 00 00 00 00 00 15 02 00 00 Offset 40: 40 10 03 00 00 00 00 00 00 0B 00 00 00 00 00 00 Offset 50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 60: 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 80: 01 00 C2 FF 00 00 00 00 00 00 00 00 00 00 00 00 Offset 90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset C0: 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset F0: 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 00 B00 D10 F02: VIA VT8235 USB Universal Host Controller Offset 00: 06 11 38 30 07 00 10 02 80 00 03 0C 08 20 80 00 Offset 10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 20: 01 BC 00 00 00 00 00 00 00 00 00 00 06 11 38 30 Offset 30: 00 00 00 00 80 00 00 00 00 00 00 00 15 03 00 00 Offset 40: 40 10 03 00 00 00 00 00 00 0B 00 00 00 00 00 00 Offset 50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 60: 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 80: 01 00 C2 FF 00 00 00 00 00 00 00 00 00 00 00 00 Offset 90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset C0: 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset F0: 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 00 B00 D10 F03: VIA VT8235 USB 2.0 Enhanced Host Controller Offset 00: 06 11 04 31 07 00 10 02 82 20 03 0C 08 20 00 00 Offset 10: 00 30 00 E3 00 00 00 00 00 00 00 00 00 00 00 00 Offset 20: 00 00 00 00 00 00 00 00 00 00 00 00 06 11 04 31 Offset 30: 00 00 00 00 80 00 00 00 00 00 00 00 15 04 00 00 Offset 40: 00 00 03 00 00 00 00 00 80 10 00 89 00 00 00 00 Offset 50: 00 5A 00 80 00 00 00 00 04 0B 66 88 53 66 00 00 Offset 60: 20 20 01 00 00 00 00 00 01 00 00 00 00 00 00 C0 Offset 70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 80: 01 00 C2 FF 00 00 00 00 00 00 00 00 00 00 00 00 Offset 90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset F0: 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 00 B00 D11 F00: VIA VT8233A/8235 PCI-ISA Bridge Offset 00: 06 11 77 31 87 00 10 02 00 00 01 06 00 00 80 00 Offset 10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 20: 00 00 00 00 00 00 00 00 00 00 00 00 06 11 77 31 Offset 30: 00 00 00 00 C0 00 00 00 00 00 00 00 00 00 00 00 Offset 40: 44 00 F8 0B 00 00 00 00 0C 20 00 00 44 00 08 08 Offset 50: 81 0D 09 00 00 00 22 00 43 80 00 00 00 00 00 00 Offset 60: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 Offset 70: 06 11 77 31 00 00 00 00 00 00 00 00 20 00 00 00 Offset 80: 20 84 59 00 FA 30 00 00 01 40 00 00 00 00 00 00 Offset 90: 00 7F 1F 88 B0 40 05 00 00 12 26 00 00 00 00 00 Offset A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset C0: 01 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset D0: 01 50 01 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset E0: 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 Offset F0: 00 00 00 00 00 00 07 00 00 00 00 00 00 00 00 00 B00 D11 F01: VIA IDE Controller Offset 00: 06 11 71 05 07 00 90 02 06 8A 01 01 00 20 00 00 Offset 10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 20: 01 C0 00 00 00 00 00 00 00 00 00 00 06 11 71 05 Offset 30: 00 00 00 00 C0 00 00 00 00 00 00 00 FF 01 00 00 Offset 40: 0B F2 09 05 18 1C C0 00 20 20 20 20 FF 00 B6 B6 Offset 50: F6 F6 17 F1 0C 03 00 00 A8 A8 A8 A8 00 00 00 00 Offset 60: 00 02 00 00 00 00 00 00 00 02 00 00 00 00 00 00 Offset 70: 02 01 00 00 00 00 00 00 02 01 00 00 00 00 00 00 Offset 80: F8 AE 72 03 00 00 00 00 C8 D9 74 03 00 00 00 00 Offset 90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset C0: 01 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset D0: 06 00 71 05 06 11 71 05 00 00 00 00 00 00 00 00 Offset E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset F0: 00 00 00 00 00 00 07 00 00 00 00 00 00 00 00 00 B00 D11 F05: VIA AC'97 Enhanced Audio Controller Offset 00: 06 11 59 30 01 00 10 02 50 00 01 04 00 00 00 00 Offset 10: 01 C4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 20: 00 00 00 00 00 00 00 00 00 00 00 00 0F 27 7E 75 Offset 30: 00 00 00 00 C0 00 00 00 00 00 00 00 16 03 00 00 Offset 40: 01 CC 00 00 00 00 00 00 00 00 00 00 3F 00 00 00 Offset 50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset C0: 01 00 02 06 00 00 00 00 00 00 00 00 00 00 00 00 Offset D0: 01 00 02 06 00 00 00 00 00 00 00 00 00 00 00 00 Offset E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B01 D00 F00: Gigabyte Radeon 9200 SE Video Adapter Offset 00: 02 10 64 59 07 00 B0 02 01 00 00 03 08 FF 80 00 Offset 10: 08 00 00 D8 01 90 00 00 00 00 00 E1 00 00 00 00 Offset 20: 00 00 00 00 00 00 00 00 00 00 00 00 58 14 18 40 Offset 30: 00 00 00 00 58 00 00 00 00 00 00 00 10 01 08 00 Offset 40: 00 00 00 00 00 00 00 00 00 00 00 00 58 14 18 40 Offset 50: 01 00 02 06 00 00 00 00 02 50 30 00 1B 02 00 FF Offset 60: 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 80: 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B01 D00 F01: Gigabyte Radeon 9200 SE - Secondary Video Adapter Offset 00: 02 10 44 5D 07 00 B0 02 01 00 80 03 08 20 00 00 Offset 10: 08 00 00 DC 00 00 FF E1 00 00 00 00 00 00 00 00 Offset 20: 00 00 00 00 00 00 00 00 00 00 00 00 58 14 19 40 Offset 30: 00 00 00 00 50 00 00 00 00 00 00 00 FF 00 08 00 Offset 40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 50: 01 00 02 06 00 00 00 00 02 50 30 00 1B 02 00 FF Offset 60: 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Debug - Video BIOS C000:0000 U.`.....................\.....IBM'.............. 761295520...... C000:0040 ??..............2003/07/28 02:11.....>...p......DvN7.X..@....... C000:0080 ..R92S64T F1...(C) 1988-2003, ATI Technologies Inc. BK-ATI VER00 C000:00C0 8.015.028.000. dagba166.f1 v611 .V280AGP DGD1UN...f.......f...\W C000:0100 ................X..@dY.........qVg..$.0...>...$TVS<...........Ax C000:0140 ....H.......................PCIR..dY........`.......ATI RADEON 9 C000:0180 200.kk..........*{...).:.j{..3.................................. C000:01C0 ...................VfW..0 ..3Q0`..........CD..<..... ....P .... C000:0200 P`........X .A`.X`........hA...............}..`................ C000:0240 ...A.........M.......[......t...........0....px..r..|........... C000:0280 ...`..........UU..........UU..........I............Q...........Q C000:02C0 ...............M.......[.A...........@.....L.. .'H.....T..tWw..0 C000:0300 .0.D.#S9.X.2.2u......dM..........................dM.........H... C000:0340 ....@.M.........D........4`...s.....H......o......H......f..M... C000:0380 ..............A...............A.................A............... C000:03C0 A...................A...............A........................H.. Debug - Unknown Monitor ID LTN021E: Écran Plug-and-Play [NoDB] Monitor Model K15ANC/R/A The names of actual companies and products mentioned herein may be the trademarks of their respective owners. a utilisation du processeur, le chiffre varie de 0 a 13 % Si j'ai bien compris, je n'ai pas de spyware mais mon problème viendrait des ram Merci

Regis59 · Answer

Salut,

Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau.
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe 
Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici :
•	Redémarre ton ordinateur
•	Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde).
•	A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.
•	Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".
•	Choisis ton compte.
Déroule la liste des instructions ci-dessous :
•	Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script.
•	Appuie sur Y pour commencer le processus de nettoyage.
•	Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
•	Appuie sur une touche pour redémarrer le PC.
•	Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
•	Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
•	Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
•	Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
•	Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum, avec un nouveau log Hijackthis !

sergino17 · Answer

Salut
comme je risque d'en avoir pour un moment avant d'avoir fait tout ca meme si c'est superbement bien expliqué , je tiens a te remercier de ta réponse
a +

Regis59 · Answer

Coucou

C'est rapide et de rien !

a+

sergino17 · Answer

hello,
effectivement, c'est plus facile que je le pensait
voici le report sdfix en attendant le hidjackthis

SDFix: Version 1.74

Run by Propri‚taire - 21/03/2007 - 23:19:37,20

Microsoft Windows XP [version 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services: 





Restoring Windows Registry Entries
Restoring Default Hosts File


Rebooting...

Normal Mode:
Checking Files:

No Trojan Files Found...




ADS Check:

C:\WINDOWS\system32
No streams found.


                                 Final Check:

Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\adslTV\adslTV.exe"="C:\Program Files\adslTV\adslTV.exe:*:Enabled:adslTV"
"C:\Program Files\Freeplayer\vlc\vlc.exe"="C:\Program Files\Freeplayer\vlc\vlc.exe:*:Enabled:VLC media player"
"C:\Program Files\adslTV\vlc.exe"="C:\Program Files\adslTV\vlc.exe:*:Enabled:VLC media player"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\eMule\emule.exe"="C:\Program Files\eMule\emule.exe:*:Enabled:eMule"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\Program Files\FreeEasyZap\FreeEasyZap.exe"="C:\Program Files\FreeEasyZap\FreeEasyZap.exe:*:Enabled:FreeEasyZap"


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"


Remaining Files:
---------------


Checking For Files with Hidden Attributes :

C:\WINDOWS\Temp\cpmyyz04.TMP

                                 Finished
merci et

en route  pour un monde meilleur

sergino17 · Answer

re hello
je deviens un pro
voici le hidjackthisLogfile of HijackThis v1.99.1
Scan saved at 23:32:35, on 21/03/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32
otepad.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Propriétaire.SERGE.001\Bureau\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -masquer
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?e5a4a23e5af94ac78d85653648984880
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?e5a4a23e5af94ac78d85653648984880
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase9602.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Kaspersky Anti-Virus 5.5  for Check Point™ FireWall-1® (kav4cpf1) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus for Check Point FireWall\Kav4cpf1.exe (file missing)
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe

super 
a+

Regis59 · Answer

Salut

lol

Vas sur le site https://virusscan.jotti.org/ 
- Clic en haut à droite sur "Parcourir", navigue dans les dossiers et sélectionne ce fichier : C:\WINDOWS\Temp\cpmyyz04.TMP 
- Clic sur submit toujours en haut à droite 
- Le scan va se lancer, ça va prendre un petit instant 
- En bas, tu as le résultat du scan, copie/colle le résultat complet du scan ici. 
Aide : https://www.malekal.com/scan-antivirus-ligne-nod32/#mozTocId662799

sergino17 · Answer

Salut Regis
je viens d'envoyer le résultat sur le site.
je crois que j'approche du but (?)
merci de ta patience et de ta gentillesse pour te mettre a ma portée
A +

Regis59 · Answer

Salut

Lorsque tu le scannes, a la fin, il donne un rapport, tu l as vu?

A+

sergino17 · Answer

Salut
je t'envoie le résultat de ce que j'ai fait
j'ai été sur le site malekal pour mettre le résultat
le t'envoie le tout :phpMyVisites
je crois que j'ai envoyé le rapport au mauvais endroit
merci
A+
	
	

Malekal.com site d''aide informatique
	

- Malekal's forum - forum d'aide informatique Index du Forum » VIRUS : Aide Malwares (vers, trojans, spywares, hijack) » infection malware
News du forum
  	
Bienvenue sur le forum malekal.com
Logo malware complaints









Pour les novices des forums, voici un petit tutorial qui vous explique Comment créer un sujet sur le forum
	 

La date/heure actuelle est Ven 23 Mar , 20:46 pm 2007
Voir le sujet précédent | Voir le sujet suivant
Répondre au sujet 	Page 1 sur 1

infection malware
Auteur 	Message
sergelevine
Invité



	
Répondre en citant
Message infection malware 
Last file scanned at least one scanner reported something about: server.exe (MD5: 65ea309e1e4526e05261ff36682d456c, size: 44032 bytes), detected by:

Scanner Malware name
AntiVir TR/Delphi.Downloader.Gen
ArcaVir Trojan.Downloader.Banload.Btw
Avast X
AVG Antivirus Downloader.Generic3.YVE
BitDefender Trojan.Downloader.Banload.BTW
ClamAV Trojan.Downloader-2292
Dr.Web Trojan.DownLoader.18418
F-Prot Antivirus X
F-Secure Anti-Virus Trojan-Downloader.Win32.Banload.btw
Fortinet X
Kaspersky Anti-Virus Trojan-Downloader.Win32.Banload.btw
NOD32 a variant of Win32/TrojanDownloader.Banload.NMG
Norman Virus Control W32/Banload.LEN
Panda Antivirus X
VirusBuster X
VBA32 Trojan-Downloader.Win32.Banload.btw
Bonjour a tou
j'espere avoir bien compris ce que Régis(encore merci) m'a demandé
voici le resultat
merci d'avance

Jeu 22 Mar , 22:27 pm 2007 	
Malekal_morte
Site Admin
Site Admin
Inscrit le: 10 Sep 2005
Messages: 7934

	
Répondre en citant
Message  
Salut,

Heuuuuuu tu peux me donner plus d'infos là ??!!
Il t'a demandé quoi regis?


_________________
Sécuriser votre machine contre les malwares!
Malware Complaints - Stand up and be Counted!
Soutenez malekal.com en effectuant un don!
- http://www.malekal.com -
Jeu 22 Mar , 22:29 pm 2007 	Voir le profil de l'utilisateur Envoyer un message privé [ Invisible ] Visiter le site web du posteur
Invité




	
Répondre en citant
Message  
Vas sur le site https://virusscan.jotti.org/
- Clic en haut à droite sur "Parcourir", navigue dans les dossiers et sélectionne ce fichier : C:\WINDOWS\Temp\cpmyyz04.TMP
- Clic sur submit toujours en haut à droite
- Le scan va se lancer, ça va prendre un petit instant
- En bas, tu as le résultat du scan, copie/colle le résultat complet du scan ici.
Aide : https://www.malekal.com/scan-antivirus-ligne-nod32/#mozTocId662799
---Salut
voici ce que Regis m'a donc demandé, j'espère avoir compris.
merci

Ven 23 Mar , 17:14 pm 2007 	
Malekal_morte
Site Admin
Site Admin
Inscrit le: 10 Sep 2005
Messages: 7934

	
Répondre en citant
Message  
Je vois pas le rapport avec le forum...
Tu devrais relire ce qui est inscri

sergino17 · Answer

Jotti's malware scan 2.99-TRANSITION_TO_3.00-R1
File to upload & scan: Virus 	
   
Service
Service load: 	
0% 	  	  	100%
File: 	cpmyyz04.TMP
Status: 	
OK(Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database)
MD5 	79fcad4e94ed64b1d285c7da6bbac73c
Packers detected: 	
-
Scanner results
Scan taken on 23 Mar 2007 19:55:45 (GMT)
AntiVir 	
Found nothing
ArcaVir 	
Found nothing
Avast 	
Found nothing
AVG Antivirus 	
Found nothing
BitDefender 	
Found nothing
ClamAV 	
Found nothing
Dr.Web 	
Found nothing
F-Prot Antivirus 	
Found nothing
F-Secure Anti-Virus 	
Found nothing
Fortinet 	
Found nothing
Kaspersky Anti-Virus 	
Found nothing
NOD32 	
Found nothing
Norman Virus Control 	
Found nothing
Panda Antivirus 	
Found nothing
VirusBuster 	
Found nothing
VBA32 	
Found nothing
 
Powered by
images/antivir.png images/arcabit.png images/avast.png images/avg.gif images/bitdefender.png images/clamav-logo1.png images/drweb.gif images/f-prot.png images/f-secure_logo.gif images/fortinet.gif images/kaspersky.png images/nod32.gif images/norman.png images/panda.png images/virusbuster.gif images/vba32.png
Disclaimer
This service is by no means 100% safe. If this scanner says 'OK', it does not necessarily mean the file is clean. There could be a whole new virus on the loose. NEVER EVER rely on one single product only, not even this service, even though it utilizes several products. Therefore, We cannot and will not be held responsible for any damage caused by results presented by this non-profit online service.

Also, we are aware of the implications of a setup like this. We are sure this whole thing is by no means scientifically correct, since this is a fully automated service (although manual correction is possible). We are aware, in spite of efforts to proactively counter these, false positives might occur, for example. We do not consider this a very big issue, so please do not e-mail us about it. This is a simple online scan service, not the university of Wichita.

Scanning can take a while, since several scanners are being used, plus the fact some scanners use very high levels of (time consuming) heuristics. Scanners used are Linux versions, differences with Windows scanners may or may not occur. Another note: some scanners will only report one virus when scanning archives with multiple pieces of malware.

Virus definitions are updated every hour. There is a 15Mb limit per file. Please refrain from uploading tons of hex-edited or repacked variants of the same sample.

Please do not ask for viruses uploaded here, unless you work for an anti-virus vendor. They are not for trade. This is a legitimate service, not a VX site. Viruses uploaded here will be distributed to antivirus vendors without exception. Read more about this in our privacy policy. If you do not want your files to be distributed, please do not send them at all.

Sponsored by donations (in random order) from: Stormbyte Technologies LLC, The ClamAV project, Steve S., Eric Johansen, Eric Schechter, Paul Bokel, Wilders Security, Wilfried Lilie, Prevx, SonicWALL, Lance Mueller, Ewido networks, HotelScraper.com, people who donated in the past, and some people who prefer to remain anonymous... many thanks to all!
Statistics
Last file scanned at least one scanner reported something about: BootingRevamped.exe (MD5: c7643c5d36903176401e1ebd209f5b81, size: 1338451 bytes), detected by:

Scanner 	Malware name
AntiVir 	HEUR/Crypted
ArcaVir 	X
Avast 	X
AVG Antivirus 	X
BitDefender 	DeepScan:Generic.Malware.G!SKI!!FLMWX!!Bg.1FDF1674
ClamAV 	X
Dr.Web 	X
F-Prot Antivirus 	X
F-Secure Anti-Virus 	X
Fortinet 	X
Kaspersky Anti-Virus 	X
NOD32 	X
Norman Virus Control 	X
Panda Antivirus 	X
VirusBuster 	X
VBA32 	X


You're free to (mis)interpret these automated, flawed statistics at your own discretion. For antivirus comparisons, visit AV comparatives
We are not affiliated with any third parties that conduct tests using this service.



Frequently asked questions - Feedback - Privacy policy

Debian    

Page generated by JTPL

Copyright © 2004-2007 Jordi Bosveld <jotti@jotti.org>
je me sui endu compte que j'avais mis le rapport au mauvais endreoit
voici un autre rapport fait a l'instant
merci
a+

Regis59 · Answer

Salut

Supprime:

C:\WINDOWS\Temp\cpmyyz04.TMP

A+

sergino17 · Answer

Salut
j'essaie de trouver ce fichier, le seul moyen que je connaisse c'est de lancer une recherche, ou il ne trouve pas, ou il redémarre au bout d'un moment j'ai essayé en mode sans échec. 
A un moment, il s'est mis a redémarrer tellement vite que plus rien ne répondait, ni F10, F5, F8, échap, delete, je suis en sueur mais j'ai réussi a le remettre en route.
comment faire apparaitre ce fichier?
merci

Regis59 · Answer

Salut,

Execute ceci:

Clean Up 40:
http://pageperso.aol.fr/balltrap34/CleanUp40.exe 
-aide en image:(merci à Balltrap34).
 http://pageperso.aol.fr/balltrap34/democleanup.htm
 
Si tu as le moindre probleme, signale le moi.

Puis relance SDfix, copie colle le rapport.

A+

sergino17 · Answer

salut je me depeche
SDFix: Version 1.74

Run by Propri‚taire - 24/03/2007 - 16:04:48,20

Microsoft Windows XP [version 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services: 





Restoring Windows Registry Entries
Restoring Default Hosts File


Rebooting...

Normal Mode:
Checking Files:

No Trojan Files Found...




ADS Check:

C:\WINDOWS\system32
No streams found.


