3 rapports d'analyses - ecran rouge HELP Résolu/Fermé

Question

Bonjour, 

J'ai deuis quelques mois un problème lorsque je double clic sur mon C:  un message d'erreur s'affiche me disant qu'il ne trouve pas de... pr win32 ou qqc comme ça.   En essayant de résoudre ce problème hier, je me suis rendu compte que c'étai un Virus en survolant plusieurs forums.  AUjourd'hui, mon fond d'écran est tout rouge (et c'est écrit : your privacy is in danger download privacy protection softwaree now) et m'envoie comme un lien sur un site qui me proposent d'effectuer des analyses; des fenetres de sécurités s'affichent régulièrement et me dirigent sur des sites equivalents. De plus avast me répète toutes les dix minutes que mon pc est infecté mais ne me permet pas de détruire ce/ces virus ou trojan.

J'ai essayé de résoudre ce problème tout cet après midi en suivant plusieurs instructions sur différents forums mais je n'ai pas trouvé mon bohneur. Mon ordinateur est tjs très lent et ce "lien-fond d'écran" est toujours la!!

J'ai donc commencé par analyser avec Ccleaner comme d'habitude puis fait trois analyses différentes dont je vous soummais les rapports suivants :







---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

 + Créé à:	18:08:13 20/11/2007

 + Résultat de l'analyse:	



HKU\S-1-5-21-39989766-2330583763-384686628-1006\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{4E7BD74F-2B8D-469E-A0E8-ED6AB685FA7D} -> Adware.2020Search : Nettoyé.
C:\Config.Msi\359a32.rbf -> Adware.BHO : Nettoyé.
C:\WINDOWS\Downloaded Program Files\installer2.dll -> Adware.ClickMedia : Nettoyé.
C:\WINDOWS\privacy_danger -> Adware.RogueSuspect : Nettoyé.
C:\WINDOWS\privacy_danger\images -> Adware.RogueSuspect : Nettoyé.
C:\WINDOWS\privacy_danger\images\capt.gif -> Adware.RogueSuspect : Nettoyé.
C:\WINDOWS\privacy_danger\images\danger.jpg -> Adware.RogueSuspect : Nettoyé.
C:\WINDOWS\privacy_danger\images\down.gif -> Adware.RogueSuspect : Nettoyé.
C:\WINDOWS\privacy_danger\images\spacer.gif -> Adware.RogueSuspect : Nettoyé.
C:\WINDOWS\privacy_danger\index.htm -> Adware.RogueSuspect : Nettoyé.
HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\WhenUSave -> Adware.SaveNow : Nettoyé.
:mozilla.10:C:\Documents and Settings\PIN\Application Data\Mozilla\Firefox\Profiles\iuuhhagu.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.11:C:\Documents and Settings\PIN\Application Data\Mozilla\Firefox\Profiles\iuuhhagu.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
C:\Documents and Settings\PIN\Cookies\pin@advertising[2].txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.9:C:\Documents and Settings\PIN\Application Data\Mozilla\Firefox\Profiles\iuuhhagu.default\cookies.txt -> TrackingCookie.Bluestreak : Nettoyé.
C:\Documents and Settings\PIN\Cookies\pin@bluestreak[1].txt -> TrackingCookie.Bluestreak : Nettoyé.
:mozilla.22:C:\Documents and Settings\PIN\Application Data\Mozilla\Firefox\Profiles\iuuhhagu.default\cookies.txt -> TrackingCookie.Doubleclick : Nettoyé.
C:\Documents and Settings\PIN\Cookies\pin@doubleclick[1].txt -> TrackingCookie.Doubleclick : Nettoyé.
C:\Documents and Settings\PIN\Cookies\pin@bs.serving-sys[1].txt -> TrackingCookie.Serving-sys : Nettoyé.
C:\Documents and Settings\PIN\Cookies\pin@serving-sys[1].txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.12:C:\Documents and Settings\PIN\Application Data\Mozilla\Firefox\Profiles\iuuhhagu.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.13:C:\Documents and Settings\PIN\Application Data\Mozilla\Firefox\Profiles\iuuhhagu.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.14:C:\Documents and Settings\PIN\Application Data\Mozilla\Firefox\Profiles\iuuhhagu.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.26:C:\Documents and Settings\PIN\Application Data\Mozilla\Firefox\Profiles\iuuhhagu.default\cookies.txt -> TrackingCookie.Tradedoubler : Nettoyé.
C:\Documents and Settings\PIN\Cookies\pin@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Nettoyé.
:mozilla.27:C:\Documents and Settings\PIN\Application Data\Mozilla\Firefox\Profiles\iuuhhagu.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
C:\Documents and Settings\PIN\Cookies\pin@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Nettoyé.


Fin du rapport








-------------------------------------------------------------------------------------------------------------------------------------------------------------









BitDefender Online Scanner
  
  
 
Scan report generated at: Tue, Nov 20, 2007 - 19:31:35
 
 
  
  
 
Scan path: C:\;D:\;
  
  
 
 
  
  
 
Statistics
 
Time
 01:10:01
 
Files
 157022
 
Folders
 6396
 
Boot Sectors
 3
 
Archives
 6967
 
Packed Files
 8340
 
  
  
 
Results
 
Identified Viruses 
 5
 
Infected Files 
 10
 
Suspect Files 
 0
 
Warnings
 0
 
Disinfected
 0
 
Deleted Files
 10
 
  
  
 
Engines Info
 
Virus Definitions
 878621
 
Engine build
 AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)
 
Scan plugins
 14
 
Archive plugins
 38
 
Unpack plugins
 7
 
E-mail plugins
 6
 
System plugins
 1
 
  
  
 
Scan Settings
 
First Action
 Disinfect
 
Second Action
 Delete
 
Heuristics
 Yes
 
Enable Warnings
 Yes
 
Scanned Extensions
 *;
 
Exclude Extensions
  
 
Scan Emails
 Yes
 
Scan Archives
 Yes
 
Scan Packed
 Yes
 
Scan Files
 Yes
 
Scan Boot
 Yes
 
  
  
 
  Scanned File
  Status
 
C:\Documents and Settings\PIN\Local Settings\Temp\ac8zt2\edi.exe
 Infected with: Trojan.Agent.BHO.N
 
C:\Documents and Settings\PIN\Local Settings\Temp\ac8zt2\edi.exe
 Disinfection failed
 
C:\Documents and Settings\PIN\Local Settings\Temp\ac8zt2\edi.exe
 Deleted
 
C:\Documents and Settings\PIN\Local Settings\Temp\ac8zt2\install.bat
 Infected with: Trojan.Agent.BHO.N
 
C:\Documents and Settings\PIN\Local Settings\Temp\ac8zt2\install.bat
 Disinfection failed
 
C:\Documents and Settings\PIN\Local Settings\Temp\ac8zt2\install.bat
 Deleted
 
C:\Documents and Settings\PIN\Local Settings\Temp\ac8zt2\msmdev.dll
 Infected with: Trojan.Downloader.Agent.YNU
 
C:\Documents and Settings\PIN\Local Settings\Temp\ac8zt2\msmdev.dll
 Disinfection failed
 
C:\Documents and Settings\PIN\Local Settings\Temp\ac8zt2\msmdev.dll
 Deleted
 
C:\Documents and Settings\PIN\Local Settings\Temp\ac8zt2.dat=>ac8zt2/edi.exe
 Infected with: Trojan.Agent.BHO.N
 
C:\Documents and Settings\PIN\Local Settings\Temp\ac8zt2.dat=>ac8zt2/edi.exe
 Disinfection failed
 
C:\Documents and Settings\PIN\Local Settings\Temp\ac8zt2.dat=>ac8zt2/edi.exe
 Deleted
 
C:\Documents and Settings\PIN\Local Settings\Temp\ac8zt2.dat
 Update failed
 
C:\Documents and Settings\PIN\Local Settings\Temp\ac8zt2.dat=>ac8zt2/install.bat
 Infected with: Trojan.Agent.BHO.N
 
C:\Documents and Settings\PIN\Local Settings\Temp\ac8zt2.dat=>ac8zt2/install.bat
 Disinfection failed
 
C:\Documents and Settings\PIN\Local Settings\Temp\ac8zt2.dat=>ac8zt2/install.bat
 Deleted
 
C:\Documents and Settings\PIN\Local Settings\Temp\ac8zt2.dat
 Update failed
 
C:\Documents and Settings\PIN\Local Settings\Temp\ac8zt2.dat=>ac8zt2/main_uninstaller.exe
 Infected with: Trojan.Agent.ABSG
 
C:\Documents and Settings\PIN\Local Settings\Temp\ac8zt2.dat=>ac8zt2/main_uninstaller.exe
 Disinfection failed
 
C:\Documents and Settings\PIN\Local Settings\Temp\ac8zt2.dat=>ac8zt2/main_uninstaller.exe
 Deleted
 
C:\Documents and Settings\PIN\Local Settings\Temp\ac8zt2.dat
 Update failed
 
C:\Documents and Settings\PIN\Local Settings\Temp\ac8zt2.dat=>ac8zt2/msmdev.dll
 Infected with: Trojan.Downloader.Agent.YNU
 
C:\Documents and Settings\PIN\Local Settings\Temp\ac8zt2.dat=>ac8zt2/msmdev.dll
 Disinfection failed
 
C:\Documents and Settings\PIN\Local Settings\Temp\ac8zt2.dat=>ac8zt2/msmdev.dll
 Deleted
 
C:\Documents and Settings\PIN\Local Settings\Temp\ac8zt2.dat
 Update failed
 
C:\Documents and Settings\PIN\Local Settings\Temp\ac8zt2.dat=>ac8zt2/msmhost.dll
 Infected with: Trojan.Agent.BHO.O
 
C:\Documents and Settings\PIN\Local Settings\Temp\ac8zt2.dat=>ac8zt2/msmhost.dll
 Disinfection failed
 
C:\Documents and Settings\PIN\Local Settings\Temp\ac8zt2.dat=>ac8zt2/msmhost.dll
 Deleted
 
C:\Documents and Settings\PIN\Local Settings\Temp\ac8zt2.dat
 Update failed
 
C:\Documents and Settings\PIN\Local Settings\Temp\ac8zt2.dat=>ac8zt2/nsduo.dll
 Infected with: Trojan.Downloader.Agent.YNQ
 
C:\Documents and Settings\PIN\Local Settings\Temp\ac8zt2.dat=>ac8zt2/nsduo.dll
 Disinfection failed
 
C:\Documents and Settings\PIN\Local Settings\Temp\ac8zt2.dat=>ac8zt2/nsduo.dll
 Deleted
 
C:\Documents and Settings\PIN\Local Settings\Temp\ac8zt2.dat
 Update failed
 
C:\Documents and Settings\PIN\Local Settings\Temp\ac8zt2.dat=>ac8zt2/rmv.exe
 Infected with: Trojan.Agent.ABSG
 
C:\Documents and Settings\PIN\Local Settings\Temp\ac8zt2.dat=>ac8zt2/rmv.exe
 Disinfection failed
 
C:\Documents and Settings\PIN\Local Settings\Temp\ac8zt2.dat=>ac8zt2/rmv.exe
 Deleted
 
