[infection] au secours

zouzou -  
Bonjour
je vous écris ce message dans l'espoir que quelq'un puisse m'aider. En effet, je ne suis pas une spécialiste de l'informatique et là je n'en peux plus...

Voilà mon problème :
Il y a deux jours on a telechargé un truc et depuis c'est le chaos. J'ai eu es fenetre internets qui s'ouvraient malgré moi (notamment serwab et sa soit disant solution.. Bon j'ai fait des recherches sur internet et j'ai téléchargé pas mal d'antivirus, antispywre pour assayer de faire le menage (notamment zone alarm qui a trouvé plus de630 et queques virus ou fichiers infectés.
bref, au final, j'ai perdu mes photos et pas mal de dossiers remplis de documents.
et quand je veux lancer spybot.. et fsecure blacklight que j'ai teléchargés, ca refuse.
bref je sais plus quoi faire pour retrouver un ordi sain.
Quelqu'un peut-il m'aider?
merci d'avance
Configuration: windows xp

24 réponses

  1.  ^^Marie^^
    Slt,

    on a telechargé un truc Quoi ???
    Tu ne peux pas le supprimer dans ajout/supp ???

    Fais ceci :

    F - Hijackthis - Outil de diagnostic et réparation
    lire démo
    http://pageperso.aol.fr/balltrap34/Hijenr.gif
    http://pageperso.aol.fr/balltrap34/demohijack.htm
    Télécharge version française ici
    http://telechargement.zebulon.fr/160-patch-francais-pour-hijackthis-1991.html
    Copie/colle le rapport

    Bon courage

    A++
    0
    1. zouzou
      merci de m'avoir répondu si vite
      j'ai teléchargé mais il ne veut pas se lancer...
      0
      1. zouzou
        autre précision, quand je regarde dans le gestionnaire des taches, dans application, ya un truc qui se lance tout seul (meme si je stoppe réculièrement) et qui s'appelle project1.
        Kezako?
        0
        1. zouzou
          bon j'ai finalement réussi voici ce que ca donne :
          Logfile of HijackThis v1.99.1
          Scan saved at 10:57:10, on 21/08/2006
          Platform: Windows XP SP2 (WinNT 5.01.2600)
          MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

          Running processes:
          C:\WINDOWS\System32\smss.exe
          C:\WINDOWS\system32\winlogon.exe
          C:\WINDOWS\system32\services.exe
          C:\WINDOWS\system32\lsass.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\System32\svchost.exe
          C:\WINDOWS\system32\LEXBCES.EXE
          C:\WINDOWS\system32\spoolsv.exe
          C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
          C:\Program Files\Alwil Software\Avast4\ashServ.exe
          C:\Program Files\ewido anti-spyware 4.0\guard.exe
          C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
          C:\WINDOWS\System32\nvsvc32.exe
          C:\WINDOWS\system32\pctspk.exe
          C:\WINDOWS\system32\SatSrv.exe
          C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
          C:\WINDOWS\System32\svchost.exe
          C:\WINDOWS\system32\ZoneLabs\vsmon.exe
          C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
          C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
          C:\WINDOWS\system32\ZoneLabs\isafe.exe
          C:\WINDOWS\Explorer.EXE
          C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
          C:\PROGRA~1\LEXMAR~1\ACMonitor_X73.exe
          C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X73.exe
          C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
          C:\WINDOWS\system32\sstray.exe
          C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
          C:\WINDOWS\system32\ctfmon.exe
          C:\WINDOWS\system32\rundll32.exe
          C:\WINDOWS\System32\svchost.exe
          C:\Program Files\Internet Explorer\iexplore.exe
          C:\WINDOWS\system32\taskmgr.exe
          C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com
          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com
          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://actus.sfr.fr
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
          R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com
          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer avec Club-Internet
          R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
          R3 - Default URLSearchHook is missing
          O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
          O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
          O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
          O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
          O4 - HKLM\..\Run: [Lexmark X73 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X73.exe
          O4 - HKLM\..\Run: [Lexmark X73 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X73.exe
          O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
          O4 - HKLM\..\Run: [keyboard] C:\\kybrdff_11a.exe
          O4 - HKLM\..\Run: [eav31ca1] RUNDLL32.EXE w2351762.dll,n 00331c9e0000000a2351762
          O4 - HKLM\..\Run: [newname] C:\\nwnmff_11.exe
          O4 - HKLM\..\Run: [Workflow] D:\install\Workflow.exe
          O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
          O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
          O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
          O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
          O4 - HKLM\..\Run: [Dit] Dit.exe
          O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
          O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
          O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
          O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
          O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe
          O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
          O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
          O4 - HKLM\..\Run: [BtcMaestro] C:\Program Files\KMaestro\KMaestro.exe
          O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
          O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
          O4 - HKCU\..\Run: [SSS2006] "C:\Program Files\Steganos Security Suite 2006\SSS2006.exe" -boot
          O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
          O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
          O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
          O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
          O8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
          O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
          O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
          O8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
          O8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
          O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
          O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
          O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
          O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
          O16 - DPF: teleir_cert - https://static.ir.dgi.minefi.gouv.fr/secure/connexion/archives/ie4n4/teleir_cert.cab
          O16 - DPF: {09C21411-B9A2-4DE6-8416-4E3B58577BE0} (France Telecom MDM ActiveX Control) - http://minitelweb.minitel.com/imin_data/ocx/MDM.cab
          O16 - DPF: {1F83CD9E-505E-4F87-BECE-0832A763E36F} (Image Uploader 3.0 Control) - http://www.mypixmania.com/fr/fr/importer/MypixUploader.cab
          O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540000} (CInstall Class) - http://www.videossimo.com/videossimo/portail/cab/Install.cab
          O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/026a092ea38db51fd106/netzip/RdxIE601_fr.cab
          O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
          O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
          O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IP-Uploader Control) - http://asp03.photoprintit.de/microsite/1156/defaults/activex/ImageUploader3.cab
          O17 - HKLM\System\CCS\Services\Tcpip\..\{8620F741-9FFE-43FE-A526-1C55ED88E46F}: NameServer = 194.17.200.10,194.117.200.15
          O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
          O20 - AppInit_DLLs: repairs303169590.dll
          O20 - Winlogon Notify: DateTime - C:\WINDOWS\system32\udib.dll (file missing)
          O20 - Winlogon Notify: Extensions - C:\WINDOWS\system32\k2440chqef4e0.dll (file missing)
          O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
          O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
          O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
          O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
          O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
          O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe.exe
          O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
          O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
          O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
          O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
          O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
          O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
          O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
          O23 - Service: Steganos AntiTheft (SatSrv) - Unknown owner - C:\WINDOWS\system32\SatSrv.exe
          O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