                                 Final Check:

Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\adslTV\adslTV.exe"="C:\Program Files\adslTV\adslTV.exe:*:Enabled:adslTV"
"C:\Program Files\Freeplayer\vlc\vlc.exe"="C:\Program Files\Freeplayer\vlc\vlc.exe:*:Enabled:VLC media player"
"C:\Program Files\adslTV\vlc.exe"="C:\Program Files\adslTV\vlc.exe:*:Enabled:VLC media player"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\eMule\emule.exe"="C:\Program Files\eMule\emule.exe:*:Enabled:eMule"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\Program Files\FreeEasyZap\FreeEasyZap.exe"="C:\Program Files\FreeEasyZap\FreeEasyZap.exe:*:Enabled:FreeEasyZap"


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"


Remaining Files:
---------------


Checking For Files with Hidden Attributes :


                                 Finished
merci

sergino17 · Answer

Logfile of HijackThis v1.99.1
Scan saved at 16:49:19, on 24/03/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32
otepad.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Documents and Settings\Propriétaire.SERGE.001\Bureau\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -masquer
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?e5a4a23e5af94ac78d85653648984880
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?e5a4a23e5af94ac78d85653648984880
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase9602.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Kaspersky Anti-Virus 5.5  for Check Point™ FireWall-1® (kav4cpf1) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus for Check Point FireWall\Kav4cpf1.exe (file missing)
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe

a+ 
il re démarre souvent

sergino17 · Answer

salut
meme en mode sans echec il redemarre
pas facile pour moi mais je m'en sort
a+

Regis59 · Answer

Salut

¤Relance HijackThis, coche les cases devant ces lignes et ensuite clique sur fix checked :

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) 

Ferme HijackThis.

a+

sergino17 · Answer

Salut
quand j'avais fait clean up, il avait redémarré a la dernière phase juste avant le rapport
j'ai donc fait hidjackthis a l'instant, il n'y avait qu'une seule case a cocher
maintenant je ne fait plus rien avant tes instructions 
merci
A+

Regis59 · Answer

Salut,

ok, ou en sont tes soucis?

A+

sergino17 · Answer

Salut
il y a déja un progrès
dernièrement il redémarrait pendant l'écran de veille
maintenant il s'éteint normalement
je vais éssayer de faire un scann avec spybot
merci 
a+

sergino17 · Answer

Salut
il a redémarré a la moitié du ccan 
merci
A+

sergino17 · Answer

Salut
a l'instant il s'est éteint normalement.
il a redémarré mais c'était microsoft pour "verification du système de disque C" CHKDSK ....
A+

sergino17 · Answer

je vais faire un scann avec AVG

sergino17 · Answer

Salut
j"ai ouvert AVG, il a redémarré aussitot
AVG m'indique:dernière mise a jour:01.01.2003, alors que je viens de l'installer,
merci
A+

sergino17 · Answer

Salut
après s'etre éteint, il s'est rallumé tout seul
je viens de m'apercevoir qu'il s'est mis a une heure différent:23h56 alors qu'il est 19h29 heure d'été
A+

Regis59 · Answer

Salut

Il s eteint n importe quand?
Et cela depuis quand?

A+

sergino17 · Answer

Salut
ca m'arrivait de facon épisodique depuis longtemps, une foi j'ai ouvert un fichier sur émule ,environ 1 mois avant que je pose la question, et depuis ca arrive plus souvent.
je l'ai remis a l'heure et il s'était aussi remis a la date de 2003.
merci

sergino17 · Answer

Salut
a propos de la question ton cpu monte a 100%, STP, peux tu me dire comment procéder pour le savoir
merci

Regis59 · Answer

Salut

Ta date a changée toute seule?
Maintenant l'heure reste a la bonne heure?

Pour ton UC (pas CPU pardon), fais ctlr+alt+supp, et regarde en bas, c est marqué CU.

a+

sergino17 · Answer

Salut oui,elle a changé, je crois, quand il y a eu le scann microsoft
et la date s'est mise en 2003 année de fabrication de l'ordi
maintenant, l'heure fonctionne normalement

en bas, je vois UC utilisée: ca varie entre 0 et 7%
Merci

Regis59 · Answer

ok.

Il plante a des moments particuliers?
Tu un nettoyeur de registre?

A+

sergino17 · Answer

Salut
il redemarre : quand je veux le scanner,
                           parfois, quand j'ouvre un dossier
                           parfois, quand je fait une recherche
j'ai CCleaner
Merci

Regis59 · Answer

re

jv16 

(ancienne version gratuite) https://puntocr.it/index.php?module=downloads_riz&func=display&pid=3&lid=26 
dans preferences < languages < met francais
là tu le lances tu cliques sur outil registre/outil/nettoyage de registre/continuer /démarrer 
là tu le laisses faire c’est un peu long 
quand il a fini
tu sélectionnes les ronds verts par paquet de 20 ou 30 
une fois que tu les a sélectionnés tu cliques sur supprimer en bas à droite 
et tu continues jusqu’à ce qu’il ne reste plus de ronds verts

sergino17 · Answer

jv16 PowerTools 2006 [1.5.2.350]

Data fields are: Gravité de l'Erreur :, Clé :, Nom de l'Inscription :, Valeur :, Description de l'Erreur :, Inscription modifiée en dernier le :

Moyenne, HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\install.exe\, {KEY}, {KEY}, Inscription AppPath invalide, 26.02.2007, 17:17
Moyenne, HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\install.exe\, RunAsOnNonAdminInstall, N/A, Inscription AppPath invalide, 26.02.2007, 17:17
Moyenne, HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\install.exe\, BlockOnTSNonInstallMode, N/A, Inscription AppPath invalide, 26.02.2007, 17:17
Moyenne, HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\setup.exe\, {KEY}, {KEY}, Inscription AppPath invalide, 26.02.2007, 17:17
Moyenne, HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\setup.exe\, RunAsOnNonAdminInstall, N/A, Inscription AppPath invalide, 26.02.2007, 17:17
Moyenne, HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\setup.exe\, BlockOnTSNonInstallMode, N/A, Inscription AppPath invalide, 26.02.2007, 17:17
Moyenne, HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths	able30.exe\, {KEY}, {KEY}, Inscription AppPath invalide, 26.02.2007, 17:17
Moyenne, HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths	able30.exe\, UseShortName, N/A, Inscription AppPath invalide, 26.02.2007, 17:17
Moyenne, HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\winnt32.exe\, {KEY}, {KEY}, Inscription AppPath invalide, 26.02.2007, 17:17
Moyenne, HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime\, {KEY}, {KEY}, Inscription obsolète du menu Ajouter / Supprimer, 26.02.2007, 17:56
Moyenne, HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\winnt32.exe\, RunAsOnNonAdminInstall, N/A, Inscription AppPath invalide, 26.02.2007, 17:17
Moyenne, HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft NetShow Player 2.0\, {KEY}, {KEY}, Inscription obsolète du menu Ajouter / Supprimer, 26.02.2007, 17:31
Moyenne, HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2\, {KEY}, {KEY}, Inscription obsolète du menu Ajouter / Supprimer, 12.03.2007, 14:57
Elevée, HKLM\Software\Microsoft\Windows NT\CurrentVersion\Asr\Commands\, ASR format utility for volumes, %SystemRoot%\system32\asr_fmt.exe /backup, Le Fichier ou Répertoire "C:\WINDOWS\system32\asr_fmt.exe" n'existe pas, 26.02.2007, 17:09
Elevée, HKLM\Software\Microsoft\Windows NT\CurrentVersion\Asr\Commands\, ASR protected file utility, %SystemRoot%\system32\asr_pfu.exe /backup, Le Fichier ou Répertoire "C:\WINDOWS\system32\asr_pfu.exe" n'existe pas, 26.02.2007, 17:09
Elevée, HKLM\Software\Microsoft\Windows NT\CurrentVersion\Asr\Commands\, ASR utility for Logical Disk Manager, %SystemRoot%\system32\asr_ldm.exe /backup, Le Fichier ou Répertoire "C:\WINDOWS\system32\asr_ldm.exe" n'existe pas, 26.02.2007, 17:09
Elevée, HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide\PatchedComponents\, {98CB1B80-5997-DB5F-B01F-C8B3B9A1E18E}, C:\WINDOWS\winsxs\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.89_x-ww_0de46bd0\ ..., Le Fichier ou Répertoire "C:\WINDOWS\winsxs\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0" n'existe pas, 12.03.2007, 12:17
Elevée, HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide\PatchedComponents\, {98CB16C1-5C55-DB5F-B01F-C8B3B9A1E18E}, C:\WINDOWS\winsxs\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.93_x-ww_0de56c09\ ..., Le Fichier ou Répertoire "C:\WINDOWS\winsxs\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0" n'existe pas, 12.03.2007, 12:17
Elevée, HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide\PatchedComponents\, {98CB1712-5C31-DB5F-B01F-C8B3B9A1E18E}, C:\WINDOWS\winsxs\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.94_x-ww_0de56c0a\ ..., Le Fichier ou Répertoire "C:\WINDOWS\winsxs\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0" n'existe pas, 12.03.2007, 12:17
Elevée, HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide\PatchedComponents\, {98CB1763-5C0D-DB5F-B01F-C8B3B9A1E18E}, C:\WINDOWS\winsxs\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.95_x-ww_0de56c0b\ ..., Le Fichier ou Répertoire "C:\WINDOWS\winsxs\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.95" n'existe pas, 12.03.2007, 12:17
Elevée, HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide\PatchedComponents\, {98CB17B4-5BE9-DB5F-B01F-C8B3B9A1E18E}, C:\WINDOWS\winsxs\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.96_x-ww_0de56c0c\ ..., Le Fichier ou Répertoire "C:\WINDOWS\winsxs\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0" n'existe pas, 12.03.2007, 12:17
Elevée, HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide\PatchedComponents\, {98CB1805-5BC5-DB5F-B01F-C8B3B9A1E18E}, C:\WINDOWS\winsxs\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.97_x-ww_0de56c0d\ ..., Le Fichier ou Répertoire "C:\WINDOWS\winsxs\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0" n'existe pas, 12.03.2007, 12:17
Elevée, HKCR\Installer\Products\B4D8F7D64A1DA20479E3139E90045E58\SourceList\Net\, 1, C:\WINDOWS\TEMP\IXP000.TMP\, Le Fichier ou Répertoire "C:\WINDOWS\TEMP\IXP000.TMP" n'existe pas, 01.03.2007, 03:34
Elevée, HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide\PatchedComponents\, {98CB1856-5BA1-DB5F-B01F-C8B3B9A1E18E}, C:\WINDOWS\winsxs\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.98_x-ww_0de56c0e\ ..., Le Fichier ou Répertoire "C:\WINDOWS\winsxs\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.98" n'existe pas, 12.03.2007, 12:17
Elevée, HKLM\Software\classes\Installer\Products\B4D8F7D64A1DA20479E3139E90045E58\SourceList\Net\, 1, C:\WINDOWS\TEMP\IXP000.TMP\, Le Fichier ou Répertoire "C:\WINDOWS\TEMP\IXP000.TMP" n'existe pas, 01.03.2007, 03:34
Elevée, HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide\PatchedComponents\, {98CB18A7-5B7D-DB5F-B01F-C8B3B9A1E18E}, C:\WINDOWS\winsxs\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.99_x-ww_0de56c0f\ ..., Le Fichier ou Répertoire "C:\WINDOWS\winsxs\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0" n'existe pas, 12.03.2007, 12:17
Elevée, HKCR\Installer\Products\2509FC9A0A4FD5740AF08A83C826DD36\SourceList\Net\, 1, c:\25db8beac7bc1b6d5c54c2d8b88f\, Le Fichier ou Répertoire "c:\25db8beac7bc1b6d5c54c2d8b88f\" n'existe pas, 08.03.2007, 18:45
Elevée, HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide\PatchedComponents\, {9C01957A-EA3F-10B0-B01F-C8B3B9A1E18E}, C:\WINDOWS\winsxs\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.100_x-ww_6818287e\ ..., Le Fichier ou Répertoire "C:\WINDOWS\winsxs\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0" n'existe pas, 12.03.2007, 12:17
Elevée, HKLM\Software\classes\Installer\Products\2509FC9A0A4FD5740AF08A83C826DD36\SourceList\Net\, 1, c:\25db8beac7bc1b6d5c54c2d8b88f\, Le Fichier ou Répertoire "c:\25db8beac7bc1b6d5c54c2d8b88f\" n'existe pas, 08.03.2007, 18:45
Elevée, HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide\PatchedComponents\, {9C00AED1-EA89-10B1-B01F-C8B3B9A1E18E}, C:\WINDOWS\winsxs\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.101_x-ww_6818287f\ ..., Le Fichier ou Répertoire "C:\WINDOWS\winsxs\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0" n'existe pas, 12.03.2007, 12:17
Elevée, HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide\PatchedComponents\, {9BFEE17F-EB1D-10B3-B01F-C8B3B9A1E18E}, C:\WINDOWS\winsxs\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.103_x-ww_68182881\ ..., Le Fichier ou Répertoire "C:\WINDOWS\winsxs\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0" n'existe pas, 12.03.2007, 12:17
Elevée, HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide\PatchedComponents\, {9BFDFAD6-EB67-10B4-B01F-C8B3B9A1E18E}, C:\WINDOWS\winsxs\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.104_x-ww_68182882\ ..., Le Fichier ou Répertoire "C:\WINDOWS\winsxs\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0" n'existe pas, 12.03.2007, 12:17
Elevée, HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EBCEA20E8C979C7439DBE64E103E89B6\, 00000000000000000000000000000000, C:\Program Files\Microsoft Windows OneCare Live\WinSSWebAgentTlb.dll, Le Fichier ou Répertoire "C:\Program Files\Microsoft Windows OneCare Live\WinSSWebAgentTlb.dll" n'existe pas, 12.03.2007, 12:17
Elevée, HKCU\AppEvents\Schemes\Apps\MSNMSGR\MSNMSGR_NewSMSMessage\.Current\, @, C:\Program Files\MSN Messengering.wav, Le Fichier ou Répertoire "C:\Program Files\MSN Messengering.wav" n'existe pas, 26.02.2007, 19:48
Elevée, HKCR\AcroExch.Sequence\DefaultIcon\, @, C:\WINDOWS\Installer\{AC76BA86-7AD7-1036-7B44-A80000000002}\SequenceFile.ico,0, Le Fichier ou Répertoire "C:\WINDOWS\Installer\{AC76BA86-7AD7-1036-7B44-A80000000002}\SequenceFile.ico" n'existe pas, 10.03.2007, 15:27
Elevée, HKUS\S-1-5-21-1202660629-790525478-682003330-1003\AppEvents\Schemes\Apps\MSNMSGR\MSNMSGR_NewSMSMessage\.Current\, @, C:\Program Files\MSN Messengering.wav, Le Fichier ou Répertoire "C:\Program Files\MSN Messengering.wav" n'existe pas, 26.02.2007, 19:48
Elevée, HKLM\Software\classes\AcroExch.Sequence\DefaultIcon\, @, C:\WINDOWS\Installer\{AC76BA86-7AD7-1036-7B44-A80000000002}\SequenceFile.ico,0, Le Fichier ou Répertoire "C:\WINDOWS\Installer\{AC76BA86-7AD7-1036-7B44-A80000000002}\SequenceFile.ico" n'existe pas, 10.03.2007, 15:27
Elevée, HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B7C40C7BF9B4B544A821CABA0FE703F4\, 00000000000000000000000000000000, C:\Program Files\Microsoft Windows OneCare Live\WinSSWebAgent.dll, Le Fichier ou Répertoire "C:\Program Files\Microsoft Windows OneCare Live\WinSSWebAgent.dll" n'existe pas, 12.03.2007, 12:17
Elevée, HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7274AF0DE10294440BB53DFA840D5CE6\, 00000000000000000000000000000000, C:\Program Files\Microsoft Windows OneCare Live\, Le Fichier ou Répertoire "C:\Program Files\Microsoft Windows OneCare Live\" n'existe pas, 12.03.2007, 12:17
Elevée, HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1321ECD60121176448F92F0A834A7675\, 00000000000000000000000000000000, C:\Program Files\Microsoft Windows OneCare Live\OCSetup.exe, Le Fichier ou Répertoire "C:\Program Files\Microsoft Windows OneCare Live\OCSetup.exe" n'existe pas, 12.03.2007, 12:17
Elevée, HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\B4D8F7D64A1DA20479E3139E90045E58\InstallProperties\, InstallSource, C:\WINDOWS\TEMP\IXP000.TMP\, Le Fichier ou Répertoire "C:\WINDOWS\TEMP\IXP000.TMP" n'existe pas, 01.03.2007, 03:34
Elevée, HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\6030E61781384634B8F8C04C9E73B6CA\InstallProperties\, InstallSource, C:\Program Files\Microsoft Windows OneCare Live\Staging\, Le Fichier ou Répertoire "C:\Program Files\Microsoft Windows OneCare Live\Staging\" n'existe pas, 07.03.2007, 22:47
Elevée, HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\2509FC9A0A4FD5740AF08A83C826DD36\InstallProperties\, InstallSource, c:\25db8beac7bc1b6d5c54c2d8b88f\, Le Fichier ou Répertoire "c:\25db8beac7bc1b6d5c54c2d8b88f\" n'existe pas, 08.03.2007, 18:45
Elevée, HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\WebView\TemplateMacros\BACKGROUNDIMAGE\, @, %SystemRoot%\Web\wvleft.bmp, Le Fichier ou Répertoire "C:\WINDOWS\Web\wvleft.bmp" n'existe pas, 26.02.2007, 17:17
Elevée, HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\WebView\TemplateMacros\LOGOLINE\, @, %SystemRoot%\Web\wvline.gif, Le Fichier ou Répertoire "C:\WINDOWS\Web\wvline.gif" n'existe pas, 26.02.2007, 17:17
Elevée, HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Extended Properties\{305CA226-D286-468e-B848-2B2E8E697B74} 2\, %SystemRoot%\system32
wc.cpl, N/A, Le Fichier ou Répertoire "C:\WINDOWS\system32
wc.cpl" n'existe pas, 26.02.2007, 17:55
Elevée, HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Extended Properties\{305CA226-D286-468e-B848-2B2E8E697B74} 2\, %SystemRoot%\system32\sticpl.cpl, N/A, Le Fichier ou Répertoire "C:\WINDOWS\system32\sticpl.cpl" n'existe pas, 26.02.2007, 17:55
Elevée, HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\, HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\Cebcevégnver\Zrf qbphzragf\OhernhQrCbpur
ccfsvkrf\BcraBssvpr\CbegnoyrBbQenj.rkr, N/A, Le Fichier ou Répertoire "C:\Documents and Settings\Propriétaire\Mes documents\BureauDePoche\appsfixes\OpenOffice\PortableOoDraw.exe" n'existe pas, 26.03.2007, 20:44
Elevée, HKUS\S-1-5-21-1202660629-790525478-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\, HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\Cebcevégnver\Zrf qbphzragf\OhernhQrCbpur
ccfsvkrf\BcraBssvpr\CbegnoyrBbQenj.rkr, N/A, Le Fichier ou Répertoire "C:\Documents and Settings\Propriétaire\Mes documents\BureauDePoche\appsfixes\OpenOffice\PortableOoDraw.exe" n'existe pas, 26.03.2007, 20:44
Elevée, HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\, HRZR_EHACNGU:P:\Cebtenz Svyrf\Yninylf\RIRERFG Hygvzngr Rqvgvbairerfg.rkr, N/A, Le Fichier ou Répertoire "C:\Program Files\Lavalys\EVEREST Ultimate Edition\everest.exe" n'existe pas, 26.03.2007, 20:44
Elevée, HKUS\S-1-5-21-1202660629-790525478-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\, HRZR_EHACNGU:P:\Cebtenz Svyrf\Yninylf\RIRERFG Hygvzngr Rqvgvbairerfg.rkr, N/A, Le Fichier ou Répertoire "C:\Program Files\Lavalys\EVEREST Ultimate Edition\everest.exe" n'existe pas, 26.03.2007, 20:44
Elevée, HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\, HRZR_EHACNGU:P:\Cebtenz Svyrf\Synfu Zrzbel Gbbyxvg\SynfuZrzbelGbbyxvg.rkr, N/A, Le Fichier ou Répertoire "C:\Program Files\Flash Memory Toolkit\FlashMemoryToolkit.exe" n'existe pas, 26.03.2007, 20:44
Elevée, HKUS\S-1-5-21-1202660629-790525478-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\, HRZR_EHACNGU:P:\Cebtenz Svyrf\Synfu Zrzbel Gbbyxvg\SynfuZrzbelGbbyxvg.rkr, N/A, Le Fichier ou Répertoire "C:\Program Files\Flash Memory Toolkit\FlashMemoryToolkit.exe" n'existe pas, 26.03.2007, 20:44
Elevée, HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\, HRZR_EHACNGU:P:\Cebtenz Svyrf\Synfu Zrzbel Gbbyxvg\havaf000.rkr, N/A, Le Fichier ou Répertoire "C:\Program Files\Flash Memory Toolkit\unins000.exe" n'existe pas, 26.03.2007, 20:44
Elevée, HKUS\S-1-5-21-1202660629-790525478-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\, HRZR_EHACNGU:P:\Cebtenz Svyrf\Synfu Zrzbel Gbbyxvg\havaf000.rkr, N/A, Le Fichier ou Répertoire "C:\Program Files\Flash Memory Toolkit\unins000.exe" n'existe pas, 26.03.2007, 20:44
Elevée, HKLM\Software\Microsoft\Windows\CurrentVersion\Applets\DeluxeCD\Providers\Provider0000\, ProviderLogo, %SystemRoot%\System32	unes.bmp, Le Fichier ou Répertoire "C:\WINDOWS\System32	unes.bmp" n'existe pas, 26.02.2007, 17:09
Elevée, HKLM\Software\Microsoft\Windows\CurrentVersion\Applets\DeluxeCD\Providers\Provider0001\, ProviderLogo, %SystemRoot%\System32
2k.bmp, Le Fichier ou Répertoire "C:\WINDOWS\System32
2k.bmp" n'existe pas, 26.02.2007, 17:09
Insignifiante, HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\, a, C:\Program Files\jv16 PowerTools 2006\jv16, Le Fichier ou Répertoire "C:\Program Files\jv16 PowerTools 2006\jv16" n'existe pas, 26.03.2007, 20:39
Insignifiante, HKUS\S-1-5-21-1202660629-790525478-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\, a, C:\Program Files\jv16 PowerTools 2006\jv16, Le Fichier ou Répertoire "C:\Program Files\jv16 PowerTools 2006\jv16" n'existe pas, 26.03.2007, 20:39
Insignifiante, HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*\, a, C:\Program Files\jv16 PowerTools 2006\jv16, Le Fichier ou Répertoire "C:\Program Files\jv16 PowerTools 2006\jv16" n'existe pas, 26.03.2007, 20:39
Insignifiante, HKUS\S-1-5-21-1202660629-790525478-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*\, a, C:\Program Files\jv16 PowerTools 2006\jv16, Le Fichier ou Répertoire "C:\Program Files\jv16 PowerTools 2006\jv16" n'existe pas, 26.03.2007, 20:39
Elevée, HKCU\Software\DivXNetworks\DivX4Windows\, Nth Pass debug file name, C:
ewrc.txt, Le Fichier ou Répertoire "C:
ewrc.txt" n'existe pas, 10.03.2007, 16:03
Elevée, HKUS\S-1-5-21-1202660629-790525478-682003330-1003\Software\DivXNetworks\DivX4Windows\, Nth Pass debug file name, C:
ewrc.txt, Le Fichier ou Répertoire "C:
ewrc.txt" n'existe pas, 10.03.2007, 16:03
Elevée, HKCU\Software\DivXNetworks\DivX4Windows\, MP4 File Name, C:	est.divx, Le Fichier ou Répertoire "C:	est.divx" n'existe pas, 10.03.2007, 16:03
Elevée, HKUS\S-1-5-21-1202660629-790525478-682003330-1003\Software\DivXNetworks\DivX4Windows\, MP4 File Name, C:	est.divx, Le Fichier ou Répertoire "C:	est.divx" n'existe pas, 10.03.2007, 16:03
Elevée, HKCU\Software\DivXNetworks\DivX4Windows\, YUV Dir Name, C:\yuv, Le Fichier ou Répertoire "C:\yuv" n'existe pas, 10.03.2007, 16:03
Elevée, HKUS\S-1-5-21-1202660629-790525478-682003330-1003\Software\DivXNetworks\DivX4Windows\, YUV Dir Name, C:\yuv, Le Fichier ou Répertoire "C:\yuv" n'existe pas, 10.03.2007, 16:03
Elevée, HKCU\Software\DivXNetworks\DivX4Windows\, MV File Name, C:\mvinfo.bin, Le Fichier ou Répertoire "C:\mvinfo.bin" n'existe pas, 10.03.2007, 16:03
Elevée, HKUS\S-1-5-21-1202660629-790525478-682003330-1003\Software\DivXNetworks\DivX4Windows\, MV File Name, C:\mvinfo.bin, Le Fichier ou Répertoire "C:\mvinfo.bin" n'existe pas, 10.03.2007, 16:03
Elevée, HKLM\Software\Microsoft\Microsoft Interactive Training\, MediaPath, C:\FIX\content\, Le Fichier ou Répertoire "C:\FIX\content\" n'existe pas, 26.02.2007, 17:19
Elevée, HKLM\Software\Microsoft\Java VM\, LibsDirectory, C:\WINDOWS\java\lib, Le Fichier ou Répertoire "C:\WINDOWS\java\lib" n'existe pas, 26.02.2007, 20:18
Elevée, HKLM\Software\Microsoft\Code Store Database\Distribution Units\DirectAnimation Java Classes\DownloadInformation\, CODEBASE, file://C:\WINDOWS\Java\classes\dajava.cab, Le Fichier ou Répertoire "C:\WINDOWS\Java\classes\dajava.cab" n'existe pas, 26.02.2007, 17:18
Elevée, HKLM\Software\Microsoft\Code Store Database\Distribution Units\Microsoft XML Parser for Java\DownloadInformation\, CODEBASE, file://C:\WINDOWS\Java\classes\xmldso.cab, Le Fichier ou Répertoire "C:\WINDOWS\Java\classes\xmldso.cab" n'existe pas, 26.02.2007, 17:18
Elevée, HKLM\Software\Microsoft\Advanced INF Setup\IE40.UserAgent\, BackupFileName, C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.DAT, Le Fichier ou Répertoire "C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.DAT" n'existe pas, 07.03.2007, 21:59
Elevée, HKLM\Software\Microsoft\Advanced INF Setup\IE40.UserAgent\, BackupPath, C:\Program Files\Uninstall Information\IE40.UserAgent, Le Fichier ou Répertoire "C:\Program Files\Uninstall Information\IE40.User" n'existe pas, 07.03.2007, 21:59
Elevée, HKLM\Software\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\, BackupFileName, C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.DAT, Le Fichier ou Répertoire "C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.DAT" n'existe pas, 07.03.2007, 21:59
Elevée, HKLM\Software\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\, BackupPath, C:\Program Files\Uninstall Information\IE.HKCUZoneInfo, Le Fichier ou Répertoire "C:\Program Files\Uninstall Information\IE.HKC" n'existe pas, 07.03.2007, 21:59
Elevée, HKLM\Software\Microsoft\Advanced INF Setup\IE UserData NT\, BackupFileName, C:\Program Files\Uninstall Information\IE UserData NT\IE UserData NT.DAT, Le Fichier ou Répertoire "C:\Program Files\Uninstall Information\IE UserData NT\IE UserData NT.DAT" n'existe pas, 17.03.2007, 17:41
Elevée, HKLM\Software\Microsoft\Advanced INF Setup\IE UserData NT\, BackupPath, C:\Program Files\Uninstall Information\IE UserData NT, Le Fichier ou Répertoire "C:\Program Files\Uninstall Information\IE UserData NT" n'existe pas, 17.03.2007, 17:41
Elevée, HKLM\Software\DivXNetworks\Artwork\7B63B2922B174135AFC0E1377DD81EC2\, xmlPath, C:\Program Files\DivX\Artwork\Artwork-1.0.xml, Le Fichier ou Répertoire "C:\Program Files\DivX\Artwork\Artwork-1.0.xml" n'existe pas, 26.02.2007, 20:04
Elevée, HKLM\Software\DivXNetworks\Artwork\8ADFC4160D694100B5B8A22DE9DCABD9\, xmlPath, C:\Program Files\DivX\Artwork\Artwork-1.0.xml, Le Fichier ou Répertoire "C:\Program Files\DivX\Artwork\Artwork-1.0.xml" n'existe pas, 26.02.2007, 20:04
Elevée, HKLM\Software\DivXNetworks\DivX Player\Content\, Database, C:\Program Files\DivX\DivX Player\Database.dat, Le Fichier ou Répertoire "C:\Program Files\DivX\DivX Player\Database.dat" n'existe pas, 26.02.2007, 20:04
Moyenne, HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DAT\, {KEY}, {KEY}, Extension de fichier sans objet, 14.03.2007, 20:26
Moyenne, HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rc\, {KEY}, {KEY}, Extension de fichier sans objet, 01.03.2007, 20:39
Elevée, HKUS\S-1-5-21-1202660629-790525478-682003330-1003\Software\Gabest\VSFilter\DefTextPathes\, Path1, c:\subtitles, Le Fichier ou Répertoire "c:\subtitles" n'existe pas, 26.02.2007, 20:09
Salut
quand je lance jv16Power Tools2006, j'obtiens un tableau, j'ai cliqué sur nettoyeur de registre et j'ai obtenu ci dessus, je ne vois pas les ronds verts,
merci