C:\Documents and Settings\PIN\Local Settings\Temp\ac8zt2.dat
 Update failed
 
C:\WINDOWS\I386\COMDLG32.DL_
 Clean
 
C:\WINDOWS\I386\COMDLG32.DL_=>comdlg32.dll
 Clean
 
C:\WINDOWS\I386\COMEMPTY.DA_
 Clean
 
C:\WINDOWS\I386\COMEMPTY.DA_=>comempty.dat
 Clean
 
C:\WINDOWS\I386\COMEXP.CH_
 Clean
 
C:\WINDOWS\I386\COMEXP.CH_=>comexp.chm
 Clean
 
C:\WINDOWS\I386\COMEXP.CH_=>comexp.chm=>/#SYSTEM
 Clean
 
C:\WINDOWS\I386\COMEXP.CH_=>comexp.chm=>/htm/adapppooling_371v.htm
 Clean
 
C:\WINDOWS\I386\COMEXP.CH_=>comexp.chm=>/htm/adapppooling_3s6f.htm
 Clean
 
C:\WINDOWS\I386\COMEXP.CH_=>comexp.chm=>/htm/adapppooling_5ohf.htm
 Clean
 
C:\WINDOWS\I386\COMEXP.CH_=>comexp.chm=>/htm/adapppooling_7unb.htm
 Clean
 
C:\WINDOWS\I386\COMEXP.CH_=>comexp.chm=>/htm/adcom_059o.htm
 Clean
 
C:\WINDOWS\I386\COMEXP.CH_=>comexp.chm=>/htm/adcom_14ab.htm
 Clean
 
C:\WINDOWS\I386\COMEXP.CH_=>comexp.chm=>/htm/adcom_1fg3.htm
 Clean
 
C:\WINDOWS\I386\COMEXP.CH_=>comexp.chm=>/htm/adcom_1lt8.htm
 Clean
 
C:\WINDOWS\I386\COMEXP.CH_=>comexp.chm=>/htm/adcom_24ry.htm
 Clean
 
C:\WINDOWS\I386\COMEXP.CH_=>comexp.chm=>/htm/adcom_2eb7.htm
 Clean
 
C:\WINDOWS\I386\COMEXP.CH_=>comexp.chm=>/htm/adcom_2hm4.htm
 Clean
 
C:\WINDOWS\I386\COMEXP.CH_=>comexp.chm=>/htm/adcom_2p6b.htm
 Clean
 
C:\WINDOWS\I386\COMEXP.CH_=>comexp.chm=>/htm/adcom_2wvt.htm
 Clean
 
C:\WINDOWS\I386\COMEXP.CH_=>comexp.chm=>/htm/adcom_33jh.htm
 Clean
 
C:\WINDOWS\I386\COMEXP.CH_=>comexp.chm=>/htm/adcom_38vn.htm
 Clean
 
C:\WINDOWS\I386\COMEXP.CH_=>comexp.chm=>/htm/adcom_3z77.htm
 Clean
 
C:\WINDOWS\I386\COMEXP.CH_=>comexp.chm=>/htm/adcom_59gu.htm
 Clean
 
C:\WINDOWS\I386\COMEXP.CH_=>comexp.chm=>/htm/adcom_5wdo.htm
 Clean
 
C:\WINDOWS\I386\COMEXP.CH_=>comexp.chm=>/htm/adcom_6dgu.htm
 Clean
 
C:\WINDOWS\I386\COMEXP.CH_=>comexp.chm=>/htm/adcom_6gh3.htm
 Clean
 
C:\WINDOWS\I386\COMEXP.CH_=>comexp.chm=>/htm/adcom_7qhz.htm
 Clean
 
C:\WINDOWS\I386\COMEXP.CH_=>comexp.chm=>/htm/adcom_95df.htm
 Clean
 
C:\WINDOWS\I386\COMEXP.CH_=>comexp.chm=>/htm/adcom_9s4z.htm
 Clean
 
C:\WINDOWS\I386\COMEXP.CH_=>comexp.chm=>/htm/adcom_9uk3.htm
 Clean
 
C:\WINDOWS\I386\COMEXP.CH_=>comexp.chm=>/htm/adconfiguring_1jeb.htm
 Clean
 
C:\WINDOWS\I386\COMEXP.CH_=>comexp.chm=>/htm/adconfiguring_23l9.htm
 Clean
 
C:\WINDOWS\I386\COMEXP.CH_=>comexp.chm=>/htm/adconfiguring_35tf.htm
 Clean
 
C:\WINDOWS\I386\COMEXP.CH_=>comexp.chm=>/htm/adconfiguring_5zsp.htm
 Clean
 
C:\WINDOWS\I386\COMEXP.CH_=>comexp.chm=>/htm/adconfiguring_9dbn.htm
 Clean
 
C:\WINDOWS\I386\COMEXP.HL_
 Clean
 
C:\WINDOWS\I386\COMEXP.HL_=>comexp.hlp
 Clean
 
C:\WINDOWS\I386\COMEXP.MS_
 Clean
 
C:\WINDOWS\I386\COMEXP.MS_=>comexp.msc
 Clean
 
C:\WINDOWS\I386\COMIC.TT_
 Clean
 
C:\WINDOWS\I386\COMIC.TT_=>comic.ttf
 Clean
 
C:\WINDOWS\I386\COMICBD.TT_
 Clean
 
C:\WINDOWS\I386\COMICBD.TT_=>comicbd.ttf
 Clean
 
C:\WINDOWS\I386\COMM.DR_
 Clean
 
C:\WINDOWS\I386\COMM.DR_=>comm.drv
 Clean
 
C:\WINDOWS\I386\COMMAND.CO_
 Clean
 
C:\WINDOWS\I386\COMMAND.CO_=>command.com
 Clean
 
C:\WINDOWS\I386\COMMDLG.DL_
 Clean
 
C:\WINDOWS\I386\COMMDLG.DL_=>commdlg.dll
 Clean
 
C:\WINDOWS\I386\COMMON.CH_
 Clean
 
C:\WINDOWS\I386\COMMON.CH_=>common.chm
 Clean
 
C:\WINDOWS\I386\COMMON.CH_=>common.chm=>/#SYSTEM
 Clean
 
C:\WINDOWS\I386\COMMON.CH_=>common.chm=>/common_file_save_as.htm
 Clean
 
C:\WINDOWS\I386\COMMON.CH_=>common.chm=>/common_link_info.htm
 Clean
 
C:\WINDOWS\I386\COMMON.CH_=>common.chm=>/common_move_info.htm
 Clean
 
C:\WINDOWS\I386\COMMON.CH_=>common.chm=>/common_open_file.htm
 Clean
 
C:\WINDOWS\I386\COMMON.CH_=>common.chm=>/common_quit_program.htm
 Clean
 
C:\WINDOWS\I386\COMMON.CH_=>common.chm=>/common_save_file.htm
 Clean
 
C:\WINDOWS\I386\COMMON.CH_=>common.chm=>/common_status_bar_on_off.htm
 Clean
 
C:\WINDOWS\I386\COMMON.CH_=>common.chm=>/common_toolbar_on_off.htm
 Clean
 
C:\WINDOWS\I386\COMMON.CH_=>common.chm=>/common_trans_wind_screen.htm
 Clean
 
C:\WINDOWS\I386\COMMON.CH_=>common.chm=>/common_use_info.htm
 Clean
 
C:\WINDOWS\I386\COMMON.CH_=>common.chm=>/common_embed_info.htm
 Clean
 
C:\WINDOWS\I386\COMMON.CH_=>common.chm=>/compile_date.htm
 Clean
 
C:\WINDOWS\I386\COMMON.CH_=>common.chm=>/common_edit_undo.htm
 Clean
 
C:\WINDOWS\I386\COMMON.CH_=>common.chm=>/#WINDOWS
 Clean
 
C:\WINDOWS\I386\COMMON.CH_=>common.chm=>/$WWKeywordLinks/Property
 Clean
 
C:\WINDOWS\I386\COMMON.CH_=>common.chm=>/$WWAssociativeLinks/BTree
 Clean
 
C:\WINDOWS\I386\COMMON.CH_=>common.chm=>/$WWAssociativeLinks/Data
 Clean
 
C:\WINDOWS\I386\COMMON.CH_=>common.chm=>/$WWAssociativeLinks/Map
 Clean
 
C:\WINDOWS\I386\COMMON.CH_=>common.chm=>/$WWAssociativeLinks/Property
 Clean
 
C:\WINDOWS\I386\COMMON.CH_=>common.chm=>/$OBJINST
 Clean
 
C:\WINDOWS\I386\COMMON.CH_=>common.chm=>/$FIftiMain
 Clean
 
C:\WINDOWS\I386\COMMON.CH_=>common.chm=>/#IDXHDR
 Clean
 
C:\WINDOWS\I386\COMMON.CH_=>common.chm=>/#TOPICS
 Clean
 
C:\WINDOWS\I386\COMMON.CH_=>common.chm=>/#URLTBL
 Clean
 
C:\WINDOWS\I386\COMMON.CH_=>common.chm=>/#URLSTR
 Clean
 
C:\WINDOWS\I386\COMMON.CH_=>common.chm=>/#STRINGS
 Clean
 
C:\WINDOWS\I386\COMMUNIC.IN_
 Clean
 
C:\WINDOWS\I386\COMMUNIC.IN_=>communic.inf
 Clean
 
C:\WINDOWS\I386\COMMUNIC.IN_=>communic.inf=>(unicode)
 Clean
 
C:\WINDOWS\I386\COMNTWKS.IN_
 Clean
 
C:\WINDOWS\I386\COMNTWKS.IN_=>comntwks.inf
 Clean
 
C:\WINDOWS\I386\COMNTWKS.IN_=>comntwks.inf=>(unicode)
 Clean
 
C:\WINDOWS\I386\COMP.EX_
 Clean
 
C:\WINDOWS\I386\COMP.EX_=>comp.exe
 Clean
 
C:\WINDOWS\I386\COMPACT.EX_
 Clean
 
C:\WINDOWS\I386\COMPACT.EX_=>compact.exe
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>bg_bottomleft.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>bg_bottomright.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>bg_topleft.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>bg_topright.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>bottom_tile.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>brand_down.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>brand_hover.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>brand_up.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>brightness.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>btngroup_colormap.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>btngroup_disabled.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>btngroup_down.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>btngroup_hover.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>btngroup_up.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>compact.js
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>compact.wms
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>compact.wms=>(unicode)
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>compact.wms=>(unicode)=>(JAVASCRIPT 9)
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>compact.wms=>(unicode)=>(JAVASCRIPT 15)
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>compact.wms=>(unicode)=>(JAVASCRIPT 19)
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>compact_drawer_bottom_down.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>compact_drawer_right_down.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>contrast.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>drawer_bottom.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>drawer_bottom_closed.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>drawer_bottom_open.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>drawer_right_bottom.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>drawer_right_closed.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>drawer_right_open.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>drawer_right_tile.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>drawer_right_top.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>hue.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>left_tile.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>logo_default.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>logo_down.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>logo_hover.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>min_close_down.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>min_close_hover.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>min_close_map.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>min_close_up.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>mute_btn_up.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>next_down.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>next_hover.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>next_up.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>onoff_down.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>onoff_hover.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>onoff_up.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>play_btn_down.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>play_btn_hover.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>play_btn_up.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>play_pause_btn_down.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>play_pause_btn_hover.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>play_pause_btn_up.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>prev_down.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>prev_hover.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>prev_up.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>right_tile.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>saturation.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>seek_sldr_bkg_comp.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>seek_sldr_fore_comp.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>seek_thumb_down.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>seek_thumb_hover.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>seek_thumb_up.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>shufflebtn_down.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>shufflebtn_hover.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>shufflebtn_up.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>size.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>slider_h_video.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>slider_thumb.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>slider_thumb_down.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>slider_v_eq.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>sound_btn_hover.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>sound_btn_up.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>srswow_logo.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>stop_btn_down.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>stop_btn_hover.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>stop_btn_up.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>toggle_down.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>toggle_hover.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>toggle_up.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>top_tile.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>transport.js
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>vol_sldr_bkg.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>vol_thumb_down.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>vol_thumb_hover.bmp
 Clean
 
C:\WINDOWS\I386\COMPACT.WM_=>compact.wmz=>vol_thumb_up.bmp
 Clean
 
C:\WINDOWS\I386\COMPATUI.DL_
 Clean
 
C:\WINDOWS\I386\COMPATUI.DL_=>compatui.dll
 Clean
 
C:\WINDOWS\I386\COMPDATA\
 Clean
 
C:\WINDOWS\I386\COMPDATA\3COM.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\3COM.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\AACRAID.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\AACRAID.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\ACER640P.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\ACER640P.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\ACLIENT.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\ACLIENT.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\ACS.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\ACS.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\ADAPTEC.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\ADAPTEC.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\ADMPKW2K.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\ADMPKW2K.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\ADMPKXP.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\ADMPKXP.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\AHA8940.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\AHA8940.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\AICDRV.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\AICDRV.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\ALKB2K.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\ALKB2K.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\ALPSPRT.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\ALPSPRT.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\APFILTR.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\APFILTR.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\APMERROR.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\APMERROR.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\ARTCAS6E.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\ARTCAS6E.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\ASSETCI.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\ASSETCI.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\ATGUARD.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\ATGUARD.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\ATKPROTO.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\ATKPROTO.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\AVPGATEK.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\AVPGATEK.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\AWARD.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\AWARD.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\BAYMAN.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\BAYMAN.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\BLACKICE.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\BLACKICE.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\BOSERROR.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\BOSERROR.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\CALCOMP.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\CALCOMP.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\CANO620P.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\CANO620P.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\CANOS100.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\CANOS100.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\CARDEXEC.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\CARDEXEC.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\CDR4VSD.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\CDR4VSD.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\CERTSRV.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\CERTSRV.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\CIC.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\CIC.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\CIMGR.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\CIMGR.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\CISCOACU.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\CISCOACU.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\CLDVD.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\CLDVD.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\CLTMGR.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\CLTMGR.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\CNBJ51.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\CNBJ51.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\CNMULTI1.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\CNMULTI1.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\CPQDIAGC.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\CPQDIAGC.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\CPQIJ.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\CPQIJ.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\CPQKBD.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\CPQKBD.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\CPQMULTI.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\CPQMULTI.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\CPQPNPMG.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\CPQPNPMG.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\CPQPWREX.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\CPQPWREX.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\CPUFEAT.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\CPUFEAT.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\CRASHMON.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\CRASHMON.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\CRUISE.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\CRUISE.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\CRYSTAL.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\CRYSTAL.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\CS4281.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\CS4281.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\CSA64XX.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\CSA64XX.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\CSMIGRAT.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\CSMIGRAT.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\CSREM32.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\CSREM32.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\CTZ_CRDL.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\CTZ_CRDL.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\DAYT.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\DAYT.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\DECATAPI.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\DECATAPI.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\DECML.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\DECML.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\DELLPS.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\DELLPS.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\DELLTH.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\DELLTH.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\DELPERC2.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\DELPERC2.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\DIRECTCD.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\DIRECTCD.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\DLCPROTO.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\DLCPROTO.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\DMIBIOS.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\DMIBIOS.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\DOCK.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\DOCK.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\DOCKSVC.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\DOCKSVC.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\DRVMAIN.CHM
 Clean
 
C:\WINDOWS\I386\COMPDATA\DRVMAIN.CHM=>/#SYSTEM
 Clean
 
C:\WINDOWS\I386\COMPDATA\DRVMAIN.CHM=>/idh_w2_20669.htm
 Clean
 
C:\WINDOWS\I386\COMPDATA\DRVMAIN.CHM=>/idh_w2_21216.htm
 Clean
 
C:\WINDOWS\I386\COMPDATA\DRVMAIN.CHM=>/idh_w2_21217.htm
 Clean
 
C:\WINDOWS\I386\COMPDATA\DRVMAIN.CHM=>/idh_w2_21248.htm
 Clean
 
C:\WINDOWS\I386\COMPDATA\DRVMAIN.CHM=>/idh_w2_21187.htm
 Clean
 
C:\WINDOWS\I386\COMPDATA\DRVMAIN.CHM=>/idh_w2_21149.htm
 Clean
 
C:\WINDOWS\I386\COMPDATA\DRVMAIN.CHM=>/idh_w2_21320.htm
 Clean
 
C:\WINDOWS\I386\COMPDATA\DRVMAIN.CHM=>/idh_w2_21203.htm
 Clean
 
C:\WINDOWS\I386\COMPDATA\DRVMAIN.CHM=>/idh_w2_21214.htm
 Clean
 
C:\WINDOWS\I386\COMPDATA\DRVMAIN.CHM=>/idh_w2_21299.htm
 Clean
 
C:\WINDOWS\I386\COMPDATA\DRVMAIN.CHM=>/idh_w2_21178.htm
 Clean
 
C:\WINDOWS\I386\COMPDATA\DRVMAIN.CHM=>/idh_w2_21108.htm
 Clean
 
C:\WINDOWS\I386\COMPDATA\DRVMAIN.CHM=>/idh_w2_30019.htm
 Clean
 
C:\WINDOWS\I386\COMPDATA\DRVMAIN.CHM=>/idh_w2_21185.htm
 Clean
 
C:\WINDOWS\I386\COMPDATA\DRVMAIN.CHM=>/idh_w2_30007.htm
 Clean
 
C:\WINDOWS\I386\COMPDATA\DRVMAIN.CHM=>/idh_w2_21220.htm
 Clean
 
C:\WINDOWS\I386\COMPDATA\DRVMAIN.CHM=>/idh_w2_20886.htm
 Clean
 
C:\WINDOWS\I386\COMPDATA\DRVMAIN.CHM=>/idh_w2_21205.htm
 Clean
 
C:\WINDOWS\I386\COMPDATA\DRVMAIN.CHM=>/idh_w2_21226.htm
 Clean
 
C:\WINDOWS\I386\COMPDATA\DRVMAIN.CHM=>/idh_w2_30009.htm
 Clean
 
C:\WINDOWS\I386\COMPDATA\DRVMAIN.CHM=>/idh_w2_21151.htm
 Clean
 
C:\WINDOWS\I386\COMPDATA\DRVMAIN.CHM=>/idh_w2_20004.htm
 Clean
 
C:\WINDOWS\I386\COMPDATA\DRVMAIN.CHM=>/idh_w2_21169.htm
 Clean
 
C:\WINDOWS\I386\COMPDATA\DRVMAIN.CHM=>/idh_w2_21186.htm
 Clean
 
C:\WINDOWS\I386\COMPDATA\DRVMAIN.CHM=>/idh_w2_21154.htm
 Clean
 
C:\WINDOWS\I386\COMPDATA\DRVMAIN.CHM=>/idh_w2_21152.htm
 Clean
 
C:\WINDOWS\I386\COMPDATA\DRVMAIN.CHM=>/idh_w2_21118.htm
 Clean
 
C:\WINDOWS\I386\COMPDATA\DRVMAIN.CHM=>/idh_w2_21103.htm
 Clean
 
C:\WINDOWS\I386\COMPDATA\DRVMAIN.CHM=>/idh_w2_21212.htm
 Clean
 
C:\WINDOWS\I386\COMPDATA\DRVMAIN.INF
 Clean
 
C:\WINDOWS\I386\COMPDATA\DRVNCDB.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\DRVNCDB.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\DSMU.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\DSMU.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\DV_COMP.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\DV_COMP.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\DV_GEN.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\DV_GEN.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\DWRITE.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\DWRITE.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\EICONTA.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\EICONTA.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\ELSAMX.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\ELSAMX.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\ENSONIQV.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\ENSONIQV.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\ENSQAUDM.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\ENSQAUDM.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\EPSCOLOR.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\EPSCOLOR.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\EPSON1.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\EPSON1.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\EPSON3.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\EPSON3.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\EPSON4.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\EPSON4.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\EPSP1270.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\EPSP1270.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\EPSPHOTO.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\EPSPHOTO.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\EXCHANGE.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\EXCHANGE.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\FAZAM.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\FAZAM.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\FIDMOU.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\FIDMOU.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\FLOWCH7.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\FLOWCH7.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\FTCOMP1.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\FTCOMP1.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\FTCOMP2.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\FTCOMP2.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\FTCOMP3.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\FTCOMP3.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\GENERIC.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\GENERIC.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\GENIUS.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\GENIUS.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\GLINT.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\GLINT.TXT
 Clean
 
