infection ! GEN HACKMAN help me ;) Résolu

Question

Bonjour,

voila plusieurs jours que mon antivir detecte ceci :  TR/Crypt.XPACK.Gen 

j'ai fais differents scans  comme "trend micro" "panda" "bitdefender" et biensur antivir mais rien n'est détecté ....



d'avance merci

jacques.gache · Answer

bonjour, ton sauveur va sûrement passer !!! lol !! @+

Light-Yagami · Answer

mais ton aide aide est egalement la bienvenue ! ;) 

merci de ton interet ;)

jacques.gache · Answer

bonjour, ok si tu avais le rapport de ton anti-virus " quel anti-virus " pour savoir exactement ou il le trouve , je voudrais savoir le chemin complet

Light-Yagami · Answer

bonjour , merci ;) 

alors tout le probleme est là , c que dans le rapport antivir il n'y a rien , c une alerte qui reviens tout le temps la voila : 

Nom: TR/Crypt.XPACK.Gen 
La date de la découverte: 25/01/2007 
Type: Cheval de Troie 
En circulation: Oui 
Infections signalées  Faible 
Potentiel de distribution: Faible 
Potentiel de destruction: Faible 
Fichier statique: Non 
Version du moteur de scan: 7.03.00.32  


et le rapport antivir : 




Avira AntiVir Personal
Date de création du fichier de rapport : dimanche 22 novembre 2009  04:00

La recherche porte sur 1382322 souches de virus.

Détenteur de la licence : Avira AntiVir Personal - FREE Antivirus
Numéro de série         : 0000149996-ADJIE-0000001
Plateforme              : Windows XP
Version de Windows      : (Service Pack 3)  [5.1.2600]
Mode Boot               : Démarré normalement
Identifiant             : SYSTEM
Nom de l'ordinateur     : YAGAMI

Informations de version :
BUILD.DAT               : 9.0.0.72      21606 Bytes  08/11/2009 10:58:00
AVSCAN.EXE              : 9.0.3.10     466689 Bytes  20/11/2009 00:14:39
AVSCAN.DLL              : 9.0.3.0       49409 Bytes  03/03/2009 09:21:02
LUKE.DLL                : 9.0.3.2      209665 Bytes  20/02/2009 10:35:11
LUKERES.DLL             : 9.0.2.0       13569 Bytes  03/03/2009 09:21:31
VBASE000.VDF            : 7.10.0.0   19875328 Bytes  06/11/2009 00:14:39
VBASE001.VDF            : 7.10.1.0    1372672 Bytes  19/11/2009 00:14:39
VBASE002.VDF            : 7.10.1.1       2048 Bytes  19/11/2009 00:14:39
VBASE003.VDF            : 7.10.1.2       2048 Bytes  19/11/2009 00:14:39
VBASE004.VDF            : 7.10.1.3       2048 Bytes  19/11/2009 00:14:39
VBASE005.VDF            : 7.10.1.4       2048 Bytes  19/11/2009 00:14:39
VBASE006.VDF            : 7.10.1.5       2048 Bytes  19/11/2009 00:14:39
VBASE007.VDF            : 7.10.1.6       2048 Bytes  19/11/2009 00:14:39
VBASE008.VDF            : 7.10.1.7       2048 Bytes  19/11/2009 00:14:39
VBASE009.VDF            : 7.10.1.8       2048 Bytes  19/11/2009 00:14:39
VBASE010.VDF            : 7.10.1.9       2048 Bytes  19/11/2009 00:14:39
VBASE011.VDF            : 7.10.1.10      2048 Bytes  19/11/2009 00:14:39
VBASE012.VDF            : 7.10.1.11      2048 Bytes  19/11/2009 00:14:39
VBASE013.VDF            : 7.10.1.12      2048 Bytes  19/11/2009 00:14:39
VBASE014.VDF            : 7.10.1.13      2048 Bytes  19/11/2009 00:14:39
VBASE015.VDF            : 7.10.1.14      2048 Bytes  19/11/2009 00:14:39
VBASE016.VDF            : 7.10.1.15      2048 Bytes  19/11/2009 00:14:39
VBASE017.VDF            : 7.10.1.16      2048 Bytes  19/11/2009 00:14:39
VBASE018.VDF            : 7.10.1.17      2048 Bytes  19/11/2009 00:14:39
VBASE019.VDF            : 7.10.1.18      2048 Bytes  19/11/2009 00:14:39
VBASE020.VDF            : 7.10.1.19      2048 Bytes  19/11/2009 00:14:39
VBASE021.VDF            : 7.10.1.20      2048 Bytes  19/11/2009 00:14:39
VBASE022.VDF            : 7.10.1.21      2048 Bytes  19/11/2009 00:14:39
VBASE023.VDF            : 7.10.1.22      2048 Bytes  19/11/2009 00:14:39
VBASE024.VDF            : 7.10.1.23      2048 Bytes  19/11/2009 00:14:39
VBASE025.VDF            : 7.10.1.24      2048 Bytes  19/11/2009 00:14:39
VBASE026.VDF            : 7.10.1.25      2048 Bytes  19/11/2009 00:14:39
VBASE027.VDF            : 7.10.1.26      2048 Bytes  19/11/2009 00:14:39
VBASE028.VDF            : 7.10.1.27      2048 Bytes  19/11/2009 00:14:39
VBASE029.VDF            : 7.10.1.28      2048 Bytes  19/11/2009 00:14:39
VBASE030.VDF            : 7.10.1.29      2048 Bytes  19/11/2009 00:14:39
VBASE031.VDF            : 7.10.1.43     70144 Bytes  20/11/2009 18:44:31
Version du moteur       : 8.2.1.72 
AEVDF.DLL               : 8.1.1.2      106867 Bytes  20/02/2009 15:07:20
AESCRIPT.DLL            : 8.1.2.45     586108 Bytes  18/11/2009 00:16:32
AESCN.DLL               : 8.1.2.5      127346 Bytes  20/02/2009 15:07:20
AESBX.DLL               : 8.1.1.1      246132 Bytes  20/11/2009 00:14:39
AERDL.DLL               : 8.1.3.2      479604 Bytes  02/10/2009 23:26:46
AEPACK.DLL              : 8.2.0.3      422261 Bytes  06/11/2009 00:12:03
AEOFFICE.DLL            : 8.1.0.38     196987 Bytes  30/06/2009 19:48:54
AEHEUR.DLL              : 8.1.0.180   2093432 Bytes  07/11/2009 00:11:57
AEHELP.DLL              : 8.1.7.4      237943 Bytes  18/11/2009 00:16:32
AEGEN.DLL               : 8.1.1.75     364918 Bytes  20/11/2009 00:14:39
AEEMU.DLL               : 8.1.1.0      393587 Bytes  02/10/2009 23:23:05
AECORE.DLL              : 8.1.8.2      184694 Bytes  06/11/2009 00:11:48
AEBB.DLL                : 8.1.0.3       53618 Bytes  09/10/2008 13:32:40
AVWINLL.DLL             : 9.0.0.3       18177 Bytes  12/12/2008 07:47:30
AVPREF.DLL              : 9.0.3.0       44289 Bytes  29/09/2009 16:39:07
AVREP.DLL               : 8.0.0.3      155905 Bytes  20/01/2009 13:34:28
AVREG.DLL               : 9.0.0.0       36609 Bytes  07/11/2008 14:24:42
AVARKT.DLL              : 9.0.0.3      292609 Bytes  24/03/2009 14:05:22
AVEVTLOG.DLL            : 9.0.0.7      167169 Bytes  30/01/2009 09:36:37
SQLITE3.DLL             : 3.6.1.0      326401 Bytes  28/01/2009 14:03:49
SMTPLIB.DLL             : 9.2.0.25      28417 Bytes  02/02/2009 07:20:57
NETNT.DLL               : 9.0.0.0       11521 Bytes  07/11/2008 14:40:59
RCIMAGE.DLL             : 9.0.0.25    2438913 Bytes  13/07/2009 21:48:17
RCTEXT.DLL              : 9.0.73.0      88321 Bytes  20/11/2009 00:14:38

Configuration pour la recherche actuelle :
Nom de la tâche...............................: Disques durs locaux
Fichier de configuration......................: c:\program files\avira\antivir desktop\alldiscs.avp
Documentation.................................: bas
Action principale.............................: interactif
Action secondaire.............................: ignorer
Recherche sur les secteurs d'amorçage maître..: marche
Recherche sur les secteurs d'amorçage.........: marche
Secteurs d'amorçage...........................: C:, 
Recherche dans les programmes actifs..........: marche
Recherche en cours sur l'enregistrement.......: marche
Recherche de Rootkits.........................: marche
Contrôle d'intégrité de fichiers système......: arrêt
Recherche optimisée...........................: marche
Fichier mode de recherche.....................: Tous les fichiers
Recherche sur les archives....................: marche
Limiter la profondeur de récursivité..........: 20
Archive Smart Extensions......................: marche
Types d'archives divergents...................: +BSD Mailbox, +Netscape/Mozilla Mailbox, +Eudora Mailbox, +Squid cache, +Pegasus Mailbox, +MS Outlook Mailbox, 
Heuristique de macrovirus.....................: marche
Heuristique fichier...........................: élevé

Début de la recherche : dimanche 22 novembre 2009  04:00

La recherche d'objets cachés commence.
'43211' objets ont été contrôlés, '0' objets cachés ont été trouvés.

La recherche sur les processus démarrés commence :
Processus de recherche 'avscan.exe' - '1' module(s) sont contrôlés
Processus de recherche 'CToolbar.exe' - '1' module(s) sont contrôlés
Processus de recherche 'firefox.exe' - '1' module(s) sont contrôlés
Processus de recherche 'mbamgui.exe' - '1' module(s) sont contrôlés
Processus de recherche 'mbam.exe' - '1' module(s) sont contrôlés
Processus de recherche 'alg.exe' - '1' module(s) sont contrôlés
Processus de recherche 'TuneUpUtilitiesApp32.exe' - '1' module(s) sont contrôlés
Processus de recherche 'wmiapsrv.exe' - '1' module(s) sont contrôlés
Processus de recherche 'nSvcIp.exe' - '1' module(s) sont contrôlés
Processus de recherche 'vssvc.exe' - '1' module(s) sont contrôlés
Processus de recherche 'TuneUpUtilitiesService32.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'snmp.exe' - '1' module(s) sont contrôlés
Processus de recherche 'PnkBstrA.exe' - '1' module(s) sont contrôlés
Processus de recherche 'mbamservice.exe' - '1' module(s) sont contrôlés
Processus de recherche 'jqs.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'hamachi-2.exe' - '1' module(s) sont contrôlés
Processus de recherche 'GSInGameService.exe' - '1' module(s) sont contrôlés
Processus de recherche 'nSvcAppFlt.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'ASO3DefragSrv.exe' - '1' module(s) sont contrôlés
Processus de recherche 'a2service.exe' - '1' module(s) sont contrôlés
Processus de recherche 'TeaTimer.exe' - '1' module(s) sont contrôlés
Processus de recherche 'ctfmon.exe' - '1' module(s) sont contrôlés
Processus de recherche 'FireWall.exe' - '1' module(s) sont contrôlés
Processus de recherche 'avgnt.exe' - '1' module(s) sont contrôlés
Processus de recherche 'explorer.exe' - '1' module(s) sont contrôlés
Processus de recherche 'avguard.exe' - '1' module(s) sont contrôlés
Processus de recherche 'sched.exe' - '1' module(s) sont contrôlés
Processus de recherche 'ati2evxx.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'ati2evxx.exe' - '1' module(s) sont contrôlés
Processus de recherche 'lsass.exe' - '1' module(s) sont contrôlés
Processus de recherche 'services.exe' - '1' module(s) sont contrôlés
Processus de recherche 'winlogon.exe' - '1' module(s) sont contrôlés
Processus de recherche 'csrss.exe' - '1' module(s) sont contrôlés
Processus de recherche 'smss.exe' - '1' module(s) sont contrôlés
'41' processus ont été contrôlés avec '41' modules

La recherche sur les secteurs d'amorçage maître commence :
Secteur d'amorçage maître HD0
    [INFO]      Aucun virus trouvé !

La recherche sur les secteurs d'amorçage commence :
Secteur d'amorçage 'C:\'
    [INFO]      Aucun virus trouvé !

La recherche sur les renvois aux fichiers exécutables (registre) commence :
Le registre a été contrôlé ( '51' fichiers).


La recherche sur les fichiers sélectionnés commence :

Recherche débutant dans 'C:\'
C:\pagefile.sys
    [AVERTISSEMENT] Impossible d'ouvrir le fichier !
    [REMARQUE]  Ce fichier est un fichier système Windows.
    [REMARQUE]  Il est correct que ce fichier ne puisse pas être ouvert pour la recherche.
C:\WINDOWS\system32\drivers\sptd.sys
    [AVERTISSEMENT] Impossible d'ouvrir le fichier !


