[Virus] Infecté par Trojan

Question

Bonjour,

c'est encore moi. Je me suis fait avoir sur Msn. J'ai ouvert un fichier zip alors que j'étais en communication directe avec un autre contact. Depuis j'ai 4 virus :




BitDefender Online Scanner
  
  
 
Rapport d'analyse généré à: Sat, Sep 08, 2007 - 21:08:22
 
 
  
  
 
Voie d'analyse: C:\;D:\;E:\;F:\;H:\;I:\;J:\;
  
  
 
 
  
  
 
Statistiques
 
Temps
 02:11:38
 
Fichiers
 342265
 
Directoires
 8921
 
Secteurs de boot
 2
 
Archives
 1493
 
Paquets programmes
 17518
 
  
  
 
Résultats
 
Virus identifiés
 4
 
Fichiers infectés
 4
 
Fichiers suspects
 0
 
Avertissements
 0
 
Désinfectés
 0
 
Fichiers effacés
 4
 
  
  
 
Info sur les moteurs
 
Définition virus
 799361
 
Version des moteurs
 AVCORE v1.0 (build 2411) (i386) (Jul 9 2007 12:10:22)
 
Analyse des plugins
 14
 
Archive des plugins
 38
 
Unpack des plugins
 7
 
E-mail plugins
 6
 
Système plugins
 1
 
  
  
 
Paramètres d'analyse
 
Première action
 Désinfecté
 
Seconde Action
 Supprimé
 
Heuristique
 Oui
 
Acceptez les avertissements
 Oui
 
Extensions analysées
 *;
 
Excludez les extensions
  
 
Analyse d'emails
 Oui
 
Analyse des Archives
 Oui
 
Analyser paquets programmes
 Oui
 
Analyse des fichiers
 Oui
 
Analyse de boot
 Oui
 
  
  
 
  Fichier analysé
  Statut
 
C:\Documents and Settings\Sylvie\Local Settings\Temp\~WA6PScannerSetup.exe=>(Instyler o)=>(Instyler Module 8)
 Infecté par: Trojan.Dldr.Fakeav.A
 
C:\Documents and Settings\Sylvie\Local Settings\Temp\~WA6PScannerSetup.exe=>(Instyler o)=>(Instyler Module 8)
 Echec de la désinfection
 
C:\Documents and Settings\Sylvie\Local Settings\Temp\~WA6PScannerSetup.exe=>(Instyler o)=>(Instyler Module 8)
 Supprimé
 
C:\Documents and Settings\Sylvie\Local Settings\Temp\~WA6PScannerSetup.exe=>(Instyler o)
 Echec de la mise à jour
 
C:\Documents and Settings\Sylvie\Local Settings\Temp\~WA6PScannerSetup.exe=>(Instyler o)=>(Instyler Module 11)
 Infecté par: Trojan.Fakealert.BX
 
C:\Documents and Settings\Sylvie\Local Settings\Temp\~WA6PScannerSetup.exe=>(Instyler o)=>(Instyler Module 11)
 Echec de la désinfection
 
C:\Documents and Settings\Sylvie\Local Settings\Temp\~WA6PScannerSetup.exe=>(Instyler o)=>(Instyler Module 11)
 Supprimé
 
C:\Documents and Settings\Sylvie\Local Settings\Temp\~WA6PScannerSetup.exe=>(Instyler o)
 Echec de la mise à jour
 
C:\Documents and Settings\Sylvie\Local Settings\Temp\~WA6PScannerSetup.exe=>(Instyler o)=>(Instyler Module 16)
 Infecté par: Trojan.DM
 
C:\Documents and Settings\Sylvie\Local Settings\Temp\~WA6PScannerSetup.exe=>(Instyler o)=>(Instyler Module 16)
 Echec de la désinfection
 
C:\Documents and Settings\Sylvie\Local Settings\Temp\~WA6PScannerSetup.exe=>(Instyler o)=>(Instyler Module 16)
 Supprimé
 
C:\Documents and Settings\Sylvie\Local Settings\Temp\~WA6PScannerSetup.exe=>(Instyler o)
 Echec de la mise à jour
 
C:\Documents and Settings\Sylvie\Local Settings\Temp\~WA6PScannerSetup.exe=>(Instyler o)=>(Instyler Module 49)
 Infecté par: Trojan.Fakealert.BB
 
C:\Documents and Settings\Sylvie\Local Settings\Temp\~WA6PScannerSetup.exe=>(Instyler o)=>(Instyler Module 49)
 Echec de la désinfection
 
C:\Documents and Settings\Sylvie\Local Settings\Temp\~WA6PScannerSetup.exe=>(Instyler o)=>(Instyler Module 49)
 Supprimé
 
C:\Documents and Settings\Sylvie\Local Settings\Temp\~WA6PScannerSetup.exe=>(Instyler o)
 Echec de la mise à jour

jlpjlp · Answer

oui fais tout

sandy086 · Answer

Voici le rapport de SDFix et je continue maintenant avec AVG AS.


SDFix: Version 1.103

Run by Sandrine on 11/09/2007 at 14:53

Microsoft Windows XP [version 5.1.2600]

Running From: C:\virus\SDFix

Safe Mode:
Checking Services: 


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Normal Mode:
Checking Files: 

No Trojan Files Found




Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found. 

C:\WINDOWS\system32
No streams found. 

C:\WINDOWS\system32\svchost.exe
No streams found.
 
C:\WINDOWS\system32
toskrnl.exe
No streams found.
 


                                 Final Check:

Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe"="C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe:*:Disabled:F-Secure Automatic Update"
"C:\Kaspersky\kavupd.exe"="C:\Kaspersky\kavupd.exe:*:Enabled:kavupd"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

Remaining Files:
---------------


Files with Hidden Attributes:

C:\Documents and Settings\Sandrine\Local Settings\Temp\FsSetup\00000001\FsSetupSync.tmp
C:\Documents and Settings\Sandrine\Mes documents\Analyse fi\~WRL2774.tmp
C:\Documents and Settings\Sandrine\Mes documents\Analyse fi\GEFI-EXAMEN JUIN 2005 (cf. ...)\~WRL1265.tmp
C:\Documents and Settings\Sandrine\Mes documents\DUT GEA\Economie\Revue de presse ‚conomique\~WRL2288.tmp
C:\Documents and Settings\Sandrine\Mes documents\DUT GEA\ma revue de presse\23.01\International\~WRL0001.tmp
C:\Documents and Settings\Sandrine\Mes documents\DUT GEA\PPP\poster\~WRL0003.tmp
C:\WINDOWS\system32\config\SAM.tmp.LOG
C:\WINDOWS\system32\config\SECURITY.tmp.LOG

Finished!

sandy086 · Answer

Voici le rapport de AVG AS :

---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

 + Créé à:	17:24:28 11/09/2007

 + Résultat de l'analyse:	



HKLM\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex\ContextMenuHandlers\{7EC618F2-C506-4221-9F56-792B92BF762E} -> Adware.DriveCleaner : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Sylvie\Local Settings\Temp\UDC6V_0001_D19M0709\installer.exe -> Adware.Drop : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Jean-Claude\Application Data\ShopperReports -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Jean-Claude\Application Data\ShopperReports\cs -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Jean-Claude\Application Data\ShopperReports\cs\Config.xml -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Jean-Claude\Application Data\ShopperReports\cs\db -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Jean-Claude\Application Data\ShopperReports\cs\db\Aliases.dbs -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Jean-Claude\Application Data\ShopperReports\cs\db\Sites.dbs -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Jean-Claude\Application Data\ShopperReports\cs\dwld -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Jean-Claude\Application Data\ShopperReports\cs\dwld\WhiteList.xip -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Jean-Claude\Application Data\ShopperReports\cs\persist.dbs -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Jean-Claude\Application Data\ShopperReports\cseport -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Jean-Claude\Application Data\ShopperReports\cseport\ag_ShopperReports.xml -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Jean-Claude\Application Data\ShopperReports\cseport\ag_ShopperReports.xml.db -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Jean-Claude\Application Data\ShopperReports\cseport\aggr_storage.xml -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Jean-Claude\Application Data\ShopperReports\cseport\send_ShopperReports.xml -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Jean-Claude\Application Data\ShopperReports\cseport\send_ShopperReports.xml.db -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Jean-Claude\Application Data\ShopperReports\cseport\send_storage.xml -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Jean-Claude\Application Data\ShopperReports\cses2 -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Jean-Claude\Application Data\ShopperReports\cses2\WhiteList.dbs -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Jean-Claude\Application Data\ShopperReports\shprrprt.log -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Jean-Claude\Application Data\ShopperReports\shprrprt_1158812783.log -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Sylvie\Application Data\ShopperReports -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Sylvie\Application Data\ShopperReports\cs -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Sylvie\Application Data\ShopperReports\cs\Config.xml -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Sylvie\Application Data\ShopperReports\cs\db -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Sylvie\Application Data\ShopperReports\cs\db\Aliases.dbs -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Sylvie\Application Data\ShopperReports\cs\db\Sites.dbs -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Sylvie\Application Data\ShopperReports\cs\dwld -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Sylvie\Application Data\ShopperReports\cs\dwld\WhiteList.xip -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Sylvie\Application Data\ShopperReports\cs\persist.dbs -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Sylvie\Application Data\ShopperReports\cseport -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Sylvie\Application Data\ShopperReports\cseport\aggr_storage.xml -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Sylvie\Application Data\ShopperReports\cseport\send_storage.xml -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Sylvie\Application Data\ShopperReports\cses2 -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Sylvie\Application Data\ShopperReports\cses2\WhiteList.dbs -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Sylvie\Application Data\ShopperReports\shprrprt.log -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Sylvie\Application Data\ShopperReports\shprrprt_1160061207.log -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Sandrine\Application Data\Registry Cleaner -> Adware.RogueSuspect : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Sandrine\Application Data\Registry Cleaner\Regclean.ini -> Adware.RogueSuspect : Nettoyé et sauvegardé (mise en quarantaine).
HKU\S-1-5-21-1715567821-1935655697-682003330-1008\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{74CC49F7-EB32-4A08-B204-948962A6E3DB} -> Adware.RogueSuspect : Nettoyé et sauvegardé (mise en quarantaine).
HKU\S-1-5-21-1715567821-1935655697-682003330-1008\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{74CC49F7-EB32-4A08-B204-948962A6E3DB} -> Adware.RogueSuspect : Nettoyé et sauvegardé (mise en quarantaine).
HKU\S-1-5-21-1715567821-1935655697-682003330-1008\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4B18DD50-C996-44FC-AC52-0FECFF82ED58} -> Adware.RogueSuspect : Nettoyé et sauvegardé (mise en quarantaine).
HKU\S-1-5-21-1715567821-1935655697-682003330-1008\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{74CC49F7-EB32-4A08-B204-948962A6E3DB} -> Adware.RogueSuspect : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Sylvie\Local Settings\Temp\USDR6V_0001_D18M3107\installer.exe -> Adware.WinFixer : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Sylvie\Cookies\sylvie@ad.adnet[1].txt -> TrackingCookie.Adnet : Nettoyé.
C:\Documents and Settings\Sylvie\Cookies\sylvie@ad.adocean[2].txt -> TrackingCookie.Adocean : Nettoyé.
C:\Documents and Settings\Sylvie\Cookies\sylvie@www.burstbeacon[1].txt -> TrackingCookie.Burstbeacon : Nettoyé.
C:\Documents and Settings\Sylvie\Cookies\sylvie@burstnet[2].txt -> TrackingCookie.Burstnet : Nettoyé.
C:\Documents and Settings\Sylvie\Cookies\sylvie@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Nettoyé.
C:\Documents and Settings\Sylvie\Cookies\sylvie@c.goclick[2].txt -> TrackingCookie.Goclick : Nettoyé.
C:\Documents and Settings\Sylvie\Cookies\sylvie@info[2].txt -> TrackingCookie.Info : Nettoyé.
C:\Documents and Settings\Sylvie\Cookies\sylvie@intelli-direct[1].txt -> TrackingCookie.Intelli-direct : Nettoyé.
C:\Documents and Settings\Sylvie\Cookies\sylvie@beta.search.live[1].txt -> TrackingCookie.Live : Nettoyé.
C:\Documents and Settings\Sylvie\Cookies\sylvie@search.live[2].txt -> TrackingCookie.Live : Nettoyé.
C:\Documents and Settings\Sylvie\Cookies\sylvie@www.myaffiliateprogram[1].txt -> TrackingCookie.Myaffiliateprogram : Nettoyé.
C:\Documents and Settings\Sylvie\Cookies\sylvie@data4.perf.overture[1].txt -> TrackingCookie.Overture : Nettoyé.
C:\Documents and Settings\Sylvie\Cookies\sylvie@ads.planetactive[2].txt -> TrackingCookie.Planetactive : Nettoyé.
C:\Documents and Settings\Sylvie\Cookies\sylvie@site.skype[1].txt -> TrackingCookie.Skype : Nettoyé.
C:\Documents and Settings\Sylvie\Cookies\sylvie@skype[1].txt -> TrackingCookie.Skype : Nettoyé.
C:\Documents and Settings\Sylvie\Cookies\sylvie@h.starware[2].txt -> TrackingCookie.Starware : Nettoyé.
C:\Documents and Settings\Sylvie\Cookies\sylvie@try.starware[1].txt -> TrackingCookie.Starware : Nettoyé.
C:\Documents and Settings\Jean-Claude\Cookies\jean-claude@toplist[1].txt -> TrackingCookie.Toplist : Nettoyé.
C:\Documents and Settings\Jean-Claude\Cookies\jean-claude@m.webtrends[2].txt -> TrackingCookie.Webtrends : Nettoyé.
C:\Documents and Settings\Sylvie\Cookies\sylvie@m.webtrends[1].txt -> TrackingCookie.Webtrends : Nettoyé.
C:\Documents and Settings\Sylvie\Local Settings\Temp\NI.UWA6PV_0001_N91M2107\setup.exe -> Trojan.Fakealert : Nettoyé et sauvegardé (mise en quarantaine).