          alors, verdict?
          0
          2. zouzou
            ya plus personne pour m'aider???
            HELP!!!
            Merci à qui répondra à ce sos...
            0
            1. ^^Marie^^
              Heu !!!!!!!!!!! C'est le genre d'appel au secours que les Helpers n'aiment pas trop..............

              D'autres part tu n'as pas répondu à ça ::

              on a telechargé un truc ===> Quoi ???
              Tu ne peux pas le supprimer dans ajout/supp ???

              Salut

              Telecharge la derniere version stp

              http://siri.urz.free.fr/Fix/SmitfraudFix.zip
              SMITFRAUD REGIS 30/07/2006
              Télécharge ceci: (merci a S!RI pour ce programme).
              http://siri.urz.free.fr/Fix/SmitfraudFix.zip
              Exécute le, Double click sur Smitfraudfix.cmd choisit l’option 1, il va générer un rapport
              Copie/colle le sur le poste stp.
              ----------------------------------------------------------------------------
              Démarre en mode sans échec :
              Pour cela, tu tapotes la touche F8 dès le début de l’allumage du pc sans t’arrêter
              Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée.
              Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal !
              (Si F8 ne marche pas utilise la touche F5).
              ----------------------------------------------------------------------------
              Relance le programme Smitfraud,
              Cette fois choisit l’option 2, répond oui a tous ;
              Sauvegarde le rapport, Redémarre en mode normal, copie/colle le rapport sauvegardé sur le forum

              Et tu refais un Hitjackthis et tu nous dis koa 2 9...
              ========================================
              A+

              Prends patience un peu...........
              0
              1. zouzou
                Ok, je m'excuse pour l'impatience...
                Alors je vais faire tout ce que tu m'as dit et je reviens mettre ma réponse.
                Ah oui pour ce que j'ai téléchargé, ou plutôt ce que mon chéri a téléchargé c'etait des épisodes de dessin animé japonais. Comme il s'y connait pas du tout en ordi et qu'il découvre le téléchargement, et que j'étais pas là quand il l'a ouvert..Bref après j'ai supprimé le truc, c'etait un truc exe, mais je me souviens pas du nom exact parce que je me suis justement empressée de le supprimer. Voilà pour les explications et encore merci.
                0
                1. zouzou
                  voilà le 1er rapport.
                  Je fais le deuxième et je reviens. a tout a l'heure...
                  SmitFraudFix v2.81

                  Rapport fait à 13:13:24,17, 21/08/2006
                  Executé à partir de C:\Documents and Settings\juliette\Mes documents\logiciels\SmitfraudFix
                  OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
                  Fix executé en mode normal

                  »»»»»»»»»»»»»»»»»»»»»»»» C:\

                  »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

                  C:\WINDOWS\drsmartload2.dat PRESENT !
                  C:\WINDOWS\keyboard1.dat PRESENT !
                  C:\WINDOWS\newname.dat PRESENT !
                  C:\WINDOWS\teller2.chk PRESENT !