Fin de la recherche : dimanche 22 novembre 2009  04:39
Temps nécessaire: 39:45 Minute(s)

La recherche a été effectuée intégralement

   8057 Les répertoires ont été contrôlés
 260521 Des fichiers ont été contrôlés
      0 Des virus ou programmes indésirables ont été trouvés
      0 Des fichiers ont été classés comme suspects
      0 Des fichiers ont été supprimés
      0 Des virus ou programmes indésirables ont été réparés
      0 Les fichiers ont été déplacés dans la quarantaine
      0 Les fichiers ont été renommés
      2 Impossible de contrôler des fichiers
 260519 Fichiers non infectés
   2017 Les archives ont été contrôlées
      2 Avertissements
      1 Consignes
  43211 Des objets ont été contrôlés lors du Rootkitscan
      0 Des objets cachés ont été trouvés

Light-Yagami · Answer

C: documents and setting / proprietaire/local setting/ ~26 temp

selon antir...

jacques.gache · Answer

comme tu dis rien de visible sur ton rapprt de antivir, mais quand il te met l'alerte tu dois avoir un chemin avec l'endroit ou il le trouve!! 
bon pas très grave tu vas dans un premier temps poster un RSIT pour voir si on y trouve l'infection

• Télécharge Random's System Information Tool (RSIT) de Random/Random, et enregistre le sur ton Bureau.
• Double clique sur RSIT.exe pour lancer l'outil.
* laisses le chois 1 month 
• Clique sur "Continue" à l'écran Disclaimer.
• Si l'outil HijackThis n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu s'il te le demande) et tu devras accepter la licence.
• Une fois le scan terminé, deux rapports vont apparaître : poste les dans deux messages séparés stp

ps:Les rapports se trouvent à cet endroit:

C:\rsit\info.txt

C:\rsit\log.txt


Tutoriel pour t'aider




si le rapport ne passe pas sur le forum à cause de sa longeur envoie-le sur : http://www.cijoint.fr/index.php , 

fais parcourir recherche le rapport 

puis sélectionne le rapport en double cliquand dessus

et puis sur " cliquer ici pour déposer le fichier "

un lien bleu de cette forme va apparaitre :

Veuillez noter le lien ci-dessous qui vous permettra d'accéder à ce fichier. 
C'est ce même lien que vous devrez transmettre à vos correspondants
http://www.cijoint.fr/cjlink.php?file=cjge368/cijSKAP5fU.txt 

renvoie le lien tout frais dans ta prochaine reponse .

jacques.gache · Answer

Light-Yagami bonjour, ok mais tu vois cela ou sur le rapport de antivir C: documents and setting / proprietaire/local setting/ ~26 temp 

selon antir...

Light-Yagami · Answer

Logfile of random's system information tool 1.06 (written by random/random)
Run by Yagami at 2009-11-22 16:37:32
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 146 GB (48%) free of 305 GB
Total RAM: 3071 MB (81% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:37:36, on 22/11/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Ashampoo\Ashampoo FireWall\FireWall.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Advanced System Optimizer 3\ASO3DefragSrv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32
SvcAppFlt.exe
C:\Program Files\GameTracker\GSInGameService.exe
C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe
C:\WINDOWS\System32\vssvc.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32
SvcIp.exe
C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Documents and Settings\Yagami\Bureau\RSIT.exe
C:\Program Files	rend micro\Yagami.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = socks=
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = plimus.com,www.plimus.com,regnow.com,www.regnow.com,
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: WOT Helper - {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} - C:\Program Files\WOT\WOT.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: DAPIELoader Class - {FF6C3CF0-4B15-11D1-ABED-709549C10000} - C:\PROGRA~1\DAP\DAPIEL~1.DLL
O3 - Toolbar: WOT - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [Ashampoo FireWall] "C:\Program Files\Ashampoo\Ashampoo FireWall\FireWall.exe" -TRAY
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [SystemProtector] "C:\Program Files\Advanced System Optimizer 3\SystemProtector.exe" /autorun
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DownloadAccelerator] "C:\Program Files\DAP\DAP.EXE" /STARTUP
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files
vidia corporation
etworkaccessmanager\bin32
vlsp.dll
O10 - Unknown file in Winsock LSP: c:\program files
vidia corporation
etworkaccessmanager\bin32
vlsp.dll
O10 - Unknown file in Winsock LSP: c:\program files
vidia corporation
etworkaccessmanager\bin32
vlsp.dll
O10 - Unknown file in Winsock LSP: c:\program files
vidia corporation
etworkaccessmanager\bin32
vlsp.dll
O10 - Unknown file in Winsock LSP: c:\program files
vidia corporation
etworkaccessmanager\bin32
vlsp.dll
O10 - Unknown file in Winsock LSP: c:\program files
vidia corporation
etworkaccessmanager\bin32
vlsp.dll
O10 - Unknown file in Winsock LSP: c:\program files
vidia corporation
etworkaccessmanager\bin32
vlsp.dll
O10 - Unknown file in Winsock LSP: c:\program files
vidia corporation
etworkaccessmanager\bin32
vlsp.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} - http://www.inoculer.com/antivirus/Msie/bitdefender.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files\WOT\WOT.dll
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Application Driver Auto Removal Service (01) (appdrvrem01) - Protection Technology - C:\WINDOWS\System32\appdrvrem01.exe
O23 - Service: ASO3DiskOptimizer - Systweak Inc. - C:\Program Files\Advanced System Optimizer 3\ASO3DefragSrv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32
SvcAppFlt.exe
O23 - Service: GS In-Game Service - ClanServers Hosting LLC - C:\Program Files\GameTracker\GSInGameService.exe
O23 - Service: Google Update Service (gupdate1ca4dd47efc34c6) (gupdate1ca4dd47efc34c6) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32
SvcIp.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe
O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe

Light-Yagami · Answer

info.txt logfile of random's system information tool 1.06 2009-11-22 15:53:34

======Uninstall list======

-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
-->MsiExec /X{5DB65884-C963-4454-AABA-4CA3089281FA}
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
3DMark06-->"C:\Program Files\InstallShield Installation Information\{7F3AD00A-1819-4B15-BB7D-08B3586336D7}\setup.exe" -runfromtemp -l0x0009 -removeonly
7-Zip 4.65-->"C:\Program Files\7-Zip\Uninstall.exe"
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 9.2 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A92000000001}
Ad-Remover By C_XX-->"C:\Program Files\Ad-Remover\Uninstall ADR.exe"
Advanced System Optimizer-->"C:\Program Files\Advanced System Optimizer 3\unins000.exe"
ALZip-->"C:\Program Files\ESTsoft\ALZip\unins000.exe"
Ashampoo FireWall 1.20-->"C:\Program Files\Ashampoo\Ashampoo FireWall\unins000.exe"
ATI - Utilitaire de désinstallation du logiciel-->C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe
ATI Catalyst Control Center-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{055EE59D-217B-43A7-ABFF-507B966405D8}\setup.exe" -l0x0 
ATI Catalyst Registration-->MsiExec.exe /X{72736F5F-520D-472A-88CC-7B02872FD34E}
ATI Display Driver-->rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
Audacity 1.2.6-->"C:\Program Files\Audacity\unins000.exe"
Avira AntiVir Personal - Free Antivirus-->C:\Program Files\Avira\AntiVir Desktop\setup.exe /REMOVE
AVS Mobile Uploader version 1.9-->"C:\Program Files\Fichiers communs\AVSMedia\MobileUploader\unins000.exe"
AVS Update Manager 1.0 (Update Version)-->"C:\Program Files\AVS4YOU\AVSUpdateManger\unins000.exe"
AVS Video Editor 4-->"C:\Program Files\AVS4YOU\AVSVideoEditor4\unins000.exe"
AVS4YOU Software Navigator 1.3-->"C:\Program Files\AVS4YOU\AVSSoftwareNavigator\unins000.exe"
Call of Duty(R) - World at War(TM) 1.1 Patch-->C:\Program Files\InstallShield Installation Information\{AFAE2B15-89A0-4215-A030-F7B5B478886B}\setup.exe -runfromtemp -l0x0409
Call of Duty(R) - World at War(TM) 1.2 Patch-->C:\Program Files\InstallShield Installation Information\{2BF0AE92-C3BC-4112-9066-1546342B1FAE}\setup.exe -runfromtemp -l0x0409
Call of Duty(R) - World at War(TM) 1.3 Patch-->C:\Program Files\InstallShield Installation Information\{149464D9-B06F-4505-9968-FD1206F67AD3}\setup.exe -runfromtemp -l0x0409
Call of Duty(R) - World at War(TM) 1.4 Patch-->C:\Program Files\InstallShield Installation Information\{9F01A67B-7D67-482F-9D4F-D5980A440FD4}\setup.exe -runfromtemp -l0x0409
Call of Duty(R) - World at War(TM) 1.5 Patch-->C:\Program Files\InstallShield Installation Information\{C3DC2DF5-EFAC-4055-9010-31F7C545DD9E}\setup.exe -runfromtemp -l0x0409
Call of Duty(R) - World at War(TM) 1.6 Patch-->C:\Program Files\InstallShield Installation Information\{064DC64E-7A2F-4FDF-B598-E3C0747BBB9C}\setup.exe -runfromtemp -l0x0409
Call of Duty(R) - World at War(TM)-->C:\Program Files\InstallShield Installation Information\{D80A6A73-E58A-4673-AFF5-F12D7110661F}\setup.exe -runfromtemp -l0x0409
Call of Duty(R) 4 - Modern Warfare(TM) 1.7 Patch-->C:\Program Files\InstallShield Installation Information\{931C37FC-594D-43A9-B10F-A2F2B1F03498}\setup.exe -runfromtemp -l0x0409
Call of Duty(R) 4 - Modern Warfare(TM)-->C:\Program Files\InstallShield Installation Information\{E48469CC-635E-4FD5-A122-1497C286D217}\setup.exe -runfromtemp -l0x040c
Call of Duty: Modern Warfare 2 - Multiplayer-->"C:\Program Files\Steam\steam.exe" steam://uninstall/10190
Call of Duty: Modern Warfare 2-->"C:\Program Files\Steam\steam.exe" steam://uninstall/10180
Catalyst Control Center - Branding-->MsiExec.exe /I{1FF713E1-FE5E-4AD0-9C8C-B2E877846B45}
CCleaner-->"C:\Program Files\CCleaner\uninst.exe"
CODE OF HONOR 3 (1.0)-->"C:\Program Files\City Interactive\CODE OF HONOR 3\unins000.exe"
DivX Codec-->C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
DivX Converter-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
DivX Player-->C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
DivX Plus DirectShow Filters-->C:\Program Files\DivX\DivXDSFiltersUninstall.exe /DSFILTERS
DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
Download Accelerator Plus (DAP)-->C:\PROGRA~1\DAP\DAPREMOVE.EXE
eMule-->"C:\Program Files\eMule\Uninstall.exe"
ESET Online Scanner v3-->C:\Program Files\ESET\ESET Online Scanner\OnlineScannerUninstaller.exe
Far Cry 2-->"C:\Program Files\InstallShield Installation Information\{F2835483-37F2-4123-B4FE-0E77D58447F2}\setup.exe" -runfromtemp -l0x040c -removeonly
Fraps (remove only)-->"C:\Fraps\uninstall.exe"
Free Easy Burner V 3.9-->"C:\Program Files\Free Easy Burner\unins000.exe"
Futuremark SystemInfo-->"C:\Program Files\InstallShield Installation Information\{BEE64C14-BEF1-4610-8A68-A16EAA47B882}\setup.exe" -runfromtemp -l0x0009 -removeonly
GameTracker Lite-->C:\Program Files\GameTracker\gametracker-uninst.exe
Gears of War-->C:\Program Files\InstallShield Installation Information\{1170D24F-42B7-40CF-AA1B-6395CE562354}\setup.exe -runfromtemp -l0x040c
Glary Utilities 2.17.0.776-->"C:\Program Files\Glary Utilities\unins000.exe"
Google Chrome-->"C:\Program Files\Google\Chrome\Application\3.0.195.33\Installer\setup.exe" --uninstall --system-level
Google Update Helper-->MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
HijackThis 2.0.2-->"C:\Program Files	rend micro\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall  /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
Java(TM) 6 Update 17-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216016FF}
Junk Mail filter update-->MsiExec.exe /I{E2DFE069-083E-4631-9B6C-43C48E991DE5}
K-Lite Codec Pack 5.1.6 (Full) BETA-->"C:\Program Files\K-Lite Codec Pack\unins000.exe"
Lecteur Windows Media 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
Logiciel QuickCam de Logitech-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C43048A9-742C-4DAD-90D2-E3B53C9DB825}\setup.exe" -l0x40c 
Logitech Desktop Messenger-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{900B1197-53F5-4F46-A882-2CFFFE2EEDCB}\Setup.exe" -l0x40c UNINSTALL
Logitech IM Video Companion-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{984F10FD-11FD-4BED-8163-92DB81E6A825}\Setup.exe" -l0x40c UNINSTALL
Logitech ImageStudio-->MsiExec.exe /I{5A24DD7E-7B01-41AC-ADA8-F1776177A3BA}
Logitech Print Service-->C:\PROGRA~1\Logitech\PRINTS~1\UNWISE.EXE C:\PROGRA~1\Logitech\PRINTS~1\INSTALL.LOG
LogMeIn Hamachi-->C:\WINDOWS\system32\msiexec.exe /i {067EC517-9731-43FD-B4D5-296EE0027BBB} REMOVE=ALL
LogMeIn Hamachi-->MsiExec.exe /I{067EC517-9731-43FD-B4D5-296EE0027BBB}
Ma-Config.com-->MsiExec.exe /X{425FFD94-36BD-4933-881B-FE0B9DADF2B7}
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Manhunt 2-->C:\Program Files\Rockstar Games\Manhunt 2\Uninstall.exe
Messenger Plus! Live-->"C:\Program Files\Messenger Plus! Live\Uninstall.exe"
Microsoft .NET Framework 1.1 French Language Pack-->MsiExec.exe /X{9A394342-4A68-4EBA-85A6-55B559F4E700}
Microsoft .NET Framework 1.1 Security Update (KB953297)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M953297\M953297Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - FRA-->MsiExec.exe /I{72AD53CC-CCC0-3757-8480-9EE176866A7C}
Microsoft .NET Framework 2.0 Service Pack 2-->MsiExec.exe /I{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - FRA-->MsiExec.exe /I{0BD83598-C2EF-3343-847B-7D2E84599128}
Microsoft .NET Framework 3.0 Service Pack 2-->MsiExec.exe /I{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}
Microsoft .NET Framework 3.5 Language Pack SP1 - fra-->MsiExec.exe /I{3E31821C-7917-367E-938E-E65FC413EA31}
Microsoft .NET Framework 3.5 SP1-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Choice Guard-->MsiExec.exe /X{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}
Microsoft Games for Windows - LIVE Redistributable-->MsiExec.exe /X{2E660A2A-A55F-43CD-9F73-CAD7382EEB78}
Microsoft Games for Windows - LIVE-->MsiExec.exe /X{F112F66E-25CA-42DD-983C-6118EB38F606}
Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053-->MsiExec.exe /X{770657D0-A123-3C07-8E44-1C83EC895118}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{837b34e3-7c30-493c-8f6a-2b0f04e2912c}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148-->MsiExec.exe /X{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022-->MsiExec.exe /X{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Mise à jour de sécurité pour Windows Internet Explorer 8 (KB969897)-->"C:\WINDOWS\ie8updates\KB969897-IE8\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 8 (KB971961)-->"C:\WINDOWS\ie8updates\KB971961-IE8\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 8 (KB972260)-->"C:\WINDOWS\ie8updates\KB972260-IE8\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 8 (KB974455)-->"C:\WINDOWS\ie8updates\KB974455-IE8\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923789)-->C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf
Mise à jour pour Windows Internet Explorer 8 (KB971930)-->"C:\WINDOWS\ie8updates\KB971930-IE8\spuninst\spuninst.exe"
Mise à jour pour Windows Internet Explorer 8 (KB973874)-->"C:\WINDOWS\ie8updates\KB973874-IE8\spuninst\spuninst.exe"
Mise à jour pour Windows Internet Explorer 8 (KB976749)-->"C:\WINDOWS\ie8updates\KB976749-IE8\spuninst\spuninst.exe"
Module linguistique Microsoft .NET Framework 3.5 SP1- fra-->c:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack SP1 - fra\setup.exe
Mozilla Firefox (3.5.5)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 4.0 SP2 and SOAP Toolkit 3.0-->MsiExec.exe /I{32343DB6-9A52-40C9-87E4-5E7C79791C87}
NVIDIA Drivers-->C:\WINDOWS\system32
vuninst.exe UninstallGUI
NVIDIA ForceWare Network Access Manager-->"C:\Program Files\InstallShield Installation Information\{7CFA46E3-CC2F-4355-82AE-6012DC3633FD}\setup.exe" -runfromtemp -l0x040c -removeonly
NVIDIA ForceWare Network Access Manager-->MsiExec.exe /I{7CFA46E3-CC2F-4355-82AE-6012DC3633FD}
NVIDIA PhysX-->MsiExec.exe /X{5DB65884-C963-4454-AABA-4CA3089281FA}
OpenAL-->"C:\Program Files\OpenAL\OpenALwEAX.exe" /U
Outil de téléchargement Windows Live-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}
Pack Vista Inspirat 2 1.0-->C:\WINDOWS\BricoPacks\Vista Inspirat 2\Remove.exe
Package de pilotes Windows - Advanced Micro Devices (AmdK8) Processor  (05/27/2006 1.3.2.0)-->C:\PROGRA~1\DIFX\7B44739871F4D539FA473F57A832EA4B6A59EF06\DPInst.exe /d /u C:\WINDOWS\system32\DRVSTORE\amdk8_1F9DE4E49C97F59EE9F75C34E0E91E568FC9EEB2\amdk8.inf
PeerGuardian 2.0-->"C:\Program Files\PeerGuardian2\unins000.exe"
PowerISO-->"C:\Program Files\PowerISO\uninstall.exe"
Pro Cycling Manager - Season 2009 1.0.3.3-->"C:\Program Files\Cyanide\Pro Cycling Manager - Season 2009\unins000.exe"
Pro Evolution Soccer 2010-->MsiExec.exe /X{283FFB23-8751-4B08-ACB8-5E0F8BCF7727}
Programme de gestion Camera de Logitech®-->"C:\Program Files\Fichiers communs\Logitech\QCDRV\BIN\SETUP.EXE" UNINSTALL REMOVEPROMPT
PunkBuster Services-->C:\WINDOWS\system32\pbsvc.exe -u
Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -l0x40c  -removeonly
RESIDENT EVIL 5-->MsiExec.exe /X{AC08BBA0-96B9-431A-A7D0-D8598E493775}
Revo Uninstaller 1.83-->C:\Program Files\VS Revo Group\Revo Uninstaller\uninst.exe
Segoe UI-->MsiExec.exe /I{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}
Skype web features-->MsiExec.exe /I{541DEAC0-5F3D-45E6-B7CB-94ECF3B96748}
Skype™ 4.1-->MsiExec.exe /X{D103C4BA-F905-437A-8049-DB24763BBE36}
SpeechRedist-->MsiExec.exe /X{8795CBED-55E2-4693-9F14-84EC446935BE}
SpeedFan (remove only)-->"C:\Program Files\SpeedFan\uninstall.exe"
Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
Steam-->MsiExec.exe /X{048298C9-A4D3-490B-9FF9-AB023A9238F3}
Thermal Analysis Tool-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6B2C675E-8040-431B-99C4-137DF4FBF75A}\setup.exe" -l0x9  -removeonly
TuneUp Utilities-->C:\Program Files\TuneUp Utilities 2010\TUInstallHelper.exe --Trigger-Uninstall
Unreal Tournament 2004-->C:\UT2004\System\Setup.exe uninstall "UT2004"
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""
VC80CRTRedist - 8.0.50727.4053-->MsiExec.exe /I{5EE7D259-D137-4438-9A5F-42F432EC0421}
VLC media player 1.0.2-->C:\Program Files\VideoLAN\VLC\uninstall.exe
Windows Internet Explorer 8-->"C:\WINDOWS\ie8\spuninst\spuninst.exe"
Windows Live Call-->MsiExec.exe /I{F6BD194C-4190-4D73-B1B1-C48C99921BFE}
Windows Live Communications Platform-->MsiExec.exe /I{3B4E636E-9D65-4D67-BA61-189800823F52}
Windows Live Essentials-->C:\Program Files\Windows Live\Installer\wlarp.exe
Windows Live Essentials-->MsiExec.exe /I{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}
Windows Live Family Safety-->MsiExec.exe /X{139E303E-1050-497F-98B1-9AE87B15C463}
Windows Live Mail-->MsiExec.exe /I{6412CECE-8172-4BE5-935B-6CECACD2CA87}
Windows Live Messenger-->MsiExec.exe /X{A85FD55B-891B-4314-97A5-EA96C0BD80B5}
Windows Live Sign-in Assistant-->MsiExec.exe /I{45338B07-A236-4270-9A77-EBB4115517B5}
Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Player Firefox Plugin-->MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}
WinRAR archiver-->C:\Program Files\WinRAR\uninstall.exe
WOT pour Internet Explorer-->MsiExec.exe /X{DB6BD5D5-8482-45C0-99CF-745C5B924497}
Xfire (remove only)-->"C:\Program Files\Xfire\uninst.exe"