Fin du rapport

jlpjlp · Answer

bien

fait aussi ca  avant le scan en ligne car il y avait drive cleaner


lance rogue remover 

http://www.libellules.ch/dotclear/index.php?2006/11/29/1518-rogue-remover

https://www.01net.com/telecharger/

_____________

smit fraud fix 

http://telechargement.zebulon.fr/smitfraudfix.html 



2/ double clique sur smitfraudfix. puis sélectionne 1 et appuyer sur entrée afin de créer le rapport des infection présentes. une fois le rapport effectué redémarre en mode sans échec (en appuyant sur F8 ou suppr, ou F5 au démarrage en général) 

3/ puis refaire comme en 2/ mais selectionne l'option 2 et appuyer sur entrée pour commencer la desinfection. lorsque le programme demande si tu veut nettoyer le registre metsoui en tapant 0 et entrée

sandy086 · Answer

Voici le rapport de SmitFraudFix :

SmitFraudFix v2.212

Rapport fait à 18:07:02,96, 11/09/2007
Executé à partir de C:\virus\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode sans echec

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus


»»»»»»»»»»»»»»»»»»»»»»»» hosts

127.0.0.1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés


»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{8724BE50-CD49-4BE7-B64D-6B759CE4B5BE}: DhcpNameServer=212.27.53.252 212.27.54.252
HKLM\SYSTEM\CCS\Services\Tcpip\..\{C6EFDA6D-C246-469E-94B2-466D5A91CB1E}: DhcpNameServer=212.27.53.252 212.27.54.252
HKLM\SYSTEM\CS1\Services\Tcpip\..\{8724BE50-CD49-4BE7-B64D-6B759CE4B5BE}: DhcpNameServer=212.27.53.252 212.27.54.252
HKLM\SYSTEM\CS1\Services\Tcpip\..\{C6EFDA6D-C246-469E-94B2-466D5A91CB1E}: DhcpNameServer=212.27.53.252 212.27.54.252
HKLM\SYSTEM\CS2\Services\Tcpip\..\{8724BE50-CD49-4BE7-B64D-6B759CE4B5BE}: DhcpNameServer=212.27.53.252 212.27.54.252
HKLM\SYSTEM\CS2\Services\Tcpip\..\{C6EFDA6D-C246-469E-94B2-466D5A91CB1E}: DhcpNameServer=212.27.53.252 212.27.54.252
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.27.53.252 212.27.54.252
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.27.53.252 212.27.54.252
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=212.27.53.252 212.27.54.252


»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre
 
Nettoyage terminé. 
 
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

jlpjlp · Answer

si tout c'est bien passé désactive la restauration système pour purger les virus qui seraient dedans puis réactive là (dans DEMARRER puis TOUS LES PROGRAMMES puis ACCESSOIRE puis OUTILS SYSTEME puis RESTAURATION SYSTEME puis paramètre)

--------------

colle le rapport d'un scan en ligne
avec un des suivants:


bitdefender en ligne :
http://www.bitdefender.fr/scan_fr/scan8/ie.html

sandy086 · Answer

Voici le rapport de Bidefender, J'ai toujours 4 virus :

BitDefender Online Scanner
  
  
 
Rapport d'analyse généré à: Tue, Sep 11, 2007 - 21:57:50
 
 
  
  
 
Voie d'analyse: C:\;D:\;E:\;F:\;H:\;I:\;J:\;
  
  
 
 
  
  
 
Statistiques
 
Temps
 03:25:29
 
Fichiers
 286041
 
Directoires
 8807
 
Secteurs de boot
 2
 
Archives
 1428
 
Paquets programmes
 11951
 
  
  
 
Résultats
 
Virus identifiés
 4
 
Fichiers infectés
 4
 
Fichiers suspects
 0
 
Avertissements
 0
 
Désinfectés
 0
 
Fichiers effacés
 4
 
  
  
 
Info sur les moteurs
 
Définition virus
 801079
 
Version des moteurs
 AVCORE v1.0 (build 2411) (i386) (Jul 9 2007 12:10:22)
 
Analyse des plugins
 14
 
Archive des plugins
 38
 
Unpack des plugins
 7
 
E-mail plugins
 6
 
Système plugins
 1
 
  
  
 
Paramètres d'analyse
 
Première action
 Désinfecté
 
Seconde Action
 Supprimé
 
Heuristique
 Oui
 
Acceptez les avertissements
 Oui
 
Extensions analysées
 *;
 
Excludez les extensions
  
 
Analyse d'emails
 Oui
 
Analyse des Archives
 Oui
 
Analyser paquets programmes
 Oui
 
Analyse des fichiers
 Oui
 
Analyse de boot
 Oui
 
  
  
 
  Fichier analysé
  Statut
 
C:\Documents and Settings\Sylvie\Local Settings\Temp\~WA6PScannerSetup.exe=>(Instyler o)=>(Instyler Module 8)
 Infecté par: Trojan.Dldr.Fakeav.A
 
C:\Documents and Settings\Sylvie\Local Settings\Temp\~WA6PScannerSetup.exe=>(Instyler o)=>(Instyler Module 8)
 Echec de la désinfection
 
C:\Documents and Settings\Sylvie\Local Settings\Temp\~WA6PScannerSetup.exe=>(Instyler o)=>(Instyler Module 8)
 Supprimé
 
C:\Documents and Settings\Sylvie\Local Settings\Temp\~WA6PScannerSetup.exe=>(Instyler o)
 Echec de la mise à jour
 
C:\Documents and Settings\Sylvie\Local Settings\Temp\~WA6PScannerSetup.exe=>(Instyler o)=>(Instyler Module 11)
 Infecté par: Trojan.Fakealert.BX
 
C:\Documents and Settings\Sylvie\Local Settings\Temp\~WA6PScannerSetup.exe=>(Instyler o)=>(Instyler Module 11)
 Echec de la désinfection
 
C:\Documents and Settings\Sylvie\Local Settings\Temp\~WA6PScannerSetup.exe=>(Instyler o)=>(Instyler Module 11)
 Supprimé
 
C:\Documents and Settings\Sylvie\Local Settings\Temp\~WA6PScannerSetup.exe=>(Instyler o)
 Echec de la mise à jour
 
C:\Documents and Settings\Sylvie\Local Settings\Temp\~WA6PScannerSetup.exe=>(Instyler o)=>(Instyler Module 16)
 Infecté par: Trojan.DM
 
C:\Documents and Settings\Sylvie\Local Settings\Temp\~WA6PScannerSetup.exe=>(Instyler o)=>(Instyler Module 16)
 Echec de la désinfection
 
C:\Documents and Settings\Sylvie\Local Settings\Temp\~WA6PScannerSetup.exe=>(Instyler o)=>(Instyler Module 16)
 Supprimé
 
C:\Documents and Settings\Sylvie\Local Settings\Temp\~WA6PScannerSetup.exe=>(Instyler o)
 Echec de la mise à jour
 
C:\Documents and Settings\Sylvie\Local Settings\Temp\~WA6PScannerSetup.exe=>(Instyler o)=>(Instyler Module 49)
 Infecté par: Trojan.Fakealert.BB
 
C:\Documents and Settings\Sylvie\Local Settings\Temp\~WA6PScannerSetup.exe=>(Instyler o)=>(Instyler Module 49)
 Echec de la désinfection
 
C:\Documents and Settings\Sylvie\Local Settings\Temp\~WA6PScannerSetup.exe=>(Instyler o)=>(Instyler Module 49)
 Supprimé
 
C:\Documents and Settings\Sylvie\Local Settings\Temp\~WA6PScannerSetup.exe=>(Instyler o)
 Echec de la mise à jour

jlpjlp · Answer

smit fraud fix 

http://telechargement.zebulon.fr/smitfraudfix.html 



2/ double clique sur smitfraudfix. puis sélectionne 1 et appuyer sur entrée afin de créer le rapport des infection présentes. une fois le rapport effectué redémarre en mode sans échec (en appuyant sur F8 ou suppr, ou F5 au démarrage en général) 

3/ puis refaire comme en 2/ mais selectionne l'option 2 et appuyer sur entrée pour commencer la desinfection. lorsque le programme demande si tu veut nettoyer le registre metsoui en tapant 0 et entrée


__________________


refais
AVG antispyxare

https://www.01net.com/

Tuto :
http://www.kachouri.com/tuto/tuto-161-avg-anti-spyware-75-pour-votre-securite.html

->Relance AVG AS -> "Analyse" ->"Paramètres"

Sous la question "Comment réagir ?" :

-> clique sur "Actions recommandées" et choisis "Quarantaines"
-> Re-clique sur l'onglet "Analyse" puis réalise une "Analyse complète du système"

Si un fichier est infecté en fin d'analyse

->Clique sur "Appliquer toutes les actions "

->Clique sur "Enregistrer le rapport" puis sur "Enregistrer le rapport sous".

->Enregistre ce fichier texte sur ton bureau ensuite colle le rapport ici 

__________



Clean permettra de faire du nettoyage et supprimer des fichiers que des anti-virus et anti-spywares n'ont pas pu trouver. Le logiciel est régulièrement mis à jour, vous devrez donc le re-téléchargé pour obtenir une version plus récente.

·  Téléchargez clean.zip, décompressez-le sur votre bureau (clic droit / extraire tout), vous obtenez alors un dossier clean 
·  Démarrez Windows en mode sans échec : Guide pour redémarrer en mode sans échec 
·  Ouvrez le dossier clean qui se trouve sur ton bureau, et double-cliquez sur clean.cmd, une fenêtre noire va apparaître pendant un instant, laissez la ouverte jusqu'à ce qu'elle se ferme.

http://kerio.probb.fr/tuto-Clean-h37.html

_________

refait ccleaner et nettoie les fichiers temporaires

_____
nettoie avec regcleaner ton registre
http://www.01net.com/windows/Utilitaire/nettoyeurs_et_installeurs/fiches/4894.html

tutoriel avoir (merci malekal)

https://www.malekal.com/registre-windows/
___________

 colle le rapport d'un scan en ligne 
avec un des suivants: 


bitdefender en ligne : 
http://www.bitdefender.fr/scan_fr/scan8/ie.html

___________

desactive puis reactive la restauration systeme
____________
si ca persiste 

colle un rapport hijackthis 
https://www.01net.com/telecharger/windows/Securite/anti-spyware/fiches/29061.html 


manuel :

https://leblogdeclaude.blogspot.com/2006/10/informatique-section-hijackthis.html

sandy086 · Answer

Voici le rapport de AVG-AS :

---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

 + Créé à:	01:54:54 13/09/2007

 + Résultat de l'analyse:	



C:\Documents and Settings\Jean-Claude\Application Data\ShopperReports -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Jean-Claude\Application Data\ShopperReports\cs -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Jean-Claude\Application Data\ShopperReports\cs\db -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Jean-Claude\Application Data\ShopperReports\cs\dwld -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Jean-Claude\Application Data\ShopperReports\cs\report -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Jean-Claude\Application Data\ShopperReports\cs\res2 -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Sylvie\Application Data\ShopperReports -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Sylvie\Application Data\ShopperReports\cs -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Sylvie\Application Data\ShopperReports\cs\db -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Sylvie\Application Data\ShopperReports\cs\dwld -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Sylvie\Application Data\ShopperReports\cs\report -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Sylvie\Application Data\ShopperReports\cs\res2 -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).