C:\WINDOWS\I386\COMPDATA\GSNW.HTM
 Clean
 
C:\WINDOWS\I386\COMPDATA\GSNW.TXT
 Clean
 
  
 
 
  
 
-------------------------------------------------------------------------------------------------------------------------------------------------------------





3ème rapport effectué par HiJackthis :





O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll
O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O10 - Unknown file in Winsock LSP: c:\windows\system32
wprovau.dll
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {09CC593B-E8A9-4491-927D-A3E33534DDD4} (InstallerObj Class) - http://www.m6video.fr/1click/install/files/installer2.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O18 - Protocol: t-mobile - (no CLSID) - (no file)
O21 - SSODL: sapnet - {FF6C9F35-C22D-43B6-A399-0374AF11EC2E} - (no file)
O21 - SSODL: rmvgor - {CE7AEE4E-2130-4EF8-8B04-3B437490A6FB} - C:\WINDOWSmvgor.dll
O21 - SSODL: msmdev - {184970FB-13E0-453F-9F97-F9FCF66FA95F} - C:\WINDOWS\msmdev.dll (file missing)
O21 - SSODL: msmhost - {EB9A1653-0152-4036-AD23-371DB6517287} - C:\WINDOWS\msmhost.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: MySqlInventime - Unknown owner - c:\mysql\bin\mysqld-max-nt.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
O24 - Desktop Component 0: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm

Utilisateur anonyme · Answer

salut
 refaits un rapport Hijackthis complet, il lui manques des plumes...
;-)

tamarin · Answer

ok, ça y est c'est fait pr HijackThis :


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:49:25, on 20/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\Rainlendar2\Rainlendar2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Metacafe\MetacafeAgent.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\DAP\DAP.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Metacafe\Metacafe.exe
C:\Program Files\stickies\stickies.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\explorer.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\livecall.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?cc=fr&toHttps=1&redig=55729C844D6A45819CAD368B3E178C9F
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://home.sweetim.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Hacked by Godzilla
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file)
R3 - URLSearchHook: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM	bShar.dll
O2 - BHO: (no name) - {02DCA195-602B-4B1F-83FF-381B7E804BDB} - C:\WINDOWS\system32\HDBHO.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: ShoppingReport - {100EB1FD-D03E-47FD-81F3-EE91287F9465} - C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - (no file)
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM	bShar.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: MSVPS System - {9C985AC6-A138-4EAB-B10A-DC522F755146} - C:\WINDOWS\popnetdpt.dll
O3 - Toolbar: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file)
O3 - Toolbar: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM	bShar.dll
O3 - Toolbar: The jokwmp - {D71F3444-606D-46EB-9ABE-DF80E5E9BF67} - C:\WINDOWS\jokwmp.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Rainlendar2] C:\Program Files\Rainlendar2\Rainlendar2.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Metacafe.lnk = C:\Program Files\Metacafe\MetacafeAgent.exe
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll
O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O10 - Unknown file in Winsock LSP: c:\windows\system32
wprovau.dll
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {09CC593B-E8A9-4491-927D-A3E33534DDD4} (InstallerObj Class) - http://www.m6video.fr/1click/install/files/installer2.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O18 - Protocol: t-mobile - (no CLSID) - (no file)
O21 - SSODL: sapnet - {FF6C9F35-C22D-43B6-A399-0374AF11EC2E} - (no file)
O21 - SSODL: rmvgor - {CE7AEE4E-2130-4EF8-8B04-3B437490A6FB} - C:\WINDOWSmvgor.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: MySqlInventime - Unknown owner - c:\mysql\bin\mysqld-max-nt.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
O24 - Desktop Component 0: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm

Utilisateur anonyme · Answer

download ceci lopxpMH2
 http://www.alt-shift-return.org/Info/Fichiers/lopxpMH2.zip 
sur ton bureau.
Dézippe-le (clic droit -> "Extraire ici") et double clique sur le fichier lopxpMH.bat. 
postes le rapport