======Hosts File======

127.0.0.1 localhost

======Security center information======

AV: AntiVir Desktop

======System event log======

Computer Name: YAGAMI-RLEB75LC
Event Code: 1001
Message: Le service SNMP a démarré correctement.

Record Number: 973
Source Name: SNMP
Time Written: 20091003225125.000000+120
Event Type: Informations
User: 

Computer Name: YAGAMI-RLEB75LC
Event Code: 6005
Message: Le service d'Enregistrement d'événement a démarré.

Record Number: 972
Source Name: EventLog
Time Written: 20091003225110.000000+120
Event Type: Informations
User: 

Computer Name: YAGAMI-RLEB75LC
Event Code: 6009
Message: Microsoft (R) Windows (R) 5.01. 2600 Service Pack 3 Multiprocessor Free.

Record Number: 971
Source Name: EventLog
Time Written: 20091003225110.000000+120
Event Type: Informations
User: 

Computer Name: YAGAMI-RLEB75LC
Event Code: 6006
Message: Le service d'Enregistrement d'événement a été arrêté.

Record Number: 970
Source Name: EventLog
Time Written: 20091003225026.000000+120
Event Type: Informations
User: 

Computer Name: YAGAMI-RLEB75LC
Event Code: 4201
Message: Le système a détecté que la carte réseau \DEVICE\TCPIP_{7254642D-A686-45D7-ACA7-0174EAFDDB97} était connectée au réseau,
et a lancé une opération normale sur la carte réseau.

Record Number: 969
Source Name: Tcpip
Time Written: 20091003224120.000000+120
Event Type: Informations
User: 

=====Application event log=====

Computer Name: YAGAMI
Event Code: 4096
Message: Le service AntiVir a bien démarré!

Record Number: 2116
Source Name: Avira AntiVir
Time Written: 20091016122555.000000+120
Event Type: Informations
User: AUTORITE NT\SYSTEM

Computer Name: YAGAMI
Event Code: 0
Message: 
Record Number: 2115
Source Name: gupdate1ca4dd47efc34c6
Time Written: 20091015231839.000000+120
Event Type: Informations
User: 

Computer Name: YAGAMI
Event Code: 1800
Message: Le service Centre de sécurité Windows a démarré.

Record Number: 2114
Source Name: SecurityCenter
Time Written: 20091015231812.000000+120
Event Type: Informations
User: 

Computer Name: YAGAMI
Event Code: 1015
Message: Le paramètre TraceLevel ne se trouve pas dans le Registre.
La niveau de suivi utilisé par défaut est 32.

Record Number: 2113
Source Name: EvntAgnt
Time Written: 20091015231811.000000+120
Event Type: Avertissement
User: 

Computer Name: YAGAMI
Event Code: 1003
Message: Le paramètre TraceFileName ne se trouve pas dans le Registre.
Le fichier de suivi utilisé par défaut est .

Record Number: 2112
Source Name: EvntAgnt
Time Written: 20091015231811.000000+120
Event Type: Avertissement
User: 

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\system32\wbem;C:\Program Files\ATI Technologies\ATI.ACE\Core-Static;C:\Program Files\ESTsoft\ALZip;C:\Program Files\Fichiers communs\DivX Shared
"windir"=%SystemRoot%
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 6, GenuineIntel
"PROCESSOR_REVISION"=0f06
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"FP_NO_HOST_CHECK"=NO

-----------------EOF-----------------
le second rapport

Light-Yagami · Answer

", ok mais tu vois cela ou sur le rapport de antivir"

c 'est ce ke je lis dans "source " dans ma quarantaine  j'en ai encore 2 d'aujourd'hui dedans ...

Light-Yagami · Answer

les infections  : C:documents and settings/proprietaire/local settings/temp/~4F.tmp
                      C:documents and settings/proprietaire/local settings/temp/~26.tmp

jacques.gache · Answer

rien de vraiment visible sur les rapports, tu passes malwarebytes pour voir ce qu'il va nous trouvé ! 

Télécharge Malwarebytes' Anti-Malware: https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

. sur la page cliques sur Télécharger Malwarebyte's Anti-Malware
. enregistres le sur le bureau
. Double cliques sur le fichier téléchargé pour lancer le processus d'installation.
. si le pare-feu demande l'autorisation  de se connecter pour malwarebytes, acceptes
. rend-toi dans l'onglet, Recherche
. Sélectionnes  Exécuter un examen complet
. Cliques sur Rechercher
. Le scan démarre.
. A la fin de l'analyse, un message s'affiche : L'examen s'est terminé normalement. Cliquez sur 'Afficher les résultats' pour afficher tous les objets trouvés.
. Cliques sur Ok pour poursuivre.
. Si des malwares ont été détectés, cliques sur Afficher les résultats
. Sélectionnes tout (ou laisses cochés) et cliques sur Supprimer la sélection Malwarebytes va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.
. Malwarebytes va ouvrir le bloc-notes et y copier le rapport d'analyse.
. redemarre le pc si il le fait pas lui même
. une fois redémarré  double-cliques sur malwarebytes
. rends toi dans l'onglet rapport/log
. tu cliques dessus pour l'afficher une fois affiché
. tu cliques sur edition en haut du boc notes,et puis sur sélectionner tous
. tu recliques sur edition et puis sur copier et tu reviens sur le forum et dans ta réponse
. tu cliques droit dans le cadre de la reponse et coller


Si tu as besoin d'aide regarde ce tutoriel :
https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

Light-Yagami · Answer

rien du tout .... je l'ai en garde active quasiment tout le temps sauf pour jouer 

le rapport : 

Malwarebytes' Anti-Malware 1.41
Version de la base de données: 3208
Windows 5.1.2600 Service Pack 3

22/11/2009 10:44:55
mbam-log-2009-11-22 (10-44-55).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 184663
Temps écoulé: 36 minute(s), 43 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)



et 1h apres il me dectectait encore ceci : 

Dans le fichier 'C:\Documents and Settings\Yagami\Local Settings	emp\~26.tmp'
un virus ou un programme indésirable 'TR/Crypt.XPACK.Gen' [trojan] a été détecté.
Action exécutée : Déplacer le fichier en quarantaine

Light-Yagami · Answer

viola le dernier scan en faite : 

Malwarebytes' Anti-Malware 1.41
Version de la base de données: 3213
Windows 5.1.2600 Service Pack 3

22/11/2009 13:46:25
mbam-log-2009-11-22 (13-46-25).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 185724
Temps écoulé: 35 minute(s), 25 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

gen-hackman · Answer

salut jacques , Yagami:

moi je vois ceci qui delire :

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\WINDOWS\system32\sessmgr.exe"="C:\WINDOWS\system32\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019" 


ensuite Combofix a ete utilisé plusieurs fois

Light-Yagami · Answer

slt Gen :) 

du chinois pour moi cette clé registre ...  mais Combofix je vois bien ... enfin j'attend vos consignes ;)

jacques.gache · Answer

et 1h apres il me dectectait encore ceci :

Dans le fichier 'C:\Documents and Settings\Yagami\Local Settings\temp\~26.tmp'
un virus ou un programme indésirable 'TR/Crypt.XPACK.Gen' [trojan] a été détecté.
Action exécutée : Déplacer le fichier en quarantaine

ert bien notre amis Light-Yagami avais raison donc comme local settings est un fichier cacher il faut le décacher et vider le dossier temps de préférence en mode sans echec tu copies la procédure car en mode sans echec tu n'aura pas de connectiob pour pouvoir suivre si besoin

1) pour redémarrer en mode sans échec : /!\ Ne jamais démarrer en mode sans échec via MSCONFIG /!\

(attention : pas de connexion possible en mode sans échec , donc copies ou imprimes bien la manipe pour éviter les erreurs ...)