sergino17 · Answer

re
dans le nettoyeur de registre, dois je prendre l'option "approfondi" malgré la mise en garde "...réservé aux utilisateurs expérimentés qui sauront comment restaurer une sauvegarde si quelquechose se passe mal.."
merci

Regis59 · Answer

C'est la version jv16 PowerTools 2006 que tu utilises?

sergino17 · Answer

Bonjour,
tout a fait, je n'avais pas trouvé l'ancienne version.
Merci

sergino17 · Answer

Salut
j'ai lancé AVG, il a redémarré avant la fin, et il s'est bloqué a la page d'acceuil, je l'ai  redémarré, il est revenu normalement mais avec un écran noir assez long.
Merci.

sergino17 · Answer

bonsoir
je viens de trouver la version de jvc 16 ancienne version
j'ai donc supprimé tous les ronds verts
merci

sergino17 · Answer

Salut
ma freebox ne fonctionnant plus sur le telephone ni sur la tele, j'ai fait une restauration systeme mais ca ne marche toujours pas
merci

sergino17 · Answer

re
j'ai fait un hard reboot et c'est revenu
bonsoir

Regis59 · Answer

Bonsoir

Oula, que de miseres cet aprem :S

Ca va?
Ou en sont tes soucis?

A+

sergino17 · Answer

Bonsoir Regis
merci, finalement ca va, tout est rentré dans l'ordre 
j'essaie encore des choses pour voir
il a l'air de fonctionner mieux mais c'est toujours ce probleme de scann anti spyware
merci

Regis59 · Answer

Salut

Ok dis moi quoi.
Pour le scan, tu le fais en sans echec? Il entre peut etre en conflit, je sais pas...

A+

sergino17 · Answer

Salut
donc, hier après mes émotions j'ai scanné avec AVG, il a redémarré, avec Squared, il a été jusqu'au bout, avec spybot, il a redémarré.
tout de suite, je viens de scanner en mse, AVG, il a redémarré au bout d'1/4 d'heure, un peu apres avoir avoir trouvé DIALER FREE.fr, risque élevé. puis en mse avec spybot, redémarré.
j'ai réessayé AVG en mode normal, il a redémarré en boucle 2 fois, la 3éme il s'est bloqué a la page d'acceuil, finalement il est revenu a de bons sentiments; manifestement il n'aime pas etre scanné.
sinon, j'ai essayé movie maker, j'ai ouvert des fichiers, j'ai été sur internet, ca fonctionne.
merci de ta patiente

Regis59 · Answer

Salut

Ok :)

Telecharge ceci
https://www.silentrunners.org/Silent%20Runners.vbs 
Execute le,atends quelques minutes, il va creer ensuite un dossier juste a coté de silent runner sous format texte, copie/colle ce qu il te donnera