Tamarin · Answer

Merci,

Je fais ça ce soir, je dois retourner en cours

Utilisateur anonyme · Answer

pas de soucis, a+

Tamarin · Answer

Bonsoir, j'ai bien importé iopxpMH2.bat sur mon bureau et voici le rapport : Rapport lopxpMH2 version 2.0 fait à 19:36:00,52 le 21/11/2007 C:\Documents and Settings\PIN\Mes documents\My Completed Downloads ****************************************** ## Répertoires Application Data Le volume dans le lecteur C s'appelle disc Le numéro de série du volume est B0E4-0458 Répertoire de C:\Documents and Settings\All Users\Application Data 16/08/2004 17:54 . 16/08/2004 17:54 .. 15/02/2006 19:11 Adobe 15/02/2006 19:12 AOL 14/09/2006 18:00 Apple Computer 09/10/2006 18:18 Autodesk 30/08/2007 19:20 BufferZone 22/07/2006 14:25 CyberLink 12/03/2007 17:28 Forge of Games 24/11/2006 15:00 Google 20/11/2007 16:34 Grisoft 07/10/2007 16:25 Intel 24/10/2006 13:55 Metacafe 16/08/2004 17:54 Microsoft 28/08/2006 19:46 Motive 15/02/2006 19:13 OD2 15/11/2007 00:36 pixelStorm 15/02/2006 19:12 QuickTime 16/08/2004 18:28 SBSI 18/06/2007 19:03 Skype 26/07/2006 16:56 Sony Ericsson 15/02/2006 19:07 Symantec 15/02/2006 19:13 Viewpoint 28/08/2006 19:27 Windows Genuine Advantage 16/08/2004 17:55 62 desktop.ini 1 fichier(s) 62 octets 24 Rép(s) 11 671 212 032 octets libres Le volume dans le lecteur C s'appelle disc Le numéro de série du volume est B0E4-0458 Répertoire de C:\Documents and Settings\Default User\Application Data 16/08/2004 17:54 . 16/08/2004 17:54 .. 22/07/2006 12:07 Identities 07/10/2007 16:26 Intel 22/07/2006 12:07 Macromedia 16/08/2004 17:54 Microsoft 22/07/2006 12:07 Real 22/07/2006 12:07 Sun 22/07/2006 12:07 Symantec 22/07/2006 12:07 You've Got Pictures Screensaver 16/08/2004 17:54 62 desktop.ini 1 fichier(s) 62 octets 10 Rép(s) 11 671 212 032 octets libres Le volume dans le lecteur C s'appelle disc Le numéro de série du volume est B0E4-0458 Répertoire de C:\Documents and Settings\Default User\Local Settings\Application Data 16/08/2004 17:55 . 16/08/2004 17:55 .. 22/07/2006 12:07 {7148F0A6-6813-11D6-A77B-00B0D0142050} 22/07/2006 12:07 ApplicationHistory 16/08/2004 18:10 Microsoft 22/07/2006 12:07 PowerCinema 22/07/2006 12:07 135 fusioncache.dat 22/07/2006 12:07 2 687 222 IconCache.db 2 fichier(s) 2 687 357 octets 6 Rép(s) 11 671 212 032 octets libres Le volume dans le lecteur C s'appelle disc Le numéro de série du volume est B0E4-0458 Répertoire de C:\Documents and Settings\LocalService\Application Data 16/08/2004 18:18 . 16/08/2004 18:18 .. 07/10/2007 16:26 Intel 16/08/2004 18:18 Microsoft 0 fichier(s) 0 octets 4 Rép(s) 11 671 212 032 octets libres Le volume dans le lecteur C s'appelle disc Le numéro de série du volume est B0E4-0458 Répertoire de C:\Documents and Settings\LocalService\Local Settings\Application Data 16/08/2004 18:18 . 16/08/2004 18:18 .. 16/08/2004 18:18 Microsoft 0 fichier(s) 0 octets 3 Rép(s) 11 671 212 032 octets libres Le volume dans le lecteur C s'appelle disc Le numéro de série du volume est B0E4-0458 Répertoire de C:\Documents and Settings\NetworkService\Application Data 16/08/2004 18:18 . 16/08/2004 18:18 .. 07/10/2007 16:26 Intel 16/08/2004 18:18 Microsoft 09/08/2006 21:08 Symantec 0 fichier(s) 0 octets 5 Rép(s) 11 671 207 936 octets libres Le volume dans le lecteur C s'appelle disc Le numéro de série du volume est B0E4-0458 Répertoire de C:\Documents and Settings\NetworkService\Local Settings\Application Data 16/08/2004 18:18 . 16/08/2004 18:18 .. 16/08/2004 18:18 Microsoft 0 fichier(s) 0 octets 3 Rép(s) 11 671 207 936 octets libres Le volume dans le lecteur C s'appelle disc Le numéro de série du volume est B0E4-0458 Répertoire de C:\Documents and Settings\PIN\Application Data 22/07/2006 12:08 . 22/07/2006 12:08 .. 26/07/2006 16:15 Adobe 11/09/2006 14:39 AdobeUM 14/09/2006 18:03 Apple Computer 09/10/2006 18:18 Autodesk 31/03/2007 21:03 BSplayer 31/03/2007 21:03 BSplayer Pro 22/07/2006 16:23 CyberLink 14/09/2006 17:39 FotoTime 28/10/2006 13:30 funkitron 25/09/2006 21:49 Google 20/11/2007 16:34 Grisoft 13/10/2006 15:19 Help 22/07/2006 12:08 Identities 07/10/2007 16:26 Intel 01/10/2006 15:56 Lavasoft 25/08/2006 18:09 Leadertech 22/07/2006 12:08 Macromedia 24/10/2006 13:55 MetaCafe 22/07/2006 12:08 Microsoft 14/09/2006 17:49 Mozilla 22/07/2006 12:12 OD2 12/12/2006 14:20 PlayFirst 22/07/2006 12:08 Real 13/07/2007 11:54 SecondLife 30/08/2007 19:20 ShoppingReport 22/07/2006 13:42 Skype 25/08/2006 18:09 Sonic 05/09/2006 18:47 stickies 22/07/2006 12:08 Sun 22/07/2006 12:08 Symantec 14/09/2006 17:50 Talkback 27/08/2006 23:37 U3 04/12/2006 18:53 vlc 22/07/2006 12:08 You've Got Pictures Screensaver 22/07/2006 12:08 62 desktop.ini 13/11/2006 21:38 78 792 GDIPFONTCACHEV1.DAT 2 fichier(s) 78 854 octets 36 Rép(s) 11 671 207 936 octets libres Le volume dans le lecteur C s'appelle disc Le numéro de série du volume est B0E4-0458 Répertoire de C:\Documents and Settings\PIN\Local Settings\Application Data 22/07/2006 12:08 . 22/07/2006 12:08 .. 22/07/2006 12:08 {7148F0A6-6813-11D6-A77B-00B0D0142050} 26/07/2006 16:15 Adobe 19/12/2006 14:49 Ahead 14/09/2006 18:03 Apple Computer 22/07/2006 12:08 ApplicationHistory 09/10/2006 18:18 Autodesk 01/11/2006 16:05 Downloaded Installations 23/09/2006 22:29 Gearbox Software 25/09/2006 21:49 Google 13/10/2006 15:19 Help 04/09/2006 16:25 Identities 22/07/2006 12:08 Microsoft 14/09/2006 17:49 Mozilla 08/12/2006 00:12 Paint.NET 22/07/2006 12:08 PowerCinema 15/11/2007 23:56 Share_Accelerator_MM 30/08/2006 16:22 218 112 DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 22/07/2006 12:08 135 fusioncache.dat 22/07/2006 16:23 47 160 GDIPFONTCACHEV1.DAT 22/07/2006 12:08 6 362 026 IconCache.db 4 fichier(s) 6 627 433 octets 18 Rép(s) 11 671 203 840 octets libres Le volume dans le lecteur C s'appelle disc Le numéro de série du volume est B0E4-0458 Répertoire de C:\Documents and Settings\Propriétaire\Application Data 22/07/2006 16:18 . 22/07/2006 16:18 .. 07/10/2007 16:26 Intel 22/07/2006 16:18 You've Got Pictures Screensaver 0 fichier(s) 0 octets 4 Rép(s) 11 671 203 840 octets libres Le volume dans le lecteur C s'appelle disc Le numéro de série du volume est B0E4-0458 Répertoire de C:\WINDOWS\system32\config\systemprofile\Application Data 16/08/2004 18:16 . 16/08/2004 18:16 .. 22/07/2006 12:07 Identities 07/10/2007 16:25 Intel 22/07/2006 12:07 Macromedia 16/08/2004 18:16 Microsoft 22/07/2006 12:07 Real 22/07/2006 12:07 Sun 22/07/2006 12:07 Symantec 22/07/2006 12:07 You've Got Pictures Screensaver 16/08/2004 18:16 62 desktop.ini 1 fichier(s) 62 octets 10 Rép(s) 11 671 203 840 octets libres Le volume dans le lecteur C s'appelle disc Le numéro de série du volume est B0E4-0458 Répertoire de C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data 16/08/2004 18:16 . 16/08/2004 18:16 .. 22/07/2006 12:07 {7148F0A6-6813-11D6-A77B-00B0D0142050} 22/07/2006 12:07 ApplicationHistory 16/08/2004 18:16 Microsoft 22/07/2006 12:07 PowerCinema 22/07/2006 12:07 135 fusioncache.dat 22/07/2006 12:07 2 687 222 IconCache.db 2 fichier(s) 2 687 357 octets 6 Rép(s) 11 671 203 840 octets libres ****************************************** Recherche des taches planifiées dans C:\WINDOWS asks C:\WINDOWS\Tasks\AppleSoftwareUpdate.job s €!× " : C : \ P r o g r a m F i l e s \ A p p l e S o f t w a r e U p d a t e \ S o f t w a r e U p d a t e . e x e - T a s k S Y S T E M 0 Ö " C:\WINDOWS\Tasks\HDReg.job € s ! c : \ A p p s \ H D R e g \ H D R e g R e m . e x e c : \ A p p s \ H D R e g \ P I N C:\WINDOWS\Tasks\Rappel Rappel inexploitable C:\WINDOWS\Tasks\Rappel Rappel inexploitable ****************************************** ## Répertoires de C:\Program Files Le volume dans le lecteur C s'appelle disc Le numéro de série du volume est B0E4-0458 Répertoire de C:\Program Files 20/11/2007 19:37 . 20/11/2007 19:37 .. 15/02/2006 19:11 Adobe 19/12/2006 14:47 Ahead 24/08/2006 15:32 Alwil Software 13/08/2007 17:44 AMT 14/09/2006 18:01 Apple Software Update 09/11/2007 21:09 Autodesk Architectural Desktop 2004 22/10/2006 13:37 Bibliorom_CD 20/11/2007 16:13 CCleaner 28/08/2006 19:45 Common Files 15/02/2006 19:04 CyberLink 02/10/2006 10:54 DAP 16/10/2007 20:57 DivX 16/10/2007 20:25 Easy WiFi Radar 19/11/2007 19:27 eMule 01/06/2007 12:22 EPSON 27/05/2007 13:46 ESET 09/11/2007 21:06 Fichiers communs 16/10/2007 21:08 Google 20/11/2007 16:34 Grisoft 22/10/2006 12:52 HiDownload 19/11/2007 19:28 inKline Global 07/10/2007 16:24 Intel 11/10/2007 00:16 Internet Explorer 15/02/2006 18:49 Java 16/10/2007 21:06 Lavasoft 15/02/2006 19:13 Learn2.com 28/08/2006 22:01 Macrogaming 16/10/2007 20:43 Metacafe 16/08/2004 18:11 microsoft frontpage 28/08/2006 19:31 Microsoft Office 22/10/2006 13:38 Microsoft Référence 16/08/2004 18:06 Movie Maker 15/10/2007 18:04 Mozilla Firefox 16/08/2004 18:03 MSN Gaming Zone 02/10/2007 18:30 MSN Messenger 18/11/2006 03:22 MSXML 4.0 09/10/2007 02:00 MSXML 6.0 16/08/2004 18:06 NetMeeting 16/08/2004 18:03 Online Services 16/06/2007 13:25 Outlook Express 11/12/2006 21:51 Rainlendar2 15/02/2006 19:06 Real 15/02/2006 18:48 Realtek 16/11/2007 16:41 RegCleaner 30/08/2007 19:19 Secured eMule 16/08/2004 18:07 Services en ligne 15/11/2007 23:56 Share_Accelerator_MM 30/08/2007 19:20 ShoppingReport 18/06/2007 19:04 Skype 26/07/2006 16:56 Sony Ericsson 05/09/2006 18:47 stickies 01/10/2006 17:57 3 889 824 SweetImSetup.exe 15/02/2006 18:36 Synaptics 20/11/2007 19:37 Trend Micro 29/08/2006 11:25 VDCodecPack3.4 19/11/2007 23:45 Video Add-on 04/12/2006 17:33 VideoLAN 15/02/2006 19:13 Viewpoint 20/10/2007 15:11 Winamp 16/10/2007 21:14 Windows Media Connect 2 16/12/2006 20:52 Windows Media Player 16/08/2004 18:03 Windows NT 28/08/2006 21:48 WinRAR 16/08/2004 18:11 xerox 1 fichier(s) 3 889 824 octets 65 Rép(s) 11 671 199 744 octets libres ****************************************** ## Popups autorisées * Internet Explorer ! REG.EXE VERSION 3.0 HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\New Windows\Allow www.packardbell.com REG_NONE www.packardbell.co.uk REG_NONE www.packardbell.at REG_NONE www.packardbell.dk REG_NONE www.packardbell.fi REG_NONE www.packardbell.fr REG_NONE www.packardbell.de REG_NONE www.packardbell.it REG_NONE www.packardbell.no REG_NONE www.packardbell.es REG_NONE www.packardbell.se REG_NONE www.packardbell.ch REG_NONE www.canalplus.fr REG_BINARY eu1.badoo.com REG_BINARY www8.ratp.info REG_BINARY zonenxt.msn-int.com REG_BINARY zonenxt.msn-ppe.com REG_BINARY zone.msn.com REG_BINARY HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\New Windows\Allow\*.od2.com REG_SZ 0 * Mozilla Firefox (1 autorisé 2 interdit) Rapport lopxpMH2 version 2.0 fait à 19:36:49,72 le 21/11/2007 C:\Documents and Settings\PIN\Bureau ****************************************** ## Répertoires Application Data Le volume dans le lecteur C s'appelle disc Le numéro de série du volume est B0E4-0458 Répertoire de C:\Documents and Settings\All Users\Application Data 16/08/2004 17:54 . 16/08/2004 17:54 .. 15/02/2006 19:11 Adobe 15/02/2006 19:12 AOL 14/09/2006 18:00 Apple Computer 09/10/2006 18:18 Autodesk 30/08/2007 19:20 BufferZone 22/07/2006 14:25 CyberLink 12/03/2007 17:28 Forge of Games 24/11/2006 15:00 Google 20/11/2007 16:34 Grisoft 07/10/2007 16:25 Intel 24/10/2006 13:55 Metacafe 16/08/2004 17:54 Microsoft 28/08/2006 19:46 Motive 15/02/2006 19:13 OD2 15/11/2007 00:36 pixelStorm 15/02/2006 19:12 QuickTime 16/08/2004 18:28 SBSI 18/06/2007 19:03 Skype 26/07/2006 16:56 Sony Ericsson 15/02/2006 19:07 Symantec 15/02/2006 19:13 Viewpoint 28/08/2006 19:27 Windows Genuine Advantage 16/08/2004 17:55 62 desktop.ini 1 fichier(s) 62 octets 24 Rép(s) 11 671 183 360 octets libres Le volume dans le lecteur C s'appelle disc Le numéro de série du volume est B0E4-0458 Répertoire de C:\Documents and Settings\Default User\Application Data 16/08/2004 17:54 . 16/08/2004 17:54 .. 22/07/2006 12:07 Identities 07/10/2007 16:26 Intel 22/07/2006 12:07 Macromedia 16/08/2004 17:54 Microsoft 22/07/2006 12:07 Real 22/07/2006 12:07 Sun 22/07/2006 12:07 Symantec 22/07/2006 12:07 You've Got Pictures Screensaver 16/08/2004 17:54 62 desktop.ini 1 fichier(s) 62 octets 10 Rép(s) 11 671 183 360 octets libres Le volume dans le lecteur C s'appelle disc Le numéro de série du volume est B0E4-0458 Répertoire de C:\Documents and Settings\Default User\Local Settings\Application Data 16/08/2004 17:55 . 16/08/2004 17:55 .. 22/07/2006 12:07 {7148F0A6-6813-11D6-A77B-00B0D0142050} 22/07/2006 12:07 ApplicationHistory 16/08/2004 18:10 Microsoft 22/07/2006 12:07 PowerCinema 22/07/2006 12:07 135 fusioncache.dat 22/07/2006 12:07 2 687 222 IconCache.db 2 fichier(s) 2 687 357 octets 6 Rép(s) 11 671 183 360 octets libres Le volume dans le lecteur C s'appelle disc Le numéro de série du volume est B0E4-0458 Répertoire de C:\Documents and Settings\LocalService\Application Data 16/08/2004 18:18 . 16/08/2004 18:18 .. 07/10/2007 16:26 Intel 16/08/2004 18:18 Microsoft 0 fichier(s) 0 octets 4 Rép(s) 11 671 183 360 octets libres Le volume dans le lecteur C s'appelle disc Le numéro de série du volume est B0E4-0458 Répertoire de C:\Documents and Settings\LocalService\Local Settings\Application Data 16/08/2004 18:18 . 16/08/2004 18:18 .. 16/08/2004 18:18 Microsoft 0 fichier(s) 0 octets 3 Rép(s) 11 671 183 360 octets libres Le volume dans le lecteur C s'appelle disc Le numéro de série du volume est B0E4-0458 Répertoire de C:\Documents and Settings\NetworkService\Application Data 16/08/2004 18:18 . 16/08/2004 18:18 .. 07/10/2007 16:26 Intel 16/08/2004 18:18 Microsoft 09/08/2006 21:08 Symantec 0 fichier(s) 0 octets 5 Rép(s) 11 671 183 360 octets libres Le volume dans le lecteur C s'appelle disc Le numéro de série du volume est B0E4-0458 Répertoire de C:\Documents and Settings\NetworkService\Local Settings\Application Data 16/08/2004 18:18 . 16/08/2004 18:18 .. 16/08/2004 18:18 Microsoft 0 fichier(s) 0 octets 3 Rép(s) 11 671 183 360 octets libres Le volume dans le lecteur C s'appelle disc Le numéro de série du volume est B0E4-0458 Répertoire de C:\Documents and Settings\PIN\Application Data 22/07/2006 12:08 . 22/07/2006 12:08 .. 26/07/2006 16:15 Adobe 11/09/2006 14:39 AdobeUM 14/09/2006 18:03 Apple Computer 09/10/2006 18:18 Autodesk 31/03/2007 21:03 BSplayer 31/03/2007 21:03 BSplayer Pro 22/07/2006 16:23 CyberLink 14/09/2006 17:39 FotoTime 28/10/2006 13:30 funkitron 25/09/2006 21:49 Google 20/11/2007 16:34 Grisoft 13/10/2006 15:19 Help 22/07/2006 12:08 Identities 07/10/2007 16:26 Intel 01/10/2006 15:56 Lavasoft 25/08/2006 18:09 Leadertech 22/07/2006 12:08 Macromedia 24/10/2006 13:55 MetaCafe 22/07/2006 12:08 Microsoft 14/09/2006 17:49 Mozilla 22/07/2006 12:12 OD2 12/12/2006 14:20 PlayFirst 22/07/2006 12:08 Real 13/07/2007 11:54 SecondLife 30/08/2007 19:20 ShoppingReport 22/07/2006 13:42 Skype 25/08/2006 18:09 Sonic 05/09/2006 18:47 stickies 22/07/2006 12:08 Sun 22/07/2006 12:08 Symantec 14/09/2006 17:50 Talkback 27/08/2006 23:37 U3 04/12/2006 18:53 vlc 22/07/2006 12:08 You've Got Pictures Screensaver 22/07/2006 12:08 62 desktop.ini 13/11/2006 21:38 78 792 GDIPFONTCACHEV1.DAT 2 fichier(s) 78 854 octets 36 Rép(s) 11 671 179 264 octets libres Le volume dans le lecteur C s'appelle disc Le numéro de série du volume est B0E4-0458 Répertoire de C:\Documents and Settings\PIN\Local Settings\Application Data 22/07/2006 12:08 . 22/07/2006 12:08 .. 22/07/2006 12:08 {7148F0A6-6813-11D6-A77B-00B0D0142050} 26/07/2006 16:15 Adobe 19/12/2006 14:49 Ahead 14/09/2006 18:03 Apple Computer 22/07/2006 12:08 ApplicationHistory 09/10/2006 18:18 Autodesk 01/11/2006 16:05 Downloaded Installations 23/09/2006 22:29 Gearbox Software 25/09/2006 21:49 Google 13/10/2006 15:19 Help 04/09/2006 16:25 Identities 22/07/2006 12:08 Microsoft 14/09/2006 17:49 Mozilla 08/12/2006 00:12 Paint.NET 22/07/2006 12:08 PowerCinema 15/11/2007 23:56 Share_Accelerator_MM 30/08/2006 16:22 218 112 DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 22/07/2006 12:08 135 fusioncache.dat 22/07/2006 16:23 47 160 GDIPFONTCACHEV1.DAT 22/07/2006 12:08 6 362 026 IconCache.db 4 fichier(s) 6 627 433 octets 18 Rép(s) 11 671 179 264 octets libres Le volume dans le lecteur C s'appelle disc Le numéro de série du volume est B0E4-0458 Répertoire de C:\Documents and Settings\Propriétaire\Application Data 22/07/2006 16:18 . 22/07/2006 16:18 .. 07/10/2007 16:26 Intel 22/07/2006 16:18 You've Got Pictures Screensaver 0 fichier(s) 0 octets 4 Rép(s) 11 671 179 264 octets libres Le volume dans le lecteur C s'appelle disc Le numéro de série du volume est B0E4-0458 Répertoire de C:\WINDOWS\system32\config\systemprofile\Application Data 16/08/2004 18:16 . 16/08/2004 18:16 .. 22/07/2006 12:07 Identities 07/10/2007 16:25 Intel 22/07/2006 12:07 Macromedia 16/08/2004 18:16 Microsoft 22/07/2006 12:07 Real 22/07/2006 12:07 Sun 22/07/2006 12:07 Symantec 22/07/2006 12:07 You've Got Pictures Screensaver 16/08/2004 18:16 62 desktop.ini 1 fichier(s) 62 octets 10 Rép(s) 11 671 175 168 octets libres Le volume dans le lecteur C s'appelle disc Le numéro de série du volume est B0E4-0458 Répertoire de C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data 16/08/2004 18:16 . 16/08/2004 18:16 .. 22/07/2006 12:07 {7148F0A6-6813-11D6-A77B-00B0D0142050} 22/07/2006 12:07 ApplicationHistory 16/08/2004 18:16 Microsoft 22/07/2006 12:07 PowerCinema 22/07/2006 12:07 135 fusioncache.dat 22/07/2006 12:07 2 687 222 IconCache.db 2 fichier(s) 2 687 357 octets 6 Rép(s) 11 671 175 168 octets libres ****************************************** Recherche des taches planifiées dans C:\WINDOWS asks C:\WINDOWS\Tasks\AppleSoftwareUpdate.job s €!× " : C : \ P r o g r a m F i l e s \ A p p l e S o f t w a r e U p d a t e \ S o f t w a r e U p d a t e . e x e - T a s k S Y S T E M 0 Ö " C:\WINDOWS\Tasks\HDReg.job € s ! c : \ A p p s \ H D R e g \ H D R e g R e m . e x e c : \ A p p s \ H D R e g \ P I N C:\WINDOWS\Tasks\Rappel Rappel inexploitable C:\WINDOWS\Tasks\Rappel Rappel inexploitable ****************************************** ## Répertoires de C:\Program Files Le volume dans le lecteur C s'appelle disc Le numéro de série du volume est B0E4-0458 Répertoire de C:\Program Files 20/11/2007 19:37 . 20/11/2007 19:37 .. 15/02/2006 19:11 Adobe 19/12/2006 14:47 Ahead 24/08/2006 15:32 Alwil Software 13/08/2007 17:44 AMT 14/09/2006 18:01 Apple Software Update 09/11/2007 21:09 Autodesk Architectural Desktop 2004 22/10/2006 13:37 Bibliorom_CD 20/11/2007 16:13 CCleaner 28/08/2006 19:45 Common Files 15/02/2006 19:04 CyberLink 02/10/2006 10:54 DAP 16/10/2007 20:57 DivX 16/10/2007 20:25 Easy WiFi Radar 19/11/2007 19:27 eMule 01/06/2007 12:22 EPSON 27/05/2007 13:46 ESET 09/11/2007 21:06 Fichiers communs 16/10/2007 21:08 Google 20/11/2007 16:34 Grisoft 22/10/2006 12:52 HiDownload 19/11/2007 19:28 inKline Global 07/10/2007 16:24 Intel 11/10/2007 00:16 Internet Explorer 15/02/2006 18:49 Java 16/10/2007 21:06 Lavasoft 15/02/2006 19:13 Learn2.com 28/08/2006 22:01 Macrogaming 16/10/2007 20:43 Metacafe 16/08/2004 18:11 microsoft frontpage 28/08/2006 19:31 Microsoft Office 22/10/2006 13:38 Microsoft Référence 16/08/2004 18:06 Movie Maker 15/10/2007 18:04 Mozilla Firefox 16/08/2004 18:03 MSN Gaming Zone 02/10/2007 18:30 MSN Messenger 18/11/2006 03:22 MSXML 4.0 09/10/2007 02:00 MSXML 6.0 16/08/2004 18:06 NetMeeting 16/08/2004 18:03 Online Services 16/06/2007 13:25 Outlook Express 11/12/2006 21:51 Rainlendar2 15/02/2006 19:06 Real 15/02/2006 18:48 Realtek 16/11/2007 16:41 RegCleaner 30/08/2007 19:19 Secured eMule 16/08/2004 18:07 Services en ligne 15/11/2007 23:56 Share_Accelerator_MM 30/08/2007 19:20 ShoppingReport 18/06/2007 19:04 Skype 26/07/2006 16:56 Sony Ericsson 05/09/2006 18:47 stickies 01/10/2006 17:57 3 889 824 SweetImSetup.exe 15/02/2006 18:36 Synaptics 20/11/2007 19:37 Trend Micro 29/08/2006 11:25 VDCodecPack3.4 19/11/2007 23:45 Video Add-on 04/12/2006 17:33 VideoLAN 15/02/2006 19:13 Viewpoint 20/10/2007 15:11 Winamp 16/10/2007 21:14 Windows Media Connect 2 16/12/2006 20:52 Windows Media Player 16/08/2004 18:03 Windows NT 28/08/2006 21:48 WinRAR 16/08/2004 18:11 xerox 1 fichier(s) 3 889 824 octets 65 Rép(s) 11 671 171 072 octets libres ****************************************** ## Popups autorisées * Internet Explorer ! REG.EXE VERSION 3.0 HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\New Windows\Allow www.packardbell.com REG_NONE www.packardbell.co.uk REG_NONE www.packardbell.at REG_NONE www.packardbell.dk REG_NONE www.packardbell.fi REG_NONE www.packardbell.fr REG_NONE www.packardbell.de REG_NONE www.packardbell.it REG_NONE www.packardbell.no REG_NONE www.packardbell.es REG_NONE www.packardbell.se REG_NONE www.packardbell.ch REG_NONE www.canalplus.fr REG_BINARY eu1.badoo.com REG_BINARY www8.ratp.info REG_BINARY zonenxt.msn-int.com REG_BINARY zonenxt.msn-ppe.com REG_BINARY zone.msn.com REG_BINARY HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\New Windows\Allow\*.od2.com REG_SZ 0 * Mozilla Firefox (1 autorisé 2 interdit) ---------- C:\DOCUMENTS AND SETTINGS\PIN\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\IUUHHAGU.DEFAULT\HOSTPERM.1 host popup 1 webmessenger.msn.com host popup 1 www.xtremeverbier.com ****************************************** ## Registre * [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] Search Bar REG_SZ https://www.bing.com/?cc=fr&toHttps=1&redig=55729C844D6A45819CAD368B3E178C9F ****************************************** ## Zones de sécurité * HKCU Domains (4) * P3P History (5) ****************************************** ## Recherche C:\WINDOWS\*.htm, "C:\WINDOWS\*.gif" *************** Fin du rapport **************** est-ce mauvais signe docteur? Sinon mon fond d'écran rouge n'était plus la ce midi ms il est revenu ce soir