.Cliques sur Démarrer
.Cliques sur Arrêter
.Sélectionnes Redémarrer et au redémarrage
.Appuis sur la touche F8 ou F5 celon les marques de pc sans discontinuer "1 appuis seconde" dès qu'un écran de texte apparaît puis disparaît
.Utilises les touches de direction pour sélectionner mode sans échec
.puis appuis sur ENTRÉE
.Il faudra choisir ta session habituelle, pas le compte "Administrateur" ou une autre
une fois démarré ne t'inquiette pas si les couleurs et les icônes ne sont pas comme d'abitude

tuto:http://www.vista-xp.fr/forum/topic93.html

2) Affiches les dossiers cachés:

.ouvres le poste de travail
.cliques sur Outils en haut
. Options des dossiers
.onglet Affichage
.actives la case Afficher les fichiers et dossiers cachés.
.désactives la case Masquer les extensions des fichiers dont le type est connu
.désactives la case Masquer les fichiers protégés du système d'exploitation
.une boite de dialogue te prévient que c'est risqué tu mets oui
.cliques sur Appliquer à tous les dossiers
.cliques sur appliqué et OK
tu fais ce que tu as à faire et une fois fini penses à remettre les dossiers cachés
.ouvres le poste de travail
.cliques sur Outils en haut
.Options des dossiers
.onglet Affichage
.cliques sur paramètres par défaut

3) vas vider le dossier temp

tu vas dans postes de travail tu ouvres ton disque dur C

ouvres Documents and Settings

piis Yagami<gras> et Local Settings

et enfin <gras>temp une fois se dossier ouvert tu cliques en haut sur édition

et puis sur sélectionner tous une fois tous le contenu en surbrillant

tu appuis sur la touche Suppr de ton clavier supprimer et tu confirmes avec OK

si tu ne veux pas supprimer la totalité de ce qui est dans le dossier dans tu peux supprimer que

~26.tmp en faisant un clique droit dessus et supprimer

mais tu peux sans crainte vider le dossier temps

Light-Yagami · Answer

c fait ..

je peux re cacher les dossiers ?

Light-Yagami · Answer

ps: y avait pas le "26temp " 

puis qu'il est dans ma quarantaine antivir ....

Light-Yagami · Answer

nouvelle detection : et à chaque fois que je suis sur call of duty 6 ( acheté ) 

à 17h55 ! 

Dans le fichier 'C:\Documents and Settings\Yagami\Local Settings	emp\~25.tmp'
un virus ou un programme indésirable 'TR/Crypt.XPACK.Gen' [trojan] a été détecté.
Action exécutée : Déplacer le fichier en quarantaine

jacques.gache · Answer

oui si tu as vider le dossier remets les fichiers en cacher comme expliqué dans la procédure 

ouvres le poste de travail 
.cliques sur Outils en haut 
.Options des dossiers 
.onglet Affichage 
.cliques sur paramètres par défaut 

et continu avec gen puisqu'il est la salut à toi gen

gen-hackman · Answer

ok :)

Télécharge OTL de OLDTimer

&#9654 enregistre le sur ton Bureau.

&#9654 Double clic ( pour vista => clic droit "executer en tant qu'administrateur") sur OTL.exe pour le lancer.

&#9654 Coche les 2 cases Lop et Purity

&#9654 Coche la case devant scan all users

&#9654 règle-le sur "60 Days"

&#9654 dans la colonne de gauche , mets tout sur all

ne modifie pas ceci : 

"files created whithin" et "files modified whithin" 

&#9654Clic sur Run Scan.

A la fin du scan, le Bloc-Notes va s'ouvrir avec le rapport (OTL.txt).

Ce fichier est sur ton Bureau (en général C:\Documents and settings\le_nom_de_ta_session\OTL.txt)

&#9654&#9654&#9654 NE LE POSTE PAS SUR LE FORUM

Pour me le transmettre clique sur ce lien : http://www.cijoint.fr/

&#9654 Clique sur Parcourir et cherche le fichier ci-dessus.

&#9654 Clique sur Ouvrir.

&#9654 Clique sur "Cliquez ici pour déposer le fichier".

Un lien de cette forme :

http://www.cijoint.fr/cjlink.php?file=cjge368/cijSKAP5fU.txt

est ajouté dans la page.

&#9654 Copie ce lien dans ta réponse.

Tu feras la meme chose avec le "Extra.txt".

Light-Yagami · Answer

c long ... c normal ?

gen-hackman · Answer

ca arrive...

Light-Yagami · Answer

lolllll apres plus de 2h d'attente il me mets que le programme ne repond pas lollll  

je recommencerai pdt la nuit, le posterai demain matin  

tu me conseils de me deconnecter ? et de desactiver mes protections avant ce scan ?

gen-hackman · Answer

oui l antivirus car ca devrait pas durer plus de 10 mn ^^

Light-Yagami · Answer

je viens encore de reessayer 45min mais tjrs rien ...;

je ressaie la nuit on verra...

gen-hackman · Answer

en mode sans echec

Light-Yagami · Answer

non plus ... apres 10min "ne repond pas"

gen-hackman · Answer

&#9654 Désactive ton antivirus le temps de la manipulation car OTM est détecté comme une infection à tort. 

&#9654 Télécharge OTM (OldTimer) sur ton Bureau : 

&#9654 Double-clique sur OTM.exe afin de le lancer. 

&#9654 Copie (Ctrl+C) le texte suivant ci-dessous : 


:processes
explorer.exe
iexplore.exe
firefox.exe
msnmsgr.exe
Teatimer.exe

:reg
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\shared­access\parameters\firewallpolicy\standardprofile\authorizeda­pplications\list]
"C:\WINDOWS\system32\sessmgr.exe"="C:\WINDOWS\system32\sessmgr.exe:*:Enabled:@xpsp2res.dll,-22019" 

:commands
[emptytemp]
[start explorer]
[reboot] 


&#9654 Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved. 

&#9654 Clique maintenant sur le bouton MoveIt! puis ferme OTM 

Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer. 
Accepte en cliquant sur YES. 

&#9654 Poste le rapport situé dans ce dossier : C:\_OTM\MovedFiles\ 

*Le nom du rapport correspond au moment de sa création : date_heure.log

Light-Yagami · Answer

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
No active process named iexplore.exe was found!
No active process named firefox.exe was found!
No active process named msnmsgr.exe was found!
No active process named Teatimer.exe was found!
========== REGISTRY ==========
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\shared­access\parameters\firewallpolicy\standardprofile\authorizeda­pplications\list\"C:\WINDOWS\system32\sessmgr.exe"|"C:\WINDOWS\system32\sessmgr.exe:*:Enabled:@xpsp2res.dll,-22019" /E : value set successfully!
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Administrateur
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: All Users
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Yagami
->Temp folder emptied: 158 bytes
->Temporary Internet Files folder emptied: 2171491 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 22526145 bytes
->Google Chrome cache emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 155648 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
Windows Temp folder emptied: 32768 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33728 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 23,83 mb
 
 
OTM by OldTimer - Version 3.1.2.0 log created on 11222009_233432

gen-hackman · Answer

Desactive ton antivirus le temps de la manip ainsi que ton parefeu si présent

&#9654 Télécharge List&Kill'em et enregistre le sur ton bureau

&#9654 dezippe-le , (clic droit/ extraire.....)

Il ne necessite pas d'installation 

&#9654double clic (clic droit "executer en tant qu'administrateur" pour Vista) pour lancer le scan

choisis la langue puis choisis l'option 1 = Mode Recherche

&#9654laisse travailler l'outil

&#9654Poste le contenu du rapport qui s'ouvre

Light-Yagami · Answer

List'em by g3n-h@ckm@n 1.0.5.5 

Thx to Chiquitine29..... 

User : Yagami (Administrateurs) # YAGAMI
Update on 21/11/2009 by g3n-h@ckm@n ::::: 20:13 
Start at: 23:54:02 | 22/11/2009
Contact : g3n-h@ckm@n sur CCM

Intel(R) Core(TM)2 CPU          6600  @ 2.40GHz
Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Disabled
AV : AntiVir Desktop 9.0.1.32 [ Enabled | Updated ]

C:\ -> Disque fixe local | 298,09 Go (137,41 Go free) | NTFS
D:\ -> Disque CD-ROM
E:\ -> Disque CD-ROM
F:\ -> Disque CD-ROM

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processus en cours 

C:\WINDOWS\System32\smss.exe 820
C:\WINDOWS\system32\csrss.exe 940
C:\WINDOWS\system32\winlogon.exe 1092
C:\WINDOWS\system32\services.exe 1136
C:\WINDOWS\system32\lsass.exe 1148
C:\WINDOWS\system32\Ati2evxx.exe 1368
C:\WINDOWS\system32\svchost.exe 1388
C:\WINDOWS\system32\svchost.exe 1436
C:\WINDOWS\System32\svchost.exe 1820
C:\WINDOWS\system32\svchost.exe 2044
C:\WINDOWS\system32\Ati2evxx.exe 288
C:\WINDOWS\system32\spoolsv.exe 492
C:\Program Files\Avira\AntiVir Desktop\sched.exe 540
C:\Program Files\Avira\AntiVir Desktop\avguard.exe 564
C:\WINDOWS\Explorer.EXE 1772
C:\Program Files\Advanced System Optimizer 3\ASO3DefragSrv.exe 884
C:\WINDOWS\System32\svchost.exe 996
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32
SvcAppFlt.exe 1572
C:\Program Files\GameTracker\GSInGameService.exe 1676
C:\Program Files\LogMeIn Hamachi\hamachi-2.exe 1732
C:\WINDOWS\System32\svchost.exe 452
C:\Program Files\Java\jre6\bin\jqs.exe 1960
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe 2020
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe 1608
C:\WINDOWS\system32\ctfmon.exe 920
C:\WINDOWS\system32\PnkBstrA.exe 2384
C:\WINDOWS\System32\snmp.exe 2436
C:\WINDOWS\System32\svchost.exe 2456
C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe 2496
C:\WINDOWS\System32\vssvc.exe 2592
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32
SvcIp.exe 3244
C:\WINDOWS\system32\wbem\wmiprvse.exe 4044
C:\WINDOWS\System32\wbem\wmiapsrv.exe 2484
C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe 3008
C:\WINDOWS\System32\alg.exe 4008
C:\WINDOWS\explorer.exe 3832
C:\Documents and Settings\Yagami\Bureau\List_Kill'em.exe 2100
C:\WINDOWS\system32\cmd.exe 1640
C:\WINDOWS\system32\wbem\wmiprvse.exe 1140
C:\Documents and Settings\Yagami\Local Settings	emp\A.tmp\pv.exe 3684

======================
Cles de demarrage "Run" 
======================

! REG.EXE VERSION 3.0

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    ctfmon.exe	REG_SZ	C:\WINDOWS\system32\ctfmon.exe
    DownloadAccelerator	REG_SZ	"C:\Program Files\DAP\DAP.EXE" /STARTUP

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    avgnt	REG_SZ	"C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
    Ashampoo FireWall	REG_SZ	"C:\Program Files\Ashampoo\Ashampoo FireWall\FireWall.exe" -TRAY
    Malwarebytes Anti-Malware (reboot)	REG_SZ	"C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystweakDisabled
=====================
cles additionnelles
=====================

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System
    dontdisplaylastusername	REG_DWORD	0x0
    legalnoticecaption	REG_SZ	
    legalnoticetext	REG_SZ	
    shutdownwithoutlogon	REG_DWORD	0x1
    undockwithoutlogon	REG_DWORD	0x1
=============== 
=============== 
BHO :
====== 

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C920E44A-7F78-4E64-BDD7-A57026E7FEB7}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FF6C3CF0-4B15-11D1-ABED-709549C10000}

========
Services
========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services] 

Ndisuio : 0x3 
EapHost : 0x2 
SharedAccess : 0x2 
wuauserv : 0x2 
=========
 
=========================
Environnement variables :
=========================

ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\Yagami\Application Data
choix=1
CLIENTNAME=Console
CommonProgramFiles=C:\Program Files\Fichiers communs
COMPUTERNAME=YAGAMI
ComSpec=C:\WINDOWS\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\Yagami
LOGONSERVER=\YAGAMI
NUMBER_OF_PROCESSORS=2
OS=Windows_NT
Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\system32\wbem;C:\Program Files\ATI Technologies\ATI.ACE\Core-Static;C:\Program Files\ESTsoft\ALZip;C:\Program Files\Fichiers communs\DivX Shared;C:\Program Files\ESTsoft\ALZip
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 6 Model 15 Stepping 6, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=0f06
ProgramFiles=C:\Program Files
PROMPT=$P$G
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\Yagami\LOCALS~1\Temp
TMP=C:\DOCUME~1\Yagami\LOCALS~1\Temp
USERDOMAIN=YAGAMI
USERNAME=Yagami
USERPROFILE=C:\Documents and Settings\Yagami
windir=C:\WINDOWS


¤¤¤¤¤¤¤¤¤¤ Fichiers et dossiers presents :

C:\WINDOWS\mbr.exe  
C:\WINDOWS\WMSysPrx.prx  
 
¤¤¤¤¤¤¤¤¤¤ Clés de registre Presentes : 

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"  