                  »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

                  »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

                  »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

                  »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\juliette\Application Data

                  »»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

                  »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\juliette\Favoris

                  »»»»»»»»»»»»»»»»»»»»»»»» Bureau

                  »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

                  »»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

                  »»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

                  [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
                  "Source"="C:\\Program Files\\WindowsUpdate\\kyfedy.html"
                  "SubscribedURL"=""
                  "FriendlyName"=""

                  [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\1]
                  "Source"="C:\\Program Files\\Services en ligne\\hocyboxu.html"
                  "SubscribedURL"=""
                  "FriendlyName"=""
                  [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\2]
                  "Source"="About:Home"
                  "SubscribedURL"="About:Home"
                  "FriendlyName"="Ma page d'accueil"

                  »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
                  !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                  SrchSTS.exe by S!Ri
                  Search SharedTaskScheduler's .dll

                  »»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

                  »»»»»»»»»»»»»»»»»»»»»»»» Fin
                  0
                  1. zouzou
                    coucou
                    alors voilà le deuxieme rapport avec mode sans echec
                    SmitFraudFix v2.81

                    Rapport fait à 13:21:11,12, 21/08/2006
                    Executé à partir de C:\Documents and Settings\juliette\Mes documents\logiciels\SmitfraudFix
                    OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
                    Fix executé en mode sans echec

                    »»»»»»»»»»»»»»»»»»»»»»»» Avant SmitFraudFix
                    !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                    SrchSTS.exe by S!Ri
                    Search SharedTaskScheduler's .dll

                    »»»»»»»»»»»»»»»»»»»»»»»» Arret des processus

                    »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

                    GenericRenosFix by S!Ri

                    »»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés

                    C:\WINDOWS\drsmartload2.dat supprimé
                    C:\WINDOWS\keyboard1.dat supprimé
                    C:\WINDOWS\newname.dat supprimé
                    C:\WINDOWS\teller2.chk supprimé

                    »»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires

                    »»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre

                    Nettoyage terminé.

                    »»»»»»»»»»»»»»»»»»»»»»»» Après SmitFraudFix
                    !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                    SrchSTS.exe by S!Ri
                    Search SharedTaskScheduler's .dll

                    »»»»»»»»»»»»»»»»»»»»»»»» Fin

                    et puis le deuxième rapport hijackthis
                    Logfile of HijackThis v1.99.1
                    Scan saved at 13:32:13, on 21/08/2006
                    Platform: Windows XP SP2 (WinNT 5.01.2600)
                    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

                    Running processes:
                    C:\WINDOWS\System32\smss.exe
                    C:\WINDOWS\system32\winlogon.exe
                    C:\WINDOWS\system32\services.exe
                    C:\WINDOWS\system32\lsass.exe
                    C:\WINDOWS\system32\svchost.exe
                    C:\WINDOWS\System32\svchost.exe
                    C:\WINDOWS\system32\LEXBCES.EXE
                    C:\WINDOWS\system32\spoolsv.exe
                    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                    C:\Program Files\Alwil Software\Avast4\ashServ.exe
                    C:\Program Files\ewido anti-spyware 4.0\guard.exe
                    C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
                    C:\WINDOWS\System32\nvsvc32.exe
                    C:\WINDOWS\system32\pctspk.exe
                    C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
                    C:\WINDOWS\system32\SatSrv.exe
                    C:\WINDOWS\System32\svchost.exe
                    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                    C:\WINDOWS\Explorer.EXE
                    C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                    C:\PROGRA~1\LEXMAR~1\ACMonitor_X73.exe
                    C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X73.exe
                    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
                    C:\WINDOWS\system32\sstray.exe
                    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                    C:\Program Files\ewido anti-spyware 4.0\ewido.exe
                    C:\Program Files\Winamp\winampa.exe
                    C:\Program Files\iTunes\iTunesHelper.exe
                    C:\Program Files\KMaestro\KMaestro.exe
                    C:\WINDOWS\system32\ctfmon.exe
                    C:\Program Files\iPod\bin\iPodService.exe
                    C:\WINDOWS\system32\rundll32.exe
                    C:\Program Files\Skype\Phone\Skype.exe
                    C:\Program Files\MSN Messenger\MsnMsgr.Exe
                    C:\Program Files\Steganos Security Suite 2006\SSS2006.exe
                    C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
                    C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