A+

sergino17 · Answer

Salut j'ai cliqué sur le" lien et j'ai eu directement ceci, sans rien télécharger A+ merci:'Silent Runners.vbs -- find out what starts up with Windows! '(compatible with Windows 95/98/Millennium/NT 4.0/2000 Pro/XP Home & Pro/Vista RC1) ' 'DO NOT REMOVE THIS HEADER! ' 'Copyright Andrew ARONOFF 14 January 2007, https://www.silentrunners.org/ 'This script is provided without any warranty, either express or implied 'It may not be copied or distributed without permission ' '** YOU RUN THIS SCRIPT AT YOUR OWN RISK! ** (END OF HEADER) Option Explicit Dim strRevNo : strRevNo = "R50" Public flagTest : flagTest = False 'True if in testing mode 'flagTest = True 'Uncomment to put in testing mode Public arSecTest : arSecTest = Array() 'array of section numbers to test Public intSection : intSection = 0 'section counter 'This script is divided into 28 sections. 'malware launch points: ' registry keys (1-12, 15) ' INI/INF-files (16-18) ' folders (19) ' enabled scheduled tasks (20) ' Winsock2 service provider DLLs (21) ' IE toolbars, explorer bars, extensions (22) ' started services (26) ' keyboard driver filters (27) ' printer monitors (28) 'hijack points: ' System/Group Policies (14) ' prefixes for IE URLs (23) ' misc IE points (24) ' HOSTS file (25) 'Output is suppressed if deemed normal unless the -all parameter is used 'Section XVIII is skipped unless the -supp/-all parameters are used or 'the first message box is answered "No" and the next message box "Yes" ' 1. HKCU/HKLM... Run/RunOnce/RunOnce\Setup/RunOnceEx ' HKLM... RunServices/RunServicesOnce ' HKCU/HKLM... Policies\Explorer\Run ' 2. HKLM... Active Setup\Installed Components\ ' HKCU... Active Setup\Installed Components\ ' (StubPath <> "" And HKLM version # > HKCU version #) ' 3. HKLM... Explorer\Browser Helper Objects\ ' 4. HKLM... Shell Extensions\Approved\ ' 5. HKLM... Explorer\SharedTaskScheduler/ShellExecuteHooks ' 6. HKCU/HKLM... ShellServiceObjectDelayLoad\ ' 7. HKCU/HKLM... Command Processor\AutoRun ' HKCU... Policies\System\Shell (W2K/WXP/WVa only) ' HKCU... Windows\load & run ' HKLM... Windows\AppInit_DLLs ' HKCU/HKLM... Winlogon\Shell ' HKLM... Winlogon\Userinit, System, Ginadll, Taskman ' HKLM... Control\SafeBoot\Option\UseAlternateShell ' HKLM... Control\SecurityProviders\SecurityProviders ' HKLM... Control\Session Manager\BootExecute ' HKLM... Control\Session Manager\WOW\cmdline, wowcmdline ' 8. HKLM... Winlogon\Notify\ (subkey names/DLLName values <> O/S-specific dictionary data) ' 9. HKLM... Image File Execution Options ("Debugger" subkeys) '10. HKCU/HKLM... Policies... Startup/Shutdown, Logon/Logoff scripts (W2K/WXP/WVa) '11. HKCU/HKLM Protocols\Filter '12. Context menu shell extensions '13. HKCU/HKLM executable file type (bat/cmd/com/exe/hta/pif/scr) '14. System/Group Policies '15. Enabled Wallpaper & Screen Saver '16. WIN.INI (load/run <> ""), SYSTEM.INI (shell <> explorer.exe, scrnsave.exe), WINSTART.BAT '17. AUTORUN.INF in root directory of local fixed disks '18. DESKTOP.INI in any local fixed disk directory (section skipped by default) '19. %WINDIR%... Startup & All Users... Startup (W98/WMe) or ' %USERNAME%... Startup & All Users... Startup folder contents '20. Enabled Scheduled Tasks '21. Winsock2 Service Provider DLLs '22. Internet Explorer Toolbars, Explorer Bars, Extensions '23. Internet Explorer URL Prefixes '24. Misc. IE Hijack Points '25. HOSTS file '26. Started Services '27. Keyboard Driver Filters '28. Print Monitors Dim Wshso : Set Wshso = WScript.CreateObject("WScript.Shell") Dim WshoArgs : Set WshoArgs = WScript.Arguments Dim intErrNum, intMB, intMB1 'Err.Number, MsgBox return value x 2 Dim strflagTest : strflagTest = "" If flagTest Then strflagTest = "TEST " Wshso.Popup "Silent Runners is in testing mode.",1, _ "Testing, testing, 1-2-3...", vbOKOnly + vbExclamation End If 'Configuration Detection Section ' FileSystemObject creation error (112) ' CScript/WScript (147) ' Dim (161) ' GetFileVersion(WinVer.exe) (VBScript 5.1) (182) ' OS version (223) ' WMI (279) ' Dim (364) ' command line arguments (440) ' supplementary search MsgBox (532) ' startup MsgBox (557) ' CreateTextFile error (583) ' output file header (625) ' WXP SP2 (629) On Error Resume Next Dim Fso : Set Fso = CreateObject("Scripting.FileSystemObject") intErrNum = Err.Number : Err.Clear On Error Goto 0 If intErrNum <> 0 Then strURL = "https://docs.microsoft.com/en-us/" intMB = MsgBox (Chr(34) & "Silent Runners" & Chr(34) &_ " cannot access file services critical to" & vbCRLF &_ "proper script operation." & vbCRLF & vbCRLF &_ "If you are running Windows XP, make sure that the" &_ vbCRLF & Chr(34) & "Cryptographic Services" & Chr(34) &_ " service is started." & vbCRLF & vbCRLF &_ "You can also try reinstalling the latest version of the MS" &_ vbCRLF & "Windows Script Host." & vbCRLF & vbCRLF &_ "Press " & Chr(34) & "OK" & Chr(34) & " to direct your browser to " &_ "the download site or" & vbCRLF & Space(10) & Chr(34) & "Cancel" &_ Chr(34) & " to quit.", vbOKCancel + vbCritical, _ "Can't access the FileSystemObject!") 'if dl wanted now, send browser to dl site If intMB = 1 Then Wshso.Run strURL WScript.Quit End If Dim oNetwk : Set oNetwk = WScript.CreateObject("WScript.Network") Const HKLM = &H80000002, HKCU = &H80000001 Const REG_SZ=1, REG_EXPAND_SZ=2, REG_BINARY=3, REG_DWORD=4, REG_MULTI_SZ=7 Const REG_QWORD = 11 Const MS = " [MS]" Const DQ = """", LBr = "{" Const IWarn = "<> ", HWarn = "<> " 'determine whether output is via MsgBox/PopUp or Echo Dim flagOut If InStr(LCase(WScript.FullName),"wscript.exe") > 0 Then flagOut = "W" 'WScript ElseIf InStr(LCase(WScript.FullName),"cscript.exe") > 0 Then flagOut = "C" 'CScript Else 'echo and continue if it works flagOut = "C" 'assume CScript-compatible WScript.Echo "Neither " & Chr(34) & "WSCRIPT.EXE" & Chr(34) & " nor " &_ Chr(34) & "CSCRIPT.EXE" & Chr(34) & " was detected as " &_ "the script host." & vbCRLF & Chr(34) & "Silent Runners" & Chr(34) &_ " will assume that the script host is CSCRIPT-compatible and will" & vbCRLF &_ "use WScript.Echo for all messages." End If 'script host Const SysFolder = 1 : Const WinFolder = 0 Dim strOS : strOS = "Unknown" Dim strOSLong : strOSLong = "Unknown" Dim strOSXP : strOSXP = "Windows XP Home" 'XP Home or Pro Public strFPSF : strFPSF = Fso.GetSpecialFolder(SysFolder).Path 'FullPathSystemFolder Public strFPWF : strFPWF = Fso.GetSpecialFolder(WinFolder).Path 'FullPathWindowsFolder Public strExeBareName 'bare file name w/o windows or system folder prefixes Dim strSysVer 'Winver.exe version number Dim intErrNum1, intErrNum2, intErrNum3, intErrNum4, intErrNum5, intErrNum6 'error number Dim intLenValue 'value length Dim strURL 'download URL 'assume Group Policies cannot be set in the O/S Dim flagGP : flagGP = False 'HKCU/HKLM CLSID Lower Limit, default is HKLM for O/S <= NT4 Dim intCLL : intCLL = 1 'Winver.exe is in \Windows under W98, but in \System32 for other O/S's 'trap GetFileVersion error for VBScript version < 5.1 On Error Resume Next If Fso.FileExists (strFPSF & "\Winver.exe") Then strSysVer = Fso.GetFileVersion(strFPSF & "\Winver.exe") Else strSysVer = Fso.GetFileVersion(strFPWF & "\Winver.exe") End If intErrNum = Err.Number : Err.Clear On Error Goto 0 'if GetFileVersion returns error due to old WSH version If intErrNum <> 0 Then 'store dl URL strURL = "http://tinyurl.com/7zh0" 'if using WScript If flagOut = "W" Then 'explain the problem intMB = MsgBox ("This script requires Windows Script Host (WSH) 5.1 " &_ "or higher to run." & vbCRLF & vbCRLF & "Press " & Chr(34) & "OK" &_ Chr(34) & " to direct your browser to the WSH download site or " &_ Chr(34) & "Cancel" & Chr(34) & " to quit." & vbCRLF & vbCRLF &_ "(WMI is also required. If it's missing, download instructions " &_ "will appear later.)", vbOKCancel + vbExclamation, _ "Unsupported Windows Script Host Version!") 'if dl wanted now, send browser to dl site If intMB = 1 Then Wshso.Run strURL 'if using CScript Else 'flagOut = "C" 'explain the problem WScript.Echo Chr(34) & "Silent Runners" & Chr(34) & " requires " &_ "Windows Script Host 5.1 or higher to run." & vbCRLF & vbCRLF &_ "It can be downloaded at: " & strURL End If 'WScript or CScript? 'quit the script WScript.Quit End If 'VBScript version error encountered? 'use WINVER.EXE file version to determine O/S If Instr(Left(strSysVer,3),"4.1") > 0 Then strOS = "W98" : strOSLong = "Windows 98" ElseIf Instr(Left(strSysVer,5),"4.0.1") > 0 Then strOS = "NT4" : strOSLong = "Windows NT 4.0" ElseIf Instr(Left(strSysVer,8),"4.0.0.95") > 0 Then strOS = "W98" : strOSLong = "Windows 95" ElseIf Instr(Left(strSysVer,8),"4.0.0.11") > 0 Then strOS = "W98" : strOSLong = "Windows 95 SR2 (OEM)" ElseIf Instr(Left(strSysVer,3),"5.0") > 0 Then strOS = "W2K" : strOSLong = "Windows 2000" : : intCLL = 0 : flagGP = True ElseIf Instr(Left(strSysVer,3),"5.1") > 0 Then 'SP0 & SP1 = 5.1.2600.0, SP2 = 5.1.2600.2180 strOS = "WXP" : strOSLong = "Windows XP" : intCLL = 0 If Instr(strSysVer,".2180") > 0 Then strOSLong = "Windows XP SP2" ElseIf Instr(Left(strSysVer,3),"4.9") > 0 Then strOS = "WME" : strOSLong = "Windows Me (Millennium Edition)" ElseIf Instr(Left(strSysVer,3),"5.2") > 0 Then strOS = "WXP" : strOSLong = "Windows Server 2003 (interpreted as Windows XP)" flagGP = True : intCLL = 0 ElseIf Instr(Left(strSysVer,3),"6.0") > 0 Then strOS = "WVA" : strOSLong = "Windows Vista RC1" flagGP = True : intCLL = 0 Else 'unknown strSysVer If flagOut = "W" Then intMB = MsgBox ("The " & Chr(34) & "Silent Runners" & Chr(34) &_ " script cannot determine the operating system." & vbCRLF & vbCRLF &_ "Click " & Chr(34) & "OK" & Chr(34) & " to send an e-mail to the " &_ "author, providing the following information:" & vbCRLF & vbCRLF &_ "WINVER.EXE file version = " & strSysVer & vbCRLF & vbCRLF &_ "or click " & Chr(34) & "Cancel" & Chr(34) & " to quit.", _ 49,"O/S Unknown!") If intMB = 1 Then Wshso.Run "mailto:Andrew%20Aronoff%20" &_ "<%6F%73.%76%65%72.%65%72%72%6F%72@%73%69%6C%65%6E%74%72%75%6E%6E%65%72%73.%6F%72%67>?" &_ "subject=Silent%20Runners%20OS%20Version%20Error&body=WINVER.EXE" &_ "%20file%20version%20=%20" & strSysVer Else 'flagOut = "C" WScript.Echo Chr(34) & "Silent Runners" & Chr(34) & " cannot " &_ "determine the operating system." & vbCRLF & vbCRLF & "This script will exit." End If 'flagOut? WScript.Quit End If 'OS id'd from strSysVer? 'use WMI to connect to the registry On Error Resume Next Dim oReg : Set oReg = GetObject("winmgmts:\root\default:StdRegProv") intErrNum = Err.Number : Err.Clear On Error Goto 0 'detect WMI connection error If intErrNum <> 0 Then strURL = "" 'for W98/NT4, assume WMI not installed and direct to d/l URL If strOS = "W98" Or strOS = "NT4" Then If strOS = "W98" Then strURL = "http://tinyurl.com/jbxe" If strOS = "NT4" Then strURL = "http://tinyurl.com/7wd7" 'invite user to download WMI & quit If flagOut = "W" Then intMB = MsgBox ("This script requires " & Chr(34) & "WMI" &_ Chr(34) & ", Windows Management Instrumentation, to run." &_ vbCRLF & vbCRLF & "It can be downloaded at: " & strURL &_ vbCRLF & vbCRLF & "Press " & Chr(34) & "OK" & Chr(34) &_ " to direct your browser to the download site or " &_ Chr(34) & "Cancel" & Chr(34) & " to quit.",_ vbOKCancel + vbCritical,"WMI Not Installed!") If intMB = 1 Then Wshso.Run strURL 'at command line, explain & quit Else 'flagOut = "C" WScript.Echo Chr(34) & "Silent Runners" & Chr(34) & " requires " &_ Chr(34) & "WMI" & Chr(34) & ", Windows Management Instrumentation, " &_ "to run." & vbCRLF & vbCRLF & "It can be downloaded at: " & strURL End If 'for W2K/WXP/WVa, explain how to start the WMI service ElseIf strOS = "W2K" Or strOS = "WXP" or strOS = "WVA" Then If strOS = "W2K" Then strLine = "Settings | Control Panel | " If strOS = "WXP" Then strLine = "Control Panel | " If strOS = "WVA" Then strLine = "Control Panel | Classic View | " 'explain how to turn on WMI service If flagOut = "W" Then MsgBox "This script requires Windows Management Instrumentation" &_ " to run." & vbCRLF & vbCRLF & "Click on Start | " & strLine &_ "Administrative Tools | Services," & vbCRLF &_ "and start the " & Chr(34) & "Windows Management Instrumentation" &_ Chr(34) & " service.",vbOKOnly + vbCritical,"WMI Service not running!" 'at command line, explain & quit Else 'flagOut = "C" WScript.Echo Chr(34) & "Silent Runners" & Chr(34) & " requires " &_ "Windows Management Instrumentation to run." & vbCRLF & vbCRLF &_ "Click on Start | " & strLine & "Administrative " &_ "Tools | Services" & vbCRLF & "and start the " & Chr(34) &_ "Windows Management Instrumentation" & Chr(34) & " service." End If 'flagOut? Else 'WMe 'say there's a WMI problem If flagOut = "W" Then MsgBox "This script requires WMI (Windows Management Instrumentation)" &_ " to run," & vbCRLF & "but WMI is not running correctly.", _ vbOKOnly + vbCritical,"WMI problem!" 'at command line, explain & quit Else 'flagOut = "C" WScript.Echo Chr(34) & "Silent Runners" & Chr(34) & " requires " &_ "WMI (Windows Management Instrumentation) to run," & vbCRLF &_ "but WMI is not running correctly." End If 'flagOut? End If 'which O/S? WScript.Quit End If 'WMI execution error 'array of Run keys, counter x 5, hive member, startup folder file, 'startup file shortcut, IERESET.INF file Dim arRunKeys, i, ii, j, k, l, oHiveElmt, oSUFi, oSUSC 'dictionary, keys, items, hard disk collection Dim arSK, arSKk, arSKi, colDisks 'arrays: Run key names, keys, sub-keys, value type, SecurityProviders, ' Protocol filters, values Dim arNames(), arKeys(), arSubKeys(), arType, arSP, arFilter(), arValues 'Sub-Directory DeskTop.Ini array, Sub-Directory Error array, Error array 'Recognized GP names, allowed GP names Public arSDDTI(), arSDErr(), arErr(), arRecNames(), arAllowedNames() 'DeskTop.Ini counter, Error counter x 2, Classes data Hive counter Public ctrArDTI, ctrArErr, ctrErr, ctrCH Public ctrFo : ctrFo = 0 'folder counter 'name member, key array member x 4, O/S, drive root directory, work file Dim oName, oKey, oKey2, strMemKey, strMemSubKey, oOS, oRoot, oFileWk 'values x 7 Dim strValue, strValue1, strValue2, strValue3, strValue4, strValue5, strValue6 Dim strVal, intValue, strCmd 'name, single character, startup folder name, startup folder, array member, temp var Dim strName, strChr, arSUFN, oSUF, strArMember, strTmp, strTmp2 'output string x 3 Public strOut, strOut1, strOut2 'output file msg x 2, warning string, title line Dim strLine, strLine1, strLine2, strWarn, strTitleLine 'infection/hijack warning detection flags -- add footer note if True Public flagIWarn : flagIWarn = False Public flagHWarn : flagHWarn = False Dim strKey, strKey1, strKey2, strKey3, strSubKey 'register key x 4, sub-key 'output file name string (incl. path), file name (wo path), 'PIF path string, single binary character Dim strFN, strFNNP, strPIFTgt, bin1C Public datLaunch : datLaunch = Now 'script launch time Public intCnt 'counter 'ref time, time taken by 2 pop-up boxes Public datRef : datRef = 0 Public datPUB1 : datPUB1 = 0 : Public datPUB2 : datPUB2 = 0 'TRUE if show all output (default values not filtered) Public flagShowAll : flagShowAll = False Dim strRptOutput : strRptOutput = "Output limited to non-default values, " &_ "except where indicated by " & Chr(34) & "{++}" & Chr(34) 'output file string Public strTitle : strTitle = "" Public strSubTitle : strSubTitle = "" Public strSubSubTitle : strSubSubTitle = "" Public flagNVP : flagNVP = False 'existence of name/value pairs in a key Public flagInfect : flagInfect = False 'flag infected condition Dim flagMatch 'flag matching keys Dim flagAllow 'flag key on approved list Dim flagFound 'flag key that exists in Registry Dim flagDirArg : flagDirArg = False 'presence of output directory argument Dim flagIsCLSID : flagIsCLSID = False 'true if argument in CLSID format Dim flagTitle 'True if title has already been written Dim flagAllArg : flagAllArg = False 'presence of all output argument Dim flagArray 'flag array containing elements Public flagSupp : flagSupp = False 'do *not* check for DESKTOP.INI in all 'directories of local fixed disks Dim intLBSP 'Last BackSlash Position in path string Dim intSS 'lowest sort subscript Dim intType 'value type Dim strDLL, strCN 'DLL name, company name 'string to signal all output by default Public strAllOutDefault : strAllOutDefault = "" Dim ScrPath : ScrPath = Fso.GetParentFolderName(WScript.ScriptFullName) If Right(ScrPath,1) <> "\" Then ScrPath = ScrPath & "\" 'initialize Path of Output File Folder to script path Dim strPathOFFo : strPathOFFo = ScrPath 'hive array Public arHives(1,1) arHives(0,0) = "HKCU" : arHives(1,0) = "HKLM" arHives(0,1) = &H80000001 : arHives(1,1) = &H80000002 'set up argument usage message string Dim strLSp, strCSp 'Leading Spaces, Centering Spaces strLSp = Space(4) : strCSp = Space(33) 'WScript spacing If flagOut = "C" Then 'CScript spacing strLsp = Space(3) : strCSp = Space(28) End If Dim strMsg : strMsg = "Only two arguments are permitted:" &_ vbCRLF & vbCRLF &_ "1. the name of an existing directory for the output report" &_ vbCRLF & strLSp & "(embed in quotes if it contains spaces)" &_ vbCRLF & vbCRLF & strCSp & "AND:" & vbCRLF & vbCRLF &_ "2. " & Chr(34) & "-supp" & Chr(34) & " to search " &_ "all directories for DESKTOP.INI DLL" & vbCRLF &_ strLSp & "launch points" &_ vbCRLF & vbCRLF & strCSp & "-OR-" & vbCRLF & vbCRLF &_ "3. " & Chr(34) & "-all" & Chr(34) & " to output all non-empty " &_ "values and all launch" & vbCRLF & strLSp & "points checked" 'check if output directory or "-all" or "-supp" was supplied as argument If WshoArgs.length > 0 And WshoArgs.length <= 2 Then For i = 0 To WshoArgs.length-1 'if directory arg not already passed and arg directory exists If Not flagDirArg And Fso.FolderExists(WshoArgs(i)) Then 'get the path & toggle the directory arg flag Dim oOFFo : Set oOFFo = Fso.GetFolder(WshoArgs(i)) strPathOFFo = oOFFo.Path : flagDirArg = True If Right(strPathOFFo,1) <> "\" Then strPathOFFo = strPathOFFo & "\" Set oOFFo=Nothing 'if -all arg not already passed and is this arg ElseIf Not flagAllArg And LCase(WshoArgs(i)) = "-all" Then 'toggle ShowAll flag, toggle the all arg flag, fill report string flagShowAll = True : flagAllArg = True strRptOutput = "Output of all locations checked and all values found." 'if -all arg not already passed and is this arg ElseIf Not flagAllArg And LCase(WshoArgs(i)) = "-supp" Then flagSupp = True : flagAllArg = True strRptOutput = "Search enabled of all directories on local fixed " &_ "drives for DESKTOP.INI" & vbCRLF & " DLL launch points" &_ vbCRLF & strRptOutput 'argument can't be interpreted, so explain & quit Else If flagOut = "W" Then 'pop up a message window Wshso.Popup "The argument:" & vbCRLF &_ Chr(34) & UCase(WshoArgs(i)) & Chr(34) & vbCRLF &_ "... can't be interpreted." & vbCRLF & vbCRLF &_ strMsg,10,"Bad Script Argument", vbOKOnly + vbExclamation Else 'flagOut = "C" 'write the message to the console WScript.Echo vbCRLF & "The argument: " &_ Chr(34) & UCase(WshoArgs(i)) & Chr(34) &_ " can't be interpreted." & vbCRLF & vbCRLF &_ strMsg & vbCRLF End If 'WScript host? WScript.Quit End If 'argument can be interpreted? Next 'argument 'too many args passed ElseIf WshoArgs.length > 2 Then 'explain & quit If flagOut = "W" Then 'pop up a message window Wshso.Popup "Too many arguments (" & WshoArgs.length & ") were passed." &_ vbCRLF & vbCRLF & strMsg,10,"Too Many Arguments",_ vbOKOnly + vbCritical Else 'flagOut = "C" 'write the message to the console WScript.Echo "Too many arguments (" & WshoArgs.length & ") were passed." &_ vbCRLF & vbCRLF & strMsg & vbCRLF End If 'WScript host? WScript.Quit End If 'directory arguments passed? Set WshoArgs=Nothing datRef = Now 'if no cmd line argument for flagSupp and not testing, show popup If Not flagTest And Not flagShowAll And Not flagSupp And flagOut = "W" Then intMB = Wshso.Popup ("Do you want to skip the supplementary search?" &_ vbCRLF & "(It typically takes several minutes.)" & vbCRLF & vbCRLF &_ "Press " & Chr(34) & "Yes" & Chr(34) & Space(5) &_ " to skip the supplementary search (default)" & vbCRLF & vbCRLF &_ Space(10) & Chr(34) & "No" & Chr(34) & Space(6) &_ " to perform it, or" & vbCRLF & vbCRLF &_ Space(10) & Chr(34) & "Cancel" & Chr(34) &_ " to get more information at the web site" & vbCRLF &_ Space(25) & "and exit the script.",_ 15,"Skip supplementary search?",_ vbYesNoCancel + vbQuestion + vbDefaultButton1 + vbSystemModal) If intMB = vbNo Then flagSupp = True intMB1 = MsgBox ("Are you SURE you want to run the supplementary " &_ "search?" & vbCRLF & vbCRLF & "It's _rarely_ necessary " &_ "and it takes a *long* time." & vbCRLF & vbCRLF & "Press " & DQ &_ "Yes" & DQ & " to confirm running the supplementary search, " &_ "or" & vbCRLF & Space(10) & DQ & "No" & DQ & " to run without it.", _ vbYesNo + vbQuestion + vbDefaultButton2 + vbSystemModal,"Are you sure?") If intMB1 = vbNo Then flagSupp = False ElseIf intMB = vbCancel Then Wshso.Run "https://www.silentrunners.org/thescript.html#supp" WScript.Quit End If End If datPUB1 = DateDiff("s",datRef,Now) : datRef = Now 'inform user that script has started If Not flagTest Then If flagOut = "W" Then Wshso.PopUp Chr(34) & "Silent Runners" & Chr(34) & " has started." &_ vbCRLF & vbCRLF & "A message box like this one will appear " &_ "when it's done." & vbCRLF & vbCRLF & "Please be patient...",3,_ "Silent Runners R" & strRevNo & " startup", _ vbOKOnly + vbInformation + vbSystemModal Else WScript.Echo Chr(34) & "Silent Runners" & Chr(34) & " has started." &_ " Please be patient..." End If 'flagOut? End If 'flagTest? datPUB2 = DateDiff("s",datRef,Now) 'create output file name with computer name & today's date 'Startup Programs (pc_name_here) yyyy-mm-dd.txt strFNNP = "Startup Programs (" & oNetwk.ComputerName & ") " &_ FmtDate(datLaunch) & " " & FmtHMS(datLaunch) & ".txt" strFN = strPathOFFo & strflagTest & strFNNP On Error Resume Next If Fso.FileExists(strFN) Then Fso.DeleteFile(strFN) Err.Clear Public oFN : Set oFN = Fso.CreateTextFile(strFN,True) intErrNum = Err.Number : Err.Clear On Error Goto 0 'if can't create report file If intErrNum > 0 Then strURL = "https://www.silentrunners.org/Silent%20Runners%20RED.vbs" 'invite user to run RED version & quit If flagOut = "W" Then intMB = MsgBox ("The script cannot create its report file. " &_ "This is a known, intermittent" & vbCRLF & "problem under " &_ strOSLong & "." & vbCRLF & vbCRLF &_ "An alternative script version is available for download. " &_ "After it runs, " & vbCRLF & "the script you're using now will " &_ "run correctly." & vbCRLF & vbCRLF &_ "Press " & Chr(34) & "OK" & Chr(34) & " to direct your browser " &_ "to the alternate script location, or" & vbCRLF & Space(10) &_ Chr(34) & "Cancel" & Chr(34) & " to quit.",49,"CreateTextFile Error!") 'if alternative script wanted now, send browser to dl site If intMB = 1 Then Wshso.Run strURL 'explain & quit Else 'flagOut = "C" WScript.Echo Chr(34) & "Silent Runners" & Chr(34) & " cannot " &_ "create the report file." & vbCRLF & vbCRLF &_ "An alternative script is available. Run it, then rerun this version." &_ vbCRLF & "The alternative script can be downloaded at: " & vbCRLF &_ vbCRLF & strURL End If WScript.Quit End If 'report file creation error? 'add report header Set oNetwk=Nothing oFN.WriteLine Chr(34) & "Silent Runners.vbs" & Chr(34) &_ ", revision " & strRevNo & ", https://www.silentrunners.org/" &_ vbCRLF & "Operating System: " & strOSLong & vbCRLF & strRptOutput 'test for WMI corruption and use WMI to differentiate between 'WXP Home & WXP Pro 'get the O/S collection Dim colOS : Set colOS = GetObject("winmgmts:\root\cimv2").ExecQuery _ ("Select * from Win32_OperatingSystem") On Error Resume Next Err.Clear For Each oOS in colOS If strOS = "WXP" Then 'modify strOSXP if O/S = Pro If InStr(1,LCase(oOS.Name),"professional",1) > 0 Then strOSXP = "Windows XP Professional" flagGP = True End If 'modify strOSXP if SP2 If Right(strOSLong,3) = "SP2" Then strOSXP = strOSXP & " SP2" End If 'WXP? Next 'oOS If Err.Number <> 0 Then strURL = "http://go.microsoft.com/fwlink/?LinkId=62562" oFN.WriteLine vbCRLF & "FATAL ERROR!" & vbCRLF & String(12,"-") &_ vbCRLF & vbCRLF & DQ & "Silent Runners" & DQ &_ " cannot use WMI to identify the operating system." &_ vbCRLF & "This is caused by corruption of the WMI installation." &_ vbCRLF & vbCRLF &_ "WMI is complex and it is recommended that you use a Microsoft" &_ vbCRLF & "tool, " & DQ & "WMIDiag.vbs," & DQ & " to diagnose WMI " &_ "on your system." & vbCRLF & vbCRLF & "It can be downloaded here:" &_ vbCRLF & vbCRLF & strURL intMB = MsgBox (DQ & "Silent Runners" & DQ & " cannot use WMI to " &_ "identify the operating system." & vbCRLF & "This is caused by " &_ "corruption of the WMI installation." &_ vbCRLF & vbCRLF &_ "WMI is complex and it is recommended that you use a Microsoft" &_ vbCRLF & "tool, " & DQ & "WMIDiag.vbs," & DQ & " to diagnose WMI " &_ "on your system." &_ vbCRLF & vbCRLF &_ "Press " & DQ & "OK" & DQ & " to direct your browser to the " &_ "WMIDiag download site or" &_ vbCRLF & Space(10) & DQ & "Cancel" & DQ & " to quit.",_ vbOKCancel + vbCritical + + vbSystemModal + vbDefaultButton2,_ "Can't iterate Win32_OperatingSystem!") 