=====================
Verification Rootkits
=====================

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-22 23:55:20
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000001
"ujdew"=hex:35,f9,fa,38,c2,18,a0,ed,3a,4b,6e,ac,82,89,78,bc,80,21,9b,5f,97,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC]
"h0"=dword:00000000
"hdf12"=hex:a7,35,2e,0e,d6,ad,0f,03,3b,b8,c8,3a,08,99,25,c8,43,ab,e6,7f,be,..
"p0"="C:\Program Files\DAEMON Tools Lite\"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001]
"a0"=hex:20,01,00,00,c2,d0,90,ca,bd,55,d8,a4,de,35,bb,7a,e2,80,8c,0a,74,..
"hdf12"=hex:e9,51,6d,7a,39,ff,f9,7b,c0,a0,87,9c,3c,14,c7,f2,24,5a,8a,d8,ab,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0]
"hdf12"=hex:55,0f,20,2c,ee,26,2f,39,26,94,f1,ec,6c,3a,d0,57,15,4c,63,59,7c,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000001
"ujdew"=hex:35,f9,fa,38,c2,18,a0,ed,3a,4b,6e,ac,82,89,78,bc,80,21,9b,5f,97,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC]
"h0"=dword:00000000
"hdf12"=hex:a7,35,2e,0e,d6,ad,0f,03,3b,b8,c8,3a,08,99,25,c8,43,ab,e6,7f,be,..
"p0"="C:\Program Files\DAEMON Tools Lite\"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001]
"a0"=hex:20,01,00,00,c2,d0,90,ca,bd,55,d8,a4,de,35,bb,7a,e2,80,8c,0a,74,..
"hdf12"=hex:e9,51,6d,7a,39,ff,f9,7b,c0,a0,87,9c,3c,14,c7,f2,24,5a,8a,d8,ab,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0]
"hdf12"=hex:4d,40,26,df,3b,68,0e,f2,b1,0e,e0,8c,60,e0,e1,47,1d,37,d5,28,3c,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1]
"hdf12"=hex:ca,6f,ea,67,6f,a2,b5,dc,b6,d3,24,de,8c,de,ae,9d,c1,38,39,f6,cf,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000001
"ujdew"=hex:35,f9,fa,38,c2,18,a0,ed,3a,4b,6e,ac,82,89,78,bc,80,21,9b,5f,97,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC]
"h0"=dword:00000000
"hdf12"=hex:a7,35,2e,0e,d6,ad,0f,03,3b,b8,c8,3a,08,99,25,c8,43,ab,e6,7f,be,..
"p0"="C:\Program Files\DAEMON Tools Lite\"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001]
"a0"=hex:20,01,00,00,c2,d0,90,ca,bd,55,d8,a4,de,35,bb,7a,e2,80,8c,0a,74,..
"hdf12"=hex:e9,51,6d,7a,39,ff,f9,7b,c0,a0,87,9c,3c,14,c7,f2,24,5a,8a,d8,ab,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0]
"hdf12"=hex:4d,40,26,df,3b,68,0e,f2,b1,0e,e0,8c,60,e0,e1,47,1d,37,d5,28,3c,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1]
"hdf12"=hex:ca,6f,ea,67,6f,a2,b5,dc,b6,d3,24,de,8c,de,ae,9d,c1,38,39,f6,cf,..

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

 
¤¤¤¤¤¤¤¤¤¤ C:\WINDOWS\Prefetch : 

A2FREE.EXE-34CE1BFD.pf
A2SERVICE.EXE-084E756C.pf
AAWSERVICE.EXE-3B93EBA3.pf
AAWTRAY.EXE-1858AE3F.pf
AAWWSC.EXE-248CAA52.pf
ALAUTH.EXE-307C919E.pf
ALBNCOLLECTOR.EXE-3496DC3B.pf
ALG.EXE-0F138680.pf
ALZIP.EXE-328886AF.pf
ASO3.EXE-0F96A2B0.pf
ATTRIB.EXE-39EAFB02.pf
AU_.EXE-28DA65D2.pf
AVCENTER.EXE-1A970FA0.pf
AVGNT.EXE-200FEF40.pf
AVNOTIFY.EXE-05ED5FD8.pf
AVSCAN.EXE-07FC469C.pf
AVWSC.EXE-0283F9DD.pf
BYPASS.EXE-3A13827B.pf
CCC.EXE-2F1AF7F1.pf
CCLEANER.EXE-0BCE437C.pf
CGHTME.EXE-1FFD7506.pf
CHCP.COM-18156052.pf
CLI.EXE-06A4F0BB.pf
CLIPTEXT.EXE-3927268A.pf
CMD.EXE-087B4001.pf
CONTROL.EXE-013DBFB5.pf
CSCRIPT.EXE-1C26180C.pf
CSWEG.EXE-19687E72.pf
CTFMON.EXE-0E17969B.pf
DAP.EXE-35E17E3D.pf
DNIF.EXE-363BC2BF.pf
DRIVERUPDATER.EXE-3531E54C.pf
ECHOX.EXE-0EC32D49.pf
EDITREG.EXE-1914E017.pf
EXPLORER.EXE-082F38A9.pf
FIND.EXE-0EC32F1E.pf
FINDSTR.EXE-0CA6274B.pf
FIREFOX.EXE-28641590.pf
FIREWALL.EXE-2C447313.pf
FLASHGOT.EXE-2548C156.pf
FRAPS.EXE-2E18AF75.pf
GAMEOVERLAYUI.EXE-1A46F21E.pf
GOOGLEUPDATE.EXE-1E123D86.pf
GREP.COM-30632777.pf
GUARDGUI.EXE-00ECD849.pf
HIGHESTAVAILABLE.EXE-2D4D5628.pf
IW4MP.EXE-28B926BB.pf
JQSNOTIFY.EXE-24AE4A36.pf
KILL.EXE-25FB2C73.pf
KILL_P.EXE-15C7A895.pf
Layout.ini
LOGONUI.EXE-0AF22957.pf
LS.EXE-05AD0276.pf
MBAM.EXE-0BEE0439.pf
MBAMGUI.EXE-1286D63B.pf
MBAMSERVICE.EXE-02CB9980.pf
MD5FILE.EXE-0B52814C.pf
MODE.COM-31685BAE.pf
MOM.EXE-33A6BD58.pf
NIRCMD.COM-35BF857A.pf
NOTEPAD.EXE-336351A9.pf
NSVCIP.EXE-13106DF4.pf
NTOSBOOT-B00DFAAD.pf
OSV.EXE-1A4D2F4B.pf
PNKBSTRA.EXE-188A67A9.pf
PRIVACYPROTECTOR.EXE-31CEC2CE.pf
PV.COM-006EB813.pf
PV.EXE-02C569DD.pf
RAR.EXE-2741A703.pf
REG.EXE-0D2A95F7.pf
REGCLEAN.EXE-1FC54FD4.pf
REGDACL.COM-3B1D4525.pf
REGEDIT.EXE-1B606482.pf
REGISTRYOPTIMIZER.EXE-2BC1CCC7.pf
REGSVR32.EXE-25EEFE2F.pf
REVOUNINSTALLER.EXE-38379543.pf
RSIT.EXE-10298F2A.pf
RTSDNIF.EXE-0B3880C1.pf
RUNDLL32.EXE-13DA0E71.pf
RUNDLL32.EXE-1831A4F3.pf
RUNDLL32.EXE-198D103D.pf
RUNDLL32.EXE-4489B61B.pf
RUNDLL32.EXE-451FC2C0.pf
SC.EXE-012262AF.pf
SDFIX.EXE-2E8062E3.pf
SDUPDATE.EXE-00420EF0.pf
SED.COM-281CC846.pf
SED.EXE-2A032EBB.pf
SETPATH.EXE-2D3D2E76.pf
SETPATH.EXE-38F85A52.pf
SHUTDOWN.EXE-12DAD820.pf
SNMP.EXE-0E0E1166.pf
SORT.EXE-194AE83C.pf
SPYBOTSD.EXE-1344276B.pf
SPYWAREBLASTER.EXE-20CF1E62.pf
SPYWAREBLASTERSETUP42.EXE-15BDA922.pf
SPYWAREBLASTERSETUP42.TMP-1029C8E2.pf
STEAM.EXE-15609EA3.pf
SVCHOST.EXE-3530F672.pf
SWREG.COM-3A277B41.pf
SWREG.EXE-2A961210.pf
SWSC.EXE-2E20CED5.pf
SYSTEMCLEANER.EXE-05BE7877.pf
SYSTEMPROTECTOR.EXE-0676AEFF.pf
TEATIMER.EXE-1F57E47A.pf
THREATWORK.EXE-0F50642D.pf
TOOLBARSD.EXE-28AB0BCA.pf
TUNEUPSYSTEMSTATUSCHECK.EXE-30504EAA.pf
TUNEUPUTILITIESAPP32.EXE-1055BB6E.pf
TUNEUPUTILITIESSERVICE32.EXE-32EBE434.pf
UNINS000.EXE-1C6AF694.pf
UNINS000.EXE-1CFDBE67.pf
UNINSTALL ADR.EXE-06F93FCD.pf
UNIQ.COM-1121C69B.pf
UNIQ.COM-1A4274C4.pf
UNRAR.EXE-15F7ED13.pf
UNSECAPP.EXE-1A95A33B.pf
USBFIX.EXE-1DB4A471.pf
USBFIX.EXE-39B6DDDB.pf
USERINIT.EXE-30B18140.pf
VERCLSID.EXE-3667BD89.pf
VSSVC.EXE-0F74375A.pf
WMIAPSRV.EXE-1E2270A5.pf
WMIPRVSE.EXE-28F301A9.pf
WSCNTFY.EXE-1B24F5EB.pf
WSCRIPT.EXE-32960AB9.pf
WUAUCLT.EXE-399A8E72.pf
YAGAMI.EXE-308AFE4A.pf
ZIP.EXE-2B4AB880.pf
_IU14D2N.TMP-032F070B.pf
 
 
 

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

gen-hackman · Answer

&#9654 Relance List&Kill'em comme tu as fait pour l'option 1 (soit en clic droit pour vista),

mais cette fois-ci :

&#9654 choisis l'option 2 = Mode Destruction

laisse travailler l'outil.

en fin de scan un rapport s'ouvre , ferme-le puis redemarre

&#9654 colle le contenu dans ta reponse

Light-Yagami · Answer

Kill'em by g3n-h@ckm@n 1.0.5.5 
 
User : Yagami (Administrateurs) # YAGAMI
Update on 21/11/2009 by g3n-h@ckm@n ::::: 20:13 
Start at: 0:29:46 | 23/11/2009
Contact : g3n-h@ckm@n sur CCM

Intel(R) Core(TM)2 CPU          6600  @ 2.40GHz
Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Disabled
AV : AntiVir Desktop 9.0.1.32 [ Enabled | Updated ]

C:\ -> Disque fixe local | 298,09 Go (137,27 Go free) | NTFS
D:\ -> Disque CD-ROM
E:\ -> Disque CD-ROM
F:\ -> Disque CD-ROM
 

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processus en cours
 

C:\WINDOWS\System32\smss.exe 820
C:\WINDOWS\system32\csrss.exe 940
C:\WINDOWS\system32\winlogon.exe 1092
C:\WINDOWS\system32\services.exe 1136
C:\WINDOWS\system32\lsass.exe 1148
C:\WINDOWS\system32\Ati2evxx.exe 1368
C:\WINDOWS\system32\svchost.exe 1388
C:\WINDOWS\system32\svchost.exe 1436
C:\WINDOWS\System32\svchost.exe 1820
C:\WINDOWS\system32\svchost.exe 2044
C:\WINDOWS\system32\Ati2evxx.exe 288
C:\WINDOWS\system32\spoolsv.exe 492
C:\Program Files\Avira\AntiVir Desktop\sched.exe 540
C:\Program Files\Avira\AntiVir Desktop\avguard.exe 564
C:\WINDOWS\Explorer.EXE 1772
C:\Program Files\Advanced System Optimizer 3\ASO3DefragSrv.exe 884
C:\WINDOWS\System32\svchost.exe 996
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32
SvcAppFlt.exe 1572
C:\Program Files\GameTracker\GSInGameService.exe 1676
C:\Program Files\LogMeIn Hamachi\hamachi-2.exe 1732
C:\WINDOWS\System32\svchost.exe 452
C:\Program Files\Java\jre6\bin\jqs.exe 1960
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe 2020
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe 1608
C:\WINDOWS\system32\ctfmon.exe 920
C:\WINDOWS\system32\PnkBstrA.exe 2384
C:\WINDOWS\System32\snmp.exe 2436
C:\WINDOWS\System32\svchost.exe 2456
C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe 2496
C:\WINDOWS\System32\vssvc.exe 2592
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32
SvcIp.exe 3244
C:\WINDOWS\System32\wbem\wmiapsrv.exe 2484
C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe 3008
C:\WINDOWS\System32\alg.exe 4008
C:\WINDOWS\explorer.exe 3832
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe 1008
C:\Documents and Settings\Yagami\Bureau\List_Kill'em.exe 3656
C:\WINDOWS\system32\cmd.exe 3000
C:\WINDOWS\system32\wbem\wmiprvse.exe 3976
C:\Documents and Settings\Yagami\Local Settings	emp\23.tmp\pv.exe 1340
 
Fichiers analysés : 
================= 
 

¤¤¤¤¤¤¤¤¤¤ Fichiers et dossiers presents : 

"C:\WINDOWS\mbr.exe"  
"C:\WINDOWS\WMSysPrx.prx"  
 
 
¤¤¤¤¤¤¤¤¤¤ Action sur les fichiers : 
  
Quarantaine : 

MBR.exe.Kill'em
WMSysPrx.prx.Kill'em

====================
Fichiers hosts nettoyés
==================== 
¤¤¤¤¤¤¤¤¤¤ C:\WINDOWS\Prefetch
 
Layout.ini
NTOSBOOT-B00DFAAD.pf
 
 
 
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

gen-hackman · Answer

&#9654 Télécharge ZHPDiag (de Nicolas Coolman) 

ou :ZHPDiag

&#9654 Enregistre le sur ton Bureau.

Une fois le téléchargement achevé, 

&#9654 lance ZHPDiag.exe et clique sur Unzip dans la fenêtre qui s'ouvre.