Fin du rapport

sandy086 · Answer

Voici le rapport de Bitdefender :

BitDefender Online Scanner
  
  
 
Rapport d'analyse généré à: Thu, Sep 13, 2007 - 13:51:53
 
 
  
  
 
Voie d'analyse: C:\;D:\;E:\;F:\;G:\;H:\;I:\;J:\;
  
  
 
 
  
  
 
Statistiques
 
Temps
 02:13:50
 
Fichiers
 284899
 
Directoires
 8759
 
Secteurs de boot
 2
 
Archives
 1436
 
Paquets programmes
 11917
 
  
  
 
Résultats
 
Virus identifiés
 4
 
Fichiers infectés
 4
 
Fichiers suspects
 0
 
Avertissements
 0
 
Désinfectés
 0
 
Fichiers effacés
 4
 
  
  
 
Info sur les moteurs
 
Définition virus
 803647
 
Version des moteurs
 AVCORE v1.0 (build 2411) (i386) (Jul 9 2007 12:10:22)
 
Analyse des plugins
 14
 
Archive des plugins
 38
 
Unpack des plugins
 7
 
E-mail plugins
 6
 
Système plugins
 1
 
  
  
 
Paramètres d'analyse
 
Première action
 Désinfecté
 
Seconde Action
 Supprimé
 
Heuristique
 Oui
 
Acceptez les avertissements
 Oui
 
Extensions analysées
 *;
 
Excludez les extensions
  
 
Analyse d'emails
 Oui
 
Analyse des Archives
 Oui
 
Analyser paquets programmes
 Oui
 
Analyse des fichiers
 Oui
 
Analyse de boot
 Oui
 
  
  
 
  Fichier analysé
  Statut
 
C:\Documents and Settings\Sylvie\Local Settings\Temp\~WA6PScannerSetup.exe=>(Instyler o)=>(Instyler Module 8)
 Infecté par: Trojan.Dldr.Fakeav.A
 
C:\Documents and Settings\Sylvie\Local Settings\Temp\~WA6PScannerSetup.exe=>(Instyler o)=>(Instyler Module 8)
 Echec de la désinfection
 
C:\Documents and Settings\Sylvie\Local Settings\Temp\~WA6PScannerSetup.exe=>(Instyler o)=>(Instyler Module 8)
 Supprimé
 
C:\Documents and Settings\Sylvie\Local Settings\Temp\~WA6PScannerSetup.exe=>(Instyler o)
 Echec de la mise à jour
 
C:\Documents and Settings\Sylvie\Local Settings\Temp\~WA6PScannerSetup.exe=>(Instyler o)=>(Instyler Module 11)
 Infecté par: Trojan.Fakealert.BX
 
C:\Documents and Settings\Sylvie\Local Settings\Temp\~WA6PScannerSetup.exe=>(Instyler o)=>(Instyler Module 11)
 Echec de la désinfection
 
C:\Documents and Settings\Sylvie\Local Settings\Temp\~WA6PScannerSetup.exe=>(Instyler o)=>(Instyler Module 11)
 Supprimé
 
C:\Documents and Settings\Sylvie\Local Settings\Temp\~WA6PScannerSetup.exe=>(Instyler o)
 Echec de la mise à jour
 
C:\Documents and Settings\Sylvie\Local Settings\Temp\~WA6PScannerSetup.exe=>(Instyler o)=>(Instyler Module 16)
 Infecté par: Trojan.DM
 
C:\Documents and Settings\Sylvie\Local Settings\Temp\~WA6PScannerSetup.exe=>(Instyler o)=>(Instyler Module 16)
 Echec de la désinfection
 
C:\Documents and Settings\Sylvie\Local Settings\Temp\~WA6PScannerSetup.exe=>(Instyler o)=>(Instyler Module 16)
 Supprimé
 
C:\Documents and Settings\Sylvie\Local Settings\Temp\~WA6PScannerSetup.exe=>(Instyler o)
 Echec de la mise à jour
 
C:\Documents and Settings\Sylvie\Local Settings\Temp\~WA6PScannerSetup.exe=>(Instyler o)=>(Instyler Module 49)
 Infecté par: Trojan.Fakealert.BB
 
C:\Documents and Settings\Sylvie\Local Settings\Temp\~WA6PScannerSetup.exe=>(Instyler o)=>(Instyler Module 49)
 Echec de la désinfection
 
C:\Documents and Settings\Sylvie\Local Settings\Temp\~WA6PScannerSetup.exe=>(Instyler o)=>(Instyler Module 49)
 Supprimé
 
C:\Documents and Settings\Sylvie\Local Settings\Temp\~WA6PScannerSetup.exe=>(Instyler o)
 Echec de la mise à jour

sandy086 · Answer

Voici le rapport de HijackThis : 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:56:33, on 13/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsqh.exe
C:\Program Files\F-Secure\Anti-Virus\fsrw.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Wanadoo\CnxMon.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
C:\Program Files\F-Secure\Common\FNRB32.EXE
C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
C:\Program Files\F-Secure\Common\FIH32.EXE
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\system32\LVComS.exe
C:\PROGRA~1\F-Secure\ANTI-S~1\fsaw.exe
C:\Program Files\F-Secure\FSGUI\fsguidll.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Java\jre1.5.0_08\bin\jucheck.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\unzipped\Scanner.exe\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\Wanadoo\CnxMon.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_5 -reboot 1
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: F-Secure Automatic Update.lnk = C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Block this popup - C:\Program Files\F-Secure\Anti-Spyware\blockpopups.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: IE Shield - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: IE Shield... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {05D96F71-87C6-11D3-9BE4-00902742D6E0} (QuickPlace Class) - http://upgroups.univ-poitiers.fr/qp2.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.girafoto.fr/uploaders/aurigma_4_5_35/ImageUploader4.cab
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - F-Secure Automatic Update - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

jlpjlp · Answer

slt, 
scan avec des antiespions (en mode sans échec): pour cela demarre l'ordi en appuayant plusieurs fois sur F8


en premier utilise AD AWARE puis SPYBOT


AD AWARE
https://www.01net.com/telecharger/windows/Securite/anti-spyware/fiches/11643.html



spybot :
https://www.01net.com/telecharger/windows/Securite/anti-spyware/fiches/26157.html

voir demo d utilisation (merci Balltrap)
http://pageperso.aol.fr/Balltrap34/demo%20spybot.htm


ensuite refait CCLEANER et recolle un rapport de scan en ligne

jlpjlp · Answer

va dans poste de travail puis C puis doc et setting puis sylvie puis LOCAL STTINGS puis temps et vire ce qui est dedans

C:\Documents and Settings\Sylvie\Local Settings\Temp

sandy086 · Answer

Voici le rapport de AD AWARE :


Ad-Aware 2007 Build 
Log File Created on: 2007-09-13 20:29:57
Using Definitions File: C:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware 2007\core.aawdef
Computer name: JC
Name of user performing scan: SYSTEM

System information
===========================
Number of processors: 1
Processor type:               Intel(R) Pentium(R) 4 CPU 2.80GHz
Memory Available: 55%
Total Physical Memory: 536334336 Bytes
Available Physical Memory: 291418112 Bytes
Total Page File Size: 1311002624 Bytes
Available On Page File: 1095393280 Bytes
Total Virtual Memory: 2147352576 Bytes
Available Virtual Memory: 2006118400 Bytes
OS: Microsoft Windows XP Service Pack 2 (Build 2600) 

Ad-Aware 2007 Settings
===========================
Skipping files larger than 1048576 kB 
Ignoring infections with lower TAI than: 3


Extended Ad-Aware 2007 Settings
===========================
Unloading known modules during scan
Ignoring spanned files when scanning cab archives
Scanning registry for all users
Using permanent archive caching
Reanalyzing results after scanning before displaying results
Trying to unload modules prior to removal
Let Windows remove files currently in use at next reboot
Removing quarantined objects after restore
Logging Ad-Aware events
Blocking Pop-Ups aggressively
Deactivating Ad-Watch during scans
Writeprotecting system files after repairs
Including Ad-aware command line parameters in log file
Include info about ignored objects in log file
Including basic settings in log file
Including advanced settings in log file
Including user and computer name in log file
Include reference summary in log file
Creating log file for removal operations
Including module info in log file
Include Alternate Data Stream details in log file
Create and save WebUpdate log file

Databaseinfo
===========================
Version number: 7
Build Number: 0
Build Date and Time: 2007/07/05 07:55:33

Scan Statistics
===========================
Method: Smart
	 Scan tracking cookies.............................: On 
	 Scan ADS filestreams..............................: Off 

Item Scanned: 155388
Infections Detected: 183
Infections Ignored: 0

Scan detailed statistics
===========================
Type                  Critical    Total
Process Scan....:        0        0
Registry Scan...:        0        0
Registry PE Scan:        0        0
Hosts File Scan.:        0        0
File Scan.......:        0        0
Folder Scan.....:        0        0
LSP Scan........:        0        0
ADS Scan........:        0        0
Cookie Scan.....:      180      180
File Hash Scan..:        0        0