'if dl wanted now, send browser to dl site If intMB = 1 Then Wshso.Run strURL WScript.Quit End If 'Err.Number<>0? On Error Goto 0 Set colOS=Nothing '#1. HKCU/HKLM... Run/RunOnce/RunOnce\Setup/RunOnceEx ' HKLM... RunServices/RunServicesOnce ' HKCU/HKLM... Policies\Explorer\Run intSection = intSection + 1 'execute section if not in testing mode or (in testing mode And this section selected for testing) If Not flagTest Or (flagTest And SecTest) Then 'write registry header lines to file strTitle = "Startup items buried in registry:" TitleLineWrite 'put keys in array (Key Index 0 - 6) arRunKeys = Array ("Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run", _ "Software\Microsoft\Windows\CurrentVersion\Run", _ "Software\Microsoft\Windows\CurrentVersion\RunOnce", _ "Software\Microsoft\Windows\CurrentVersion\RunOnce\Setup", _ "Software\Microsoft\Windows\CurrentVersion\RunOnceEx", _ "Software\Microsoft\Windows\CurrentVersion\RunServices", _ "Software\Microsoft\Windows\CurrentVersion\RunServicesOnce") 'Key Execution Flag/Subkey Recursion Flag array ' 'first number in the ordered pair in the array immediately below ' pertains to execution of the key: '0: not executed (ignore) '1: may be executed so display with EXECUTION UNLIKELY warning '2: executable ' 'second number in the ordered pair pertains to subkey recursion '0: subkeys not used '1: subkey recursion necessary '0 Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run '1 Software\Microsoft\Windows\CurrentVersion\Run '2 Software\Microsoft\Windows\CurrentVersion\RunOnce '3 Software\Microsoft\Windows\CurrentVersion\RunOnce\Setup '4 Software\Microsoft\Windows\CurrentVersion\RunOnceEx '5 Software\Microsoft\Windows\CurrentVersion\RunServices '6 Software\Microsoft\Windows\CurrentVersion\RunServicesOnce 'Hive HKCU - 0 HKLM - 1 ' 'Key 0 1 2 3 4 5 6 0 1 2 3 4 5 6 'Index 'O/S: 'W95 0,0 2,0 2,0 0,0 2,1 0,0 0,0 0,0 2,0 2,0 0,0 2,1 2,0 2,0 'W98 0,0 2,0 2,0 0,0 2,1 0,0 0,0 0,0 2,0 2,0 2,0 2,1 2,0 2,0 'WMe 2,1 2,1 2,0 2,0 2,1 0,0 0,0 2,1 2,1 2,0 2,0 2,1 2,0 2,0 'NT4 0,0 2,0 2,0 0,0 2,1 0,0 0,0 0,0 2,0 2,0 0,0 2,1 0,0 0,0 'W2K 2,1 2,1 2,1 0,0 2,1 0,0 0,0 2,1 2,1 2,1 0,0 2,1 0,0 0,0 'WXP 2,0 2,0 2,0 0,0 2,1 0,0 0,0 2,0 2,0 2,0 0,0 2,1 0,0 0,0 'WS2K3 ??? <-------------------- ??? --------------------> ??? 'WVa 2,0 2,0 2,0 0,0 2,1 0,0 0,0 2,0 2,0 2,0 0,0 2,1 0,0 0,0 'arRegFlag(i,j,k): put flags in array by O/S: 'hive = i (0 or 1), key_# = j (0-6), ' flags (key execution/subkey recursion) = k (0 or 1) ' k = 0 holds key execution value = 0/1/2 ' 1 holds subkey recursion value = 0/1 Dim arRegFlag() ReDim arRegFlag(1,6,1) 'initialize entire array to zero For i = 0 To 1 : For j = 0 To 6 : For k = 0 To 1 arRegFlag(i,j,k) = 0 Next : Next : Next 'add data to array for O/S that's running 'W98 If strOS = "W98" Then arRegFlag(0,1,0) = 2 'HKCU,Run = no-warn arRegFlag(0,2,0) = 2 'HKCU,RunOnce = no-warn arRegFlag(0,4,0) = 2 'HKCU,RunOnceEx = no-warn arRegFlag(0,4,1) = 1 'HKCU,RunOnceEx = sub-keys arRegFlag(1,1,0) = 2 'HKLM,Run = no-warn arRegFlag(1,2,0) = 2 'HKLM,RunOnce = no-warn 'don't set HKLM,RunOnce\Setup for W95 If strOSLong = "Windows 98" Then _ arRegFlag(1,3,0) = 2 'HKLM,RunOnce\Setup = no-warn arRegFlag(1,4,0) = 2 'HKLM,RunOnceEx = no-warn arRegFlag(1,4,1) = 1 'HKLM,RunOnceEx = sub-keys arRegFlag(1,5,0) = 2 'HKLM,RunServices = no-warn arRegFlag(1,6,0) = 2 'HKLM,RunServicesOnce = no-warn End If If strOS = "WME" Then arRegFlag(0,0,0) = 2 'HKCU,Explorer\Run = no-warn arRegFlag(0,0,1) = 1 'HKCU,Explorer\Run = sub-keys arRegFlag(0,1,0) = 2 'HKCU,Run = no-warn arRegFlag(0,1,1) = 1 'HKCU,Run = sub-keys arRegFlag(0,2,0) = 2 'HKCU,RunOnce = no-warn arRegFlag(0,3,0) = 2 'HKCU,RunOnce\Setup = no-warn arRegFlag(0,4,0) = 2 'HKCU,RunOnceEx = no-warn arRegFlag(0,4,1) = 1 'HKCU,RunOnceEx = sub-keys arRegFlag(1,0,0) = 2 'HKLM,Explorer\Run = no-warn arRegFlag(1,0,1) = 1 'HKLM,Explorer\Run = sub-keys arRegFlag(1,1,0) = 2 'HKLM,Run = no-warn arRegFlag(1,1,1) = 1 'HKLM,Run = sub-keys arRegFlag(1,2,0) = 2 'HKLM,RunOnce = no-warn arRegFlag(1,3,0) = 2 'HKLM,RunOnce\Setup = no-warn arRegFlag(1,4,0) = 2 'HKLM,RunOnceEx = no-warn arRegFlag(1,4,1) = 1 'HKLM,RunOnceEx = sub-keys arRegFlag(1,5,0) = 2 'HKLM,RunServices = no-warn arRegFlag(1,6,0) = 2 'HKLM,RunServicesOnce = no-warn End If 'NT4 If strOS = "NT4" Then arRegFlag(0,1,0) = 2 'HKCU,Run = no-warn arRegFlag(0,2,0) = 2 'HKCU,RunOnce = no-warn arRegFlag(0,4,0) = 2 'HKCU,RunOnceEx = no-warn arRegFlag(0,4,1) = 1 'HKCU,RunOnceEx = sub-keys arRegFlag(1,1,0) = 2 'HKLM,Run = no-warn arRegFlag(1,2,0) = 2 'HKLM,RunOnce = no-warn arRegFlag(1,4,0) = 2 'HKLM,RunOnceEx = no-warn arRegFlag(1,4,1) = 1 'HKLM,RunOnceEx = sub-keys End If 'W2K If strOs = "W2K" Then arRegFlag(0,0,0) = 2 'HKCU,Explorer\Run = no-warn arRegFlag(0,0,1) = 1 'HKCU,Explorer\Run = sub-keys arRegFlag(0,1,0) = 2 'HKCU,Run = no-warn arRegFlag(0,1,1) = 1 'HKCU,Run = sub-keys arRegFlag(0,2,0) = 2 'HKCU,RunOnce = no-warn arRegFlag(0,2,1) = 1 'HKCU,RunOnce = sub-keys (incl. Setup) arRegFlag(0,4,0) = 2 'HKCU,RunOnceEx = no-warn arRegFlag(0,4,1) = 1 'HKCU,RunOnceEx = sub-keys arRegFlag(1,0,0) = 2 'HKLM,Explorer\Run = no-warn arRegFlag(1,0,1) = 1 'HKLM,Explorer\Run = sub-keys arRegFlag(1,1,0) = 2 'HKLM,Run = no-warn arRegFlag(1,1,1) = 1 'HKLM,Run = sub-keys arRegFlag(1,2,0) = 2 'HKLM,RunOnce = no-warn arRegFlag(1,2,1) = 1 'HKLM,RunOnce = sub-keys (incl. Setup) arRegFlag(1,4,0) = 2 'HKLM,RunOnceEx = no-warn arRegFlag(1,4,1) = 1 'HKLM,RunOnceEx = sub-keys End If 'WXP/WVa If strOs = "WXP" Or strOS = "WVA" Then arRegFlag(0,0,0) = 2 'HKCU,Explorer\Run = no-warn arRegFlag(0,1,0) = 2 'HKCU,Run = no-warn arRegFlag(0,2,0) = 2 'HKCU,RunOnce = no-warn arRegFlag(0,4,0) = 2 'HKLM,RunOnceEx = no-warn arRegFlag(0,4,1) = 1 'HKLM,RunOnceEx = sub-keys arRegFlag(1,0,0) = 2 'HKLM,Explorer\Run = no-warn arRegFlag(1,1,0) = 2 'HKLM,Run = no-warn arRegFlag(1,2,0) = 2 'HKLM,RunOnce = no-warn arRegFlag(1,4,0) = 2 'HKLM,RunOnceEx = no-warn arRegFlag(1,4,1) = 1 'HKLM,RunOnceEx = sub-keys End If 'for each hive For i = 0 To 1 'for each key For j = 0 To 6 'if not ShowAll, show all output for Run keys If j = 1 And Not flagShowAll Then strAllOutDefault = " {++}" 'if key is not ignored If arRegFlag(i,j,0) > 0 Then flagNVP = False 'intialize string with warning if necessary strWarn = "" If arRegFlag(i,j,0) = 1 Then strWarn = "EXECUTION UNLIKELY: " 'INFO 'with no name/value pairs (sub-keys are identical) ' IsArray TypeName UBound 'W98 True "Variant()" -1 'WMe True "Variant()" -1 'NT4 True "Variant()" -1 'W2K False "Null" error (--) 'WXP False "Null" error (--) 'WS2K3 True "Variant()" error (--) 'WVa False "Null" error (--) EnumNVP arHives(i,1), arRunKeys(j), arNames, arType If flagNVP Then 'name/value pairs exist 'write the full key name oFN.WriteLine vbCRLF & arHives(i,0) & "\" & arRunKeys(j) & "\" & strAllOutDefault 'for each data type in the names array For k = LBound(arNames) To UBound(arNames) 'use the type to find the value strValue = RtnValue (arHives(i,1), arRunKeys(j), arNames(k), arType(k)) 'write the name & value WriteValueData arNames(k), strValue, arType(k), strWarn Next 'member of names array Else 'no name/value pairs If flagShowAll Then _ oFN.WriteLine vbCRLF & arHives(i,0) & "\" & arRunKeys(j) & "\" End If 'flagNVP? 'recurse subkeys if necessary If arRegFlag(i,j,1) = 1 Then 'put all subkeys into array oReg.EnumKey arHives(i,1),arRunKeys(j),arKeys 'excludes W2K/WXP/WVa with no sub-keys If IsArray(arKeys) Then 'excludes W98/WMe/NT4/WS2K3 with no sub-keys For Each strMemKey in arKeys flagNVP = False strSubKey = arRunKeys(j) & "\" & strMemKey EnumNVP arHives(i,1), arRunKeys(j) & "\" & strMemKey,arNames,arType If flagNVP Then 'if name/value pairs exist 'write the full key name oFN.WriteLine vbCRLF & arHives(i,0) & "\" & strSubKey &_ "\" & strAllOutDefault 'for each data type in the names array For k = LBound(arNames) To UBound(arNames) 'use the type to find the value strValue = RtnValue (arHives(i,1), strSubKey, arNames(k), arType(k)) 'write the name & value WriteValueData arNames(k), strValue, arType(k), strWarn Next 'member of names array Else 'no name/value pairs If flagShowAll Then _ oFN.WriteLine vbCRLF & arHives(i,0) & "\" & strSubKey & "\" End If 'flagNVP? Next 'sub-key End If 'sub-keys exist? W2K/WXP/WS2K3/WVa End If 'enum sub-keys? End If 'arRegFlag(i,j,0) > 0 Next 'Run key Next 'Hive strAllOutDefault = "" : flagNVP = False 'recover array memory ReDim arRunKeys(0) ReDim arKeys(0) ReDim arRegFlag(0) End If 'flagTest And SecTest? '#2. HKLM... Active Setup\Installed Components\ ' HKCU... Active Setup\Installed Components\ intSection = intSection + 1 'execute section if not in testing mode or (in testing mode And this section selected for testing) If Not flagTest Or (flagTest And SecTest) Then 'flags True if only numeric & comma chrs in Version values Dim flagHKLMVer, flagHKCUVer 'StubPath Value string, HKLM Version value, HKCU Version value, HKLM program name Dim strSPV, strHKLMVer, strHKCUVer, strPgmName Dim arHKLMKeys, arHKCUKeys, strHKLMKey, strHKCUKey strKey = "Software\Microsoft\Active Setup\Installed Components" strSubTitle = "HKLM" & "\" & strKey & "\" 'find all the subkeys oReg.EnumKey HKLM, strKey, arHKLMKeys 'HKLM oReg.EnumKey HKCU, strKey, arHKCUKeys 'HKCU 'enumerate HKLM keys if present If IsArray(arHKLMKeys) Then 'for each HKLM key For Each strHKLMKey In arHKLMKeys 'INFO 'Default Value not set: 'W98/WMe: returns 0, strValue = "" 'NT4/W2K/WXP/WVa: returns non-zero, strValue = Null 'Non-Default name inexistent: 'W98/WMe/NT4/W2K/WXP/WVa: returns non-zero, strValue = Null 'Non-Default Value not set: 'W2K: returns 0, strValue = unwritable string 'W98/WMe/NT4/WXP/WVa: returns 0, strValue = "" 'get the StubPath value intErrNum = oReg.GetStringValue (HKLM,strKey & "\" & strHKLMKey,"StubPath",strSPV) 'if the StubPath name exists And value set (exc for W2K!) If intErrNum = 0 And strSPV <> "" Then flagMatch = False 'if HKCU keys present If IsArray(arHKCUKeys) Then 'for each HKCU key For Each strHKCUKey in arHKCUKeys 'if identical HKLM key exists If LCase(strHKLMKey) = LCase(strHKCUKey) Then 'assume Version fmts are OK flagHKLMVer = True : flagHKCUVer = True 'get HKLM & HKCU Version values intErrNum1 = oReg.GetStringValue (HKLM,strKey & "\" & strHKLMKey, _ "Version",strHKLMVer) 'HKLM Version # intErrNum2 = oReg.GetStringValue (HKCU,strKey & "\" & strHKCUKey, _ "Version",strHKCUVer) 'HKCU Version # 'if HKLM Version name exists And value set (exc for W2K!) If intErrNum1 = 0 And strHKLMVer <> "" Then 'the next two loops check for allowed chars (numeric & comma) ' in returned Version values For i = 1 To Len(strHKLMVer) strChr = Mid(strHKLMVer,i,1) If Not IsNumeric(strChr) And strChr <> "," Then flagHKLMVer = False Next 'if HKCU Version name exists And value set (exc for W2K!) If intErrNum2 = 0 And strHKCUVer <> "" Then 'check that value consists only of numeric & comma chrs For i = 1 To Len(strHKCUVer) strChr = Mid(strHKCUVer,i,1) If Not IsNumeric(strChr) And strChr <> "," Then flagHKCUVer = False Next End If 'HKCU Version null or MT? 'if HKLM Ver # has illegal fmt (i.e., is not assigned) or doesn't exist (is Null) ' or is empty, match = True 'if HKCU/HKLM Ver # fmts OK And HKCU Ver # >= HKLM Ver #, match = True 'if HKLM Ver # = "0,0" and HKCU Ver # = "", key will output ' but StubPath will not launch If Not flagHKLMVer Then flagMatch = True If flagHKLMVer And flagHKCUVer And strHKCUVer >= strHKLMVer Then flagMatch = True Else 'HKLM Version name doesn't exist Or value not set (exc for W2K!) flagMatch = True End If 'HKLM Version name exists And value set (exc for W2K!)? End If 'HKCU key=HKLM key? Next 'HKCU Installed Components key End If 'HKCU Installed Components subkeys exist? 'if the StubPath will launch If Not flagMatch Then flagAllow = False 'assume StubPath DLL not on approved list strCN = CoName(IDExe(strSPV)) 'test for approved StubPath DLL If LCase(strHKLMKey) = ">{22d6f312-b0f6-11d0-94ab-0080c74c7e95}" And _ (InStr(LCase(strSPV),"wmpocm.exe") > 0 Or _ InStr(LCase(strSPV),"unregmp2.exe") > 0) And _ strCN = MS And Not flagShowAll Then flagAllow = True 'StubPath DLL not approved If Not flagAllow Then 'get the default value (program name) intErrNum3 = oReg.GetStringValue (HKLM,strKey & "\" & strHKLMKey,"",strPgmName) 'enclose pgm name in quotes if name exists and default value isn't empty If intErrNum3 = 0 And strPgmName <> "" Then strPgmName = Chr(34) & strPgmName & Chr(34) Else strPgmName = "(no title provided)" End If TitleLineWrite 'output the CLSID & pgm name oFN.WriteLine strHKLMKey & "\(Default) = " & StringFilter(strPgmName,False) On Error Resume Next 'output the StubPath value oFN.WriteLine Space(Len(strHKLMKey)+1) & "\StubPath = " &_ Chr(34) & strSPV & Chr(34) & strCN 'error check for W2K if StubPath value not set If Err.Number <> 0 Then oFN.WriteLine Space(Len(strHKLMKey)+1) & "\StubPath = " &_ "(value not set)" Err.Clear On Error GoTo 0 End If 'flagAllow false? End If 'flagMatch false? End If 'StubPath value exists? Next 'HKLM Installed Components subkey End If 'HKLM Installed Components subkeys exist? If flagShowAll Then TitleLineWrite 'recover array memory ReDim arHKLMKeys(0) ReDim arHKCUKeys(0) strTitle = "" : strSubTitle = "" : strSubSubTitle = "" End If 'SecTest? '#3. HKLM... Explorer\Browser Helper Objects intSection = intSection + 1 'execute section if not in testing mode or (in testing mode And this section selected for testing) If Not flagTest Or (flagTest And SecTest) Then strKey = "Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" strSubTitle = "HKLM" & "\" & strKey & "\" 'find all the subkeys oReg.EnumKey HKLM, strKey, arSubKeys 'enumerate data if present If IsArray(arSubKeys) Then 'for each key For Each strSubKey In arSubKeys flagTitle = False CLSIDLocTitle HKLM, strKey & "\" & strSubKey, "", strLocTitle For ctrCH = intCLL To 1 ResolveCLSID strSubKey, arHives(ctrCH,1), strCLSIDTitle, strIPSDLL If strIPSDLL <> "" Then 'output the title line if not already done TitleLineWrite If Not flagTitle Then 'error check for W2K if value not set On Error Resume Next oFN.WriteLine strSubKey & "\(Default) = " & strLocTitle intErrNum = Err.Number : Err.Clear If intErrNum <> 0 Then oFN.WriteLine strSubKey &_ "\(Default) = (no title provided)" flagTitle = True On Error GoTo 0 End If 'output CLSID title, InProcServer32 DLL & CoName oFN.WriteLine " -> {" & arHives(ctrCH,0) & "...CLSID} = " &_ strCLSIDTitle & vbCRLF & Space(19) & "\InProcServer32\(Default) = " &_ StringFilter(strIPSDLL,True) & CoName(IDExe(strIPSDLL)) End If 'strIPSDLL exists? Next 'CLSID hive Next 'BHO subkey End If 'BHO subkeys exist? 'if ShowAll, output the key name if not already done If flagShowAll Then TitleLineWrite strTitle = "" : strSubTitle = "" : strSubSubTitle = "" 'recover array memory ReDim arSubKeys(0) End If 'SecTest? '#4. HKLM... Shell Extensions\Approved\ intSection = intSection + 1 'execute section if not in testing mode or (in testing mode And this section selected for testing) If Not flagTest Or (flagTest And SecTest) Then 'CLSID value, InProcessServer32 DLL name & output file version, 'CLSID Key Title display flag Dim strCLSID, strIPSDLL, strIPSDLLOut, strCLSIDTitle, strLocTitle 'Shell Extension Approved array Dim arSEA() ReDim arSEA(388,1) 'WXP arSEA(0,0) = "{00022613-0000-0000-C000-000000000046}" : arSEA(0,1) = "mmsys.cpl" arSEA(1,0) = "{176d6597-26d3-11d1-b350-080036a75b03}" : arSEA(1,1) = "icmui.dll" arSEA(2,0) = "{1F2E5C40-9550-11CE-99D2-00AA006E086C}" : arSEA(2,1) = "rshx32.dll" arSEA(3,0) = "{3EA48300-8CF6-101B-84FB-666CCB9BCD32}" : arSEA(3,1) = "docprop.dll" arSEA(4,0) = "{40dd6e20-7c17-11ce-a804-00aa003ca9f6}" : arSEA(4,1) = "ntshrui.dll" arSEA(5,0) = "{41E300E0-78B6-11ce-849B-444553540000}" : arSEA(5,1) = "themeui.dll" arSEA(6,0) = "{42071712-76d4-11d1-8b24-00a0c9068ff3}" : arSEA(6,1) = "deskadp.dll" arSEA(7,0) = "{42071713-76d4-11d1-8b24-00a0c9068ff3}" : arSEA(7,1) = "deskmon.dll" arSEA(8,0) = "{42071714-76d4-11d1-8b24-00a0c9068ff3}" : arSEA(8,1) = "deskpan.dll" arSEA(9,0) = "{4E40F770-369C-11d0-8922-00A024AB2DBB}" : arSEA(9,1) = "dssec.dll" arSEA(10,0) = "{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}" : arSEA(10,1) = "SlayerXP.dll" arSEA(11,0) = "{56117100-C0CD-101B-81E2-00AA004AE837}" : arSEA(11,1) = "shscrap.dll" arSEA(12,0) = "{59099400-57FF-11CE-BD94-0020AF85B590}" : arSEA(12,1) = "diskcopy.dll" arSEA(13,0) = "{59be4990-f85c-11ce-aff7-00aa003ca9f6}" : arSEA(13,1) = "ntlanui2.dll" arSEA(14,0) = "{5DB2625A-54DF-11D0-B6C4-0800091AA605}" : arSEA(14,1) = "icmui.dll" arSEA(15,0) = "{675F097E-4C4D-11D0-B6C1-0800091AA605}" : arSEA(15,1) = "icmui.dll" arSEA(16,0) = "{764BF0E1-F219-11ce-972D-00AA00A14F56}" : arSEA(16,1) = "" arSEA(17,0) = "{77597368-7b15-11d0-a0c2-080036af3f03}" : arSEA(17,1) = "printui.dll" arSEA(18,0) = "{7988B573-EC89-11cf-9C00-00AA00A14F56}" : arSEA(18,1) = "dskquoui.dll" arSEA(19,0) = "{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}" : arSEA(19,1) = "" arSEA(20,0) = "{85BBD920-42A0-1069-A2E4-08002B30309D}" : arSEA(20,1) = "syncui.dll" arSEA(21,0) = "{88895560-9AA2-1069-930E-00AA0030EBC8}" : arSEA(21,1) = "hticons.dll" arSEA(22,0) = "{BD84B380-8CA2-1069-AB1D-08000948F534}" : arSEA(22,1) = "fontext.dll" arSEA(23,0) = "{DBCE2480-C732-101B-BE72-BA78E9AD5B27}" : arSEA(23,1) = "icmui.dll" arSEA(24,0) = "{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}" : arSEA(24,1) = "rshx32.dll" arSEA(25,0) = "{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}" : arSEA(25,1) = "ntshrui.dll" arSEA(26,0) = "{f92e8c40-3d33-11d2-b1aa-080036a75b03}" : arSEA(26,1) = "deskperf.dll" arSEA(27,0) = "{7444C717-39BF-11D1-8CD9-00C04FC29D45}" : arSEA(27,1) = "cryptext.dll" arSEA(28,0) = "{7444C719-39BF-11D1-8CD9-00C04FC29D45}" : arSEA(28,1) = "cryptext.dll" arSEA(29,0) = "{7007ACC7-3202-11D1-AAD2-00805FC1270E}" : arSEA(29,1) = "NETSHELL.dll" arSEA(30,0) = "{992CFFA0-F557-101A-88EC-00DD010CCC48}" : arSEA(30,1) = "NETSHELL.dll" arSEA(31,0) = "{E211B736-43FD-11D1-9EFB-0000F8757FCD}" : arSEA(31,1) = "wiashext.dll" arSEA(32,0) = "{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}" : arSEA(32,1) = "wiashext.dll" arSEA(33,0) = "{905667aa-acd6-11d2-8080-00805f6596d2}" : arSEA(33,1) = "wiashext.dll" arSEA(34,0) = "{3F953603-1008-4f6e-A73A-04AAC7A992F1}" : arSEA(34,1) = "wiashext.dll" arSEA(35,0) = "{83bbcbf3-b28a-4919-a5aa-73027445d672}" : arSEA(35,1) = "wiashext.dll" arSEA(36,0) = "{F0152790-D56E-4445-850E-4F3117DB740C}" : arSEA(36,1) = "remotepg.dll" arSEA(37,0) = "{5F327514-6C5E-4d60-8F16-D07FA08A78ED}" : arSEA(37,1) = "wuaucpl.cpl" arSEA(38,0) = "{60254CA5-953B-11CF-8C96-00AA00B8708C}" : arSEA(38,1) = "wshext.dll" arSEA(39,0) = "{2206CDB2-19C1-11D1-89E0-00C04FD7A829}" : arSEA(39,1) = "oledb32.dll" arSEA(40,0) = "{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}" : arSEA(40,1) = "mstask.dll" arSEA(41,0) = "{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}" : arSEA(41,1) = "mstask.dll" arSEA(42,0) = "{D6277990-4C6A-11CF-8D87-00AA0060F5BF}" : arSEA(42,1) = "mstask.dll" arSEA(43,0) = "{0DF44EAA-FF21-4412-828E-260A8728E7F1}" : arSEA(43,1) = "" arSEA(44,0) = "{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}" : arSEA(44,1) = "shdocvw.dll" arSEA(45,0) = "{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}" : arSEA(45,1) = "shdocvw.dll" arSEA(46,0) = "{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}" : arSEA(46,1) = "shdocvw.dll" arSEA(47,0) = "{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}" : arSEA(47,1) = "shdocvw.dll" arSEA(48,0) = "{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}" : arSEA(48,1) = "shdocvw.dll" arSEA(49,0) = "{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}" : arSEA(49,1) = "shdocvw.dll" arSEA(50,0) = "{D20EA4E1-3957-11d2-A40B-0C5020524152}" : arSEA(50,1) = "shdocvw.dll" arSEA(51,0) = "{D20EA4E1-3957-11d2-A40B-0C5020524153}" : arSEA(51,1) = "shdocvw.dll" arSEA(52,0) = "{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}" : arSEA(52,1) = "shmedia.dll" arSEA(53,0) = "{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}" : arSEA(53,1) = "shmedia.dll" arSEA(54,0) = "{E4B29F9D-D390-480b-92FD-7DDB47101D71}" : arSEA(54,1) = "shmedia.dll" arSEA(55,0) = "{87D62D94-71B3-4b9a-9489-5FE6850DC73E}" : arSEA(55,1) = "shmedia.dll" arSEA(56,0) = "{A6FD9E45-6E44-43f9-8644-08598F5A74D9}" : arSEA(56,1) = "shmedia.dll" arSEA(57,0) = "{c5a40261-cd64-4ccf-84cb-c394da41d590}" : arSEA(57,1) = "shmedia.dll" arSEA(58,0) = "{5E6AB780-7743-11CF-A12B-00AA004AE837}" : arSEA(58,1) = "browseui.dll" arSEA(59,0) = "{22BF0C20-6DA7-11D0-B373-00A0C9034938}" : arSEA(59,1) = "browseui.dll" arSEA(60,0) = "{91EA3F8B-C99B-11d0-9815-00C04FD91972}" : arSEA(60,1) = "browseui.dll" arSEA(61,0) = "{6413BA2C-B461-11d1-A18A-080036B11A03}" : arSEA(61,1) = "browseui.dll" arSEA(62,0) = "{F61FFEC1-754F-11d0-80CA-00AA005B4383}" : arSEA(62,1) = "browseui.dll" arSEA(63,0) = "{7BA4C742-9E81-11CF-99D3-00AA004AE837}" : arSEA(63,1) = "browseui.dll" arSEA(64,0) = "{30D02401-6A81-11d0-8274-00C04FD5AE38}" : arSEA(64,1) = "browseui.dll" arSEA(65,0) = "{32683183-48a0-441b-a342-7c2a440a9478}" : arSEA(65,1) = "browseui.dll" arSEA(66,0) = "{169A0691-8DF9-11d1-A1C4-00C04FD75D13}" : arSEA(66,1) = "browseui.dll" arSEA(67,0) = "{07798131-AF23-11d1-9111-00A0C98BA67D}" : arSEA(67,1) = "browseui.dll" arSEA(68,0) = "{AF4F6510-F982-11d0-8595-00AA004CD6D8}" : arSEA(68,1) = "browseui.dll" arSEA(69,0) = "{01E04581-4EEE-11d0-BFE9-00AA005B4383}" : arSEA(69,1) = "browseui.dll" arSEA(70,0) = "{A08C11D2-A228-11d0-825B-00AA005B4383}" : arSEA(70,1) = "browseui.dll" arSEA(71,0) = "{00BB2763-6A77-11D0-A535-00C04FD7D062}" : arSEA(71,1) = "browseui.dll" arSEA(72,0) = "{7376D660-C583-11d0-A3A5-00C04FD706EC}" : arSEA(72,1) = "browseui.dll" arSEA(73,0) = "{6756A641-DE71-11d0-831B-00AA005B4383}" : arSEA(73,1) = "browseui.dll" arSEA(74,0) = "{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}" : arSEA(74,1) = "browseui.dll" arSEA(75,0) = "{7e653215-fa25-46bd-a339-34a2790f3cb7}" : arSEA(75,1) = "browseui.dll" arSEA(76,0) = "{acf35015-526e-4230-9596-becbe19f0ac9}" : arSEA(76,1) = "browseui.dll" arSEA(77,0) = "{E0E11A09-5CB8-4B6C-8332-E00720A168F2}" : arSEA(77,1) = "browseui.dll" arSEA(78,0) = "{00BB2764-6A77-11D0-A535-00C04FD7D062}" : arSEA(78,1) = "browseui.dll" arSEA(79,0) = "{03C036F1-A186-11D0-824A-00AA005B4383}" : arSEA(79,1) = "browseui.dll" arSEA(80,0) = "{00BB2765-6A77-11D0-A535-00C04FD7D062}" : arSEA(80,1) = "browseui.dll" arSEA(81,0) = "{ECD4FC4E-521C-11D0-B792-00A0C90312E1}" : arSEA(81,1) = "browseui.dll" arSEA(82,0) = "{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}" : arSEA(82,1) = "browseui.dll" arSEA(83,0) = "{ECD4FC4C-521C-11D0-B792-00A0C90312E1}" : arSEA(83,1) = "browseui.dll" arSEA(84,0) = "{ECD4FC4D-521C-11D0-B792-00A0C90312E1}" : arSEA(84,1) = "browseui.dll" arSEA(85,0) = "{DD313E04-FEFF-11d1-8ECD-0000F87A470C}" : arSEA(85,1) = "browseui.dll" arSEA(86,0) = "{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}" : arSEA(86,1) = "browseui.dll" arSEA(87,0) = "{EFA24E61-B078-11d0-89E4-00C04FC9E26E}" : arSEA(87,1) = "shdocvw.dll" arSEA(88,0) = "{0A89A860-D7B1-11CE-8350-444553540000}" : arSEA(88,1) = "shdocvw.dll" arSEA(89,0) = "{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}" : arSEA(89,1) = "shdocvw.dll" arSEA(90,0) = "{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}" : arSEA(90,1) = "shdocvw.dll" arSEA(91,0) = "{FBF23B40-E3F0-101B-8488-00AA003E56F8}" : arSEA(91,1) = "shdocvw.dll" arSEA(92,0) = "{3C374A40-BAE4-11CF-BF7D-00AA006946EE}" : arSEA(92,1) = "shdocvw.dll" arSEA(93,0) = "{FF393560-C2A7-11CF-BFF4-444553540000}" : arSEA(93,1) = "shdocvw.dll" arSEA(94,0) = "{7BD29E00-76C1-11CF-9DD0-00A0C9034933}" : arSEA(94,1) = "shdocvw.dll" arSEA(95,0) = "{7BD29E01-76C1-11CF-9DD0-00A0C9034933}" : arSEA(95,1) = "shdocvw.dll" arSEA(96,0) = "{CFBFAE00-17A6-11D0-99CB-00C04FD64497}" : arSEA(96,1) = "shdocvw.dll" arSEA(97,0) = "{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}" : arSEA(97,1) = "shdocvw.dll" arSEA(98,0) = "{67EA19A0-CCEF-11d0-8024-00C04FD75D13}" : arSEA(98,1) = "shdocvw.dll" arSEA(99,0) = "{131A6951-7F78-11D0-A979-00C04FD705A2}" : arSEA(99,1) = "shdocvw.dll" arSEA(100,0) = "{9461b922-3c5a-11d2-bf8b-00c04fb93661}" : arSEA(100,1) = "shdocvw.dll" arSEA(101,