Utilisateur anonyme · Answer

cocher + fixer ces lignes.
https://leblogdeclaude.blogspot.com/2007/05/comment-utiliser-hijackthis-fixer.html
------------------------------------------------------------ 	
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Hacked by Godzilla
 	O2 - BHO: ShoppingReport - {100EB1FD-D03E-47FD-81F3-EE91287F9465} - C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - (no file)
 	O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
	O2 - BHO: MSVPS System - {9C985AC6-A138-4EAB-B10A-DC522F755146} - C:\WINDOWS\popnetdpt.dll
 	O3 - Toolbar: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file)
	O3 - Toolbar: The jokwmp - {D71F3444-606D-46EB-9ABE-DF80E5E9BF67} - C:\WINDOWS\jokwmp.dll
 	O9 - Extra button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll
 	O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll
 	O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
 	O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
Inconnu
	O16 - DPF: {09CC593B-E8A9-4491-927D-A3E33534DDD4} (InstallerObj Class) - http://www.m6video.fr/1click/install/files/installer2.cab
 	O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
Inconnu
	O18 - Protocol: t-mobile - (no CLSID) - (no file)
O21 - SSODL: sapnet - {FF6C9F35-C22D-43B6-A399-0374AF11EC2E} - (no file)
Inconnu
	O21 - SSODL: rmvgor - {CE7AEE4E-2130-4EF8-8B04-3B437490A6FB} - C:\WINDOWS\rmvgor.dll
 	O24 - Desktop Component 0: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm
-------------------------------------------------------------------------------------------------------------------------
fais ceci:
https://leblogdeclaude.blogspot.com/2007/03/informatique-procdure-navifix.html
postes le rapport
+ à la suite le rapport Hijackthis
----------------------------------------------------
conseil:
---------------------
il faudra changer tes habites sur le NET, tu te fais courir de sérieux problèmes....

Tamarin · Answer

Voila,
J'ai donc fixé les lignes que tu m'as conseillé et voici le premier rapport du programme Navilog1 :




Search Navipromo version 3.3.6 commencé le 21/11/2007 à 21:02:21,89

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files
avilog1
Mise à jour le 14.11.2007 à 18h00 par IL-MAFIOSO


Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 7.0.5730.11 


*** Recherche Programmes installés ***




*** Recherche dossiers dans C:\WINDOWS ***



*** Recherche dossiers dans C:\Program Files ***



*** Recherche dossiers dans C:\Documents and Settings\All Users\Application Data ***




*** Recherche dossiers dans C:\Documents and Settings\PIN\Application Data ***


*** Recherche dossiers dans C:\DOCUME~1\ALLUSE~1\MENUDÉ~1\PROGRA~1 ***


*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net

Aucun fichier trouvé dans :

- C:\WINDOWS\system32
- C:\DOCUME~1\PIN\LOCALS~1\APPLIC~1



*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans C:\WINDOWS\system32 *

* Recherche dans C:\DOCUME~1\PIN\LOCALS~1\APPLIC~1 *



*** Recherche fichiers *** 




*** Recherche clés spécifiques dans le Registre ***


*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche fichiers connus:

2)Recherche Heuristique :



3)Recherche Certificats :

Certificat Egroup absent !


*** Analyse terminée le 21/11/2007 à 21:03:20,17 ***





et voici celui de HijackThis effectué a la suite :




Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:08:27, on 21/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Rainlendar2\Rainlendar2.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Metacafe\MetacafeAgent.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\DAP\DAP.EXE
C:\WINDOWS\system32
otepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\MSN Messenger\livecall.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32
otepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?cc=fr&toHttps=1&redig=55729C844D6A45819CAD368B3E178C9F
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://home.sweetim.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file)
R3 - URLSearchHook: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM	bShar.dll
O2 - BHO: (no name) - {02DCA195-602B-4B1F-83FF-381B7E804BDB} - C:\WINDOWS\system32\HDBHO.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM	bShar.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM	bShar.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Rainlendar2] C:\Program Files\Rainlendar2\Rainlendar2.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Metacafe.lnk = C:\Program Files\Metacafe\MetacafeAgent.exe
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll
O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32
wprovau.dll
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O18 - Protocol: t-mobile - (no CLSID) - (no file)
O21 - SSODL: msmhost - {0E3C805D-021A-496B-A562-F3AA760B787B} - C:\WINDOWS\msmhost.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: MySqlInventime - Unknown owner - c:\mysql\bin\mysqld-max-nt.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

Tamarin · Answer

et tu veux dire quoi par changer mes habitudes ??

Utilisateur anonyme · Answer

question ?
--------
tu utilise les caractères asiatiques sur ce PC ?
------------------------------------------------------------------------------------
et tu veux dire quoi par changer mes habitudes ??
réponse----->
En gros, fais gaffe où tu mets les pieds sur le Net.
Prend ça positivement comme un conseil.
Je ne vais pas ici te dire ce que tu dois faire ou pas.
Je vois qu'à travers tes rapports tu te fais prendre des risques inutiles et évitables.
Il faut se dire, que la majorité des virus arrivent par de mauvaises habitudes de surf !
Tu peux trés bien te prendre un virus , rien qu'en allant sur une page Internet...sans rien downloader !
A ce propos il faudra que tu changes d'antivirus.
Avast n'est pas assez réactif avec ces mises à jour. Il va te laisser passer des virus qui sont vieux de parfois plusieurs semaines !
Alors que les autres les détectent.
Je pense qui si tu continues dans le free, ANTIVIR serait un choix intelligent.

------------------------------------------------------------------------------------
Venons en au fait.
fixer et cocher
https://leblogdeclaude.blogspot.com/2007/05/comment-utiliser-hijackthis-fixer.html

-----------------------

 O9 - Extra button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll
O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab 
----------------------------------------
Télécharge OAD http://sosvirus.changelog.fr/OAD.exe
- Enregistre le sur ton bureau

Double clique sur le OAD pour le lancer

- nom de fichier à rechercher tape ou fais un copier coller de : ShoppingReport
- Type de recherche : sélectionne l'option 6 puis valide [entree]

OAD va maintenant rechercher le fichier. Laisse le travailler jusqu'à ce qu'il en ai terminé.
Le rapport de recherche s'affichera automatiquement à dès qu'il en aura terminé.

- Fais un copier / coller de ce rapport dans ton prochain post.

Tamarin · Answer

salut,

Merci pour tes conseils, je vais tacher de les suivre. Sinon pour Antivir, dois-je désinstaller AVG antispyware ou est ce que je peux laisser tourner les deux?

Sinon j'ai fixé les ligne que tu m'as dit et fait la recherche avec AOD. 

Voici le rapport :

 22/11/2007 ---- 19:35:35,21  

----------------------------------
§§§§§§ [ShoppingReport] §§§§§§
----------------------------------
[X] Registre
 
-------------- [  ] rapide
-- Fichier --- [  ] disque systeme
 ------------- [X] complete


********************
     [Registre] 
********************


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20EA9658-6BC3-4599-A87D-6371FE9295FC}\InprocServer32]
@="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20EA9658-6BC3-4599-A87D-6371FE9295FC}\ProgID]
@="ShoppingReport.HbAx.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20EA9658-6BC3-4599-A87D-6371FE9295FC}\ToolboxBitmap32]
@="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll, 102"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20EA9658-6BC3-4599-A87D-6371FE9295FC}\VersionIndependentProgID]
@="ShoppingReport.HbAx"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A16AD1E9-F69A-45AF-9462-B1C286708842}\InprocServer32]
@="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A16AD1E9-F69A-45AF-9462-B1C286708842}\ProgID]
@="ShoppingReport.IEButtonA.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A16AD1E9-F69A-45AF-9462-B1C286708842}\VersionIndependentProgID]
@="ShoppingReport.IEButtonA"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A7CDDCDC-BEEB-4685-A062-978F5E07CEEE}\InprocServer32]
@="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A7CDDCDC-BEEB-4685-A062-978F5E07CEEE}\ProgID]
@="ShoppingReport.HbInfoBand.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A7CDDCDC-BEEB-4685-A062-978F5E07CEEE}\VersionIndependentProgID]
@="ShoppingReport.HbInfoBand"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C9CCBB35-D123-4A31-AFFC-9B2933132116}\InprocServer32]
@="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C9CCBB35-D123-4A31-AFFC-9B2933132116}\ProgID]
@="ShoppingReport.IEButton.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C9CCBB35-D123-4A31-AFFC-9B2933132116}\VersionIndependentProgID]
@="ShoppingReport.IEButton"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.HbAx]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.HbAx\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.HbAx\CurVer]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.HbAx\CurVer]
@="ShoppingReport.HbAx.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.HbAx.1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.HbAx.1\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.HbInfoBand]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.HbInfoBand\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.HbInfoBand\CurVer]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.HbInfoBand\CurVer]
@="ShoppingReport.HbInfoBand.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.HbInfoBand.1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.HbInfoBand.1\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.IEButton]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.IEButton\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.IEButton\CurVer]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.IEButton\CurVer]
@="ShoppingReport.IEButton.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.IEButton.1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.IEButton.1\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.IEButtonA]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.IEButtonA\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.IEButtonA\CurVer]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.IEButtonA\CurVer]
@="ShoppingReport.IEButtonA.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.IEButtonA.1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.IEButtonA.1\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.RprtCtrl]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.RprtCtrl]
@="ShoppingReport"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.RprtCtrl\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.RprtCtrl\CurVer]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.RprtCtrl\CurVer]
@="ShoppingReport.RprtCtrl.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.RprtCtrl.1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.RprtCtrl.1]
@="ShoppingReport"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.RprtCtrl.1\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{CDCA70D8-C6A6-49EE-9BED-7429D6C477A2}\1.0\0\win32]
@="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll\4"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{CDCA70D8-C6A6-49EE-9BED-7429D6C477A2}\1.0\HELPDIR]
@="C:\Program Files\ShoppingReport\Bin\2.0.24\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D136987F-E1C4-4CCC-A220-893DF03EC5DF}\1.0\0\win32]
@="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll\3"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D136987F-E1C4-4CCC-A220-893DF03EC5DF}\1.0\HELPDIR]
@="C:\Program Files\ShoppingReport\Bin\2.0.24\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E343EDFC-1E6C-4CB5-AA29-E9C922641C80}\1.0\0\win32]
@="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E343EDFC-1E6C-4CB5-AA29-E9C922641C80}\1.0\HELPDIR]
@="C:\Program Files\ShoppingReport\Bin\2.0.24\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{C5428486-50A0-4a02-9D20-520B59A9F9B2}]
"HotIcon"="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll,204"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{C5428486-50A0-4a02-9D20-520B59A9F9B2}]
"Icon"="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll,203"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{C5428486-50A0-4a02-9D20-520B59A9F9B3}]
"HotIcon"="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll,202"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{C5428486-50A0-4a02-9D20-520B59A9F9B3}]
"Icon"="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll,201"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\ShoppingReport]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ShoppingReport]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ShoppingReport]
"DisplayIcon"="C:\Program Files\ShoppingReport\Uninst.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ShoppingReport]
"UninstallString"="C:\Program Files\ShoppingReport\Uninst.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\ShoppingReport]

[HKEY_USERS\S-1-5-21-39989766-2330583763-384686628-1006\Software\ShoppingReport]

[HKEY_USERS\S-1-5-21-39989766-2330583763-384686628-1006\Software\ShoppingReport]
"currentResDir"="C:\Documents and Settings\PIN\Application Data\ShoppingReport\cs\res2"

*******************
     [Fichier] 
*******************

c:\Documents and Settings\PIN\Application Data\ShoppingReport
c:\Program Files\ShoppingReport
c:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll


*********************
     [Même date] 
*********************

[R‚pertoire ] --- REP ---> C:\Program Files\Files   



Outil Aide Diagnostic By !aur3n7 Version 1.1
----------------------------------
§§§§§ Fin Rapport §§§§§ 
----------------------------------

Utilisateur anonyme · Answer

Argh !
j'ai du pain sur la planche...je vais te faire un script pour The Avenger.
On va faire le ménage...
A demain
--------------------
pas de réponse à ceci:
question ?
--------
tu utilise les caractères asiatiques sur ce PC ? 