&#9654 Clique sur la clé à molette puis sur Tous pour cocher toutes les cases des options.

&#9654 Clique sur la loupe pour lancer l'analyse.

A la fin de l'analyse, 

&#9654 clique sur l'appareil photo et enregistre le rapport sur ton Bureau.

Pour me le transmettre clique sur ce lien :

http://www.cijoint.fr/

&#9654 Clique sur Parcourir et cherche le fichier C:\Documents and settings\le_nom_de_ta_session\.ZHPDiag.txt

&#9654 Clique sur Ouvrir.

&#9654 Clique sur "Cliquez ici pour déposer le fichier".

Un lien de cette forme :

http://www.cijoint.fr/cjlink.php?file=cj200905/cib7SU.txt

est ajouté dans la page.

&#9654 Copie ce lien dans ta réponse.

Light-Yagami · Answer

http://www.cijoint.fr/cjlink.php?file=cj200911/cijxGkdNXZ.txt

gen-hackman · Answer

==> Télécharge  OAD (de Laur3n7!)

&#9654 Enregistre le sur ton bureau

&#9654 Double clique sur le OAD pour le lancer

&#9654 nom de fichier à rechercher ,tape : |6TO4|

&#9654 Type de recherche : sélectionne l'option 6 puis valide [entree]

OAD va maintenant rechercher le fichier. Laisse le travailler jusqu'à ce qu'il en ai terminé.
Le rapport de recherche s'affichera automatiquement à dès qu'il en aura terminé.

&#9654 Fais un copier / coller de ce rapport dans ton prochain post.

Note importante : Suivant la taille des disques dur cette recherche peut prendre plusieurs minutes. Sois patient

Light-Yagami · Answer

lun. 23/11/2009 ----  7:34:19,03  

----------------------------------
§§§§§§ [6TO4] §§§§§§
----------------------------------
[X] Registre
[  ] Fichier (rapide)
[  ] Fichier (disque systeme)
[X] Fichier (complete)




********************
     [Registre] 
********************


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\6to4]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_6TO4]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_6TO4\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_6TO4\0000]
"Service"="6to4"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\6to4]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\6to4\Config]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\6to4\Interfaces]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\6to4\Parameters]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\6to4\Security]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\6to4\Teredo]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_6TO4]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_6TO4\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_6TO4\0000]
"Service"="6to4"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_6TO4]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_6TO4\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_6TO4\0000]
"Service"="6to4"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_6TO4]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_6TO4\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_6TO4\0000]
"Service"="6to4"

*******************
     [Fichier] 
*******************



*********************
     [Même date] 
*********************

Aucun fichier créé à la même date détecté


----------------------------------
§§§§§ Fin Rapport §§§§§ 
----------------------------------

gen-hackman · Answer

&#9654 Désactive ton antivirus le temps de la manipulation car OTM est détecté comme une infection à tort. 

&#9654 Double-clique sur OTM.exe afin de le lancer. 

&#9654 Copie (Ctrl+C) le texte suivant ci-dessous : 


:processes
explorer.exe
iexplore.exe
firefox.exe
msnmsgr.exe
Teatimer.exe

:reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\6to4] 
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_6TO4]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\6to4]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_6TO4] 
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_6TO4]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_6TO4]

:commands
[emptytemp]
[start explorer]
[reboot] 


&#9654 Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved. 

&#9654 Clique maintenant sur le bouton MoveIt! puis ferme OTM 

Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer. 
Accepte en cliquant sur YES. 

&#9654 Poste le rapport situé dans ce dossier : C:\_OTM\MovedFiles\ 

*Le nom du rapport correspond au moment de sa création : date_heure.log

Light-Yagami · Answer

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
No active process named iexplore.exe was found!
Process firefox.exe killed successfully!
No active process named msnmsgr.exe was found!
No active process named Teatimer.exe was found!
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\6to4\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_6TO4\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\6to4\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_6TO4\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_6TO4\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_6TO4\ not found.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Administrateur
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: All Users
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Yagami
->Temp folder emptied: 1721413 bytes
->Temporary Internet Files folder emptied: 10135309 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 108611033 bytes
->Google Chrome cache emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
Windows Temp folder emptied: 49152 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 3399221096 bytes
 
Total Files Cleaned = -739,28 mb
 
 
OTM by OldTimer - Version 3.1.2.0 log created on 11232009_201546



mon pare feu me demande si je veux bloquer à chaque demarrage : 

C/Documents and settings/yagami/local setting/temp/SSUPDATE;EXE

je ne sais pas ce ke je dois en faire je ne sais pas ce que c ...

gen-hackman · Answer

C/Documents and settings/yagami/local setting/temp/SSUPDATE;EXE 

mises a jour de superantispyware tu peux y aller ^^

refais un log zhpdiag via ci-joint.fr stp

Light-Yagami · Answer

"test"  je n'arrive pas à poster sur le forum ...

Light-Yagami · Answer

le rapport : 


http://www.cijoint.fr/cjlink.php?file=cj200911/cijmkJdHDp.txt

Light-Yagami · Answer

supprimer ces processus de demarrage c possible ? surtout  que "ad-aware" je l'ai deja désinstaller y a longtemps mais il est tjrs sur la machine et plus dans "ajout et supp"
 

C:\Program Files\GameTracker\GSInGameService.exe

C:\Program Files\LogMeIn Hamachi\hamachi-2.exe

C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe


p: je crois que je vais desinstaller les 2 premiers en faite ... , mais pour ad aware comment faire pour le bouger ?

ceci dis plus de detections depuis ce matin ... bon signe :)

gen-hackman · Answer

==> Télécharge  OAD (de Laur3n7!)

&#9654 Enregistre le sur ton bureau

&#9654 Double clique sur le OAD pour le lancer

&#9654 nom de fichier à rechercher ,tape : |Ad-Aware|

&#9654 Type de recherche : sélectionne l'option 6 puis valide [entree]

OAD va maintenant rechercher le fichier. Laisse le travailler jusqu'à ce qu'il en ai terminé.
Le rapport de recherche s'affichera automatiquement à dès qu'il en aura terminé.

&#9654 Fais un copier / coller de ce rapport dans ton prochain post.

Note importante : Suivant la taille des disques dur cette recherche peut prendre plusieurs minutes. Sois patient

Light-Yagami · Answer

lun. 23/11/2009 ---- 21:51:08,42  

----------------------------------
§§§§§§ [Ad-Aware] §§§§§§
----------------------------------
[X] Registre
[  ] Fichier (rapide)
[  ] Fichier (disque systeme)
[X] Fichier (complete)




********************
     [Registre] 
********************


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DCE027F7-16A4-4BEE-9BE7-74F80EE3738F}\InprocServer32]
@="C:\Program Files\Lavasoft\Ad-Aware\ShellExt.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\B0B35DEDC76B4424EAA66DDFC3821DFE]
"ProductName"="Ad-Aware"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\B0B35DEDC76B4424EAA66DDFC3821DFE\SourceList]
"PackageName"="Ad-AwareInstallation.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{1CE668E6-8DCB-43A1-AEA3-6A012ADBBC76}\1.0\0\win32]
@="C:\Program Files\Lavasoft\Ad-Aware\ShellExt.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{1CE668E6-8DCB-43A1-AEA3-6A012ADBBC76}\1.0\HELPDIR]
@="C:\Program Files\Lavasoft\Ad-Aware"