Regis59 · Answer

Salut

Il faut le telecharger, clik droit sur le lien < enregistrer sous.

a+

sergino17 · Answer

"Silent Runners.vbs", revision R50, https://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "avast!" = "C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [null data] "!AVG Anti-Spyware" = ""C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized" ["Anti-Malware Development a.s."] "Windows Defender" = ""C:\Program Files\Windows Defender\MSASCui.exe" -masquer" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {02478D38-C3F9-4EFB-9B51-7695ECA05670}\(Default) = (no title provided) -> {HKLM...CLSID} = "Yahoo! Toolbar Helper" \InProcServer32\(Default) = "C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll" ["Yahoo! Inc."] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "Aide pour le lien d'Adobe PDF Reader" \InProcServer32\(Default) = "C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {9030D464-4C02-4ABF-8ECC-5164760863C6}\(Default) = (no title provided) -> {HKLM...CLSID} = "Windows Live Sign-in Helper" \InProcServer32\(Default) = "C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll" [MS] {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}\(Default) = (no title provided) -> {HKLM...CLSID} = "Windows Live Toolbar Helper" \InProcServer32\(Default) = "C:\Program Files\Windows Live Toolbar\msntb.dll" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Extension Affichage Panorama du Panneau de configuration" -> {HKLM...CLSID} = "Extension Affichage Panorama du Panneau de configuration" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Extension icône HyperTerminal" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{472083B0-C522-11CF-8763-00608CC02F24}" = "avast" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] "{A155339D-CCCD-4714-85EB-3754B804C9DF}" = "a-squared Free Context Menu Shell Extension" -> {HKLM...CLSID} = "a-squared Free Context Menu" \InProcServer32\(Default) = "C:\PROGRA~1\A-SQUA~1\A2FREE~1.DLL" ["Emsi Software GmbH"] "{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D}" = "Messenger Sharing Folders" -> {HKLM...CLSID} = "Mes dossiers de partage" \InProcServer32\(Default) = "C:\Program Files\MSN Messenger\fsshext.8.1.0178.00.dll" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ <> "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}" = "AVG Anti-Spyware 7.5" -> {HKLM...CLSID} = "CShellExecuteHookImpl Object" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" ["Anti-Malware Development a.s."] <> "{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}" = "Microsoft AntiMalware ShellExecuteHook" -> {HKLM...CLSID} = "Microsoft AntiMalware ShellExecuteHook" \InProcServer32\(Default) = "C:\PROGRA~1\WIFD1F~1\MpShHook.dll" [MS] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] AVG Anti-Spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}" -> {HKLM...CLSID} = "CContextScan Object" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll" ["Anti-Malware Development a.s."] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ AVG Anti-Spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}" -> {HKLM...CLSID} = "CContextScan Object" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll" ["Anti-Malware Development a.s."] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ a2FreeContMenu\(Default) = "{A155339D-CCCD-4714-85EB-3754B804C9DF}" -> {HKLM...CLSID} = "a-squared Free Context Menu" \InProcServer32\(Default) = "C:\PROGRA~1\A-SQUA~1\A2FREE~1.DLL" ["Emsi Software GmbH"] avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] HKLM\Software\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\ a2FreeContMenu\(Default) = "{A155339D-CCCD-4714-85EB-3754B804C9DF}" -> {HKLM...CLSID} = "a-squared Free Context Menu" \InProcServer32\(Default) = "C:\PROGRA~1\A-SQUA~1\A2FREE~1.DLL" ["Emsi Software GmbH"] Group Policies {policy setting}: -------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "DisableRegistryTools" = (REG_DWORD) hex:0x00000000 {Prevent access to registry editing tools} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\web\wallpaper\Colline verdoyante.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\WINDOWS\web\wallpaper\Colline verdoyante.bmp" Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ "SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS] Enabled Scheduled Tasks: ------------------------ "MP Scheduled Scan" -> launches: "C:\Program Files\Windows Defender\MpCmdRun.exe Scan -RestrictPrivileges" [MS] "Vérifier les mises à jour de Windows Live Toolbar" -> launches: "C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE" [MS] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 15 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}" -> {HKLM...CLSID} = "Windows Live Toolbar" \InProcServer32\(Default) = "C:\Program Files\Windows Live Toolbar\msntb.dll" [MS] "{EF99BD32-C1FB-11D2-892F-0090271D4F88}" -> {HKLM...CLSID} = "Yahoo! Toolbar avec bloqueur de fenêtres pop-up" \InProcServer32\(Default) = "C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll" ["Yahoo! Inc."] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}" = (no title provided) -> {HKLM...CLSID} = "Windows Live Toolbar" \InProcServer32\(Default) = "C:\Program Files\Windows Live Toolbar\msntb.dll" [MS] "{EF99BD32-C1FB-11D2-892F-0090271D4F88}" = (no title provided) -> {HKLM...CLSID} = "Yahoo! Toolbar avec bloqueur de fenêtres pop-up" \InProcServer32\(Default) = "C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll" ["Yahoo! Inc."] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {E2E2DD38-D088-4134-82B7-F2BA38496583}\ "MenuText" = "@xpsp3res.dll,-20001" "Exec" = "%windir%\Network Diagnostic\xpnetdiag.exe" [MS] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS] Miscellaneous IE Hijack Points ------------------------------ HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\ <> "{EF99BD32-C1FB-11D2-892F-0090271D4F88}" = "*[" (unwritable string) -> {HKLM...CLSID} = "Yahoo! Toolbar avec bloqueur de fenêtres pop-up" \InProcServer32\(Default) = "C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll" ["Yahoo! Inc."] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\System32\Ati2evxx.exe" ["ATI Technologies Inc."] avast! Antivirus, avast! Antivirus, ""C:\Program Files\Alwil Software\Avast4\ashServ.exe"" [null data] avast! iAVS4 Control Service, aswUpdSv, ""C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe"" [null data] avast! Mail Scanner, avast! Mail Scanner, ""C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service" ["ALWIL Software"] avast! Web Scanner, avast! Web Scanner, ""C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service" ["ALWIL Software"] PCTEL Speaker Phone, Pctspk, "C:\WINDOWS\system32\pctspk.exe" ["PCtel, Inc."] Windows Defender, WinDefend, ""C:\Program Files\Windows Defender\MsMpEng.exe"" [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ LPR Port\Driver = "lprmon.dll" [MS] ---------- <>: Suspicious data at a malware launch point. <>: Suspicious data at a browser hijack point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer "No" at the first message box and "Yes" at the second message box. ---------- (total run time: 72 seconds, including 9 seconds for message boxes) salut A+

Regis59 · Answer

Salut

Je n'ai rien vu.
A² est clean? Si oui, cela ne vient pas d une infection, on cherchera ailleurs.

a+

sergino17 · Answer

Salut
excuse moi, A2, je ne sais pas ce que c'est
merci, A+

Regis59 · Answer

a-squared 

A+

sergino17 · Answer

Salut 
voici le rapport A+Version - a-squared Free 2.1

Réglages Scan:

Objets: Mémoire, Traces, Cookies, C:\WINDOWS\, C:\Program Files
Scan archives: Marche
Heuristiques: Marche
Scan ADS: Marche

Début du scan:	29/03/2007 19:46:57

C:\Program Files\emule 	Détecter: Trace.Directory.Emule
C:\Program Files\emule\config 	Détecter: Trace.Directory.Emule
C:\Program Files\emule\config\preferences.ini 	Détecter: Trace.File.Emule
Value: HKEY_CURRENT_USER\Software\eMule --> Install Path 	Détecter: Trace.Registry.Emule

Scanné

Fichiers: 	28105
Traces: 	105056
Cookies: 	1
Processus: 	29

Trouver

Fichiers: 	0
Traces: 	4
Cookies: 	0
Processus: 	0
Clés de Registre: 	0

Fin du Scan:	29/03/2007 20:03:51
Temps du Scan:	00:16:54
avant ca j'avais scanné en mse avec AVG, avaant de re au bout de 20 mn, il avait trouvé 3 cookie , risque moyen et un risque élevé:DIALER.FREfr

Merci
A+

sergino17 · Answer

Bonsoir,
le scann, je l'avait fait scann rusé
j'ai refait scann complet
il avait trouvé: Riskware.risk tool.Win32.Pskill.k,i fichier,haut risque
                             Riskware       "            "       .Processor.20 2fichiers,haut risVersion - a-squared Free 2.1

Réglages Scan:

Objets: Mémoire, Traces, Cookies, C:\
Scan archives: Marche
Heuristiques: Marche
Scan ADS: Marche

Début du scan:	29/03/2007 20:54:10

C:\Program Files\emule 	Détecter: Trace.Directory.Emule
C:\Program Files\emule\config 	Détecter: Trace.Directory.Emule

Scanné

Fichiers: 	64767
Traces: 	105056
Cookies: 	4
Processus: 	27

Trouver

Fichiers: 	0
Traces: 	2
Cookies: 	0
Processus: 	0
Clés de Registre: 	0

Fin du Scan:	29/03/2007 21:21:44
Temps du Scan:	00:27:34
j'ai tout mis en quarantaine
pendant le scann, l'UC montait a 100%
A+
merci

Regis59 · Answer

Le DIALER.FREfr ; il le détectait ou?