Infections Found
===========================
Family Id: 725  Name: Tracking Cookie  Category: DataMiner  TAI:3
  Item Id: 600000190  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sandrine\Cookies\index.dat www.googleadservices.com Conversion /pagead/conversion/1060031050/
  Item Id: 600000190  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sandrine\Cookies\index.dat www.googleadservices.com Conversion /pagead/conversion/1066490786/
  Item Id: 600000190  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sandrine\Cookies\index.dat www.googleadservices.com Conversion /pagead/conversion/1066556546/
  Item Id: 600000190  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sandrine\Cookies\index.dat www.googleadservices.com Conversion /pagead/conversion/1071380559/
  Item Id: 600000190  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sandrine\Cookies\index.dat www.googleadservices.com Conversion /pagead/conversion/1071416564/
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sandrine\Cookies\index.dat fr.sitestat.com s1 /becquet/becquet/
  Item Id: 600000119  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sandrine\Cookies\index.dat www.kelkoo.fr kelkooID /
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat be.sitestat.com s1 /belgacom/skynet/
  Item Id: 600000199  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat fe.lea.lycos.fr NGUserID /
  Item Id: 600000083  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat ads.realtechnetwork.net ajess1_53C1B8078394AECB613B8A13 /
  Item Id: 600000083  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat ads.realtechnetwork.net ajefc /
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat fr.sitestat.com s1 /renault-group/renault-sport/
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat fr.sitestat.com s1 /renault-group/renault-fr/
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat fr.sitestat.com c1 /renault-group/
  Item Id: 600000199  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat hb.lycos.com lubid2 /
  Item Id: 600000049  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat tripod.lycos.es lycosUpdate /
  Item Id: 600000083  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat france.real.com __utma /
  Item Id: 600000083  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat france.real.com __utmb /
  Item Id: 600000083  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat france.real.com __utmz /
  Item Id: 600000199  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat fe.lea.lycos.es NGUserID /
  Item Id: 600000083  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat ads.realcastmedia.com universal_adpool_cookie2_103_5_0 /
  Item Id: 600000083  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat ads.realcastmedia.com directtrack_rotation_realcastmedia /
  Item Id: 600000409  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat server.iad.liveperson.net HumanClickKEY /hc/18766632
  Item Id: 600000049  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat tripod.jubii.dk lycosUpdate /
  Item Id: 600000049  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat ads.tripod.jubii.dk DXPERT /
  Item Id: 600000513  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat 4.adbrite.com hit_counter_133530 /mb/
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat int.sitestat.com s1 /ebookers/ger/
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat int.sitestat.com s1 /ebookers/fra/
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat fr.sitestat.com s1 /eyrolles/eyrolles/
  Item Id: 600000157  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat cz8.clickzs.com clklin /
  Item Id: 600000157  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat cz8.clickzs.com clkid /
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat int.sitestat.com c1 /ebookers/
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat www6.addfreestats.com NC1U /cgi-bin
  Item Id: 600000083  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat realguide.real.com oreo /
  Item Id: 600000129  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat c.goclick.com RS /
  Item Id: 600000129  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat c.goclick.com ROI /
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat int.sitestat.com s1 /cassava/new-pcp/
  Item Id: 600000396  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat www.blogtrafic.com referer /
  Item Id: 600000396  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat bobelgoss-corse.blogtrafic.com StatsVisite /
  Item Id: 600000213  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat w2761.upd.dns-look-up.com nm /
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat int.sitestat.com s1 /cassava/888/
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat int.sitestat.com c1 /cassava/
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat www.addfreestats.com NC1U /cgi-bin
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat be.sitestat.com c1 /belgacom/
  Item Id: 600000396  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat itamlaurent.blogtrafic.com StatsVisite /
  Item Id: 600000396  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat yonis79.blogtrafic.com StatsVisite /
  Item Id: 600000396  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat justeforyou-france.blogtrafic.com StatsVisite /
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat fr.sitestat.com s1 /becquet/becquet/
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat www7.addfreestats.com NC1U /cgi-bin
  Item Id: 600000350  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat www.goldenpalace.com check19 /fr/
  Item Id: 600000199  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat hebergement.lycos.fr affiliatelogin /
  Item Id: 600000199  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat hebergement.lycos.fr affiliatecode /
  Item Id: 600000199  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat hebergement.lycos.fr nsctrid /
  Item Id: 600000211  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat v29372.upd.trinityacquisitions.com nm /
  Item Id: 600000409  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat server.iad.liveperson.net HumanClickKEY /hc/53191747
  Item Id: 600000409  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat server.iad.liveperson.net HumanClickID /hc/53191747
  Item Id: 600000523  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat webstats4u.com w4u_cid /
  Item Id: 600000416  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat us.adrevenue.net GUID /
  Item Id: 600000074  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat www.allslots.com JackpotFactory /
  Item Id: 600000074  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat www.allslots.com bTag /
  Item Id: 600000409  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat server.iad.liveperson.net HumanClickKEY /hc/55997340
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat fr.sitestat.com s1 /renault-group/renault-be/
  Item Id: 600000199  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat fe.lea.lycos.nl NGUserID /
  Item Id: 600000190  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat www.googleadservices.com Conversion /pagead/conversion/1064240221/
  Item Id: 600000049  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat tripod.lycos.nl lycosUpdate /
  Item Id: 600000213  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat w5276.upd.maximumexperience.com nm /
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat fr.sitestat.com s1 /bebloom/bebloom/
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat www8.addfreestats.com NC1U /cgi-bin
  Item Id: 600000119  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat fr.kelkoo.com kelkooID /
  Item Id: 600000079  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat www.roidescasinos.com affreferrer /
  Item Id: 600000079  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat www.roidescasinos.com affid /
  Item Id: 600000079  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat www.roidescasinos.com CP /
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat fr.sitestat.com c1 /bebloom/
  Item Id: 600000523  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat m1.webstats.motigo.com w4u_ti /
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat www1.addfreestats.com NC1U /cgi-bin
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat de.sitestat.com s1 /lycos-de/fr/
  Item Id: 600000049  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat members.tripod.com rmCookiesChecked /
  Item Id: 600000049  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat members.tripod.com flashInstalled /
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat fr.sitestat.com s1 /assurland/assurland/
  Item Id: 600000190  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat www.googleadservices.com Conversion /pagead/conversion/1070847646/
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat de.sitestat.com c1 /lycos-de/
  Item Id: 600000095  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat data2.perf.overture.com NSC_ebub2_hspvq /
  Item Id: 600000513  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat ads.adbrite.com ihc_386422 /
  Item Id: 600000513  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat ads.adbrite.com ihc_229068 /
  Item Id: 600000190  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat www.googleadservices.com Conversion /pagead/conversion/1071753060/
  Item Id: 600000049  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat musikana.tripod.com rmCookiesChecked /
  Item Id: 600000049  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat musikana.tripod.com flashInstalled /
  Item Id: 600000049  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat musikana.tripod.com ym_pop_freq_expiration67698 /
  Item Id: 600000049  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat musikana.tripod.com ym_pop_freq67698 /
  Item Id: 600000199  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\François\Cookies\index.dat oascentral.lycos.com flashInstalled /
  Item Id: 600000199  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Jean-Claude\Cookies\index.dat fe.lea.lycos.fr NGUserID /
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Jean-Claude\Cookies\index.dat fr.sitestat.com s1 /asf/asf/
  Item Id: 600000199  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Jean-Claude\Cookies\index.dat f009.mail.caramail.lycos.fr ebNewBandWidth_.f009.mail.caramail.lycos.fr /
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Jean-Claude\Cookies\index.dat int.sitestat.com s1 /cassava/new-pcp/
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Jean-Claude\Cookies\index.dat int.sitestat.com s1 /cassava/888/
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Jean-Claude\Cookies\index.dat fr.sitestat.com s1 /becquet/becquet/
  Item Id: 600000190  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Jean-Claude\Cookies\index.dat www.googleadservices.com Conversion /pagead/conversion/1070738121/
  Item Id: 600000190  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Jean-Claude\Cookies\index.dat www.googleadservices.com Conversion /pagead/conversion/1071416564/
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Jean-Claude\Cookies\index.dat fr.sitestat.com s1 /bebloom/bebloom/
  Item Id: 600000190  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Jean-Claude\Cookies\index.dat www.googleadservices.com Conversion /pagead/conversion/1070245539/
  Item Id: 600000190  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Jean-Claude\Cookies\index.dat www.googleadservices.com Conversion /pagead/conversion/1071382995/
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Jean-Claude\Cookies\index.dat fr.sitestat.com c1 /bebloom/
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Jean-Claude\Cookies\index.dat int.sitestat.com c1 /cassava/
  Item Id: 600000523  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Jean-Claude\Cookies\index.dat m1.webstats.motigo.com w4u_tv /
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Jean-Claude\Cookies\index.dat fr.sitestat.com s1 /assurland/assurland/
  Item Id: 600000119  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Jean-Claude\Cookies\index.dat fr.kelkoo.com kelkooID /
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Jean-Claude\Cookies\index.dat fr.sitestat.com s1 /renault-group/renault-fr/
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Jean-Claude\Cookies\index.dat fr.sitestat.com c1 /renault-group/
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Jean-Claude\Cookies\index.dat de.sitestat.com s1 /lycos-de/fr/
  Item Id: 600000199  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Jean-Claude\Cookies\index.dat hebergement.lycos.fr LBC /
  Item Id: 600000199  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Jean-Claude\Cookies\index.dat hebergement.lycos.fr target /
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Jean-Claude\Cookies\index.dat de.sitestat.com c1 /lycos-de/
  Item Id: 600000190  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat www.googleadservices.com Conversion /pagead/conversion/1068041297/
  Item Id: 600000083  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat realarcade.com __utma /
  Item Id: 600000083  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat realarcade.com __utmb /
  Item Id: 600000083  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat realarcade.com __utmz /
  Item Id: 600000083  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat www.realarcade.com games.tps /
  Item Id: 600000083  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat www.realarcade.com games.racInstalled /
  Item Id: 600000083  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat www.realarcade.com games.racVersion /
  Item Id: 600000083  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat www.realarcade.com games.racDistCode /
  Item Id: 600000083  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat www.realarcade.com xxx /
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat int.sitestat.com s1 /cassava/888/
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat fr.sitestat.com s1 /becquet/becquet/
  Item Id: 600000199  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat www.loterie.lycos.fr salaire /
  Item Id: 600000409  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat server.iad.liveperson.net HumanClickKEY /hc/18766632
  Item Id: 600000199  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat forum.cinema.lycos.fr phpbb2mysql_data /
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat www2.addfreestats.com NC1U /cgi-bin
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat int.sitestat.com s1 /cassava/new-pcp/
  Item Id: 600000190  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat www.googleadservices.com Conversion /pagead/conversion/1071416564/
  Item Id: 600000409  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat server.iad.liveperson.net HumanClickKEY /hc/89451406
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat int.sitestat.com s1 /ebookers/fra/
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat int.sitestat.com c1 /ebookers/
  Item Id: 600000079  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat www.roidescasinos.com affreferrer /
  Item Id: 600000079  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat www.roidescasinos.com affid /
  Item Id: 600000079  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat www.roidescasinos.com CP /
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat int.sitestat.com c1 /cassava/
  Item Id: 600000119  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat fr.kelkoo.com kelkooID /
  Item Id: 600000074  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat www.allslots.com JackpotFactory /
  Item Id: 600000074  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat www.allslots.com bTag /
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat fr.sitestat.com s1 /bretagne/tourisme/
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat fr.sitestat.com s1 /astrazeneca/astrazeneca/
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat fr.sitestat.com c1 /astrazeneca/
  Item Id: 600000190  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat www.googleadservices.com Conversion /pagead/conversion/1071356547/
  Item Id: 600000416  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat us.adrevenue.net GUID /
  Item Id: 600000190  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat www.googleadservices.com Conversion /pagead/conversion/1068694205/
  Item Id: 600000409  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat server.iad.liveperson.net HumanClickKEY /hc/15527479
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat be.sitestat.com s1 /mediadis/mediadis/
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat fr.sitestat.com s1 /assurland/assurland/
  Item Id: 600000119  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat www.kelkoo.fr kelkooID /
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat fr.sitestat.com s1 /danone/chd/
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat www.addfreestats.com NC1U /cgi-bin
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat de.sitestat.com s1 /lycos-de/fr/
  Item Id: 600000144  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat ad.doubleclick.net IXAIInvited544_local /adi/agi.msnmsgus.product/winks/
  Item Id: 600000199  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat www.meteo.lycos.fr meteo_lycos /
  Item Id: 600000513  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat 3.adbrite.com hit_counter_35779 /mb/
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat fr.sitestat.com s1 /seafrance/seafrance/
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat de.sitestat.com c1 /lycos-de/
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat fr.sitestat.com c1 /seafrance/
  Item Id: 600000199  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat forum.femme.lycos.fr phpbb2mysql_data /
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat fr.sitestat.com s1 /civi/civi/
  Item Id: 600000199  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat fe.lea.lycos.fr NGUserID /
  Item Id: 600000119  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat shopping.kelkoo.fr kelkooID /
  Item Id: 600000199  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat shopping.lycos.fr stl_visitor4.56 /
  Item Id: 600000199  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat shopping.lycos.fr b4adb072-f880-4177-9077-42cfa304459dstl_conversionentry4.56 /
  Item Id: 600000199  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat shopping.lycos.fr b4adb072-f880-4177-9077-42cfa304459dstl_lastentry4.56 /
  Item Id: 600000199  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat shopping.lycos.fr fpc10002064421178 /
  Item Id: 600000199  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat shopping.lycos.fr stl_visitor4.56 /c1777p1m0b0/
  Item Id: 600000199  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat shopping.lycos.fr b4adb072-f880-4177-9077-42cfa304459dstl_lastentry4.56 /c1777p1m0b0/
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat fr.sitestat.com s1 /eyrolles/eyrolles/
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat be.sitestat.com s1 /belgacom/skynet/
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat be.sitestat.com c1 /belgacom/
  Item Id: 600000119  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat voyages.kelkoo.fr kelkooID /
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat fr.sitestat.com s1 /bebloom/bebloom/
  Item Id: 600000190  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat www.googleadservices.com Conversion /pagead/conversion/1063754225/
  Item Id: 600000190  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat www.googleadservices.com Conversion /pagead/conversion/1066597940/
  Item Id: 600000142  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat fr.sitestat.com c1 /bebloom/
  Item Id: 600000199  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat hebergement.lycos.fr affiliatelogin /
  Item Id: 600000199  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat hebergement.lycos.fr affiliatecode /
  Item Id: 600000199  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat hebergement.lycos.fr LBC /
  Item Id: 600000190  Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Sylvie\Cookies\index.dat www.googleadservices.com Conversion /pagead/conversion/1068584939/
Family Id: 9999  Name: MRU Object  Category: MRU Object  TAI:0
  Item Id: 1  Value: MRU Path: C:\Documents and Settings\Sandrine\Recent  Count: 12
  Item Id: 2  Value: MRU Registry Key: S-1-5-21-1715567821-1935655697-682003330-1008\Software\Microsoft\Search Assistant\ACMru\5603  Count: 1
  Item Id: 3  Value: MRU Registry Key: S-1-5-21-1715567821-1935655697-682003330-1008\Software\Microsoft\Internet Explorer\TypedURLs  Count: 25