[HKEY_LOCAL_MACHINE\SOFTWARE\Lavasoft\Ad-Aware]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\YUCache\Ad-Aware]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files\Lavasoft\Ad-Aware\"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files\Lavasoft\Ad-Aware\Release\Uncompressed\data\Microsoft Visual C++ Runtime 9.0 (includes ATL and MFC) Service Pack 1\3CBFA2AD\373872A7\"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files\Lavasoft\Ad-Aware\Release\Uncompressed\data\Microsoft Visual C++ Runtime 9.0 (includes ATL and MFC) Service Pack 1\3CBFA2AD\"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files\Lavasoft\Ad-Aware\Release\Uncompressed\data\Microsoft Visual C++ Runtime 9.0 (includes ATL and MFC) Service Pack 1\"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files\Lavasoft\Ad-Aware\Release\Uncompressed\data\"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files\Lavasoft\Ad-Aware\Release\Uncompressed\"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files\Lavasoft\Ad-Aware\Release\"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files\Lavasoft\Ad-Aware\Drivers\32\"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files\Lavasoft\Ad-Aware\Drivers\"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files\Lavasoft\Ad-Aware\Drivers\64\"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files\Lavasoft\Ad-Aware\Languages\"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files\Lavasoft\Ad-Aware\Resources\"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files\Lavasoft\Ad-Aware\ToolBox\LT\"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files\Lavasoft\Ad-Aware\ToolBox\"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files\Lavasoft\Ad-Aware\ToolBox\LT\Lang\"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files\Lavasoft\Ad-Aware\ToolBox\AutoStart Manager\"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files\Lavasoft\Ad-Aware\ToolBox\AutoStart Manager\Skins\grey\"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files\Lavasoft\Ad-Aware\ToolBox\AutoStart Manager\Skins\"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files\Lavasoft\Ad-Aware\ToolBox\AutoStart Manager\Translations\"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Lavasoft\Ad-Aware\"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Lavasoft\Ad-Aware\Toolbox\"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\014D58EE94A07BB4EA1367C08D5F750F]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\LavasoftGCHelper.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\018B34DA6466928448ADDFDD0351F2F5]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\aegen.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\06D64F5616F7D5147A800C2B2D390E72]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\lavamessage.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0964B21E4854E9E43901859FBE625498]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Lavasoft\Ad-Aware\Toolbox\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0BF0AAD2B0C3DE34CB2FC29E4E89B8DC]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\aawapi.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E3F19FD7B30DC3438D84A4AC981901C]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\aebb.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0FE702E64CBFE864BA309BC1032EECA1]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\Ad-Aware.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1067559529FB98E4CBD20DA28F0741F1]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\Drivers\64\AAWDriverTool.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\11DAD179C60DEFD4F801215D65A072D1]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\dbghelp.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\194BF82A2B40C16429746BC8215EC2B8]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\ToolBox\AutoStart Manager\AutoStart Manager.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1B29316863193124A9DF3F77A13650F5]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\savapi3.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1BD8DB1EB352FD34E8BE9D33719B0708]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\Ad-AwareCommand.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1C731A68FFFA30742A3502F28B03DE58]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\UpdateManager.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\20A5BA6F3A5DC6D4AAEB89DF3ED75591]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\Ad-Aware_manual_JA.chm"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\21EFA1229AD9A544A975B3D314CEA202]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\aecore.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\278527C4412FB4844AB0FE90AA9D9FA2]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\aescript.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2AC8686C3A789614E8C6C43467EB920B]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\msvcr71.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2AD4E3C6E2ED93B4E8092EE4A51F9E35]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\lavalicense.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2EB2C0EAE594D00438C971ABACA6DBF3]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\ToolBox\LT\Lang\DE.lslang"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\34C70C1EFC8F8124C8FE81311DCA1AE4]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\AAWWSC.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3AD101141E9E8774886524FCAE344D4B]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\ToolBox\AutoStart Manager\SO.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3B12B5B33CE4D0847863B9DB696AB97D]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\ToolBox\LT\ProcessWatch.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\40624885B591F73489C863DE2540BC2D]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\Drivers\32\DIFxAPI.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4083CA946660B6446A9641183D1DAAF4]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\unacev2.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4523BCD10E7037945BEED347942B0EAF]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\pubkey.dat"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\46F5E92F92A1DD747BBB65F3E9F89A4B]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\ToolBox\AutoStart Manager\Translations\de.xml"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4914A346D420FDD4DB48D80E84FEB42D]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4E66041D9D637DC408EF393330A18114]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\Drivers\64\DIFxAPI.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5103AB91A4E781F428AFF0944D11769D]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Lavasoft\Ad-Aware\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\539F671EA79DE3945BA0A6E418F910E1]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\threatwork.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5492EA072D80222448378ABB8DBFF7F8]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\Resources.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\56E2987A0799017439C49F92EF0F6DAF]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\ToolBox\LT\ProcessWatch.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\59413651A436B064FBF1DF11604BCAB9]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\msvcp71.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5B2B4D9A933FCDE47951F4B3C20CE1C8]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\Drivers\32\AAWDriverTool.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\65D73282948DADB46943124200DC154D]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\aeoffice.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6AADE1B5E9B28E94EBBFF96FC8DCB9D3]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\Neutralize.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6FCFC86DBC6F20C40BDAD82E64DDE73A]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\ToolBox\AutoStart Manager\Skins\grey\gbottompic.bmp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7281C6BC5F0D56B4A9C73A81CCC75733]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\aeemu.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\78425B93FE8CB7040A5BE116745FB447]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\Lavasoft Homepage.url"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\787DA652C545E704295B0BE4C2485F82]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Lavasoft\Ad-Aware\Toolbox\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7E5CEC4DF2989264D9B321EDEEDF1887]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Lavasoft\Ad-Aware\Toolbox\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\81241F8C69C72F94387215A183B4A0B7]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\Ad-Aware_manual_DE.chm"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\87ACED2E88B46B142AF791455A9AF8BD]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\aevdf.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8A59C1C96FD8A724FB85CAAF827ED41C]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Lavasoft\Ad-Aware\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8BFD9C68052585348875C6B9CCB462E3]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\aerdl.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8CDD1F3FBCFFD0A4288B4EFDCB4CFA65]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\Ad-Aware_manual_JA.chm"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8F07DF6E336AE394198137E01A6A5437]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\Ad-Aware_manual_FR.chm"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8F8E28CA0BC530F4198AE2E09A8FFA86]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\95F406D48A6B95A409CDFA50DE7E933D]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\Ad-Aware_manual_EN.chm"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9AA84B7FFAF93314A933FAA4B78143A7]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\aeheur.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9AF623522EA8DAF41B6E56980F9148A0]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\ToolBox\LT\HostFileEditor.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9BE275AB97D9B894BACD6975A581F0AE]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Lavasoft\Ad-Aware\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9C736B868C65D4946A74096E17D2C490]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\version.dat"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9FEBDDF7C9C83FB4EB20B53FD1B1CEC4]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\PrivacyClean.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A27043D92F061144AB5F33D6E86DECF3]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A3171B47C9B415340B07200279F8BFE7]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\ToolBox\LT\Extras.LGFF"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A7424A4FF3C87BB44ADB3124948AAF6D]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\Savapibridge.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A8C872029C465E74AB228946313F1660]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Lavasoft\Ad-Aware\Toolbox\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ADE755785861DCF46B7BF5BCC14DDA6C]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Lavasoft\Ad-Aware\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ADFE66C8ABF7B014AB92F8F55A2E5E97]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\Resources\aa11.efp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AECBD8F5CE47D9045AF23DA3595F142E]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Lavasoft\Ad-Aware\Toolbox\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AF052C779BFA8734E887DBEDAEC5DB23]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\Ad-Aware_manual_FR.chm"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B39BB8995790E6849BDE1D83C6525768]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\CEAPI.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BA584186820720A4F8072ED5E78F9DBF]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\aescn.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BC7657EFAF4EC3D4D89BB7C851B0DA96]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\lsdelete.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BE24FCB8AA89BC944A5A241390F4FDCD]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\RPAPI.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C2C9D3381F441D44E9158268275F32F8]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\aepack.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CD89EA430A2BC484E8CFBDF33E208B44]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\Release\Uncompressed\data\Microsoft Visual C++ Runtime 9.0 (includes ATL and MFC) Service Pack 1\3CBFA2AD\373872A7\Lavasoft Homepage.url"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CF1F48F72584DFC45AF5ED5799E23F79]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\ShellExt.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D827ADBCA918ED343B3D4D63208CB895]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\aehelp.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DC324644ADF561A44ABBD69CDB06C8FC]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Lavasoft\Ad-Aware\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DD4BC80EFC19DEF4BB7215F3BFB3A535]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\Languages\ResourceAdmin.xml"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DECAB613277A8AD4A90612938B2C4373]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\Ad-Aware_manual_EN.chm"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E44130FA03DD2784E9CAE77CA4BDAF55]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\unrar.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E802561417238F2458B9E531DD125583]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\gcapi_dll.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E97B701E1A902A64A836492D124D85DB]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EA2ACBF2F2AFACD40A959643012DCD75]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\WSCUpdate.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F0EB4033A1F45324B8C349A9FCEBBED5]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\core.aawdef"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F20236D3CE8ABB641AE7A585777A4A37]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\Ad-Aware_manual_DE.chm"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F68F8CA01541A234DB6CACD4A917239E]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FE3D8EB6DAD6A1448A93514BDE3D5ACD]
"B0B35DEDC76B4424EAA66DDFC3821DFE"="C:\Program Files\Lavasoft\Ad-Aware\Download Guard for Internet Explorer.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\B0B35DEDC76B4424EAA66DDFC3821DFE\InstallProperties]
"InstallLocation"="C:\Program Files\Lavasoft\Ad-Aware"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\B0B35DEDC76B4424EAA66DDFC3821DFE\InstallProperties]
"DisplayName"="Ad-Aware"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}]
"InstallLocation"="C:\Program Files\Lavasoft\Ad-Aware"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}]
"DisplayName"="Ad-Aware"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_LAVASOFT_AD-AWARE_SERVICE]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_LAVASOFT_AD-AWARE_SERVICE\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_LAVASOFT_AD-AWARE_SERVICE\0000]
"Service"="Lavasoft Ad-Aware Service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_LAVASOFT_AD-AWARE_SERVICE\0000]
"DeviceDesc"="Lavasoft Ad-Aware Service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Lavasoft Ad-Aware Service]
"DisplayName"="Lavasoft Ad-Aware Service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Lavasoft Ad-Aware Service]
"Description"="Ad-Aware Service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Lavasoft Ad-Aware Service\Security]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Lbd]
"Description"="Ad-Aware mini-filter driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Network\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_LAVASOFT_AD-AWARE_SERVICE]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_LAVASOFT_AD-AWARE_SERVICE\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_LAVASOFT_AD-AWARE_SERVICE\0000]
"Service"="Lavasoft Ad-Aware Service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_LAVASOFT_AD-AWARE_SERVICE\0000]
"DeviceDesc"="Lavasoft Ad-Aware Service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_LAVASOFT_AD-AWARE_SERVICE\0000\Control]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_LAVASOFT_AD-AWARE_SERVICE\0000\Control]
"ActiveService"="Lavasoft Ad-Aware Service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Lavasoft Ad-Aware Service]
"DisplayName"="Lavasoft Ad-Aware Service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Lavasoft Ad-Aware Service]
"Description"="Ad-Aware Service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Lavasoft Ad-Aware Service\Security]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Lavasoft Ad-Aware Service\Enum]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Lavasoft Ad-Aware Service\Enum]
"0"="Root\LEGACY_LAVASOFT_AD-AWARE_SERVICE\0000"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Lbd]
"Description"="Ad-Aware mini-filter driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\SafeBoot\Network\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_LAVASOFT_AD-AWARE_SERVICE]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_LAVASOFT_AD-AWARE_SERVICE\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_LAVASOFT_AD-AWARE_SERVICE\0000]
"Service"="Lavasoft Ad-Aware Service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_LAVASOFT_AD-AWARE_SERVICE\0000]
"DeviceDesc"="Lavasoft Ad-Aware Service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Lavasoft Ad-Aware Service]
"DisplayName"="Lavasoft Ad-Aware Service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Lavasoft Ad-Aware Service]
"Description"="Ad-Aware Service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Lavasoft Ad-Aware Service\Security]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Lbd]
"Description"="Ad-Aware mini-filter driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_LAVASOFT_AD-AWARE_SERVICE]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_LAVASOFT_AD-AWARE_SERVICE\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_LAVASOFT_AD-AWARE_SERVICE\0000]
"Service"="Lavasoft Ad-Aware Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_LAVASOFT_AD-AWARE_SERVICE\0000]
"DeviceDesc"="Lavasoft Ad-Aware Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_LAVASOFT_AD-AWARE_SERVICE\0000\Control]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_LAVASOFT_AD-AWARE_SERVICE\0000\Control]
"ActiveService"="Lavasoft Ad-Aware Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Lavasoft Ad-Aware Service]
"DisplayName"="Lavasoft Ad-Aware Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Lavasoft Ad-Aware Service]
"Description"="Ad-Aware Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Lavasoft Ad-Aware Service\Security]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Lavasoft Ad-Aware Service\Enum]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Lavasoft Ad-Aware Service\Enum]
"0"="Root\LEGACY_LAVASOFT_AD-AWARE_SERVICE\0000"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Lbd]
"Description"="Ad-Aware mini-filter driver"

[HKEY_USERS\S-1-5-21-329068152-2000478354-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\Lavasoft\Ad-Aware]

[HKEY_USERS\S-1-5-21-329068152-2000478354-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\Lavasoft\Ad-Aware\Toolbox]

[HKEY_USERS\S-1-5-21-329068152-2000478354-839522115-1004\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe"="Ad-Aware Tray Application"

[HKEY_USERS\S-1-5-21-329068152-2000478354-839522115-1004\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe"="Ad-Aware Service Application"

[HKEY_USERS\S-1-5-21-329068152-2000478354-839522115-1004\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\Program Files\Lavasoft\Ad-Aware\lsdelete.exe"="lsdelete"

[HKEY_USERS\S-1-5-21-329068152-2000478354-839522115-1004\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\Program Files\Lavasoft\Ad-Aware\LavasoftGCHelper.exe"="LavasoftGCHelper"

[HKEY_USERS\S-1-5-21-329068152-2000478354-839522115-1004\Software\SpeedBit\Download Accelerator\NoTrigger]
"LastUrl"="http://rapidshare.com/files/252634874/Ad-AwareAE.exe"

*******************
     [Fichier] 
*******************

c:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware
c:\Documents and Settings\All Users\Menu D‚marrer\Programmes\Lavasoft\Ad-Aware
c:\Program Files\Lavasoft\Ad-Aware
c:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware
c:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-Aware.exe
c:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-Aware.exe.compressed
c:\Documents and Settings\All Users\Menu D‚marrer\Programmes\Lavasoft\Ad-Aware
c:\Documents and Settings\All Users\Menu D‚marrer\Programmes\Lavasoft\Ad-Aware\Ad-Aware.lnk
c:\Documents and Settings\Yagami\Application Data\Microsoft\Internet Explorer\Quick Launch\Ad-Aware.lnk
c:\Documents and Settings\Yagami\Bureau\SECURITE\Ad-Aware.lnk
c:\Program Files\Ad-Remover\QUARANTINE\WINDOWS\Prefetch\AD-AWARE.EXE-3122AD3A.pf.vir
c:\Program Files\Lavasoft\Ad-Aware
c:\Program Files\Lavasoft\Ad-Aware\Ad-Aware.exe


*********************
     [Même date] 
*********************

C:\autorun.inf 
C:\boot.ini 
C:\Qoobox 
C:\RECYCLER 
C:sit 
C:\ToolBar 
C:\UsbFix 
C:\_OTM 
C:\WINDOWS\AppPatch 
C:\WINDOWS\ERUNT 
C:\WINDOWS\system.ini 
C:\WINDOWS\win.ini 
C:\WINDOWS\$NtUninstallKB969947$ 
C:\WINDOWS\system32\MpSigStub.exe 
C:\WINDOWS\system32\Restore 
C:\WINDOWS\system32\DirectX 
C:\WINDOWS\system32\drivers\etc 
C:\WINDOWS\system32\drivers\SBREDrv.sys 



----------------------------------
§§§§§ Fin Rapport §§§§§ 
----------------------------------

gen-hackman · Answer

apparement il  n 'est pas desinstallé

regarde si tu n'as pas un desinstaller dans le menu demarrer/programmes/AD-Aware

Light-Yagami · Answer

non deja regarder , enfaite il n'est detecter ni par "ajout et supressé ni par "tune up " "ni c cleaner " ni aucun des programmes d'ailleur , et je sais meme pas virer le dossier non plus il me dit "acces refusé" mais il demarre tout les jours , je sais le mettre à jour et faire des scan mais j'ai deja tellement de protection "inefficasse d'ailleur :p

gen-hackman · Answer

je te le virerai demain car je dois me lever à 5.00 et je vais au lit

à demain ^^

Light-Yagami · Answer

sans probleme !! desole , on a tout notre temps .. bonne nuit a+ gen

Light-Yagami · Answer

pour info 2 nouvelles detections ce soir .... aie aie aie :) tjrs la meme bebete ^^  

Dans le fichier 'C:\Documents and Settings\Yagami\Local Settings	emp\~27.tmp'
un virus ou un programme indésirable 'TR/Crypt.XPACK.Gen' [trojan] a été détecté.
Action exécutée : Déplacer le fichier en quarantaine



Dans le fichier 'C:\Documents and Settings\Yagami\Local Settings	emp\~60.tmp'
un virus ou un programme indésirable 'TR/Crypt.XPACK.Gen' [trojan] a été détecté.
Action exécutée : Déplacer le fichier en quarantaine

et tjrs en jouant ... pas qd je "surf" ^^

+++

jacques.gache · Answer

et tjrs en jouant ... pas qd je "surf" ^^ 

bonjour et en jouant à quoi ??

Light-Yagami · Answer

bonjour Jacques, a CALL of duty  moderne warfare 2 .

Light-Yagami · Answer

a mon avis ce virus : TR/Crypt.XPACK.Gen est venu pour tout le monde du crack russe multi joueur "TEKNOGODS "de cod6  

enfin le "pre crack" qui n'a tenu que 2 jours puisque steam à contré avec 2 mise à jours  simultanée 

dans le mon cas le crack à ete supprimé , j'ai finalement acheté le jeu ... 

enfin si ça peux aider ... bonne journee .