A+

sergino17 · Answer

Salut
il le détectait avec AVG, je l'ai noté avant qu'il ne redémarre mais je n'ai pas vu dans quel fichier,
comment faire pour le voir la prochaine foi si il ne va pas jusqu'au bout de scann? 
merci

sergino17 · Answer

Regis
Salut
je viens de faire un scann avec AVG
voici le rapport---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

 + Créé à:	18:23:14 30/03/2007

 + Résultat de l'analyse:	



	Rien à signaler.



Fin du rapport

mes ennuis serait ils finis?
vraiment , bravo et merci

sergino17 · Answer

Hello
je viens de faire un scann avec spybot, il a été jusqu'au bout
---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

 + Créé à:	18:23:14 30/03/2007

 + Résultat de l'analyse:	



	Rien à signaler.



Fin du rapport

dois-je effacer ce que j'ai mis en quarantaine sur AVG?
il n'a jamais aussi bien tourné
merci

Regis59 · Answer

Salut

Oui supprime !

Ou en sont tes soucis?

A+

sergino17 · Answer

Salut Regis
je viens de supprimer tout ce qu'il y avait en quarantaine sur A²
pour la première foi depuis longtemps j'ai pu scanner avec AVG et surtout spybot, a part le scann avec A², je n'ai rien fait d'autre que toutes les procédures ci dessus, 
Pour moi l'ordi est quelquechose d'important et grace a toi il remarche encore mieux
si la meme chose arrive a d'autres: patiente et confiance, tout fini par s'arranger
MERCI Régis

Regis59 · Answer

De rien,

Profite bien de ton PC et garde le en vie proprement :)

A+

s · Answer

Salut 
message reçu
A+

Regis59 · Answer

oki

a+

sergino17 · Answer

Salut
Mon ordinateur me semblait refonctionner, il tourne beaucoup mieux qu'avant. J'ai voulu faire comme indiqué sur le forum:"Si vous avez un doute quant à la bonne santé de votre PC, cela peut être la manifestation des prodromes d'une quelconque infection

Dans le dessein de gagner en vitesse et en efficacité, je vous propose une méthode préliminaire qu'il faut impérativement effectuer intégralement et dans l'ordre