                    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com
                    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com
                    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
                    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://actus.sfr.fr
                    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer avec Club-Internet
                    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
                    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                    R3 - Default URLSearchHook is missing
                    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
                    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
                    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
                    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                    O4 - HKLM\..\Run: [Lexmark X73 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X73.exe
                    O4 - HKLM\..\Run: [Lexmark X73 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X73.exe
                    O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
                    O4 - HKLM\..\Run: [eav31ca1] RUNDLL32.EXE w2351762.dll,n 00331c9e0000000a2351762
                    O4 - HKLM\..\Run: [Workflow] D:\install\Workflow.exe
                    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
                    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
                    O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
                    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
                    O4 - HKLM\..\Run: [Dit] Dit.exe
                    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                    O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
                    O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
                    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
                    O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe
                    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
                    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
                    O4 - HKLM\..\Run: [BtcMaestro] C:\Program Files\KMaestro\KMaestro.exe
                    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                    O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
                    O4 - HKCU\..\Run: [SSS2006] "C:\Program Files\Steganos Security Suite 2006\SSS2006.exe" -boot
                    O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
                    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
                    O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
                    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
                    O8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
                    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
                    O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
                    O8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
                    O8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
                    O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
                    O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
                    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                    O16 - DPF: teleir_cert - https://static.ir.dgi.minefi.gouv.fr/secure/connexion/archives/ie4n4/teleir_cert.cab
                    O16 - DPF: {09C21411-B9A2-4DE6-8416-4E3B58577BE0} (France Telecom MDM ActiveX Control) - http://minitelweb.minitel.com/imin_data/ocx/MDM.cab
                    O16 - DPF: {1F83CD9E-505E-4F87-BECE-0832A763E36F} (Image Uploader 3.0 Control) - http://www.mypixmania.com/fr/fr/importer/MypixUploader.cab
                    O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540000} (CInstall Class) - http://www.videossimo.com/videossimo/portail/cab/Install.cab
                    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/026a092ea38db51fd106/netzip/RdxIE601_fr.cab
                    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
                    O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
                    O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IP-Uploader Control) - http://asp03.photoprintit.de/microsite/1156/defaults/activex/ImageUploader3.cab
                    O17 - HKLM\System\CCS\Services\Tcpip\..\{8620F741-9FFE-43FE-A526-1C55ED88E46F}: NameServer = 194.17.200.10,194.117.200.15
                    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
                    O20 - AppInit_DLLs: repairs303169590.dll
                    O20 - Winlogon Notify: DateTime - C:\WINDOWS\system32\udib.dll (file missing)
                    O20 - Winlogon Notify: Extensions - C:\WINDOWS\system32\k2440chqef4e0.dll (file missing)
                    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
                    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                    O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                    O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
                    O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
                    O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe.exe
                    O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
                    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
                    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
                    O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
                    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
                    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
                    O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
                    O23 - Service: Steganos AntiTheft (SatSrv) - Unknown owner - C:\WINDOWS\system32\SatSrv.exe
                    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

                    Voilà...
                    Merci
                    0
                    1. ^^Marie^^
                      Bonjour,

                      Méthode à suivre dans l'ordre...
                      ----------------------------------------------------------------------------
                      Télécharger ces logiciels (sauf si tu les as)
                      A utiliser plus tard

                      A - ad-aware version 1.06
                      (ici) http://www.florensac-chasse-trap.com/ section virus/logiciel de securite
                      voir demo
                      http://pageperso.aol.fr/balltrap34/adwseflash.zip

                      B - spybot version 1.4
                      (ici) http://www.florensac-chasse-trap.com/ section virus/logiciel de securite
                      voir demo d utilisation
                      http://pageperso.aol.fr/Balltrap34/demo%20spybot.htm

                      C - Ccleaner : ( nettoyeur de registre, cookies+temps+tempos+prefetch+historique+etc..)
                      Télécharge ici :
                      https://www.ccleaner.com/ccleaner/download
                      Tutorial ici:
                      https://www.vulgarisation-informatique.com/nettoyer-windows-ccleaner.php

                      D - Ewido
                      https://www.malekal.com/tutorial-et-guide-ewido-v4/
                      ----------------------------------------------------------------------------
                      ¤Affiche tous les fichiers et dossiers :
                      Clique sur démarrer/panneau de configuration/outil/option des dossiers/affichage

                      Coche « afficher les fichiers et dossiers cachés »

                      Décoche la case "Masquer les fichiers protégés du système d'exploitation (recommandé)"

                      Décoche « masquer les extensions dont le type est connu »
                      Puis fais «Ok» pour valider les changements.