-----------------
 Sinon pour Antivir, dois-je désinstaller AVG antispyware ou est ce que je peux laisser tourner les deux? 
les deux sont complémentaires.
Par contre désinstalles Avast (absolument !) pour installer Antivir.

Tamarin · Answer

Dsl,

je n'avais pas vu la question : Non je ne me souviens pas avoir utilisé de caractères asiatiques et je ne pense pas en avoir besoin dans le future.

En tou cas merci vraiment pour le temps que tu me consacres.


J'ai fais un scan avec Antivir, je te poste ci-dessous le rapport, s'ils peuvent t'être utile :




AntiVir PersonalEdition Classic
Report file date: jeudi 22 novembre 2007  20:16

Scanning for 940014 virus strains and unwanted programs.

Licensed to:      Avira AntiVir PersonalEdition Classic
Serial number:    0000149996-ADJIE-0001
Platform:         Windows XP
Windows version:  (Service Pack 2)  [5.1.2600]
Username:         SYSTEM
Computer name:    SAMPRAS

Version information:
BUILD.DAT    : 270           15603 Bytes  19/09/2007 13:32:00
AVSCAN.EXE   : 7.0.6.1      290856 Bytes  23/08/2007 13:16:29
AVSCAN.DLL   : 7.0.6.0       49192 Bytes  16/08/2007 12:23:51
LUKE.DLL     : 7.0.5.3      147496 Bytes  14/08/2007 15:32:47
LUKERES.DLL  : 7.0.6.1       10280 Bytes  21/08/2007 12:35:20
ANTIVIR0.VDF : 6.40.0.0    11030528 Bytes  18/07/2007 14:27:15
ANTIVIR1.VDF : 7.0.0.0     1640448 Bytes  13/09/2007 14:26:55
ANTIVIR2.VDF : 7.0.0.198   1206272 Bytes  11/11/2007 19:08:37
ANTIVIR3.VDF : 7.0.0.249    201216 Bytes  22/11/2007 19:08:37
AVEWIN32.DLL : 7.6.0.34    3125760 Bytes  22/11/2007 19:08:37
AVWINLL.DLL  : 1.0.0.7       14376 Bytes  26/02/2007 10:36:26
AVPREF.DLL   : 7.0.2.2       25640 Bytes  18/07/2007 07:39:17
AVREP.DLL    : 7.0.0.1      155688 Bytes  16/04/2007 13:16:24
AVPACK32.DLL : 7.3.0.15     360488 Bytes  03/08/2007 08:46:00
AVREG.DLL    : 7.0.1.6       30760 Bytes  18/07/2007 07:17:06
AVARKT.DLL   : 1.0.0.20     278568 Bytes  28/08/2007 12:26:33
AVEVTLOG.DLL : 7.0.0.20      86056 Bytes  18/07/2007 07:10:18
NETNT.DLL    : 7.0.0.0        7720 Bytes  08/03/2007 11:09:42
RCIMAGE.DLL  : 7.0.1.30    2342952 Bytes  07/08/2007 12:38:13
RCTEXT.DLL   : 7.0.62.0      86056 Bytes  21/08/2007 12:50:37
SQLITE3.DLL  : 3.3.17.1     339968 Bytes  23/07/2007 09:37:21

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: C:, 
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: jeudi 22 novembre 2007  20:16

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned
Scan process 'livecall.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'MetacafeAgent.exe' - '1' Module(s) have been scanned
Scan process 'firefox.exe' - '1' Module(s) have been scanned
Scan process 'iFrmewrk.exe' - '1' Module(s) have been scanned
Scan process 'usnsvc.exe' - '1' Module(s) have been scanned
Scan process 'Dot1XCfg.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'ashWebSv.exe' - '1' Module(s) have been scanned
Scan process 'ashMaiSv.exe' - '1' Module(s) have been scanned
Scan process 'Rainlendar2.exe' - '1' Module(s) have been scanned
Scan process 'avgas.exe' - '1' Module(s) have been scanned
Scan process 'realsched.exe' - '1' Module(s) have been scanned
Scan process 'iFrmewrk.exe' - '1' Module(s) have been scanned
Scan process 'ZCfgSvc.exe' - '1' Module(s) have been scanned
Scan process 'ashDisp.exe' - '1' Module(s) have been scanned
Scan process 'CLSched.exe' - '1' Module(s) have been scanned
Scan process 'WLKEEPER.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'slserv.exe' - '1' Module(s) have been scanned
Scan process 'RegSrvc.exe' - '1' Module(s) have been scanned
Scan process 'HidService.exe' - '1' Module(s) have been scanned
Scan process 'EvtEng.exe' - '1' Module(s) have been scanned
Scan process 'CLCapSvc.exe' - '1' Module(s) have been scanned
Scan process 'guard.exe' - '0' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'ashServ.exe' - '1' Module(s) have been scanned
Scan process 'aswUpdSv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'S24EvMon.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
46 processes with 46 modules were scanned

Start scanning boot sectors:
Boot sector 'C:\'
      [NOTE]      No virus was found!

Starting to scan the registry.
The registry was scanned ( '22' files ).


Starting the file scan:

Begin scan in 'C:\' <disc>
C:\pagefile.sys
      [WARNING]   The file could not be opened!
C:\Documents and Settings\PIN\Local Settings\Temp\BIT1.tmp
  [0] Archive type: ZIP
  --> install-privacy-danger.bat
      [DETECTION] Contains detection pattern of the batch virus BAT/Fake.Privdanger
      [INFO]      The file was moved to '4799dd2b.qua'!
C:\Documents and Settings\PIN\Local Settings\Temp\BIT17.tmp
  [0] Archive type: ZIP
  --> install-privacy-danger.bat
      [DETECTION] Contains detection pattern of the batch virus BAT/Fake.Privdanger
      [INFO]      The file was moved to '4799dd34.qua'!
C:\Documents and Settings\PIN\Mes documents\My Completed Downloads\VideoAccessCodecInstall.exe
      [DETECTION] Contains detection pattern of the dropper DR/Zlob.Gen
      [INFO]      The file was deleted!
C:\Program Files\ShoppingReport\Uninst.exe
      [DETECTION] Contains detection pattern of the dropper DR/MartShop.2
      [INFO]      The file was moved to '47aee2c9.qua'!
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP330\A0122160.exe
      [DETECTION] Contains detection pattern of the dropper DR/180Solutions.BJ.9
      [INFO]      The file was moved to '4776e573.qua'!
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP330\A0122171.inf
      [DETECTION] Contains detection pattern of the VBS script virus VBS/IETitle.A
      [INFO]      The file was moved to '4776e578.qua'!
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP332\A0122423.exe
      [DETECTION] Contains detection pattern of the dropper DR/MartShop.2
      [INFO]      The file was moved to '4776e731.qua'!
C:\WINDOWS\system32\drivers\sptd.sys
      [WARNING]   The file could not be opened!


End of the scan: jeudi 22 novembre 2007  21:55
Used time:  1:38:49 min

The scan has been done completely.

   6441 Scanning directories
 177611 Files were scanned
      7 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      1 files were deleted
      0 files were repaired
      6 files were moved to quarantine
      0 files were renamed
      2 Files cannot be scanned
 177604 Files not concerned
   6772 Archives were scanned
      2 Warnings
      0 Notes





Voila, A demain et merci encore!

Utilisateur anonyme · Answer

bien, tu as tes points de restauration qui sont inutilisables.
----------
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP330\A0122160.exe
[DETECTION] Contains detection pattern of the dropper DR/180Solutions.BJ.9
[INFO] The file was moved to '4776e573.qua'!
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP330\A0122171.inf
[DETECTION] Contains detection pattern of the VBS script virus VBS/IETitle.A
[INFO] The file was moved to '4776e578.qua'!
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP332\A0122423.exe
[DETECTION] Contains detection pattern of the dropper DR/MartShop.2
[INFO] The file was moved to '4776e731.qua'! 
------------------------------
fais ceci:
http://www.commentcamarche.net/faq/sujet 5097 virus system volume information
-------------------------------------------
-------------------------------------------------------------------------------------
fais une sauvegarde de ta BDR.
https://leblogdeclaude.blogspot.com/2006/10/informatique-sauvegarde-de-la-base-de.html
--------------------------------------------------------------------------
ouvres notepad.exe
copie le texte en dessous (avec sélectionner le texte ctrl+c et ctrl+v pour le  coller)
enregistre le texte sous fix.txt sur le bureau
------------------------------------------

registry keys to delete: 
HKLM\SOFTWARE\Classes\CLSID\{20EA9658-6BC3-4599-A87D-6371FE9295FC}\InprocSe rver32
@="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll"
HKLM\SOFTWARE\Classes\CLSID\{20EA9658-6BC3-4599-A87D-6371FE9295FC}\ProgID
@="ShoppingReport.HbAx.1"
HKLM\SOFTWARE\Classes\CLSID\{20EA9658-6BC3-4599-A87D-6371FE9295FC}\ToolboxB itmap32
@="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll, 102"
HKLM\SOFTWARE\Classes\CLSID\{20EA9658-6BC3-4599-A87D-6371FE9295FC}\VersionI ndependentProgID
@="ShoppingReport.HbAx"
HKLM\SOFTWARE\Classes\CLSID\{A16AD1E9-F69A-45AF-9462-B1C286708842}\InprocSe rver32
@="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll"
HKLM\SOFTWARE\Classes\CLSID\{A16AD1E9-F69A-45AF-9462-B1C286708842}\ProgID
@="ShoppingReport.IEButtonA.1"
HKLM\SOFTWARE\Classes\CLSID\{A16AD1E9-F69A-45AF-9462-B1C286708842}\VersionI ndependentProgID
@="ShoppingReport.IEButtonA"
HKLM\SOFTWARE\Classes\CLSID\{A7CDDCDC-BEEB-4685-A062-978F5E07CEEE}\InprocSe rver32
@="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll"
HKLM\SOFTWARE\Classes\CLSID\{A7CDDCDC-BEEB-4685-A062-978F5E07CEEE}\ProgID
@="ShoppingReport.HbInfoBand.1"
HKLM\Classes\CLSID\{A7CDDCDC-BEEB-4685-A062-978F5E07CEEE}\VersionI ndependentProgID
@="ShoppingReport.HbInfoBand"
HKLM\SOFTWARE\Classes\CLSID\{C9CCBB35-D123-4A31-AFFC-9B2933132116}\InprocSe rver32
@="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll"
HKLM\SOFTWARE\Classes\CLSID\{C9CCBB35-D123-4A31-AFFC-9B2933132116}\ProgID
@="ShoppingReport.IEButton.1"
HKLM\SOFTWARE\Classes\CLSID\{C9CCBB35-D123-4A31-AFFC-9B2933132116}\VersionI ndependentProgID
@="ShoppingReport.IEButton"
HKLM\SOFTWARE\Classes\ShoppingReport.HbAx
HKLM\SOFTWARE\Classes\ShoppingReport.HbAx\CLSID
HKLM\SOFTWARE\Classes\ShoppingReport.HbAx\CurVer
HKLM\SOFTWARE\Classes\ShoppingReport.HbAx\CurVer
@="ShoppingReport.HbAx.1"
HKLM\SOFTWARE\Classes\ShoppingReport.HbAx.1
HKLM\SOFTWARE\Classes\ShoppingReport.HbAx.1\CLSID
HKLM\SOFTWARE\Classes\ShoppingReport.HbInfoBand
HKLM\SOFTWARE\Classes\ShoppingReport.HbInfoBand\CLSID
HKLM\SOFTWARE\Classes\ShoppingReport.HbInfoBand\CurVer
HKLM\SOFTWARE\Classes\ShoppingReport.HbInfoBand\CurVer
@="ShoppingReport.HbInfoBand.1"
HKLM\SOFTWARE\Classes\ShoppingReport.HbInfoBand.1
HKLM\SOFTWARE\Classes\ShoppingReport.HbInfoBand.1\CLSID
HKLM\SOFTWARE\Classes\ShoppingReport.IEButton
HKLM\SOFTWARE\Classes\ShoppingReport.IEButton\CLSID
HKLM\SOFTWARE\Classes\ShoppingReport.IEButton\CurVer
HKLM\SOFTWARE\Classes\ShoppingReport.IEButton\CurVer
@="ShoppingReport.IEButton.1"
HKLM\SOFTWARE\Classes\ShoppingReport.IEButton.1
HKLM\SOFTWARE\Classes\ShoppingReport.IEButton.1\CLSID
HKLM\SOFTWARE\Classes\ShoppingReport.IEButtonA
HKLM\SOFTWARE\Classes\ShoppingReport.IEButtonA\CLSID
HKLM\SOFTWARE\Classes\ShoppingReport.IEButtonA\CurVer
HKLM\SOFTWARE\Classes\ShoppingReport.IEButtonA\CurVer
@="ShoppingReport.IEButtonA.1"
HKLM\SOFTWARE\Classes\ShoppingReport.IEButtonA.1
HKLM\SOFTWARE\Classes\ShoppingReport.IEButtonA.1\CLSID
HKLM\SOFTWARE\Classes\ShoppingReport.RprtCtrl
HKLM\SOFTWARE\Classes\ShoppingReport.RprtCtrl
@="ShoppingReport"
HKLM\SOFTWARE\Classes\ShoppingReport.RprtCtrl\CLSID
HKLM\SOFTWARE\Classes\ShoppingReport.RprtCtrl\CurVer
HKLM\SOFTWARE\Classes\ShoppingReport.RprtCtrl\CurVer
@="ShoppingReport.RprtCtrl.1"
HKLM\SOFTWARE\Classes\ShoppingReport.RprtCtrl.1
HKLM\SOFTWARE\Classes\ShoppingReport.RprtCtrl.1
@="ShoppingReport"
HKLM\SOFTWARE\Classes\ShoppingReport.RprtCtrl.1\CLSID
HKLM\SOFTWARE\Classes\TypeLib\{CDCA70D8-C6A6-49EE-9BED-7429D6C477A2}\1.0\0\ win32
@="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll\4"
HKLM\SOFTWARE\Classes\TypeLib\{CDCA70D8-C6A6-49EE-9BED-7429D6C477A2}\1.0\HE LPDIR
@="C:\Program Files\ShoppingReport\Bin\2.0.24\"
HKLM\SOFTWARE\Classes\TypeLib\{D136987F-E1C4-4CCC-A220-893DF03EC5DF}\1.0\0\ win32
@="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll\3"
HKLM\SOFTWARE\Classes\TypeLib\{D136987F-E1C4-4CCC-A220-893DF03EC5DF}\1.0\HE LPDIR
@="C:\Program Files\ShoppingReport\Bin\2.0.24\"
HKLM\SOFTWARE\Classes\TypeLib\{E343EDFC-1E6C-4CB5-AA29-E9C922641C80}\1.0\0\ win32
@="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll"
HKLM\SOFTWARE\Classes\TypeLib\{E343EDFC-1E6C-4CB5-AA29-E9C922641C80}\1.0\HE LPDIR
@="C:\Program Files\ShoppingReport\Bin\2.0.24\"
HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{C5428486-50A0-4a02-9D20-520B59A9F9B2}
"HotIcon"="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll,204"
HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{C5428486-50A0-4a02-9D20-520B59A9F9B2}
"Icon"="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll,203"
HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{C5428486-50A0-4a02-9D20-520B59A9F9B3}
"HotIcon"="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll,202"
HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{C5428486-50A0-4a02-9D20-520B59A9F9B3}
"Icon"="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll,201"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\ShoppingReport
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ShoppingReport
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ShoppingReport
"DisplayIcon"="C:\Program Files\ShoppingReport\Uninst.exe"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ShoppingReport
"UninstallString"="C:\Program Files\ShoppingReport\Uninst.exe"
HKLM\SOFTWARE\ShoppingReport
HKU\S-1-5-21-39989766-2330583763-384686628-1006\Software\ShoppingReport
HKU\S-1-5-21-39989766-2330583763-384686628-1006\Software\ShoppingReport
"currentResDir"="C:\Documents and Settings\PIN\Application Data\ShoppingReport\cs\res2"