Note : Pour effectuer ces opérations, il est inutile de désactiver ou de désinstaller le(s) système(s) de protection tel que l’Antivirus, le Pare-feu et autres logiciels similaires..." 
Lorsque j'ai mis AVG, il a redémarré, s&d aussi, il n'y a que A² qui fonctionne parfois, resultat clean, et parfois il redémarre aussi, parfoi il se bloque,j'ai noté le fichier qu'il scannait au blocage;1erefoi:C\WINDOWS\driver cache\386\driver.cab/tbatm155.sys
                              2eme foi:C\program.files\...\data.cab/read outloud.api
J'ai fait un scann avec Reg Supreme et il me donne le résultét suivant: dois-je supprimmer tout ces fichiers qui sont indiqués soit"inutiles" ou "incorrects"
HKCR\AcroExch.Sequence\DefaultIcon\ | @ | "C:\WINDOWS\Installer\{AC76BA86-7AD7-1036-7B44-A80000000002}\SequenceFile.ico" n'existe pas.
HKCR\Applications\WINWORD.EXE\TaskbarExceptionsIcons\explorer.exe,16\ | @ | "C:\Program Files\Microsoft Office\Office10\OUTLOOK.EXE" n'existe pas.
HKCR\FoxitReader.Document\ | {CLE} | Entrée ProgID incorrect (OLE / DDE).
HKCR\FoxitReader.Document\ | @ | Entrée ProgID incorrect (OLE / DDE).
HKCR\FoxitReader.Document\CLSID\ | @ | Entrée ProgID incorrect (OLE / DDE).
HKCR\FoxitReader.Document\DocObject\ | @ | Entrée ProgID incorrect (OLE / DDE).
HKCR\FoxitReader.Document\Insertable\ | @ | Entrée ProgID incorrect (OLE / DDE).
HKCR\FoxitReader.Document\protocol\StdFileEditing\server\ | @ | Entrée ProgID incorrect (OLE / DDE).
HKCR\FoxitReader.Document\protocol\StdFileEditing\verb\0\ | @ | Entrée ProgID incorrect (OLE / DDE).
HKCR\Installer\Products\2509FC9A0A4FD5740AF08A83C826DD36\SourceList\Net\ | 1 | "c:\25db8beac7bc1b6d5c54c2d8b88f\" n'existe pas.
HKCR\Installer\Products\6030E61781384634B8F8C04C9E73B6CA\SourceList\Net\ | 1 | "C:\Program Files\Microsoft Windows OneCare Live\Staging\" n'existe pas.
HKCR\Installer\Products\B4D8F7D64A1DA20479E3139E90045E58\SourceList\Net\ | 1 | "C:\WINDOWS\TEMP\IXP000.TMP" n'existe pas.
HKCR\msbackupfile\ | FriendlyTypeName | "C:\WINDOWS\System32
tbackup.exe" n'existe pas.
HKCU\AppEvents\Schemes\Apps\MSNMSGR\MSNMSGR_NewSMSMessage\.Current\ | @ | "C:\Program Files\MSN Messengering.wav" n'existe pas.
HKCU\Software\Gabest\VSFilter\DefTextPathes\ | Path1 | "c:\subtitles" n'existe pas.
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{0D6D4F41-2994-4BA0-8FEF-620E43CD2812}\Count\ | HRZR_PGYFRFFVBA | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count\ | HRZR_PGYFRFFVBA | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count\ | HRZR_PGYPHNPbhag:pgbe | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count\ | HRZR_HVGBBYONE | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count\ | HRZR_HVGBBYONE:0k1,120 | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count\ | HRZR_HVGBBYONE:0k1,126 | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count\ | HRZR_HVGBBYONE:0k1,122 | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count\ | HRZR_EHACVQY:%pfvqy6%\Frphfre.pbz - Ybtvpvryf erpbzznaqéf.hey | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count\ | HRZR_HVGBBYONE:0k1,121 | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count\ | HRZR_HVGBBYONE:0k1,130 | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count\ | HRZR_HVGBBYONE:0k1,7011 | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count\ | HRZR_HVGBBYONE:0k4,7011 | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count\ | HRZR_EHACVQY:%pfvqy6%\Fhepbhs, yr fcrpvnyvfgr qr y vasbezngvdhr  zngrevryf, ybtvpvryf rg npprffbverf.hey | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count\ | HRZR_EHACVQY:%pfvqy6%\Pbzzhanhgé Pyhovp.pbz - zba beqv rfg vasrpgé ivehf, znyjner....hey | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count\ | HRZR_EHACVQY:%pfvqy6%\Orfbv Q'nvqr Cbhe Nanylfr Uvgwnpxguvf - Sbehz Vasbezngvdhr.hey | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count\ | HRZR_EHACVQY:%pfvqy6%\Géyépunetre Rg Hgvyvfre Fzvgsenhqsvk - CP Ragenvqr.hey | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count\ | HRZR_HVGBBYONE:0k4,7031 | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count\ | HRZR_HVGBBYONE:0k1,133 | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count\ | HRZR_HVGBBYONE:0k1,123 | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_PGYFRFFVBA | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\Yrpgrhe Jvaqbjf Zrqvn.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_PGYPHNPbhag:pgbe | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Cebtenz Svyrf\Fclobg - Frnepu & Qrfgebl\FclobgFQ.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHAPCY | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHAPCY:"P:\JVAQBJF\Flfgrz32
ccjvm.pcy",Nwbhg/Fhccerffvba qr cebtenzzrf | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Cebtenz Svyrf\Erny\ErnyCynlre\ernycynl.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_HVFPHG | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:::{645SS040-5081-101O-9S08-00NN002S954R} | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:W:\OhernhQrCbpur\JvaqbjfKC-XO835935-FC2-SEN.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\JVAQBJF\flfgrz32\ABGRCNQ.RKR | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHAPCY:"P:\JVAQBJF\flfgrz32\jfphv.pcy",Prager qr féphevgé | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHAPCY:"P:\JVAQBJF\flfgrz32\sverjnyy.pcy",Cner-srh Jvaqbjf | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Cebtenz Svyrf\Vagrearg Rkcybere\vrkcyber.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:::{2559N1S4-21Q7-11Q4-OQNS-00P04S60O9S0} | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHAPCY:qrfx.pcy | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:nqfy GI.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Cebtenz Svyrf
qfyGI
qfyGI.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\Cebcevégnver.FRETR.001\Ohernh\frghc-nqfygi.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\Cebcevégnver\Zrf qbphzragf\OhernhQrCbpur
ccfsvkrf\BcraBssvpr\CbegnoyrBbQenj.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:PPyrnare.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Cebtenz Svyrf\PPyrnare\ppyrnare.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\Cebcevégnver.FRETR.001\Ohernh\Vafgnyy_ZFA_Zrffratre.RKR | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\CEBTEN~1\ZBMVYY~1\SVERSBK.RKR | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\Bhgybbx Rkcerff.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Cebtenz Svyrf\Bhgybbx Rkcerff\zfvza.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\Cebcevégnver.FRETR.001\Ohernh
njfrcrefbany.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\Yninfbsg Nq-Njner FR Crefbany\Nq-Njner FR Znahny.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\Yninfbsg Nq-Njner FR Crefbany\Havafgnyy Nq-Njner FR Crefbany.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:Enppbhepv iref Qbphzragf naq Frggvatf.ya | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\Npprffbverf\Bhgvyf flfgèzr\Arggblntr qr qvfdhr.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\Npprffbverf\Bhgvyf flfgèzr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\Npprffbverf | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\JVAQBJF\flfgrz32\pyrnazte.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\Vagrearg Rkcybere.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\Zbmvyyn Sversbk\Zbmvyyn Sversbk.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\Zbmvyyn Sversbk | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Cebtenz Svyrf\Zbmvyyn Sversbk\sversbk.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:01arg. Gryrpunetre.pbz  jvaqbjf - gryrpu | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\Yninylf | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\Yninylf\RIRERFG Hygvzngr Rqvgvba | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\Yninylf\RIRERFG Hygvzngr Rqvgvba\RIRERFG Hygvzngr Rqvgvba ba gur Jro.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:RIRERFG Hygvzngr Rqvgvba.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Cebtenz Svyrf\Yninylf\RIRERFG Hygvzngr Rqvgvbairerfg.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\Cebcevégnver.FRETR.001\Ohernh\on.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\JVAQBJF\flfgrz32\zzp.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHAPCY:FLFQZ.PCY | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:ninfg! Nagvivehf.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\Fclobg - Frnepu & Qrfgebl\Havafgnyy Fclobg - Frnepu & Qrfgebl.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\Cebcevégnver.FRETR.001\Ohernh\xni4pcs1_5.5.145_ra.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\JVAQBJF\uu.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\Xnfcrefxl Nagv-Ivehf 5.5 sbe Purpx Cbvag SverJnyy-1 | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%
-fdhnerq Serr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%
-fdhnerq Serr
-fdhnerq Ubzrcntr.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%
-fdhnerq Serr\Fpna Ercbegf.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\Yninfbsg Nq-Njner FR Crefbany | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Cebtenz Svyrf\Yninfbsg\Nq-Njner FR Crefbany\Nq-Njner.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:n-fdhnerq Serr.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Cebtenz Svyrf
-fdhnerq Serr
2serr.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%
-fdhnerq Serr
-fdhnerq Serr.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\Cebcevégnver.FRETR.001\Ohernh\SvkOynfg(2).rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\Zbmvyyn Guhaqreoveq\Ernqzr.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:ErtPyrnare.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Cebtenz Svyrf\ErtPyrnare\ErtPyrnae.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\JVAQBJF\flfgrz32\ehaqyy32.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\Cebcevégnver.FRETR.001\Zrf qbphzragf\oynpxobk.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\Cebcevégnver.FRETR.001\Zrf qbphzragf\qrcnaantr.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\Cebcevégnver.FRETR.001\Zrf qbphzragf\Jro.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\Cebcevégnver.FRETR.001\Zrf qbphzragf\zrah\Perngvba_zrah.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\Cebcevégnver.FRETR.001\Zrf qbphzragf\zrah\zba_zrah_qrfnpgvir.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\Cebcevégnver.FRETR.001\Zrf qbphzragf\ofrgebbg.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\Cebcevégnver.FRETR.001\Zrf qbphzragf\ofrgot.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\Cebcevégnver.FRETR.001\Zrf qbphzragf
ccfsvkrf\SbkvgErnqre\SbkvgErnqre.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:Zbmvyyn Sversbk.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHAPCY:"P:\JVAQBJF\flfgrz32\znva.pcy",Fbhevf | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHAPCY:"P:\JVAQBJF\flfgrz32\flfqz.pcy",Flfgèzr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\Cebcevégnver.FRETR.001\Ohernh\Jro.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHAPCY:"P:\JVAQBJF\flfgrz32\vargpcy.pcy",Bcgvbaf Vagrearg | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:W:\cebtenzzrf\cebtenzzrf\qvpgvbaanver nat-senap\qvp_natynvf.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:W:\cebtenzzrf\cebtenzzrf\qvpgvbaanver nat-senap\qvpgvbaanver_frghc.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:W:\cebtenzzrf\cebtenzzrf\qvpgvbaanver nat-senap\qvpgvbaanver_frghc(3).rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\JVAQBJF\flfgrz32\cvat.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\Serrcynlre\IYP Serrcynlre.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\Serrcynlre | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:(ahyy) | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%
qfy GI | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:W:\cebtenzzrf\cebtenzzrf\frghc-nqfygi.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%
qfy GI\Nvqr nqfy GI.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%
qfy GI\Sbehzf nqfy GI.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\Cebcevégnver.FRETR.001\Ohernh\SvkOynfg.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Cebtenz Svyrf\Tevfbsg\NIT Nagv-Fcljner 7.5
itnf.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\Cebcevégnver.FRETR.001\Ohernh\FzvgsenhqSvk\FzvgsenhqSvk\Erobbg.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\Npprffbverf\Pbzzhavpngvbaf\Géyépbcvrhe | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\Cebcevégnver.FRETR.001\Ohernh\JTNCyhtvaVafgnyy.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\Cebcevégnver.FRETR.001\Ohernh\TrahvarPurpx.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%ZhyrZhyr.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%Zhyr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Cebtenz SvyrfZhyrzhyr.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:Fvgrf choyvpf senaçnvf.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:{O72O0RPR-S41R-4RP4-NN37-1N00640680OS} | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2% | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\Cebcevégnver.FRETR.001\Ohernh\UvwnpxGuvf.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\Npprffbverf\Nffvfgnag Pbzcngvovyvgé qrf cebtenzzrf.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:Enppbhepv iref PUNAFBAF rg zrf ivqébf (W | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Cebtenz Svyrf\IvqrbYNA\IYP\iyp.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\PPyrnare\PPyrnare.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\Cebcevégnver.FRETR.001\Ohernh\IveghzhaqbOrTbar.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\Cebcevégnver.FRETR.001\Ohernh\szgvafgnyy.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Cebtenz Svyrf\Synfu Zrzbel Gbbyxvg\SynfuZrzbelGbbyxvg.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Cebtenz Svyrf\Synfu Zrzbel Gbbyxvg\havaf000.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\Synfu Zrzbel Gbbyxvg\Synfu Zrzbel Gbbyxvg ba gur Jro.hey | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\Synfu Zrzbel Gbbyxvg | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\Yninylf\RIRERFG Hygvzngr Rqvgvba\RIRERFG Hygvzngr Rqvgvba.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:PbzzragPnZnepur.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\Fclobg - Frnepu & Qrfgebl\Fclobg - Frnepu & Qrfgebl.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\Fclobg - Frnepu & Qrfgebl | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\NIT Nagv-Fcljner 7.5\NIT Nagv-Fcljner.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\NIT Nagv-Fcljner 7.5 | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:NIT Nagv-Fcljner.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHAPCY:"P:\JVAQBJF\flfgrz32\jhnhpcy.pcy",Zvfrf à wbhe nhgbzngvdhrf | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Cebtenz Svyrf\Jvaqbjf Qrsraqre\ZFNFPhv.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:Jvaqbjf Zbivr Znxre.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Cebtenz Svyrf\Zbivr Znxre\zbivrzx.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHAPCY:"P:\JVAQBJF\flfgrz32\ZZFLF.PCY",@0 | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:Cnvag.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\Jvaqbjf Zbivr Znxre.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\Npprffbverf\Jvaqbjf Zbivr Znxre.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\Cebcevégnver.FRETR.001\Ohernh\Jvaqbjf_Zbivr_Znxre_2.0.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\Zbmvyyn Guhaqreoveq\Zbmvyyn Guhaqreoveq.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\Zbmvyyn Guhaqreoveq | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Cebtenz Svyrf\Zbmvyyn Guhaqreoveq\guhaqreoveq.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:Wnetba Vasbezngvdhr.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:Enppbhepv iref Vapbzvat.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:JbeqCnq.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Cebtenz Svyrf\Jvaqbjf AG\Npprffbverf\jbeqcnq.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\Cebcevégnver.FRETR.001\fretvb\qrcnaantr.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\Cebcevégnver.FRETR.001\fretvb\RIRERFG Hygvzngr Rqvgvbairerfg.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:P:\Qbphzragf naq Frggvatf\Nyy Hfref.JVAQBJF\Ohernh | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:SerrRnflMnc.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Cebtenz Svyrf\SerrRnflMnc\SerrRnflMnc.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\JVAQBJF\ertrqvg.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\Zhygv Ivehf Pyrnare 2007\Zhygv Ivehf Pyrnare 2007.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\Zhygv Ivehf Pyrnare 2007 | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Cebtenz Svyrf\NkOk\Zhygv Ivehf Pyrnare 2007\ZIP.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\Cebcevégnver.FRETR.001\Ohernh\FQSvk.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Cebtenz Svyrf
qfyGI\iyp.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\PbzzragPnZnepur\Raplpybcéqvr Pbzzrag çn Znepur.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\PbzzragPnZnepur | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\SerrRnflMnc 2.0\SerrRnflMnc.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\SerrRnflMnc 2.0 | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\Npprffbverf\Bhgvyf flfgèzr\Qésentzragrhe qr qvfdhr.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\Zhygv Ivehf Pyrnare 2007\Cntr q'npphrvy qr Zhygv Ivehf Pyrnare 2007.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHAPCY:"P:\JVAQBJF\flfgrz32\uqjjvm.pcy",Nwbhg qr zngéevry | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\wi16 CbjreGbbyf 2006\Unaqobbx.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\wi16 CbjreGbbyf 2006 | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Cebtenz Svyrf\Nqbor\Ernqre 8.0\Ernqre\NpebEq32.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\wi16 CbjreGbbyf 2006\wi16 CbjreGbbyf.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Cebtenz Svyrf\wi16 CbjreGbbyf 2006\wi16CG.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:ErtFhcerzr Ceb.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Cebtenz Svyrf\ErtFhcerzr Ceb\ErtFhcerzrCeb.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\Cebcevégnver.FRETR.001\Ohernh\wi16cg_frghc_uo.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:wi16 CbjreGbbyf.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Cebtenz Svyrf\wi16 CbjreGbbyf 2006\wi16 CbjreGbbyf.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\Yninfbsg Nq-Njner FR Crefbany\Nq-Njner FR Crefbany.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\JVAQBJF\Flfgrz32\JFpevcg.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Cebtenz Svyrf\Serr.se\vpbas.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\PyrnaHc!\PyrnaHc!.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\PyrnaHc! | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Cebtenz Svyrf\PyrnaHc!\Pyrnahc.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\Cebcevégnver.FRETR.001\OhernhZhyr0.47p-Vafgnyyre.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\IvqrbYNA\Dhvpx Frggvatf\Nhqvb\Frg Nhqvb zbqr gb QverpgK (qrsnhyg).yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\IvqrbYNA\Dhvpx Frggvatf\Nhqvb\Frg Nhqvb zbqr gb Jnirbhg.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\IvqrbYNA\Dhvpx Frggvatf\Vagresnpr\Frg Znva Vagresnpr gb Fxvaanoyr.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\IvqrbYNA\Dhvpx Frggvatf\Vagresnpr\Frg Znva Vagresnpr gb jkJvqtrgf (qrsnhyg).yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%Zhyr\YvaxPerngbe.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%Zhyr\Havafgnyy rZhyr.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\Npprffbverf\Oybp-abgrf.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\SerrRnflMnc 2.0\Qéfvafgnyyre SerrRnflMnc 2.0.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Cebtenz Svyrf\SerrRnflMnc\havafgnyy.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\Npprffbverf\Bhgvyf flfgèzr\Vagrearg Rkcybere (fnaf zbqhyr pbzcyézragnver).yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\Npprffbverf\Bhgvyf flfgèzr\Vagrearg Rkcybere (Nhpha zbqhyr pbzcyézragnver).yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Cebtenz Svyrf\Jvaqbjf Zrqvn Cynlre\jzcynlre.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\Cebcevégnver.FRETR.001\Ohernh\QviKCynl.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\Qvpgvbaanver\Natynvf-Senaçnvf.yax | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\Qvpgvbaanver | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Cebtenz Svyrf\Qvpgvbaanver\qvpg.rkr | Clé vide inutile
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\Cebcevégnver\Zrf qbphzragf\OhernhQrCbpur
ccfsvkrf\BcraBssvpr\CbegnoyrBbQenj.rkr | "C:\Documents and Settings\Propriétaire\Mes documents\BureauDePoche\appsfixes\OpenOffice\PortableOoDraw.exe" n'existe pas.
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Cebtenz Svyrf\Yninylf\RIRERFG Hygvzngr Rqvgvbairerfg.rkr | "C:\Program Files\Lavalys\EVEREST Ultimate Edition\everest.exe" n'existe pas.
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Cebtenz SvyrfZhyrzhyr.rkr | "C:\Program Files\eMule\emule.exe" n'existe pas.
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Cebtenz Svyrf\Synfu Zrzbel Gbbyxvg\SynfuZrzbelGbbyxvg.rkr | "C:\Program Files\Flash Memory Toolkit\FlashMemoryToolkit.exe" n'existe pas.
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Cebtenz Svyrf\Synfu Zrzbel Gbbyxvg\havaf000.rkr | "C:\Program Files\Flash Memory Toolkit\unins000.exe" n'existe pas.
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Cebtenz Svyrf\Jvaqbjf Qrsraqre\ZFNFPhv.rkr | "C:\Program Files\Windows Defender\MSASCui.exe" n'existe pas.
HKCU\Software\Temp_00025F6C\ | {CLE} | Entrée programme obsolète.
HKLM\Software\classes\AcroExch.Sequence\DefaultIcon\ | @ | "C:\WINDOWS\Installer\{AC76BA86-7AD7-1036-7B44-A80000000002}\SequenceFile.ico" n'existe pas.
HKLM\Software\classes\Applications\WINWORD.EXE\TaskbarExceptionsIcons\explorer.exe,16\ | @ | "C:\Program Files\Microsoft Office\Office10\OUTLOOK.EXE" n'existe pas.
HKLM\Software\classes\FoxitReader.Document\ | {CLE} | Entrée ProgID incorrect (OLE / DDE).
HKLM\Software\classes\Installer\Products\2509FC9A0A4FD5740AF08A83C826DD36\SourceList\Net\ | 1 | "c:\25db8beac7bc1b6d5c54c2d8b88f\" n'existe pas.
HKLM\Software\classes\Installer\Products\6030E61781384634B8F8C04C9E73B6CA\SourceList\Net\ | 1 | "C:\Program Files\Microsoft Windows OneCare Live\Staging\" n'existe pas.
HKLM\Software\classes\Installer\Products\B4D8F7D64A1DA20479E3139E90045E58\SourceList\Net\ | 1 | "C:\WINDOWS\TEMP\IXP000.TMP" n'existe pas.
HKLM\Software\classes\msbackupfile\ | FriendlyTypeName | "C:\WINDOWS\System32
tbackup.exe" n'existe pas.
HKLM\Software\Microsoft\Active Setup\ | JITSetupPage | "C:\WINDOWS\web\iejit.htm" n'existe pas.
HKLM\Software\Microsoft\Advanced INF Setup\IE UserData NT\ | BackupFileName | "C:\Program Files\Uninstall Information\IE UserData NT\IE UserData NT.DAT" n'existe pas.
HKLM\Software\Microsoft\Advanced INF Setup\IE UserData NT\ | BackupPath | "C:\Program Files\Uninstall Information\IE UserData NT" n'existe pas.
HKLM\Software\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\ | BackupFileName | "C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.DAT" n'existe pas.
HKLM\Software\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\ | BackupPath | "C:\Program Files\Uninstall Information\IE.HKC" n'existe pas.
HKLM\Software\Microsoft\Advanced INF Setup\IE40.UserAgent\ | BackupFileName | "C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.DAT" n'existe pas.
HKLM\Software\Microsoft\Advanced INF Setup\IE40.UserAgent\ | BackupPath | "C:\Program Files\Uninstall Information\IE40.User" n'existe pas.
HKLM\Software\Microsoft\Advanced INF Setup\IEHomePageInfo\ | BackupFileName | "C:\Program Files\Uninstall Information\IEHomePageInfo\IEHomePageInfo.DAT" n'existe pas.
HKLM\Software\Microsoft\Advanced INF Setup\IEHomePageInfo\ | BackupPath | "C:\Program Files\Uninstall Information\IEHomePageInfo" n'existe pas.
HKLM\Software\Microsoft\Java VM\ | LibsDirectory | "C:\WINDOWS\java\lib" n'existe pas.
HKLM\Software\Microsoft\Multimedia\MPlayer2\Groups\Video\DVR-MS\ | RequiredFile | "C:\WINDOWS\system32\enable.dvd" n'existe pas.
HKLM\Software\Microsoft\PCHealth\ErrorReporting\KernelFaults\ | C:\WINDOWS\Minidump\Mini040407-01.dmp | "C:\WINDOWS\Minidump\Mini040407-01.dmp" n'existe pas.
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Asr\Commands\ | ASR format utility for volumes | "C:\WINDOWS\system32\asr_fmt.exe" n'existe pas.
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Asr\Commands\ | ASR protected file utility | "C:\WINDOWS\system32\asr_pfu.exe" n'existe pas.
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Asr\Commands\ | ASR utility for Logical Disk Manager | "C:\WINDOWS\system32\asr_ldm.exe" n'existe pas.
HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\install.exe\ | {CLE} | Entrée "Application" incorrecte.
HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\install.exe\ | RunAsOnNonAdminInstall | Entrée "Application" incorrecte.
HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\install.exe\ | BlockOnTSNonInstallMode | Entrée "Application" incorrecte.
HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\setup.exe\ | {CLE} | Entrée "Application" incorrecte.
HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\setup.exe\ | RunAsOnNonAdminInstall | Entrée "Application" incorrecte.
HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\setup.exe\ | BlockOnTSNonInstallMode | Entrée "Application" incorrecte.
HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths	able30.exe\ | {CLE} | Entrée "Application" incorrecte.
HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths	able30.exe\ | UseShortName | Entrée "Application" incorrecte.
HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\winnt32.exe\ | {CLE} | Entrée "Application" incorrecte.
HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\winnt32.exe\ | RunAsOnNonAdminInstall | Entrée "Application" incorrecte.
HKLM\Software\Microsoft\Windows\CurrentVersion\Applets\DeluxeCD\Providers\Provider0000\ | ProviderLogo | "C:\WINDOWS\System32	unes.bmp" n'existe pas.
HKLM\Software\Microsoft\Windows\CurrentVersion\Applets\DeluxeCD\Providers\Provider0001\ | ProviderLogo | "C:\WINDOWS\System32
2k.bmp" n'existe pas.
HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Extended Properties\{305CA226-D286-468e-B848-2B2E8E697B74} 2\ | %SystemRoot%\system32
wc.cpl | "C:\WINDOWS\system32
wc.cpl" n'existe pas.
HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Extended Properties\{305CA226-D286-468e-B848-2B2E8E697B74} 2\ | %SystemRoot%\system32\sticpl.cpl | "C:\WINDOWS\system32\sticpl.cpl" n'existe pas.
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\WebView\TemplateMacros\BACKGROUNDIMAGE\ | @ | "C:\WINDOWS\Web\wvleft.bmp" n'existe pas.
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\WebView\TemplateMacros\LOGOLINE\ | @ | "C:\WINDOWS\Web\wvline.gif" n'existe pas.
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1321ECD60121176448F92F0A834A7675\ | 00000000000000000000000000000000 | "C:\Program Files\Microsoft Windows OneCare Live\OCSetup.exe" n'existe pas.
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7274AF0DE10294440BB53DFA840D5CE6\ | 00000000000000000000000000000000 | "C:\Program Files\Microsoft Windows OneCare Live\" n'existe pas.
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B7C40C7BF9B4B544A821CABA0FE703F4\ | 00000000000000000000000000000000 | "C:\Program Files\Microsoft Windows OneCare Live\WinSSWebAgent.dll" n'existe pas.
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EBCEA20E8C979C7439DBE64E103E89B6\ | 00000000000000000000000000000000 | "C:\Program Files\Microsoft Windows OneCare Live\WinSSWebAgentTlb.dll" n'existe pas.
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\2509FC9A0A4FD5740AF08A83C826DD36\InstallProperties\ | InstallSource | "c:\25db8beac7bc1b6d5c54c2d8b88f\" n'existe pas.
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\6030E61781384634B8F8C04C9E73B6CA\InstallProperties\ | InstallSource | "C:\Program Files\Microsoft Windows OneCare Live\Staging\" n'existe pas.
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\B4D8F7D64A1DA20479E3139E90045E58\InstallProperties\ | InstallSource | "C:\WINDOWS\TEMP\IXP000.TMP" n'existe pas.
HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide\PatchedComponents\ | {98CB1B80-5997-DB5F-B01F-C8B3B9A1E18E} | "C:\WINDOWS\winsxs\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0" n'existe pas.
HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide\PatchedComponents\ | {98CB16C1-5C55-DB5F-B01F-C8B3B9A1E18E} | "C:\WINDOWS\winsxs\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0" n'existe pas.
HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide\PatchedComponents\ | {98CB1712-5C31-DB5F-B01F-C8B3B9A1E18E} | "C:\WINDOWS\winsxs\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0" n'existe pas.
HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide\PatchedComponents\ | {98CB1763-5C0D-DB5F-B01F-C8B3B9A1E18E} | "C:\WINDOWS\winsxs\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.95" n'existe pas.
HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide\PatchedComponents\ | {98CB17B4-5BE9-DB5F-B01F-C8B3B9A1E18E} | "C:\WINDOWS\winsxs\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0" n'existe pas.
HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide\PatchedComponents\ | {98CB1805-5BC5-DB5F-B01F-C8B3B9A1E18E} | "C:\WINDOWS\winsxs\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0" n'existe pas.
HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide\PatchedComponents\ | {98CB1856-5BA1-DB5F-B01F-C8B3B9A1E18E} | "C:\WINDOWS\winsxs\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.98" n'existe pas.
HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide\PatchedComponents\ | {98CB18A7-5B7D-DB5F-B01F-C8B3B9A1E18E} | "C:\WINDOWS\winsxs\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0" n'existe pas.
HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide\PatchedComponents\ | {9C01957A-EA3F-10B0-B01F-C8B3B9A1E18E} | "C:\WINDOWS\winsxs\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0" n'existe pas.
HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide\PatchedComponents\ | {9C00AED1-EA89-10B1-B01F-C8B3B9A1E18E} | "C:\WINDOWS\winsxs\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0" n'existe pas.
HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide\PatchedComponents\ | {9BFEE17F-EB1D-10B3-B01F-C8B3B9A1E18E} | "C:\WINDOWS\winsxs\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0" n'existe pas.
HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide\PatchedComponents\ | {9BFDFAD6-EB67-10B4-B01F-C8B3B9A1E18E} | "C:\WINDOWS\winsxs\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0" n'existe pas.
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime\ | {CLE} | Entrée du menu "Ajoût/Suppression de programmes" obsolète.
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\eMule\ | {CLE} | Entrée du menu "Ajoût/Suppression de programmes" obsolète.
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft NetShow Player 2.0\ | {CLE} | Entrée du menu "Ajoût/Suppression de programmes" obsolète.
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2\ | {CLE} | Entrée du menu "Ajoût/Suppression de programmes" obsolète.
HKUS\.DEFAULT\Software\Microsoft\Windows\ShellNoRoam\MUICache\ | C:\Program Files\eMule\emule.exe | "C:\Program Files\eMule\emule.exe" n'existe pas.
HKUS\S-1-5-18\Software\Microsoft\Windows\ShellNoRoam\MUICache\ | C:\Program Files\eMule\emule.exe | "C:\Program Files\eMule\emule.exe" n'existe pas.
HKUS\S-1-5-21-1202660629-790525478-682003330-1003\AppEvents\Schemes\Apps\MSNMSGR\MSNMSGR_NewSMSMessage\.Current\ | @ | "C:\Program Files\MSN Messengering.wav" n'existe pas.
HKUS\S-1-5-21-1202660629-790525478-682003330-1003\AppEvents\Schemes\Apps\MSNMSGR\MSNMSGR_NewSMSMessage\.Current\ | @ | "C:\Program Files\MSN Messengering.wav" n'existe pas.
HKUS\S-1-5-21-1202660629-790525478-682003330-1003\Software\Gabest\VSFilter\DefTextPathes\ | Path1 | "c:\subtitles" n'existe pas.
HKUS\S-1-5-21-1202660629-790525478-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{0D6D4F41-2994-4BA0-8FEF-620E43CD2812}\Count\ | HRZR_PGYFRFFVBA | Clé vide inutile
HKUS\S-1-5-21-1202660629-790525478-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count\ | HRZR_PGYFRFFVBA | Clé vide inutile
HKUS\S-1-5-21-1202660629-790525478-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count\ | HRZR_PGYPHNPbhag:pgbe | Clé vide inutile
HKUS\S-1-5-21-1202660629-790525478-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count\ | HRZR_HVGBBYONE | Clé vide inutile
HKUS\S-1-5-21-1202660629-790525478-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count\ | HRZR_HVGBBYONE:0k1,120 | Clé vide inutile
HKUS\S-1-5-21-1202660629-790525478-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count\ | HRZR_HVGBBYONE:0k1,126 | Clé vide inutile
HKUS\S-1-5-21-1202660629-790525478-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count\ | HRZR_HVGBBYONE:0k1,122 | Clé vide inutile
HKUS\S-1-5-21-1202660629-790525478-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count\ | HRZR_EHACVQY:%pfvqy6%\Frphfre.pbz - Ybtvpvryf erpbzznaqéf.hey | Clé vide inutile
HKUS\S-1-5-21-1202660629-790525478-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count\ | HRZR_HVGBBYONE:0k1,121 | Clé vide inutile
HKUS\S-1-5-21-1202660629-790525478-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count\ | HRZR_HVGBBYONE:0k1,130 | Clé vide inutile
HKUS\S-1-5-21-1202660629-790525478-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count\ | HRZR_HVGBBYONE:0k1,7011 | Clé vide inutile
HKUS\S-1-5-21-1202660629-790525478-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count\ | HRZR_HVGBBYONE:0k4,7011 | Clé vide inutile
HKUS\S-1-5-21-1202660629-790525478-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count\ | HRZR_EHACVQY:%pfvqy6%\Fhepbhs, yr fcrpvnyvfgr qr y vasbezngvdhr  zngrevryf, ybtvpvryf rg npprffbverf.hey | Clé vide inutile
HKUS\S-1-5-21-1202660629-790525478-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count\ | HRZR_EHACVQY:%pfvqy6%\Pbzzhanhgé Pyhovp.pbz - zba beqv rfg vasrpgé ivehf, znyjner....hey | Clé vide inutile
HKUS\S-1-5-21-1202660629-790525478-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count\ | HRZR_EHACVQY:%pfvqy6%\Orfbv Q'nvqr Cbhe Nanylfr Uvgwnpxguvf - Sbehz Vasbezngvdhr.hey | Clé vide inutile
HKUS\S-1-5-21-1202660629-790525478-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count\ | HRZR_EHACVQY:%pfvqy6%\Géyépunetre Rg Hgvyvfre Fzvgsenhqsvk - CP Ragenvqr.hey | Clé vide inutile
HKUS\S-1-5-21-1202660629-790525478-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count\ | HRZR_HVGBBYONE:0k4,7031 | Clé vide inutile
HKUS\S-1-5-21-1202660629-790525478-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count\ | HRZR_HVGBBYONE:0k1,133 | Clé vide inutile
HKUS\S-1-5-21-1202660629-790525478-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count\ | HRZR_HVGBBYONE:0k1,123 | Clé vide inutile
HKUS\S-1-5-21-1202660629-790525478-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_PGYFRFFVBA | Clé vide inutile
HKUS\S-1-5-21-1202660629-790525478-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:%pfvqy2%\Yrpgrhe Jvaqbjf Zrqvn.yax | Clé vide inutile
HKUS\S-1-5-21-1202660629-790525478-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_PGYPHNPbhag:pgbe | Clé vide inutile
HKUS\S-1-5-21-1202660629-790525478-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU | Clé vide inutile
HKUS\S-1-5-21-1202660629-790525478-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Cebtenz Svyrf\Fclobg - Frnepu & Qrfgebl\FclobgFQ.rkr | Clé vide inutile
HKUS\S-1-5-21-1202660629-790525478-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHAPCY | Clé vide inutile
HKUS\S-1-5-21-1202660629-790525478-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHAPCY:"P:\JVAQBJF\Flfgrz32
ccjvm.pcy",Nwbhg/Fhccerffvba qr cebtenzzrf | Clé vide inutile
HKUS\S-1-5-21-1202660629-790525478-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Cebtenz Svyrf\Erny\ErnyCynlre\ernycynl.rkr | Clé vide inutile
HKUS\S-1-5-21-1202660629-790525478-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_HVFPHG | Clé vide inutile
HKUS\S-1-5-21-1202660629-790525478-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:::{645SS040-5081-101O-9S08-00NN002S954R} | Clé vide inutile
HKUS\S-1-5-21-1202660629-790525478-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:W:\OhernhQrCbpur\JvaqbjfKC-XO835935-FC2-SEN.rkr | Clé vide inutile
HKUS\S-1-5-21-1202660629-790525478-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\JVAQBJF\flfgrz32\ABGRCNQ.RKR | Clé vide inutile
HKUS\S-1-5-21-1202660629-790525478-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHAPCY:"P:\JVAQBJF\flfgrz32\jfphv.pcy",Prager qr féphevgé | Clé vide inutile
HKUS\S-1-5-21-1202660629-790525478-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHAPCY:"P:\JVAQBJF\flfgrz32\sverjnyy.pcy",Cner-srh Jvaqbjf | Clé vide inutile
HKUS\S-1-5-21-1202660629-790525478-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:P:\Cebtenz Svyrf\Vagrearg Rkcybere\vrkcyber.rkr | Clé vide inutile
HKUS\S-1-5-21-1202660629-790525478-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY | Clé vide inutile
HKUS\S-1-5-21-1202660629-790525478-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACVQY:::{2559N1S4-21Q7-11Q4-OQNS-00P04S60O9S0} | Clé vide inutile
HKUS\S-1-5-21-1202660629-790525478-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHAPCY:qrfx.pcy | Clé vide inutile
HKUS\S-1-5-21-1202660629-790525478-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\ | HRZR_EHACNGU:nqfy GI.yax | Clé vide inutile
HKUS\S-1-5-21-1202660629-790525478-682003330-1003\Software\Microsoft\Windows

sergino17 · Answer

Hello
mon probleme est resolu
j'ai été sur un autre site et j'ai vu quelqu'un qui avait le meme probleme,
finalement, ne trouvant rien, on lui a conseillé de nettoyer son ordi.
je viens de le faire(5 minutes), et j'ai pu scanner avec AVG et S&D
grace aux conseils de Regis mon ordi tourne super, et si quelqu'un a un probleme semblable, voici le lien:https://forums.cnetfrance.fr
A+

Regis59 · Answer

Salut

Ah ouais, pas pensé au nettoyage interieur :P

Bonne continuation !

A+

Mon ordinateur redémarre quand je scanne anti

70 réponses

Discussions similaires