Items Ignored During Scan
===========================


Listing of running processes
===========================
C:\WINDOWS\SYSTEM32\SMSS.EXE
	c:\windows\system32\smss.exe

	c:\windows\system32
tdll.dll

C:\WINDOWS\SYSTEM32\CSRSS.EXE
	c:\windows\system32\csrss.exe

	c:\windows\system32
tdll.dll

	c:\windows\system32\csrsrv.dll

	c:\windows\system32\basesrv.dll

	c:\windows\system32\winsrv.dll

	c:\windows\system32\gdi32.dll

	c:\windows\system32\kernel32.dll

	c:\windows\system32\user32.dll

	c:\windows\system32\sxs.dll

	c:\windows\system32\advapi32.dll

	c:\windows\system32pcrt4.dll

C:\WINDOWS\SYSTEM32\WINLOGON.EXE
	c:\windows\system32\winlogon.exe

	c:\windows\system32
tdll.dll

	c:\windows\system32\kernel32.dll

	c:\windows\system32\advapi32.dll

	c:\windows\system32pcrt4.dll

	c:\windows\system32\authz.dll

	c:\windows\system32\msvcrt.dll

	c:\windows\system32\crypt32.dll

	c:\windows\system32\user32.dll

	c:\windows\system32\gdi32.dll

	c:\windows\system32\msasn1.dll

	c:\windows\system32
ddeapi.dll

	c:\windows\system32\profmap.dll

	c:\windows\system32
etapi32.dll

	c:\windows\system32\userenv.dll

	c:\windows\system32\psapi.dll

	c:\windows\system32egapi.dll

	c:\windows\system32\secur32.dll

	c:\windows\system32\setupapi.dll

	c:\windows\system32\version.dll

	c:\windows\system32\winsta.dll

	c:\windows\system32\wintrust.dll

	c:\windows\system32\imagehlp.dll

	c:\windows\system32\ws2_32.dll

	c:\windows\system32\ws2help.dll

	c:\windows\system32\msgina.dll

	c:\windows\system32\shell32.dll

	c:\windows\system32\shlwapi.dll

	c:\windows\system32\comctl32.dll

	c:\windows\system32\odbc32.dll

	c:\windows\system32\comdlg32.dll

	c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll

	c:\windows\system32\odbcint.dll

	c:\windows\system32\shsvcs.dll

	c:\windows\system32\sfc.dll

	c:\windows\system32\sfc_os.dll

	c:\windows\system32\ole32.dll

	c:\windows\system32\apphelp.dll

	c:\windows\system32\winmm.dll

	c:\windows\system32\cscdll.dll

	c:\windows\system32\wlnotify.dll

	c:\windows\system32\winscard.dll

	c:\windows\system32\wtsapi32.dll

	c:\windows\system32\winspool.drv

	c:\windows\system32\mpr.dll

	c:\windows\system32saenh.dll

	c:\windows\system32\wgalogon.dll

	c:\windows\system32\oleaut32.dll

	c:\windows\system32
tmarta.dll

	c:\windows\system32\wldap32.dll

	c:\windows\system32\samlib.dll

	c:\windows\system32\clbcatq.dll

	c:\windows\system32\comres.dll

	c:\windows\system32\uxtheme.dll

	c:\windows\system32\cscui.dll

	c:\windows\system32\xpsp2res.dll

C:\WINDOWS\SYSTEM32\SERVICES.EXE
	c:\windows\system32\services.exe

	c:\windows\system32
tdll.dll

	c:\windows\system32\kernel32.dll

	c:\windows\system32\msvcrt.dll

	c:\windows\system32\advapi32.dll

	c:\windows\system32pcrt4.dll

	c:\windows\system32\user32.dll

	c:\windows\system32\gdi32.dll

	c:\windows\system32\userenv.dll

	c:\windows\system32\scesrv.dll

	c:\windows\system32\authz.dll

	c:\windows\system32\umpnpmgr.dll

	c:\windows\system32\winsta.dll

	c:\windows\system32
etapi32.dll

	c:\windows\system32
cobjapi.dll

	c:\windows\system32\msvcp60.dll

	c:\windows\system32\shimeng.dll

	c:\windows\apppatch\acgenral.dll

	c:\windows\system32\winmm.dll

	c:\windows\system32\ole32.dll

	c:\windows\system32\oleaut32.dll

	c:\windows\system32\msacm32.dll

	c:\windows\system32\version.dll

	c:\windows\system32\shell32.dll

	c:\windows\system32\shlwapi.dll

	c:\windows\system32\uxtheme.dll

	c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll

	c:\windows\system32\comctl32.dll

	c:\windows\system32\secur32.dll

	c:\windows\system32\apphelp.dll

	c:\windows\system32\eventlog.dll

	c:\windows\system32\ws2_32.dll

	c:\windows\system32\ws2help.dll

	c:\windows\system32\psapi.dll

	c:\windows\system32\wtsapi32.dll

	c:\windows\system32\wintrust.dll

	c:\windows\system32\crypt32.dll

	c:\windows\system32\msasn1.dll

	c:\windows\system32\imagehlp.dll

	c:\windows\system32\cabinet.dll

C:\WINDOWS\SYSTEM32\LSASS.EXE
	c:\windows\system32\lsass.exe

	c:\windows\system32
tdll.dll

	c:\windows\system32\kernel32.dll

	c:\windows\system32\advapi32.dll

	c:\windows\system32pcrt4.dll

	c:\windows\system32\lsasrv.dll

	c:\windows\system32\mpr.dll

	c:\windows\system32\user32.dll

	c:\windows\system32\gdi32.dll

	c:\windows\system32\msasn1.dll

	c:\windows\system32\msvcrt.dll

	c:\windows\system32
etapi32.dll

	c:\windows\system32
tdsapi.dll

	c:\windows\system32\dnsapi.dll

	c:\windows\system32\ws2_32.dll

	c:\windows\system32\ws2help.dll

	c:\windows\system32\wldap32.dll

	c:\windows\system32\secur32.dll

	c:\windows\system32\samlib.dll

	c:\windows\system32\samsrv.dll

	c:\windows\system32\cryptdll.dll

	c:\windows\system32\shimeng.dll

	c:\windows\apppatch\acgenral.dll

	c:\windows\system32\winmm.dll

	c:\windows\system32\ole32.dll

	c:\windows\system32\oleaut32.dll

	c:\windows\system32\msacm32.dll

	c:\windows\system32\version.dll

	c:\windows\system32\shell32.dll

	c:\windows\system32\shlwapi.dll

	c:\windows\system32\userenv.dll

	c:\windows\system32\uxtheme.dll

	c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll

	c:\windows\system32\comctl32.dll

	c:\windows\system32\msprivs.dll

	c:\windows\system32\kerberos.dll

	c:\windows\system32\msv1_0.dll

	c:\windows\system32\iphlpapi.dll

	c:\windows\system32
etlogon.dll

	c:\windows\system32\w32time.dll

	c:\windows\system32\msvcp60.dll

	c:\windows\system32\schannel.dll

	c:\windows\system32\crypt32.dll

	c:\windows\system32\wdigest.dll

	c:\windows\system32saenh.dll

	c:\windows\system32\scecli.dll

	c:\windows\system32\setupapi.dll

C:\WINDOWS\SYSTEM32\SVCHOST.EXE
	c:\windows\system32\svchost.exe

	c:\windows\system32
tdll.dll

	c:\windows\system32\kernel32.dll

	c:\windows\system32\advapi32.dll

	c:\windows\system32pcrt4.dll

	c:\windows\system32\shimeng.dll

	c:\windows\apppatch\acgenral.dll

	c:\windows\system32\user32.dll

	c:\windows\system32\gdi32.dll

	c:\windows\system32\winmm.dll

	c:\windows\system32\ole32.dll

	c:\windows\system32\msvcrt.dll

	c:\windows\system32\oleaut32.dll

	c:\windows\system32\msacm32.dll

	c:\windows\system32\version.dll

	c:\windows\system32\shell32.dll

	c:\windows\system32\shlwapi.dll

	c:\windows\system32\userenv.dll

	c:\windows\system32\uxtheme.dll

	c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll

	c:\windows\system32\comctl32.dll

	c:\windows\system32
tmarta.dll

	c:\windows\system32\wldap32.dll

	c:\windows\system32\samlib.dll

	c:\windows\system32pcss.dll

	c:\windows\system32\secur32.dll

	c:\windows\system32\ws2_32.dll

	c:\windows\system32\ws2help.dll

	c:\windows\system32\xpsp2res.dll

	c:\windows\system32\clbcatq.dll

	c:\windows\system32\comres.dll

	c:\windows\system32\svchost.exe

	c:\windows\system32
tdll.dll

	c:\windows\system32\kernel32.dll

	c:\windows\system32\advapi32.dll

	c:\windows\system32pcrt4.dll

	c:\windows\system32\shimeng.dll

	c:\windows\apppatch\acgenral.dll

	c:\windows\system32\user32.dll

	c:\windows\system32\gdi32.dll

	c:\windows\system32\winmm.dll

	c:\windows\system32\ole32.dll

	c:\windows\system32\msvcrt.dll

	c:\windows\system32\oleaut32.dll

	c:\windows\system32\msacm32.dll

	c:\windows\system32\version.dll

	c:\windows\system32\shell32.dll

	c:\windows\system32\shlwapi.dll

	c:\windows\system32\userenv.dll

	c:\windows\system32\uxtheme.dll

	c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll

	c:\windows\system32\comctl32.dll

	c:\windows\system32pcss.dll

	c:\windows\system32\secur32.dll

	c:\windows\system32\ws2_32.dll

	c:\windows\system32\ws2help.dll

	c:\windows\system32\xpsp2res.dll

	c:\windows\system32saenh.dll

	c:\windows\system32\mswsock.dll

	c:\program files\f-secure\fsps\program\fslsp.dll

	c:\windows\system32\hnetcfg.dll

	c:\windows\system32\wshtcpip.dll

	c:\windows\system32\dnsapi.dll

	c:\windows\system32\iphlpapi.dll

	c:\windows\system32\winrnr.dll

	c:\windows\system32\wldap32.dll

	c:\windows\system32asadhlp.dll

	c:\windows\system32\clbcatq.dll

	c:\windows\system32\comres.dll

C:\PROGRAM FILES\LAVASOFT\AD-AWARE 2007\AAWSERVICE.EXE
	c:\program files\lavasoft\ad-aware 2007\aawservice.exe

	c:\windows\system32
tdll.dll

	c:\windows\system32\kernel32.dll

	c:\program files\lavasoft\ad-aware 2007\ceapi.dll

	c:\windows\system32\advapi32.dll

	c:\windows\system32pcrt4.dll

	c:\program files\lavasoft\ad-aware 2007\pkarchive84cb.dll

	c:\windows\system32\shell32.dll

	c:\windows\system32\gdi32.dll

	c:\windows\system32\user32.dll

	c:\windows\system32\msvcrt.dll

	c:\windows\system32\shlwapi.dll

	c:\windows\system32\ole32.dll

	c:\windows\system32\crypt32.dll

	c:\windows\system32\msasn1.dll

	c:\windows\system32\wldap32.dll

	c:\windows\system32\psapi.dll

	c:\windows\system32\version.dll

	c:\windows\system32\wininet.dll

	c:\windows\system32\oleaut32.dll

	c:\program files\lavasoft\ad-aware 2007\update.dll

	c:\windows\system32\wsock32.dll

	c:\windows\system32\ws2_32.dll

	c:\windows\system32\ws2help.dll

	c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll

	c:\windows\system32\comctl32.dll

	c:\windows\system32saenh.dll

C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\GUARD.EXE
	c:\program files\grisoft\avg anti-spyware 7.5\guard.exe