Files to Delete: 
c:\Documents and Settings\PIN\Application Data\ShoppingReport
c:\Program Files\ShoppingReport
c:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll 

------------------------------------------------------------------------------------------
ensuite,
Télécharge The Avenger (Swandog46) sur ton bureau
http://www.geekstogo.com/forum/files/file/393-the-avenger-by-swandog46/

* Clic droit sur Avenger.zip
* Extrais avenger.exe sur ton bureau (clic sur "extraire")
---------------------------------

lance The Avenger.
coche load script from file (lire un script à partir d'un fichier) recherche alors fix.txt qui est sur ton bureau.
Ensuite lance-le avec l'icone du feu vert.
copies le rapport

Tamarin · Answer

Holala beaucoup de problème cette après midi :

1/  Je n'ai pas d'onglet décurité dans les options de System Volume Information donc j'ai télécharger Security Configuration Manager de Microsoft pour rajoutter cet onglet afin de supprimer les 3 points de restauration de restaurations inutilisable que tu m'as dit. Le problème et qu'une foi le téléchargement effectué, on me dit de :

Lancez NTFS.EXE 

-Dans le répertoire de décompression, sélectionnez SETUP.INF,click droit/Installer 

-Un écran vous demande alors si vous souhaitez remplacer le fichier ESENT.DLL, refusez en cliquant sur NON POUR TOUS 

Ne cliquez en aucun cas sur oui, pour remplacer les fichiers, vous prendrez le risque de rendre votre système instable! 

-Redémarrer votre poste de travail 

Sélectionnez à présent le fichier à sécuriser, click droit/Propriétés/Onglet sécurité, appliquez votre stratégie NTFS. 


alors que dans mon document téléchargé, je n'ai pas le fichier SETUP.INF, j'ai les fichiers suivant :

-symbols
-immc (win32 cabinet sef-exctractor)
-mssce(archive winrar)
-mssce(mssce AXA)
-readme(txt)
-regsvr32(microsoft(C) reister Server de microsoft Corporation)
-scefiles(info de configuration)
-scesetup(info de conf)
-setup(info de conf).

J'ai extrait le fichier winrar dans un dossier mais le SETUP.INF n'est pas présent.

Donc je me retrouve coincé pr effacé les trois points restauration inutilisable.

J'ai vu qu'il existe une autre manip qui consiste à redémarer en mode sans échec mais je ne sais pas si je suis capable de passer par là.

Aurais-tu qqc à me conseiller?
-----------------------------------------------------------------------------------------------------------------------------------------------------------------


2/ Sinon j'ai quand meme téléchargé the Avenger mais il semble y avoir un probleme, des messages d'erreurs sont apparus. 
Voici le rapport :

(le fichier créé s'appel error log)

//////////////////////////////////////////
  Avenger Pre-Processor log
//////////////////////////////////////////

Syntax error in line --- does not appear to be a valid registry path.  Line will be ignored.
Error code: 0
Line: @="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll


Syntax error in line --- does not appear to be a valid registry path.  Line will be ignored.
Error code: 0
Line: @="ShoppingReport.HbAx.1


Syntax error in line --- does not appear to be a valid registry path.  Line will be ignored.
Error code: 0
Line: @="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll, 102


Syntax error in line --- does not appear to be a valid registry path.  Line will be ignored.
Error code: 0
Line: @="ShoppingReport.HbAx


Syntax error in line --- does not appear to be a valid registry path.  Line will be ignored.
Error code: 0
Line: @="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll


------------------------------------------------------------------------------------------------------------------------------------------------------------------

Donc au final j'ai pas trop géré la manip d'aujourd'hui et ça me fait chier! lol. 

Merci encore pour tout et félicitation pour ton blog qui est une caverne d'Alibaba pour les novices!

Utilisateur anonyme · Answer

Bien,
tout d'abord, merci de ton appréciation sympa !
"Merci encore pour tout et félicitation pour ton blog qui est une caverne d'Alibaba pour les novices!"
--------------------------------------------------------------------
avec The Avenger rien de grave !
Mais je voudrais voir si tout est ok:
Double clique sur le OAD pour le lancer

- nom de fichier à rechercher tape ou fais un copier coller de : ShoppingReport
- Type de recherche : sélectionne l'option 6 puis valide [entree]

OAD va maintenant rechercher le fichier. Laisse le travailler jusqu'à ce qu'il en ai terminé.
Le rapport de recherche s'affichera automatiquement à dès qu'il en aura terminé.

- Fais un copier / coller de ce rapport dans ton prochain post. 
--------------------------------------
Donc je me retrouve coincé pour effacé les trois points restauration inutilisable. 
télécharge ceci:
https://www.zebulon.fr/telechargements/utilitaires/systeme-utilitaires/restorwin.html

tamarin · Answer

bon, 

Voici le rapport de OAD avant la suppression du point de registre :




24/11/2007 ---- 19:56:54,62  

----------------------------------
§§§§§§ [ShoppingReport] §§§§§§
----------------------------------
[X] Registre
 
-------------- [  ] rapide
-- Fichier --- [  ] disque systeme
 ------------- [X] complete


********************
     [Registre] 
********************


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20EA9658-6BC3-4599-A87D-6371FE9295FC}\InprocServer32]
@="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20EA9658-6BC3-4599-A87D-6371FE9295FC}\ProgID]
@="ShoppingReport.HbAx.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20EA9658-6BC3-4599-A87D-6371FE9295FC}\ToolboxBitmap32]
@="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll, 102"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20EA9658-6BC3-4599-A87D-6371FE9295FC}\VersionIndependentProgID]
@="ShoppingReport.HbAx"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A16AD1E9-F69A-45AF-9462-B1C286708842}\InprocServer32]
@="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A16AD1E9-F69A-45AF-9462-B1C286708842}\ProgID]
@="ShoppingReport.IEButtonA.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A16AD1E9-F69A-45AF-9462-B1C286708842}\VersionIndependentProgID]
@="ShoppingReport.IEButtonA"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A7CDDCDC-BEEB-4685-A062-978F5E07CEEE}\InprocServer32]
@="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A7CDDCDC-BEEB-4685-A062-978F5E07CEEE}\ProgID]
@="ShoppingReport.HbInfoBand.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A7CDDCDC-BEEB-4685-A062-978F5E07CEEE}\VersionIndependentProgID]
@="ShoppingReport.HbInfoBand"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C9CCBB35-D123-4A31-AFFC-9B2933132116}\InprocServer32]
@="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C9CCBB35-D123-4A31-AFFC-9B2933132116}\ProgID]
@="ShoppingReport.IEButton.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C9CCBB35-D123-4A31-AFFC-9B2933132116}\VersionIndependentProgID]
@="ShoppingReport.IEButton"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.HbAx]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.HbAx\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.HbAx\CurVer]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.HbAx\CurVer]
@="ShoppingReport.HbAx.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.HbAx.1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.HbAx.1\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.HbInfoBand]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.HbInfoBand\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.HbInfoBand\CurVer]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.HbInfoBand\CurVer]
@="ShoppingReport.HbInfoBand.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.HbInfoBand.1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.HbInfoBand.1\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.IEButton]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.IEButton\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.IEButton\CurVer]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.IEButton\CurVer]
@="ShoppingReport.IEButton.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.IEButton.1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.IEButton.1\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.IEButtonA]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.IEButtonA\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.IEButtonA\CurVer]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.IEButtonA\CurVer]
@="ShoppingReport.IEButtonA.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.IEButtonA.1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.IEButtonA.1\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.RprtCtrl]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.RprtCtrl]
@="ShoppingReport"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.RprtCtrl\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.RprtCtrl\CurVer]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.RprtCtrl\CurVer]
@="ShoppingReport.RprtCtrl.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.RprtCtrl.1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.RprtCtrl.1]
@="ShoppingReport"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.RprtCtrl.1\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{CDCA70D8-C6A6-49EE-9BED-7429D6C477A2}\1.0\0\win32]
@="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll\4"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{CDCA70D8-C6A6-49EE-9BED-7429D6C477A2}\1.0\HELPDIR]
@="C:\Program Files\ShoppingReport\Bin\2.0.24\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D136987F-E1C4-4CCC-A220-893DF03EC5DF}\1.0\0\win32]
@="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll\3"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D136987F-E1C4-4CCC-A220-893DF03EC5DF}\1.0\HELPDIR]
@="C:\Program Files\ShoppingReport\Bin\2.0.24\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E343EDFC-1E6C-4CB5-AA29-E9C922641C80}\1.0\0\win32]
@="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E343EDFC-1E6C-4CB5-AA29-E9C922641C80}\1.0\HELPDIR]
@="C:\Program Files\ShoppingReport\Bin\2.0.24\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{C5428486-50A0-4a02-9D20-520B59A9F9B2}]
"HotIcon"="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll,204"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{C5428486-50A0-4a02-9D20-520B59A9F9B2}]
"Icon"="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll,203"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{C5428486-50A0-4a02-9D20-520B59A9F9B3}]
"HotIcon"="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll,202"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{C5428486-50A0-4a02-9D20-520B59A9F9B3}]
"Icon"="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll,201"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\ShoppingReport]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ShoppingReport]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ShoppingReport]
"DisplayIcon"="C:\Program Files\ShoppingReport\Uninst.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ShoppingReport]
"UninstallString"="C:\Program Files\ShoppingReport\Uninst.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\ShoppingReport]

[HKEY_USERS\S-1-5-21-39989766-2330583763-384686628-1006\Software\ShoppingReport]

[HKEY_USERS\S-1-5-21-39989766-2330583763-384686628-1006\Software\ShoppingReport]
"currentResDir"="C:\Documents and Settings\PIN\Application Data\ShoppingReport\cs\res2"

*******************
     [Fichier] 
*******************

c:\Documents and Settings\PIN\Application Data\ShoppingReport
c:\Program Files\ShoppingReport
c:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll


*********************
     [Même date] 
*********************

[R‚pertoire ] --- REP ---> C:\Program Files\Files   



Outil Aide Diagnostic By !aur3n7 Version 1.1
----------------------------------
§§§§§ Fin Rapport §§§§§ 
----------------------------------




----------------------------------------------------------------------------------------------------------------------------------------------


J'ai ensuite supprimé le point de restoration qui se trouvais dans restorwin (j'espère avoir fait la bonne manip!)  et refais un autre rapport OAD que voici :


 24/11/2007 ---- 20:18:20,03  

----------------------------------
§§§§§§ [ShoppingReport] §§§§§§
----------------------------------
[X] Registre
 
-------------- [  ] rapide
-- Fichier --- [  ] disque systeme
 ------------- [X] complete


********************
     [Registre] 
********************


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20EA9658-6BC3-4599-A87D-6371FE9295FC}\InprocServer32]
@="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20EA9658-6BC3-4599-A87D-6371FE9295FC}\ProgID]
@="ShoppingReport.HbAx.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20EA9658-6BC3-4599-A87D-6371FE9295FC}\ToolboxBitmap32]
@="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll, 102"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20EA9658-6BC3-4599-A87D-6371FE9295FC}\VersionIndependentProgID]
@="ShoppingReport.HbAx"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A16AD1E9-F69A-45AF-9462-B1C286708842}\InprocServer32]
@="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A16AD1E9-F69A-45AF-9462-B1C286708842}\ProgID]
@="ShoppingReport.IEButtonA.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A16AD1E9-F69A-45AF-9462-B1C286708842}\VersionIndependentProgID]
@="ShoppingReport.IEButtonA"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A7CDDCDC-BEEB-4685-A062-978F5E07CEEE}\InprocServer32]
@="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A7CDDCDC-BEEB-4685-A062-978F5E07CEEE}\ProgID]
@="ShoppingReport.HbInfoBand.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A7CDDCDC-BEEB-4685-A062-978F5E07CEEE}\VersionIndependentProgID]
@="ShoppingReport.HbInfoBand"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C9CCBB35-D123-4A31-AFFC-9B2933132116}\InprocServer32]
@="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C9CCBB35-D123-4A31-AFFC-9B2933132116}\ProgID]
@="ShoppingReport.IEButton.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C9CCBB35-D123-4A31-AFFC-9B2933132116}\VersionIndependentProgID]
@="ShoppingReport.IEButton"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.HbAx]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.HbAx\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.HbAx\CurVer]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.HbAx\CurVer]
@="ShoppingReport.HbAx.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.HbAx.1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.HbAx.1\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.HbInfoBand]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.HbInfoBand\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.HbInfoBand\CurVer]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.HbInfoBand\CurVer]
@="ShoppingReport.HbInfoBand.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.HbInfoBand.1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.HbInfoBand.1\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.IEButton]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.IEButton\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.IEButton\CurVer]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.IEButton\CurVer]
@="ShoppingReport.IEButton.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.IEButton.1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.IEButton.1\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.IEButtonA]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.IEButtonA\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.IEButtonA\CurVer]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.IEButtonA\CurVer]
@="ShoppingReport.IEButtonA.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.IEButtonA.1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.IEButtonA.1\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.RprtCtrl]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.RprtCtrl]
@="ShoppingReport"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.RprtCtrl\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.RprtCtrl\CurVer]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.RprtCtrl\CurVer]
@="ShoppingReport.RprtCtrl.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.RprtCtrl.1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.RprtCtrl.1]
@="ShoppingReport"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShoppingReport.RprtCtrl.1\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{CDCA70D8-C6A6-49EE-9BED-7429D6C477A2}\1.0\0\win32]
@="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll\4"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{CDCA70D8-C6A6-49EE-9BED-7429D6C477A2}\1.0\HELPDIR]
@="C:\Program Files\ShoppingReport\Bin\2.0.24\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D136987F-E1C4-4CCC-A220-893DF03EC5DF}\1.0\0\win32]
@="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll\3"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D136987F-E1C4-4CCC-A220-893DF03EC5DF}\1.0\HELPDIR]
@="C:\Program Files\ShoppingReport\Bin\2.0.24\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E343EDFC-1E6C-4CB5-AA29-E9C922641C80}\1.0\0\win32]
@="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E343EDFC-1E6C-4CB5-AA29-E9C922641C80}\1.0\HELPDIR]
@="C:\Program Files\ShoppingReport\Bin\2.0.24\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{C5428486-50A0-4a02-9D20-520B59A9F9B2}]
"HotIcon"="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll,204"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{C5428486-50A0-4a02-9D20-520B59A9F9B2}]
"Icon"="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll,203"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{C5428486-50A0-4a02-9D20-520B59A9F9B3}]
"HotIcon"="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll,202"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{C5428486-50A0-4a02-9D20-520B59A9F9B3}]
"Icon"="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll,201"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\ShoppingReport]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ShoppingReport]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ShoppingReport]
"DisplayIcon"="C:\Program Files\ShoppingReport\Uninst.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ShoppingReport]
"UninstallString"="C:\Program Files\ShoppingReport\Uninst.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\ShoppingReport]