gen-hackman · Answer

je pense que tu dois te brancher sur des serveurs pourris

suis ce lien et fais ce qui est indiqué dessus

http://www.cijoint.fr/cjlink.php?file=cj200911/cijJ2UDLUS.txt

Light-Yagami · Answer

All processes killed
========== PROCESSES ==========
Process explorer.exe killed successfully!
No active process named iexplore.exe was found!
No active process named firefox.exe was found!
No active process named msnmsgr.exe was found!
No active process named Teatimer.exe was found!
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DCE027F7-16A4-4B­EE-9BE7-74F80EE3738F}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DCE027F7-16A4-4B­EE-9BE7-74F80EE3738F}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\B0B35DEDC76B4424EAA66DDFC3821DFE\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{1CE668E6-8DCB-43A1-AEA3-6A012ADBBC76}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1CE668E6-8DCB-43A1-AEA3-6A012ADBBC76}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Lavasoft\Ad-Aware\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\YUCache\Ad-Aware\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files\Lavasoft\Ad-Aware not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files\Lavasoft\Ad-Aware\Release\Uncompressed\data\Microsoft Visual C++ Runtime 9.0 (includes ATL and MFC) Service Pack 1\3CBFA2AD\373872A7\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files\Lavasoft\Ad-Aware\Release\Uncompressed\data\Microsoft Visual C++ Runtime 9.0 (includes ATL and MFC) Service Pack 1\3CBFA2AD\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files\Lavasoft\Ad-Aware\Release\Uncompressed\data\Microsoft Visual C++ Runtime 9.0 (includes ATL and MFC) Service Pack 1\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files\Lavasoft\Ad-Aware\Release\Uncompressed\data\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files\Lavasoft\Ad-Aware\Release\Uncompressed\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files\Lavasoft\Ad-Aware\Release\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files\Lavasoft\Ad-Aware\Drivers\32\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files\Lavasoft\Ad-Aware\Drivers\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files\Lavasoft\Ad-Aware\Drivers\64\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files\Lavasoft\Ad-Aware\Languages\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files\Lavasoft\Ad-Aware\Resources\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files\Lavasoft\Ad-Aware\ToolBox\LT\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files\Lavasoft\Ad-Aware\ToolBox\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files\Lavasoft\Ad-Aware\ToolBox\LT\Lang\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files\Lavasoft\Ad-Aware\ToolBox\AutoStart Manager\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files\Lavasoft\Ad-Aware\ToolBox\AutoStart Manager\Skins\grey\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files\Lavasoft\Ad-Aware\ToolBox\AutoStart Manager\Skins\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files\Lavasoft\Ad-Aware\ToolBox\AutoStart Manager\Translations\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Lavasoft\Ad-Aware\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Lavasoft\Ad-Aware\Toolbox\ deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\014D58EE94A07BB4EA1367C08D5F750F\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\018B34DA6466928448ADDFDD0351F2F5\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\06D64F5616F7D5147A800C2B2D390E72\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0964B21E4854E9E43901859FBE625498\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0BF0AAD2B0C3DE34CB2FC29E4E89B8DC\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E3F19FD7B30DC3438D84A4AC981901C\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0FE702E64CBFE864BA309BC1032EECA1\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1067559529FB98E4CBD20DA28F0741F1\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\11DAD179C60DEFD4F801215D65A072D1\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\194BF82A2B40C16429746BC8215EC2B8\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1B29316863193124A9DF3F77A13650F5\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1BD8DB1EB352FD34E8BE9D33719B0708\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1C731A68FFFA30742A3502F28B03DE58\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\20A5BA6F3A5DC6D4AAEB89DF3ED75591\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\21EFA1229AD9A544A975B3D314CEA202\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\278527C4412FB4844AB0FE90AA9D9FA2\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2AC8686C3A789614E8C6C43467EB920B\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2AD4E3C6E2ED93B4E8092EE4A51F9E35\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2EB2C0EAE594D00438C971ABACA6DBF3\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\34C70C1EFC8F8124C8FE81311DCA1AE4\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"e" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3AD101141E9E8774886524FCAE344D4B\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3B12B5B33CE4D0847863B9DB696AB97D\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\40624885B591F73489C863DE2540BC2D\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4083CA946660B6446A9641183D1DAAF4\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4523BCD10E7037945BEED347942B0EAF\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\46F5E92F92A1DD747BBB65F3E9F89A4B\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4914A346D420FDD4DB48D80E84FEB42D\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4E66041D9D637DC408EF393330A18114\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5103AB91A4E781F428AFF0944D11769D\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\539F671EA79DE3945BA0A6E418F910E1\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5492EA072D80222448378ABB8DBFF7F8\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\56E2987A0799017439C49F92EF0F6DAF\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\59413651A436B064FBF1DF11604BCAB9\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5B2B4D9A933FCDE47951F4B3C20CE1C8\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\65D73282948DADB46943124200DC154D\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6AADE1B5E9B28E94EBBFF96FC8DCB9D3\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6FCFC86DBC6F20C40BDAD82E64DDE73A\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7281C6BC5F0D56B4A9C73A81CCC75733\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\78425B93FE8CB7040A5BE116745FB447\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\787DA652C545E704295B0BE4C2485F82\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7E5CEC4DF2989264D9B321EDEEDF1887\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\81241F8C69C72F94387215A183B4A0B7\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\87ACED2E88B46B142AF791455A9AF8BD\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8A59C1C96FD8A724FB85CAAF827ED41C\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8BFD9C68052585348875C6B9CCB462E3\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8CDD1F3FBCFFD0A4288B4EFDCB4CFA65\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8F07DF6E336AE394198137E01A6A5437\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8F8E28CA0BC530F4198AE2E09A8FFA86\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\95F406D48A6B95A409CDFA50DE7E933D\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9AA84B7FFAF93314A933FAA4B78143A7\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9AF623522EA8DAF41B6E56980F9148A0\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9BE275AB97D9B894BACD6975A581F0AE\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9C736B868C65D4946A74096E17D2C490\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9FEBDDF7C9C83FB4EB20B53FD1B1CEC4\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A27043D92F061144AB5F33D6E86DECF3\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A3171B47C9B415340B07200279F8BFE7\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A7424A4FF3C87BB44ADB3124948AAF6D\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A8C872029C465E74AB228946313F1660\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ADE755785861DCF46B7BF5BCC14DDA6C\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ADFE66C8ABF7B014AB92F8F55A2E5E97\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AECBD8F5CE47D9045AF23DA3595F142E\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AF052C779BFA8734E887DBEDAEC5DB23\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B39BB8995790E6849BDE1D83C6525768\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BA584186820720A4F8072ED5E78F9DBF\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BC7657EFAF4EC3D4D89BB7C851B0DA96\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BE24FCB8AA89BC944A5A241390F4FDCD\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C2C9D3381F441D44E9158268275F32F8\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CD89EA430A2BC484E8CFBDF33E208B44\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CF1F48F72584DFC45AF5ED5799E23F79\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D827ADBCA918ED343B3D4D63208CB895\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DC324644ADF561A44ABBD69CDB06C8FC\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DD4BC80EFC19DEF4BB7215F3BFB3A535\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DECAB613277A8AD4A90612938B2C4373\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E44130FA03DD2784E9CAE77CA4BDAF55\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E802561417238F2458B9E531DD125583\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E97B701E1A902A64A836492D124D85DB\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EA2ACBF2F2AFACD40A959643012DCD75\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F0EB4033A1F45324B8C349A9FCEBBED5\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F20236D3CE8ABB641AE7A585777A4A37\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F68F8CA01541A234DB6CACD4A917239E\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FE3D8EB6DAD6A1448A93514BDE3D5ACD\"B0B35DEDC76B4424EAA66DDFC3821DFE"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\B0B35DEDC76B4424EAA66DDFC3821DFE\InstallProperties\"InstallLocation"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\B0B35DEDC76B4424EAA66DDFC3821DFE\InstallProperties\"DisplayName"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}\"InstallLocation"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}\"DisplayName"|"" /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\Lavasoft Ad-Aware Service\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_LAVASOFT_AD-AWARE_SERVICE\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Lavasoft Ad-Aware Service\ deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Lbd\"Description"|"" /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Network\Lavasoft Ad-Aware Service\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_LAVASOFT_AD-AWARE_SERVICE\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Lavasoft Ad-Aware Service\ deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Lbd\"Description"|"" /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\SafeBoot\Network\Lavasoft Ad-Aware Service\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_LAVASOFT_AD-AWARE_SERVICE\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Lavasoft Ad-Aware Service\ deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Lbd\"Description"|"" /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service\ not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Lavasoft Ad-Aware Service\ not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_LAVASOFT_AD-AWARE_SERVICE\ not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Lavasoft Ad-Aware Service\ not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Lbd\"Description"|"" /E : value set successfully!
Registry key HKEY_USERS\S-1-5-21-329068152-2000478354-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\Lavasoft\Ad-Aware\ deleted successfully.
Registry value HKEY_USERS\S-1-5-21-329068152-2000478354-839522115-1004\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe deleted successfully.
Registry value HKEY_USERS\S-1-5-21-329068152-2000478354-839522115-1004\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe deleted successfully.
Registry value HKEY_USERS\S-1-5-21-329068152-2000478354-839522115-1004\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\Program Files\Lavasoft\Ad-Aware\lsdelete.exe not found.
Registry value HKEY_USERS\S-1-5-21-329068152-2000478354-839522115-1004\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\Program Files\Lavasoft\Ad-Aware\LavasoftGCHelper.exe not found.
Unable to set value : HKEY_USERS\S-1-5-21-329068152-2000478354-839522115-1004\Software\SpeedBit\Download Accelerator\NoTrigger\"LastUrl"|"" /E!
========== FILES ==========
c:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Resources folder moved successfully.
c:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Languages folder moved successfully.
c:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Drivers folder moved successfully.
c:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\Update folder moved successfully.
c:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\ThreatWork Alliance\Submit folder moved successfully.
c:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\ThreatWork Alliance folder moved successfully.
c:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\Statistics folder moved successfully.
c:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\Quarantine folder moved successfully.
c:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\MiniMessage folder moved successfully.
c:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\Logs folder moved successfully.
c:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended folder moved successfully.
c:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs folder moved successfully.
c:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\Crashdumps folder moved successfully.
c:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware folder moved successfully.
File/Folder c:\Documents and Settings\All Users\Menu D‚marrer\Programmes\Lavasoft\Ad-Aware not found.
c:\Program Files\Lavasoft\Ad-Aware\ToolBox\LT\Lang folder moved successfully.
c:\Program Files\Lavasoft\Ad-Aware\ToolBox\LT folder moved successfully.
c:\Program Files\Lavasoft\Ad-Aware\ToolBox\AutoStart Manager\Translations folder moved successfully.
c:\Program Files\Lavasoft\Ad-Aware\ToolBox\AutoStart Manager\Skins\grey folder moved successfully.
c:\Program Files\Lavasoft\Ad-Aware\ToolBox\AutoStart Manager\Skins folder moved successfully.
c:\Program Files\Lavasoft\Ad-Aware\ToolBox\AutoStart Manager folder moved successfully.
c:\Program Files\Lavasoft\Ad-Aware\ToolBox folder moved successfully.
c:\Program Files\Lavasoft\Ad-Aware\Resources folder moved successfully.
c:\Program Files\Lavasoft\Ad-Aware\Release\Uncompressed\data\Microsoft Visual C++ Runtime 9.0 (includes ATL and MFC) Service Pack 1\3CBFA2AD\373872A7 folder moved successfully.
c:\Program Files\Lavasoft\Ad-Aware\Release\Uncompressed\data\Microsoft Visual C++ Runtime 9.0 (includes ATL and MFC) Service Pack 1\3CBFA2AD folder moved successfully.
c:\Program Files\Lavasoft\Ad-Aware\Release\Uncompressed\data\Microsoft Visual C++ Runtime 9.0 (includes ATL and MFC) Service Pack 1 folder moved successfully.
c:\Program Files\Lavasoft\Ad-Aware\Release\Uncompressed\data folder moved successfully.
c:\Program Files\Lavasoft\Ad-Aware\Release\Uncompressed folder moved successfully.
c:\Program Files\Lavasoft\Ad-Aware\Release folder moved successfully.
c:\Program Files\Lavasoft\Ad-Aware\Languages folder moved successfully.
c:\Program Files\Lavasoft\Ad-Aware\Drivers\64 folder moved successfully.
c:\Program Files\Lavasoft\Ad-Aware\Drivers\32 folder moved successfully.
c:\Program Files\Lavasoft\Ad-Aware\Drivers folder moved successfully.
c:\Program Files\Lavasoft\Ad-Aware folder moved successfully.
File/Folder c:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware not found.
File/Folder c:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-Aware.exe not found.
File/Folder c:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-Aware.exe.compressed not found.
File/Folder c:\Documents and Settings\All Users\Menu D‚marrer\Programmes\Lavasoft\Ad-Aware not found.
File/Folder c:\Documents and Settings\All Users\Menu D‚marrer\Programmes\Lavasoft\Ad-Aware\Ad-Aware.lnk not found.
c:\Documents and Settings\Yagami\Application Data\Microsoft\Internet Explorer\Quick Launch\Ad-Aware.lnk moved successfully.
c:\Documents and Settings\Yagami\Bureau\SECURITE\Ad-Aware.lnk moved successfully.
File/Folder c:\Program Files\Ad-Remover\QUARANTINE\WINDOWS\Prefetch\AD-AWARE.EXE-3122AD3A.pf.vir not found.
File/Folder c:\Program Files\Lavasoft\Ad-Aware not found.
File/Folder c:\Program Files\Lavasoft\Ad-Aware\Ad-Aware.exe not found.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Administrateur
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: All Users
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Yagami
->Temp folder emptied: 680071 bytes
->Temporary Internet Files folder emptied: 5486106 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 36320895 bytes
->Google Chrome cache emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
Windows Temp folder emptied: 49152 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 40353013 bytes
 
Total Files Cleaned = 79,08 mb
 
 
OTM by OldTimer - Version 3.1.2.0 log created on 11242009_093243

Files moved on Reboot...

Registry entries deleted on Reboot...



voila prends ton temps je vais bosser ... 

à ce soir .

gen-hackman · Answer

ok hello toujours AD-Aware present ?

Light-Yagami · Answer

slt :) non ad aware à bien ete supprimé , merci 

mais encore 4 detections depuis hier donc :/

gen-hackman · Answer

ben oui mais c est sur que si tu joues avec des cracks russes , ne t'etonnes pas !!!

Lyonnais92 · Answer

Salut,
https://forums.futura-sciences.com/securite-malwares-desinfectez-machine/356580-plusieurs-detection-de-tr-crypt-xpack-gen.html#post2690300

no other comment.

gen-hackman · Answer

merci Lyonnais

Yagami tu n'es pas serieux , et de plus tu mens à un vétéran du net....

les gens se décarcassent pour toi et tu les prend pour des anes !!!

Bye !!!

Light-Yagami · Answer

je trouve que j'ai ete plutot honnete moi ... tu desinfectes des gens tout les jours sans pour autant savoir comment ils ont chopper des crasses.....  

et tes remarques : "Ben oui mais c est sur que si tu joues avec des cracks russes , ne t'etonnes pas !!! " 

fort moyen ... ^^ tu grondes qui là ??? lolll 

que tu aies decidé "qd j'en avait besoin biensur" ... de ne plus m'aider s'était ton choix mais me laches pas des conneries "non plus" alors ...

j'ai tjrs ete polis et courtois mon grand ! tu peux vérifier .... 

et genre lécher le c.. des gens pour etre aider , je laisse ça aux autres ...

bonne continuation !

Infection ! GEN HACKMAN help me ;)

63 réponses

Discussions similaires

Newsletters