	c:\windows\system32
tdll.dll

	c:\windows\system32\kernel32.dll

	c:\program files\grisoft\avg anti-spyware 7.5\engine.dll

	c:\windows\system32\shfolder.dll

	c:\windows\system32\msvcrt.dll

	c:\windows\system32\advapi32.dll

	c:\windows\system32pcrt4.dll

	c:\windows\system32\shlwapi.dll

	c:\windows\system32\gdi32.dll

	c:\windows\system32\user32.dll

	c:\windows\system32\winmm.dll

	c:\windows\system32\psapi.dll

	c:\windows\system32\version.dll

	c:\windows\system32\iphlpapi.dll

	c:\windows\system32\ws2_32.dll

	c:\windows\system32\ws2help.dll

	c:\windows\system32\ole32.dll

	c:\windows\system32\oleaut32.dll

	c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll

	c:\windows\system32\comctl32.dll

	c:\windows\system32
tmarta.dll

	c:\windows\system32\wldap32.dll

	c:\windows\system32\samlib.dll

C:\WINDOWS\SYSTEM32\SVCHOST.EXE
	c:\windows\system32\svchost.exe

	c:\windows\system32
tdll.dll

	c:\windows\system32\kernel32.dll

	c:\windows\system32\advapi32.dll

	c:\windows\system32pcrt4.dll

	c:\windows\system32\shimeng.dll

	c:\windows\apppatch\acgenral.dll

	c:\windows\system32\user32.dll

	c:\windows\system32\gdi32.dll

	c:\windows\system32\winmm.dll

	c:\windows\system32\ole32.dll

	c:\windows\system32\msvcrt.dll

	c:\windows\system32\oleaut32.dll

	c:\windows\system32\msacm32.dll

	c:\windows\system32\version.dll

	c:\windows\system32\shell32.dll

	c:\windows\system32\shlwapi.dll

	c:\windows\system32\userenv.dll

	c:\windows\system32\uxtheme.dll

	c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll

	c:\windows\system32\comctl32.dll

	c:\windows\system32
tmarta.dll

	c:\windows\system32\wldap32.dll

	c:\windows\system32\samlib.dll

	c:\windows\system32\xpsp2res.dll

	c:\windows\system32\cryptsvc.dll

	c:\windows\system32\wintrust.dll

	c:\windows\system32\crypt32.dll

	c:\windows\system32\msasn1.dll

	c:\windows\system32\imagehlp.dll

	c:\windows\system32\certcli.dll

	c:\windows\system32\atl.dll

	c:\windows\system32\secur32.dll

	c:\windows\system32
etapi32.dll

	c:\windows\system32\cryptui.dll

	c:\windows\system32\wininet.dll

	c:\windows\system32\esent.dll

	c:\windows\system32\wbem\wmisvc.dll

	c:\windows\system32\vssapi.dll

	c:\windows\system32\srsvc.dll

	c:\windows\system32\powrprof.dll

	c:\windows\system32\clbcatq.dll

	c:\windows\system32\comres.dll

	c:\windows\pchealth\helpctr\binaries\pchsvc.dll

	c:\windows\system32\winsta.dll

	c:\windows\system32\wbem\wbemcore.dll

	c:\windows\system32\msvcp60.dll

	c:\windows\system32\wbem\esscli.dll

	c:\windows\system32\wbem\wbemcomn.dll

	c:\windows\system32\wbem\fastprox.dll

	c:\windows\system32
tdsapi.dll

	c:\windows\system32\dnsapi.dll

	c:\windows\system32\ws2_32.dll

	c:\windows\system32\ws2help.dll

	c:\windows\system32\wbem\wmiutils.dll

	c:\windows\system32\wbemepdrvfs.dll

	c:\windows\system32\wbem\wmiprvsd.dll

	c:\windows\system32
cobjapi.dll

	c:\windows\system32\wbem\wbemess.dll

	c:\windows\system32saenh.dll

	c:\windows\system32\wbem
cprov.dll

	c:\windows\system32\wbem\wbemcons.dll

	c:\windows\system32\wtsapi32.dll

C:\WINDOWS\EXPLORER.EXE
	c:\windows\explorer.exe

	c:\windows\system32
tdll.dll

	c:\windows\system32\kernel32.dll

	c:\windows\system32\advapi32.dll

	c:\windows\system32pcrt4.dll

	c:\windows\system32\browseui.dll

	c:\windows\system32\gdi32.dll

	c:\windows\system32\user32.dll

	c:\windows\system32\msvcrt.dll

	c:\windows\system32\ole32.dll

	c:\windows\system32\shlwapi.dll

	c:\windows\system32\oleaut32.dll

	c:\windows\system32\shdocvw.dll

	c:\windows\system32\crypt32.dll

	c:\windows\system32\msasn1.dll

	c:\windows\system32\cryptui.dll

	c:\windows\system32\wintrust.dll

	c:\windows\system32\imagehlp.dll

	c:\windows\system32
etapi32.dll

	c:\windows\system32\wininet.dll

	c:\windows\system32\wldap32.dll

	c:\windows\system32\version.dll

	c:\windows\system32\shell32.dll

	c:\windows\system32\uxtheme.dll

	c:\windows\system32\shimeng.dll

	c:\windows\apppatch\acgenral.dll

	c:\windows\system32\winmm.dll

	c:\windows\system32\msacm32.dll

	c:\windows\system32\userenv.dll

	c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll

	c:\windows\system32\comctl32.dll

	c:\windows\system32\apphelp.dll

	c:\windows\system32\clbcatq.dll

	c:\windows\system32\comres.dll

	c:\windows\system32	hemeui.dll

	c:\windows\system32\secur32.dll

	c:\windows\system32\msimg32.dll

	c:\windows\system32\xpsp2res.dll

	c:\windows\system32\msutb.dll

	c:\windows\system32\msctf.dll

	c:\windows\system32\linkinfo.dll

	c:\windows\system32
tshrui.dll

	c:\windows\system32\atl.dll

	c:\windows\system32\urlmon.dll

	c:\windows\system32saenh.dll

	c:\windows\system32\setupapi.dll

	c:\windows\system32\winsta.dll

	c:\windows\system32
etshell.dll

	c:\windows\system32tutils.dll

	c:\windows\system32\credui.dll

	c:\windows\system32\ws2_32.dll

	c:\windows\system32\ws2help.dll

	c:\windows\system32\iphlpapi.dll

	c:\windows\system32\msi.dll

	c:\windows\system32\asfsipc.dll

	c:\windows\system32\msisip.dll

	c:\windows\system32\wshext.dll

	c:\windows\system32\mfc42.dll

	c:\windows\system32\comdlg32.dll

	c:\windows\system32\mfc42loc.dll

	c:\windows\system32\wshfr.dll

	c:\progra~1\micros~2\office10\mcps.dll

	c:\windows\system32\msvcp60.dll

	c:\windows\system32\mpr.dll

	c:\windows\system32\drprov.dll

	c:\windows\system32
tlanman.dll

	c:\windows\system32
etui0.dll

	c:\windows\system32
etui1.dll

	c:\windows\system32
etrap.dll

	c:\windows\system32\samlib.dll

	c:\windows\system32\davclnt.dll

	c:\windows\system32\cscdll.dll

C:\PROGRAM FILES\LAVASOFT\AD-AWARE 2007\AD-WATCH2007.EXE
	c:\program files\lavasoft\ad-aware 2007\ad-watch2007.exe

	c:\windows\system32
tdll.dll

	c:\windows\system32\kernel32.dll

	c:\windows\system32\user32.dll

	c:\windows\system32\gdi32.dll

	c:\windows\system32\comctl32.dll

	c:\windows\system32\advapi32.dll

	c:\windows\system32pcrt4.dll

	c:\windows\system32\comdlg32.dll

	c:\windows\system32\shlwapi.dll

	c:\windows\system32\msvcrt.dll

	c:\windows\system32\shell32.dll

	c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll

	c:\windows\system32\oleaut32.dll

	c:\windows\system32\ole32.dll

	c:\windows\system32\ws2_32.dll

	c:\windows\system32\ws2help.dll

	c:\windows\system32\inetmib1.dll

	c:\windows\system32\iphlpapi.dll

	c:\windows\system32\snmpapi.dll

	c:\windows\system32\wsock32.dll

	c:\windows\system32\mprapi.dll

	c:\windows\system32\activeds.dll

	c:\windows\system32\adsldpc.dll

	c:\windows\system32
etapi32.dll

	c:\windows\system32\wldap32.dll

	c:\windows\system32\atl.dll

	c:\windows\system32tutils.dll

	c:\windows\system32\samlib.dll

	c:\windows\system32\setupapi.dll

	c:\windows\system32\version.dll

	c:\windows\system32\imm32.dll

	c:\windows\system32\winmm.dll

	c:\windows\system32\oleacc.dll

	c:\windows\system32\msvcp60.dll

	c:\windows\system32\uxtheme.dll

	c:\windows\system32\olepro32.dll

	c:\program files\lavasoft\ad-aware 2007\awprocesswatch.dll

	c:\program files\lavasoft\ad-aware 2007\awcorecomm.dll

	c:\program files\lavasoft\ad-aware 2007\ceapi.dll

	c:\program files\lavasoft\ad-aware 2007\pkarchive84cb.dll

	c:\windows\system32\crypt32.dll

	c:\windows\system32\msasn1.dll

	c:\windows\system32\psapi.dll

	c:\windows\system32\wininet.dll

	c:\windows\system32saenh.dll

	c:\program files\lavasoft\ad-aware 2007\cookieblocker.dll

	c:\program files\lavasoft\ad-aware 2007\awregwatchdll.dll

	c:\program files\lavasoft\ad-aware 2007\awccommunicatordll.dll

C:\PROGRAM FILES\LAVASOFT\AD-AWARE 2007\AD-AWARE2007.EXE
	c:\program files\lavasoft\ad-aware 2007\ad-aware2007.exe

	c:\windows\system32
tdll.dll

	c:\windows\system32\kernel32.dll

	c:\windows\system32\user32.dll

	c:\windows\system32\gdi32.dll

	c:\windows\system32\comctl32.dll

	c:\windows\system32\advapi32.dll

	c:\windows\system32pcrt4.dll

	c:\windows\system32\comdlg32.dll

	c:\windows\system32\shlwapi.dll

	c:\windows\system32\msvcrt.dll

	c:\windows\system32\shell32.dll

	c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll

	c:\windows\system32\oleaut32.dll

	c:\windows\system32\ole32.dll

	c:\windows\system32\ws2_32.dll

	c:\windows\system32\ws2help.dll

	c:\windows\system32\inetmib1.dll

	c:\windows\system32\iphlpapi.dll

	c:\windows\system32\snmpapi.dll

	c:\windows\system32\wsock32.dll

	c:\windows\system32\mprapi.dll

	c:\windows\system32\activeds.dll

	c:\windows\system32\adsldpc.dll

	c:\windows\system32
etapi32.dll

	c:\windows\system32\wldap32.dll

	c:\windows\system32\atl.dll

	c:\windows\system32tutils.dll

	c:\windows\system32\samlib.dll

	c:\windows\system32\setupapi.dll

	c:\windows\system32\version.dll

	c:\windows\system32\mpr.dll

	c:\windows\system32\imm32.dll

	c:\windows\system32\winmm.dll

	c:\windows\system32\oleacc.dll

	c:\windows\system32\msvcp60.dll

	c:\windows\system32\uxtheme.dll

	c:\windows\system32\apphelp.dll

	c:\windows\system32\clbcatq.dll

	c:\windows\system32\comres.dll

	c:\windows\system32\userenv.dll

	c:\windows\system32\olepro32.dll

	c:\windows\system32\secur32.dll

End of Scan Section
===========================

Cleaned Infections
===========================

End of Cleaned Infections
===========================

sandy086 · Answer

Et voici le rapport de ccleaner :

Windows Registry Editor Version 5.00


[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.kmz]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.kmz\OpenWithList]
"a"="googleearth.exe"
"MRUList"="a"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.kmz\OpenWithProgids]
"Google Earth.kmzfile"=hex(0):

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTX]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTX\OpenWithList]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rlg]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rlg\OpenWithList]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shd]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shd\OpenWithList]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tmp]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tmp\OpenWithList]

[HKEY_CLASSES_ROOT\AutoProto.AutoProto.1]
@="AutoProto Class"

[HKEY_CLASSES_ROOT\AutoProto.AutoProto.1\CLSID]
@="{D24C7F41-2F44-11D3-92EF-00C0F01F77C1}"

[HKEY_CLASSES_ROOT\AutoStream.AutoStream.1]
@="AutoStream Class"

[HKEY_CLASSES_ROOT\AutoStream.AutoStream.1\CLSID]
@="{405DE7C0-E7DD-11D2-92C5-00C0F01F77C1}"

[HKEY_CLASSES_ROOT\bwpfile\shell\open]

[HKEY_CLASSES_ROOT\bwpfile\shell\open\command]
@="C:\Program Files\F-Secure\BackWeb\7681197\6.3.2.116-7681197L\Program\PrvCnt.exe \"%1\""