[HKEY_USERS\S-1-5-21-39989766-2330583763-384686628-1006\Software\ShoppingReport]

[HKEY_USERS\S-1-5-21-39989766-2330583763-384686628-1006\Software\ShoppingReport]
"currentResDir"="C:\Documents and Settings\PIN\Application Data\ShoppingReport\cs\res2"

*******************
     [Fichier] 
*******************

c:\Documents and Settings\PIN\Application Data\ShoppingReport
c:\Program Files\ShoppingReport
c:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll


*********************
     [Même date] 
*********************

[R‚pertoire ] --- REP ---> C:\Program Files\Files   



Outil Aide Diagnostic By !aur3n7 Version 1.1
----------------------------------
§§§§§ Fin Rapport §§§§§ 
----------------------------------

tamarin · Answer

Aïe je viens d'exporter une Base de registre pour la sauvegarder et j'ai voulu faire un test pr voir si tout va bien en l'important tout de suite. J'obtient un message d'erreur me disant : impossible d'importer ................. : toutes les données n'ont pas été inscrites correctement dans le registre. Certeaines clefs sont ouvertes par le système ou par d'autres processus.

J'en conclu que mes sauvegarde de Base de registre ne sont pas efficaces, que faire?

Utilisateur anonyme · Answer

pour exporter l'entièreté il faut que tu soit tout en haut de la BDR dans le panneau de droite.

--------------------------------------------------------------------------------------------------------------------------
Ce qui bien indiqué dans ma page:
https://leblogdeclaude.blogspot.com/2006/10/informatique-sauvegarde-de-la-base-de.html
la deuxième image.
http://photos1.blogger.com/blogger/8123/1999/1600/ici.2.jpg
-------------------------------------------------------------
pour le script, on dirait qu'il n'a pas été plus loin que les 5 premières lignes !
---------------------------------------------------------
refais ceci:
ouvres notepad.exe
copie le texte en dessous (avec sélectionner le texte ctrl+c et ctrl+v pour le coller)
enregistre le texte sous fix.txt sur le bureau  (supprimes l'ancien script avant)
 
------------------------------------------------------------------------------------------------------------------------------

Files to Delete:
c:\Documents and Settings\PIN\Application Data\ShoppingReport
c:\Program Files\ShoppingReport
c:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll 

registry keys to delete:
HKLM\SOFTWARE\Classes\CLSID\{A16AD1E9-F69A-45AF-9462-B1C286708842}\ProgID
@="ShoppingReport.IEButtonA.1"
HKLM\SOFTWARE\Classes\CLSID\{A16AD1E9-F69A-45AF-9462-B1C286708842}\VersionI ndependentProgID
@="ShoppingReport.IEButtonA"
HKLM\SOFTWARE\Classes\CLSID\{A7CDDCDC-BEEB-4685-A062-978F5E07CEEE}\InprocSe rver32
@="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll"
HKLM\SOFTWARE\Classes\CLSID\{A7CDDCDC-BEEB-4685-A062-978F5E07CEEE}\ProgID
@="ShoppingReport.HbInfoBand.1"
HKLM\Classes\CLSID\{A7CDDCDC-BEEB-4685-A062-978F5E07CEEE}\VersionI ndependentProgID
@="ShoppingReport.HbInfoBand"
HKLM\SOFTWARE\Classes\CLSID\{C9CCBB35-D123-4A31-AFFC-9B2933132116}\InprocSe rver32
@="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll"
HKLM\SOFTWARE\Classes\CLSID\{C9CCBB35-D123-4A31-AFFC-9B2933132116}\ProgID
@="ShoppingReport.IEButton.1"
HKLM\SOFTWARE\Classes\CLSID\{C9CCBB35-D123-4A31-AFFC-9B2933132116}\VersionI ndependentProgID
@="ShoppingReport.IEButton"
HKLM\SOFTWARE\Classes\ShoppingReport.HbAx
HKLM\SOFTWARE\Classes\ShoppingReport.HbAx\CLSID
HKLM\SOFTWARE\Classes\ShoppingReport.HbAx\CurVer
HKLM\SOFTWARE\Classes\ShoppingReport.HbAx\CurVer
@="ShoppingReport.HbAx.1"
HKLM\SOFTWARE\Classes\ShoppingReport.HbAx.1
HKLM\SOFTWARE\Classes\ShoppingReport.HbAx.1\CLSID
HKLM\SOFTWARE\Classes\ShoppingReport.HbInfoBand
HKLM\SOFTWARE\Classes\ShoppingReport.HbInfoBand\CLSID
HKLM\SOFTWARE\Classes\ShoppingReport.HbInfoBand\CurVer
HKLM\SOFTWARE\Classes\ShoppingReport.HbInfoBand\CurVer
@="ShoppingReport.HbInfoBand.1"
HKLM\SOFTWARE\Classes\ShoppingReport.HbInfoBand.1
HKLM\SOFTWARE\Classes\ShoppingReport.HbInfoBand.1\CLSID
HKLM\SOFTWARE\Classes\ShoppingReport.IEButton
HKLM\SOFTWARE\Classes\ShoppingReport.IEButton\CLSID
HKLM\SOFTWARE\Classes\ShoppingReport.IEButton\CurVer
HKLM\SOFTWARE\Classes\ShoppingReport.IEButton\CurVer
@="ShoppingReport.IEButton.1"
HKLM\SOFTWARE\Classes\ShoppingReport.IEButton.1
HKLM\SOFTWARE\Classes\ShoppingReport.IEButton.1\CLSID
HKLM\SOFTWARE\Classes\ShoppingReport.IEButtonA
HKLM\SOFTWARE\Classes\ShoppingReport.IEButtonA\CLSID
HKLM\SOFTWARE\Classes\ShoppingReport.IEButtonA\CurVer
HKLM\SOFTWARE\Classes\ShoppingReport.IEButtonA\CurVer
@="ShoppingReport.IEButtonA.1"
HKLM\SOFTWARE\Classes\ShoppingReport.IEButtonA.1
HKLM\SOFTWARE\Classes\ShoppingReport.IEButtonA.1\CLSID
HKLM\SOFTWARE\Classes\ShoppingReport.RprtCtrl
HKLM\SOFTWARE\Classes\ShoppingReport.RprtCtrl
@="ShoppingReport"
HKLM\SOFTWARE\Classes\ShoppingReport.RprtCtrl\CLSID
HKLM\SOFTWARE\Classes\ShoppingReport.RprtCtrl\CurVer
HKLM\SOFTWARE\Classes\ShoppingReport.RprtCtrl\CurVer
@="ShoppingReport.RprtCtrl.1"
HKLM\SOFTWARE\Classes\ShoppingReport.RprtCtrl.1
HKLM\SOFTWARE\Classes\ShoppingReport.RprtCtrl.1
@="ShoppingReport"
HKLM\SOFTWARE\Classes\ShoppingReport.RprtCtrl.1\CLSID
HKLM\SOFTWARE\Classes\TypeLib\{CDCA70D8-C6A6-49EE-9BED-7429D6C477A2}\1.0\0\ win32
@="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll\4"
HKLM\SOFTWARE\Classes\TypeLib\{CDCA70D8-C6A6-49EE-9BED-7429D6C477A2}\1.0\HE LPDIR
@="C:\Program Files\ShoppingReport\Bin\2.0.24\"
HKLM\SOFTWARE\Classes\TypeLib\{D136987F-E1C4-4CCC-A220-893DF03EC5DF}\1.0\0\ win32
@="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll\3"
HKLM\SOFTWARE\Classes\TypeLib\{D136987F-E1C4-4CCC-A220-893DF03EC5DF}\1.0\HE LPDIR
@="C:\Program Files\ShoppingReport\Bin\2.0.24\"
HKLM\SOFTWARE\Classes\TypeLib\{E343EDFC-1E6C-4CB5-AA29-E9C922641C80}\1.0\0\ win32
@="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll"
HKLM\SOFTWARE\Classes\TypeLib\{E343EDFC-1E6C-4CB5-AA29-E9C922641C80}\1.0\HE LPDIR
@="C:\Program Files\ShoppingReport\Bin\2.0.24\"
HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{C5428486-50A0-4a02-9D20-520B59A9F9B2}
"HotIcon"="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll,204"
HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{C5428486-50A0-4a02-9D20-520B59A9F9B2}
"Icon"="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll,203"
HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{C5428486-50A0-4a02-9D20-520B59A9F9B3}
"HotIcon"="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll,202"
HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{C5428486-50A0-4a02-9D20-520B59A9F9B3}
"Icon"="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll,201"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\ShoppingReport
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ShoppingReport
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ShoppingReport
"DisplayIcon"="C:\Program Files\ShoppingReport\Uninst.exe"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ShoppingReport
"UninstallString"="C:\Program Files\ShoppingReport\Uninst.exe"
HKLM\SOFTWARE\ShoppingReport
HKU\S-1-5-21-39989766-2330583763-384686628-1006\Software\ShoppingReport
HKU\S-1-5-21-39989766-2330583763-384686628-1006\Software\ShoppingReport
"currentResDir"="C:\Documents and Settings\PIN\Application Data\ShoppingReport\cs\res2"

-----------------------------------
lance The Avenger.
coche load script from file (lire un script à partir d'un fichier) recherche alors fix.txt qui est sur ton bureau.
Ensuite lance-le avec l'icone du feu vert.
copies le rapport

tamarin · Answer

salut,

pour ce qui est de la base de registre, les problèmes persistent lors de l'importation, meme si j'ai bien enregistrer en étant tout en haut à droite, poste de travail en surbrillance....

-------------------------------------------------------------------------------------------------------


Une erreur se produit encore lors de l'execution du script, rapport :

//////////////////////////////////////////
  Avenger Pre-Processor log
//////////////////////////////////////////

Syntax error in line --- does not appear to be a valid registry path.  Line will be ignored.
Error code: 0
Line: @="ShoppingReport.IEButtonA.1


Syntax error in line --- does not appear to be a valid registry path.  Line will be ignored.
Error code: 0
Line: @="ShoppingReport.IEButtonA


Syntax error in line --- does not appear to be a valid registry path.  Line will be ignored.
Error code: 0
Line: @="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll


Syntax error in line --- does not appear to be a valid registry path.  Line will be ignored.
Error code: 0
Line: @="ShoppingReport.HbInfoBand.1


Syntax error in line --- does not appear to be a valid registry path.  Line will be ignored.
Error code: 0
Line: @="ShoppingReport.HbInfoBand


Syntax error in line --- does not appear to be a valid registry path.  Line will be ignored.
Error code: 0
Line: @="C:\Program Files\ShoppingReport\Bin\2.0.24\ShoppingReport.dll


Syntax error in line --- does not appear to be a valid registry path.  Line will be ignored.
Error code: 0
Line: @="ShoppingReport.IEButton.1


Syntax error in line --- does not appear to be a valid registry path.  Line will be ignored.
Error code: 0
Line: @="ShoppingReport.IEButton


Syntax error in line --- does not appear to be a valid registry path.  Line will be ignored.
Error code: 0
Line: @="ShoppingReport.HbAx.1


Syntax error in line --- does not appear to be a valid registry path.  Line will be ignored.
Error code: 0
Line: @="ShoppingReport.HbInfoBand.1

Utilisateur anonyme · Answer

Bon, je vais faire en sorte que ça fonctionne, il y a un truc qui m'échappe, je reviens dès que j'ai la soluce.

Tamarin · Answer

Bonsoir,

Nous n'avons pas trop avancé depuis un petit bout de temps.
Sache que dpuis, je n'ais jamais revu ce fameux écran roug et que je n'ai plus de fentre pr d antivirus qui se lancent toute seul. Pour la dernière manip, apparemment ça semble compliqué! En fait pourrais-tu me mettre sur la piste quant aux problèmes de mon ordinateur?
Sinon je pensais peut etre le formater à noel, je veux le faire depuis longtemps ms je n'ai jamais eu le tps donc je verrais.

Voila, merci pour toute ton aide en tt cas et si tu as qq petits conseils qd a ma bécanne fait moi signe;

Utilisateur anonyme · Answer

Bien, fais ceci:
https://leblogdeclaude.blogspot.com/2007/04/informatique-procdure-smitfraud.html
postes le rapport

Tamarin · Answer

c'est fait :

SmitFraudFix v2.257

Rapport fait à 20:55:01,45, 04/12/2007
Executé à partir de C:\Documents and Settings\PIN\Mes documents\My Completed Downloads\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\Explorer.EXE
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Rainlendar2\Rainlendar2.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\MSN Messenger\livecall.exe
C:\Program Files\DAP\DAP.EXE
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

C:\WINDOWS\privacy_danger PRESENT !
C:\WINDOWSmvgor.dll PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\PIN


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\PIN\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\PIN\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files 

C:\Program Files\Video Add-on\ PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
 
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="file:///C:\WINDOWS\privacy_danger\index.htm"
"SubscribedURL"=""
"FriendlyName"="Privacy Protection"
 
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\1]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Rustock



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Intel(R) PRO/Wireless 2200BG Network Connection - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.1.254
DNS Server Search Order: 0.0.0.0

HKLM\SYSTEM\CCS\Services\Tcpip\..\{A0A445AD-1ECB-400A-994D-D90D4643CEC4}: DhcpNameServer=192.168.1.254 0.0.0.0
HKLM\SYSTEM\CS1\Services\Tcpip\..\{A0A445AD-1ECB-400A-994D-D90D4643CEC4}: DhcpNameServer=192.168.1.254 0.0.0.0
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.254 0.0.0.0
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.254 0.0.0.0


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

Utilisateur anonyme · Answer

bien, fais l'option 2 de Smitfraud et postes le rapport/
regarde ici:
https://leblogdeclaude.blogspot.com/2007/04/informatique-procdure-smitfraud.html

Utilisateur anonyme · Answer

up, pour suivre..

3 rapports d'analyses - ecran rouge HELP

26 réponses

Discussions similaires