[HKEY_CLASSES_ROOT\CDDBControl.CddbCredit]
@="CddbCredit Class"

[HKEY_CLASSES_ROOT\CDDBControl.CddbCredit\CLSID]
@="{BBF37BA4-2F4F-11D3-B02F-00C04F4C0826}"

[HKEY_CLASSES_ROOT\CDDBControl.CddbCredit\CurVer]
@="CDDBControl.CddbCredit.1"

[HKEY_CLASSES_ROOT\CDDBControl.CddbCredit.1]
@="CddbCredit Class"

[HKEY_CLASSES_ROOT\CDDBControl.CddbCredit.1\CLSID]
@="{BBF37BA4-2F4F-11D3-B02F-00C04F4C0826}"

[HKEY_CLASSES_ROOT\CDDBControl.CddbFullName.1]
@="CddbFullName Class"

[HKEY_CLASSES_ROOT\CDDBControl.CddbFullName.1\CLSID]
@="{BBF37BA2-2F4F-11D3-B02F-00C04F4C0826}"

[HKEY_CLASSES_ROOT\CDDBControl.CddbSegment]
@="CddbSegment Class"

[HKEY_CLASSES_ROOT\CDDBControl.CddbSegment\CLSID]
@="{BBF37B9E-2F4F-11D3-B02F-00C04F4C0826}"

[HKEY_CLASSES_ROOT\CDDBControl.CddbSegment\CurVer]
@="CDDBControl.CddbSegment.1"

[HKEY_CLASSES_ROOT\CDDBControl.CddbSegment.1]
@="CddbSegment Class"

[HKEY_CLASSES_ROOT\CDDBControl.CddbSegment.1\CLSID]
@="{BBF37B9E-2F4F-11D3-B02F-00C04F4C0826}"

[HKEY_CLASSES_ROOT\CDDBControl.CddbURL]
@="CddbURL Class"

[HKEY_CLASSES_ROOT\CDDBControl.CddbURL\CLSID]
@="{BBF37BA0-2F4F-11D3-B02F-00C04F4C0826}"

[HKEY_CLASSES_ROOT\CDDBControl.CddbURL\CurVer]
@="CDDBControl.CddbURL.1"

[HKEY_CLASSES_ROOT\CDDBControl.CddbURL.1]
@="CddbURL Class"

[HKEY_CLASSES_ROOT\CDDBControl.CddbURL.1\CLSID]
@="{BBF37BA0-2F4F-11D3-B02F-00C04F4C0826}"

[HKEY_CLASSES_ROOT\CDDBControl.CddbURLManager]
@="CddbURLManager Class"

[HKEY_CLASSES_ROOT\CDDBControl.CddbURLManager\CLSID]
@="{AF1A9404-6CA9-11D3-B053-00C04F4C0826}"

[HKEY_CLASSES_ROOT\CDDBControl.CddbURLManager\CurVer]
@="CDDBControl.CddbURLManager.1"

[HKEY_CLASSES_ROOT\CDDBControl.CddbURLManager.1]
@="CddbURLManager Class"

[HKEY_CLASSES_ROOT\CDDBControl.CddbURLManager.1\CLSID]
@="{AF1A9404-6CA9-11D3-B053-00C04F4C0826}"

[HKEY_CLASSES_ROOT\CDDBControl.FullName]
@="CddbFullName Class"

[HKEY_CLASSES_ROOT\CDDBControl.FullName\CLSID]
@="{BBF37BA2-2F4F-11D3-B02F-00C04F4C0826}"

[HKEY_CLASSES_ROOT\CDDBControl.FullName\CurVer]
@="CDDBControl.CddbFullName.1"

[HKEY_CLASSES_ROOT\CDDBRealControl.CDDBControl]
@="CDDBControl Class"

[HKEY_CLASSES_ROOT\CDDBRealControl.CDDBControl\CLSID]
@="{339bccb5-3ab4-4495-94ed-29102f59894c}"

[HKEY_CLASSES_ROOT\CDDBRealControl.CDDBControl\CurVer]
@="CDDBRealControl.CDDBControl.1"

[HKEY_CLASSES_ROOT\CDDBRealControl.CDDBControl.1]
@="CDDBControl Class"

[HKEY_CLASSES_ROOT\CDDBRealControl.CDDBControl.1\CLSID]
@="{339bccb5-3ab4-4495-94ed-29102f59894c}"

[HKEY_CLASSES_ROOT\CDDBRealControl.CDDBControl.1\Insertable]

[HKEY_CLASSES_ROOT\CDDBRealControl.CddbDisc]
@="CddbDisc Class"

[HKEY_CLASSES_ROOT\CDDBRealControl.CddbDisc\CLSID]
@="{0272c6e8-83e5-43d2-92f4-a374385bdac4}"

[HKEY_CLASSES_ROOT\CDDBRealControl.CddbDisc\CurVer]
@="CDDBRealControl.CddbDisc.1"

[HKEY_CLASSES_ROOT\CDDBRealControl.CddbDisc.1]
@="CddbDisc Class"

[HKEY_CLASSES_ROOT\CDDBRealControl.CddbDisc.1\CLSID]
@="{0272c6e8-83e5-43d2-92f4-a374385bdac4}"

[HKEY_CLASSES_ROOT\Connection Manager Profile]
@="Connection Manager Profile"

[HKEY_CLASSES_ROOT\Connection Manager Profile\shell]

[HKEY_CLASSES_ROOT\gds_deskband.Deskband]
@="Deskband Class"

[HKEY_CLASSES_ROOT\gds_deskband.Deskband\CLSID]
@="{38F4C281-2396-424B-8B62-F236B44ADB02}"

[HKEY_CLASSES_ROOT\gds_deskband.Deskband\CurVer]
@="gds_deskband.Deskband.1"

[HKEY_CLASSES_ROOT\gds_deskband.Deskband.1]
@="Deskband Class"

[HKEY_CLASSES_ROOT\gds_deskband.Deskband.1\CLSID]
@="{38F4C281-2396-424B-8B62-F236B44ADB02}"

[HKEY_CLASSES_ROOT\gds_deskband.DeskbandController]
@="DeskbandController Class"

[HKEY_CLASSES_ROOT\gds_deskband.DeskbandController\CLSID]
@="{CCE15A15-75F9-4F05-AFF0-194FB588D26B}"

[HKEY_CLASSES_ROOT\gds_deskband.DeskbandController\CurVer]
@="gds_deskband.DeskbandController.1"

[HKEY_CLASSES_ROOT\gds_deskband.DeskbandController.1]
@="DeskbandController Class"

[HKEY_CLASSES_ROOT\gds_deskband.DeskbandController.1\CLSID]
@="{CCE15A15-75F9-4F05-AFF0-194FB588D26B}"

[HKEY_CLASSES_ROOT\GoogleDesktopSearch.EventFactory]
@="GoogleDesktopEventFactory Class"

[HKEY_CLASSES_ROOT\GoogleDesktopSearch.EventFactory\CLSID]
@="{579822B3-44CD-4786-83E0-AE32BCB9E6B1}"

[HKEY_CLASSES_ROOT\GoogleDesktopSearch.EventFactory\CurVer]
@="GoogleDesktopSearch.EventFactory.1"

[HKEY_CLASSES_ROOT\GoogleDesktopSearch.EventFactory.1]
@="GoogleDesktopEventFactory Class"

[HKEY_CLASSES_ROOT\GoogleDesktopSearch.EventFactory.1\CLSID]
@="{579822B3-44CD-4786-83E0-AE32BCB9E6B1}"

[HKEY_CLASSES_ROOT\GoogleDesktopSearch.Register]
@="GoogleDesktopRegister Class"

[HKEY_CLASSES_ROOT\GoogleDesktopSearch.Register\CLSID]
@="{BB8B07A0-B8D1-44e0-A262-C9B7212AEC68}"

[HKEY_CLASSES_ROOT\GoogleDesktopSearch.Register\CurVer]
@="GoogleDesktopSearch.Register.1"

[HKEY_CLASSES_ROOT\GoogleDesktopSearch.Register.1]
@="GoogleDesktopRegister Class"

[HKEY_CLASSES_ROOT\GoogleDesktopSearch.Register.1\CLSID]
@="{BB8B07A0-B8D1-44e0-A262-C9B7212AEC68}"

[HKEY_CLASSES_ROOT\IERJCtl.IERJCtl.1]
@="IERJCtl Class"

[HKEY_CLASSES_ROOT\IERJCtl.IERJCtl.1\CLSID]
@="{00CEDC01-864D-11D3-908D-00C0F03B3EDC}"

[HKEY_CLASSES_ROOT\IERPCtl.IERPCtl]
@="IERPCtl Class"

[HKEY_CLASSES_ROOT\IERPCtl.IERPCtl\CLSID]
@="{FDC7A535-4070-4B92-A0EA-D9994BCC0DC5}"

[HKEY_CLASSES_ROOT\IERPCtl.IERPCtl\CurVer]
@="IERPCtl.IERPCtl.1"

[HKEY_CLASSES_ROOT\IERPCtl.IERPCtl.1]
@="IERPCtl Class"

[HKEY_CLASSES_ROOT\IERPCtl.IERPCtl.1\CLSID]
@="{FDC7A535-4070-4B92-A0EA-D9994BCC0DC5}"

[HKEY_CLASSES_ROOT\Keyhole.KHFeature]
@="KHFeature Class"

[HKEY_CLASSES_ROOT\Keyhole.KHFeature\CLSID]
@="{B153D707-447A-4538-913E-6146B3FDEE02}"

[HKEY_CLASSES_ROOT\Keyhole.KHFeature.1]
@="KHFeature Class"

[HKEY_CLASSES_ROOT\Keyhole.KHFeature.1\CLSID]
@="{B153D707-447A-4538-913E-6146B3FDEE02}"

[HKEY_CLASSES_ROOT\Keyhole.KHInterface]
@="KHInterface Class"

[HKEY_CLASSES_ROOT\Keyhole.KHInterface\CLSID]
@="{AFD07A5E-3E20-4D77-825C-2F6D1A50BE5B}"

[HKEY_CLASSES_ROOT\Keyhole.KHInterface\CurVer]
@="Keyhole.KHInterface.1"

[HKEY_CLASSES_ROOT\Keyhole.KHInterface.1]
@="KHInterface Class"

[HKEY_CLASSES_ROOT\Keyhole.KHInterface.1\CLSID]
@="{AFD07A5E-3E20-4D77-825C-2F6D1A50BE5B}"

[HKEY_CLASSES_ROOT\Keyhole.KHViewExtents]
@="KHViewExtents Class"

[HKEY_CLASSES_ROOT\Keyhole.KHViewExtents\CLSID]
@="{63E6BE14-A742-4EEA-8AF3-0EC39F10F850}"

[HKEY_CLASSES_ROOT\Keyhole.KHViewExtents.1]
@="KHViewExtents Class"

[HKEY_CLASSES_ROOT\Keyhole.KHViewExtents.1\CLSID]
@="{63E6BE14-A742-4EEA-8AF3-0EC39F10F850}"

[HKEY_CLASSES_ROOT\Keyhole.KHViewInfo]
@="KHViewInfo Class"

[HKEY_CLASSES_ROOT\Keyhole.KHViewInfo\CLSID]
@="{A2D4475B-C9AA-48E2-A029-1DB829DACF7B}"

[HKEY_CLASSES_ROOT\Keyhole.KHViewInfo\CurVer]
@="Keyhole.KHViewInfo.1"

[HKEY_CLASSES_ROOT\Keyhole.KHViewInfo.1]
@="KHViewInfo Class"

[HKEY_CLASSES_ROOT\Keyhole.KHViewInfo.1\CLSID]
@="{A2D4475B-C9AA-48E2-A029-1DB829DACF7B}"

[HKEY_CLASSES_ROOT\Microsoft.ActiveXPlugin]
@="ActiveXPlugin Object"

[HKEY_CLASSES_ROOT\Microsoft.ActiveXPlugin\CLSID]
@="{06DD38D3-D187-11CF-A80D-00C04FD74AD8}"

[HKEY_CLASSES_ROOT\Microsoft.ActiveXPlugin\CurVer]
@="Microsoft.ActiveXPlugin.1"

[HKEY_CLASSES_ROOT\Microsoft.ActiveXPlugin\NotInsertable]

[HKEY_CLASSES_ROOT\Microsoft.ActiveXPlugin.1]
@="ActiveXPlugin Object"

[HKEY_CLASSES_ROOT\Microsoft.ActiveXPlugin.1\CLSID]
@="{06DD38D3-D187-11CF-A80D-00C04FD74AD8}"

[HKEY_CLASSES_ROOT\Microsoft.ActiveXPlugin.1\NotInsertable]

[HKEY_CLASSES_ROOT\MSNMessenger.ContactsPicker]
@=""

[HKEY_CLASSES_ROOT\MSNMessenger.ContactsPicker\CLSID]
@="{111C85E9-BB62-4528-A806-F0BE908E02F0}"

[HKEY_CLASSES_ROOT\MSNMessenger.ContactsPicker\CurVer]
@="MSNMessenger.ContactsPicker.1"

[HKEY_CLASSES_ROOT\MSNMessenger.ContactsPicker.1]
@=""

[HKEY_CLASSES_ROOT\MSNMessenger.ContactsPicker.1\CLSID]
@="{111C85E9-BB62-4528-A806-F0BE908E02F0}"

[HKEY_CLASSES_ROOT\MSNMessenger.ContactsPicker.1\CurVer]
@="MSNMessenger.ContactsPicker"

[HKEY_CLASSES_ROOT\Office.Desktop.Google.com]
@="Google Desktop Search Office Addin"

[HKEY_CLASSES_ROOT\Office.Desktop.Google.com\CLSID]
@="{FC4482E9-08FC-493a-BA7D-7ED5A6DD0938}"

[HKEY_CLASSES_ROOT\OISbmpfile]

[HKEY_CLASSES_ROOT\OISbmpfile\shell]

[HKEY_CLASSES_ROOT\OISgiffile]

[HKEY_CLASSES_ROOT\OISgiffile\shell]

[HKEY_CLASSES_ROOT\OISjpegfile]

[HKEY_CLASSES_ROOT\OISjpegfile\shell]

[HKEY_CLASSES_ROOT\OISpngfile]

[HKEY_CLASSES_ROOT\OISpngfile\shell]

[HKEY_CLASSES_ROOT\ppifile]
@="Fichier de configuration du Passeport Microsoft"

[HKEY_CLASSES_ROOT\ppifile\shell]

[HKEY_CLASSES_ROOT\RealDownloadExpress.InfoWindow]
@="RealDownload Express InfoWindow Class"

[HKEY_CLASSES_ROOT\RealDownloadExpress.InfoWindow\CLSID]
@="{56336BCA-3D8A-11d6-A00B-0050DA18DE71}"

[HKEY_CLASSES_ROOT\RealDownloadExpress.InfoWindow\CurVer]
@="RealDownloadExpress.InfoWindow.1"

[HKEY_CLASSES_ROOT\RealDownloadExpress.InfoWindow.1]
@="RealDownload Express InfoWindow Class"

[HKEY_CLASSES_ROOT\RealDownloadExpress.InfoWindow.1\CLSID]
@="{56336BCA-3D8A-11d6-A00B-0050DA18DE71}"

[HKEY_CLASSES_ROOT\Rpplugprot.RPHttpPlugProt]
@="RPHttpPlugProt Class"

[HKEY_CLASSES_ROOT\Rpplugprot.RPHttpPlugProt\CLSID]
@="{4D50EBC1-F054-4110-8D92-700E630361A6}"

[HKEY_CLASSES_ROOT\Rpplugprot.RPHttpPlugProt\CurVer]
@="Rpplugprot.RPHttpPlugProt.1"

[HKEY_CLASSES_ROOT\Rpplugprot.RPHttpPlugProt.1]
@="RPHttpPlugProt Class"

[HKEY_CLASSES_ROOT\Rpplugprot.RPHttpPlugProt.1\CLSID]
@="{4D50EBC1-F054-4110-8D92-700E630361A6}"

[HKEY_CLASSES_ROOT\Rpplugprot.RPMimeFilter]
@="RPMimeFilter Class"

[HKEY_CLASSES_ROOT\Rpplugprot.RPMimeFilter\CLSID]
@="{C5838ED9-78F2-4c47-8B6B-2ACF9FA16F44}"

[HKEY_CLASSES_ROOT\Rpplugprot.RPMimeFilter\CurVer]
@="Rpplugprot.RPMimeFilter.1"

[HKEY_CLASSES_ROOT\Rpplugprot.RPMimeFilter.1]
@="RPMimeFilter Class"

[HKEY_CLASSES_ROOT\Rpplugprot.RPMimeFilter.1\CLSID]
@="{C5838ED9-78F2-4c47-8B6B-2ACF9FA16F44}"

[HKEY_CLASSES_ROOT\RTCIMSP.RTCIMService]
@="RTCIMService Class"

[HKEY_CLASSES_ROOT\RTCIMSP.RTCIMService\CLSID]
@="{83D4679F-B6D7-11D2-BF36-00C04FB90A03}"

[HKEY_CLASSES_ROOT\RTCIMSP.RTCIMService\CurVer]
@="RTCIMSP.RTCIMService.1"

[HKEY_CLASSES_ROOT\RTCIMSP.RTCIMService.1]
@="RTCIMService Class"

[HKEY_CLASSES_ROOT\RTCIMSP.RTCIMService.1\CLSID]
@="{83D4679F-B6D7-11D2-BF36-00C04FB90A03}"

[HKEY_CLASSES_ROOT\WinRAR.REV]
@="Volume de restauration RAR"

[HKEY_CLASSES_ROOT\WinRAR.REV\shell]

[HKEY_CLASSES_ROOT\Applications\CmdTsf.exe]

[HKEY_CLASSES_ROOT\Applications\CmdTsf.exe\shell]

[HKEY_CLASSES_ROOT\Applications\googleearth.exe]

[HKEY_CLASSES_ROOT\Applications\googleearth.exe\shell]

[HKEY_CLASSES_ROOT\Applications\MSOXMLED.EXE]

[HKEY_CLASSES_ROOT\Applications\MSOXMLED.EXE\shell]
@="Open"

[HKEY_CLASSES_ROOT\Applications\mspub.exe]

[HKEY_CLASSES_ROOT\Applications\mspub.exe\shell]

[HKEY_CLASSES_ROOT\Applications\RealPlay.exe]
@=""

[HKEY_CLASSES_ROOT\Applications\RealPlay.exe\DefaultIcon]
@="C:\Program Files\Real\RealPlayer\realplay.exe,0"

[HKEY_CLASSES_ROOT\Applications\RealPlay.exe\shell]

[HKEY_CLASSES_ROOT\Applications\RealPlay.exe\SupportedTypes]
@=""
".mp3"=""
".m3u"=""
".cda"=""
".wav"=""
".mpg"=""
".mpeg"=""
".mpv"=""
".mps"=""
".m2v"=""
".m1v"=""
".mpe"=""
".mpa"=""
".avi"=""
".mp4"=""
".m4e"=""
".rt"=""
".rnx"=""
".rmp"=""
".rms"=""
".rjs"=""
".ra"=""
".rax"=""
".rm"=""
".rmvb"=""
".rp"=""
".ram"=""
".rmm"=""
".rsml"=""
".rv"=""
".rvx"=""
".rmj"=""
".rjt"=""
".rmx"=""
".wma"=""
".wmv"=""
".wax"=""
".asx"=""
".asf"=""
".wm"=""
".wmx"=""
".wvx"=""
".mov"=""
".qt"=""
".aac"=""
".m4a"=""
".m4p"=""
".mp2"=""
".mp1"=""
".mpga"=""
".pls"=""
".xpl"=""
".smi"=""
".smil"=""
".ssm"=""
".sdp"=""
".au"=""
".aif"=""
".aiff"=""
".mid"=""
".midi"=""
".rmi"=""
".acp"=""
".lmsff"=""
".lqt"=""
".lavs"=""
".lar"=""
".la1"=""
".3gp"=""
".amr"=""
".awb"=""
".3g2"=""
".divx"=""
".rpm"=""

[HKEY_CLASSES_ROOT\Applications\WinRAR.exe]

[HKEY_CLASSES_ROOT\Applications\WinRAR.exe\shell]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\BitComet]
"SlowInfoCache"=hex:28,02,00,00,00,00,00,00,ff,ff,ff,ff,ff,ff,ff,ff,00,00,00,\
  00,00,00,00,00,ff,ff,ff,ff,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00
"Changed"=dword:00000000

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Google Desktop]
"SlowInfoCache"=hex:28,02,00,00,00,00,00,00,00,d0,01,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,ff,ff,ff,ff,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00
"Changed"=dword:00000000

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\UDC6V_is1]
"SlowInfoCache"=hex:28,02,00,00,00,00,00,00,ff,ff,ff,ff,ff,ff,ff,ff,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00
"Changed"=dword:00000000

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\USDR6V_is1]
"SlowInfoCache"=hex:28,02,00,00,00,00,00,00,ff,ff,ff,ff,ff,ff,ff,ff,00,00,00,\
  00,00,00,00,00,ff,ff,ff,ff,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00
"Changed"=dword:00000000

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\WinRAR archiver]
"SlowInfoCache"=hex:28,02,00,00,01,00,00,00,00,10,3a,00,00,00,00,00,cc,d2,a6,\
  43,9e,5a,c7,01,08,00,00,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,\
  61,00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,57,00,69,00,6e,00,52,\
  00,41,00,52,00,5c,00,55,00,6e,00,52,00,41,00,52,00,2e,00,65,00,78,00,65,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00
"Changed"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\DOCUME~1\Sandrine\LOCALS~1\Temp\Stp27_TMP.EXE"="Stp27_TMP"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\DOCUME~1\Sandrine\LOCALS~1\Temp\is-BCIB4.tmp\is-V00L8.tmp"="Setup/Uninstall"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\DOCUME~1\Sandrine\LOCALS~1\Temp\is-KEF8M.tmp\is-CQQKB.tmp"="Setup/Uninstall"

jlpjlp · Answer

lance cleanup et nettoie ton ordi

https://www.commentcamarche.net/telecharger/securite/5989-cleanup/

________

refait un scan en ligne pour verifier

sandy086 · Answer

Voici le rapport de Bitdefender : Apparemment, je n'ai plus de virus !!

BitDefender Online Scanner
  
  
 
Rapport d'analyse généré à: Fri, Sep 14, 2007 - 00:47:17
 
 
  
  
 
Voie d'analyse: C:\;D:\;E:\;F:\;H:\;I:\;J:\;
  
  
 
 
  
  
 
Statistiques
 
Temps
 02:05:55
 
Fichiers
 282251
 
Directoires
 8793
 
Secteurs de boot
 2
 
Archives
 1334
 
Paquets programmes
 11746
 
  
  
 
Résultats
 
Virus identifiés
 0
 
Fichiers infectés
 0
 
Fichiers suspects
 0
 
Avertissements
 0
 
Désinfectés
 0
 
Fichiers effacés
 0
 
  
  
 
Info sur les moteurs
 
Définition virus
 803673
 
Version des moteurs
 AVCORE v1.0 (build 2411) (i386) (Jul 9 2007 12:10:22)
 
Analyse des plugins
 14
 
Archive des plugins
 38
 
Unpack des plugins
 7
 
E-mail plugins
 6
 
Système plugins
 1
 
  
  
 
Paramètres d'analyse
 
Première action
 Désinfecté
 
Seconde Action
 Supprimé
 
Heuristique
 Oui
 
Acceptez les avertissements
 Oui
 
Extensions analysées
 *;
 
Excludez les extensions
  
 
Analyse d'emails
 Oui
 
Analyse des Archives
 Oui
 
Analyser paquets programmes
 Oui
 
Analyse des fichiers
 Oui
 
Analyse de boot
 Oui
 
  
  
 
  Fichier analysé
  Statut
 
Aucun virus trouvé.

jlpjlp · Answer

ok c'est bon





tu peux garder spybot, ad aware et ccleaner en plus de ton antivirus bitdefender

le reste que je t'ai fais installer tu peux virer

bonne continuation!

sandy086 · Answer

Je tiens à te remercier pour ton aide précieuse. Merci beaucoup !!!

jlpjlp · Answer

de rien 

rq: mets juste pour finir java a jour

https://www.java.com/fr/


puis va dans demarrer puis panneau de confuguration puis ajout/suppression de programme et desinstallee l'ancienne version


tchao

[Virus] Infecté par Trojan

29 réponses

Discussions similaires

Newsletters