                      Et appliquer !
                      =================================
                      Relance HijackThis, choisis " do a scan only" coche la case devant les lignes ci-dessous et clique en bas sur "fix checked"

                      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com
                      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com
                      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
                      R3 - Default URLSearchHook is missing
                      O4 - HKLM\..\Run: [eav31ca1] RUNDLL32.EXE w2351762.dll,n 00331c9e0000000a2351762
                      O4 - HKLM\..\Run: [Workflow] D:\install\Workflow.exe
                      O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
                      O16 - DPF: teleir_cert - https://static.ir.dgi.minefi.gouv.fr/secure/connexion/archives/ie4n4/teleir_cert.cab
                      O16 - DPF: {09C21411-B9A2-4DE6-8416-4E3B58577BE0} (France Telecom MDM ActiveX Control) - http://minitelweb.minitel.com/imin_data/ocx/MDM.cab
                      O16 - DPF: {1F83CD9E-505E-4F87-BECE-0832A763E36F} (Image Uploader 3.0 Control) - http://www.mypixmania.com/fr/fr/importer/MypixUploader.cab
                      O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540000} (CInstall Class) - http://www.videossimo.com/videossimo/portail/cab/Install.cab
                      O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/026a092ea38db51fd106/netzip/RdxIE601_fr.cab
                      O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
                      O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
                      O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IP-Uploader Control) - http://asp03.photoprintit.de/microsite/1156/defaults/activex/ImageUploader3.cab
                      O20 - AppInit_DLLs: repairs303169590.dll

                      O20 - Winlogon Notify: DateTime - C:\WINDOWS\system32\udib.dll (file missing)
                      O20 - Winlogon Notify: Extensions - C:\WINDOWS\system32\k2440chqef4e0.dll (file missing)

                      \Steganos Security Suite 2006 ===> Est-ce que tu t’en sert ?????

                      O4 - HKCU\..\Run: [SSS2006] "C:\Program Files\Steganos Security Suite 2006\SSS2006.exe" –boot
                      O23 - Service: Steganos AntiTheft (SatSrv) - Unknown owner - C:\WINDOWS\system32\SatSrv.exe

                      ============ ============================
                      ¤Démarre en mode sans échec :
                      Pour cela, tu tapotes la touche F8 dès le début de l’allumage du pc sans t’arrêter
                      Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée.
                      Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal !
                      (Si F8 ne marche pas utilise la touche F5).
                      ----------------------------------------------------------------------------
                      ¤Vide tes fichiers temps et temporary internet file:

                      Maintenant tu lances
                      A/ Ad-Aware supprime quarantaine
                      B/ Spybot Supprime quarantaine
                      C/ Ccleaner Ewido Copier/coller le rapport
                      D/
                      ----------------------------------------------------------------------------
                      ¤ Vide ta Corbeille.
                      ----------------------------------------------------------------------------
                      ¤ Redémarre en mode normal, relance Hijackthis et copie/colle un nouveau rapport sur le forum.

                      Tiens nous au courant

                      A+

                      0
                      1. zouzou
                        coucou
                        Ouf, ca m'a pris un temps fou...
                        Alors voilà le rapport c cleaner
                        Windows Registry Editor Version 5.00

                        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls]
                        "C:\\WINDOWS\\Downloaded Program Files\\RdxIE.dll"=dword:00000001

                        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls]
                        "C:\\WINDOWS\\Downloaded Program Files\\Install.dll"=dword:00000001

                        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls]
                        "C:\\WINDOWS\\Downloaded Program Files\\ImageUploader_3.ocx"=dword:00000001

                        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls]
                        "C:\\WINDOWS\\Downloaded Program Files\\MypixUploader.ocx"=dword:00000001

                        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls]
                        "C:\\WINDOWS\\Downloaded Program Files\\xscan53.ocx"=dword:00000001

                        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls]
                        "C:\\WINDOWS\\Downloaded Program Files\\asquared.ocx"=dword:00000001

                        [HKEY_CLASSES_ROOT\urn:content-classes:contentclassdef]

                        [HKEY_CLASSES_ROOT\urn:content-classes:wizard/addcontentclass]

                        [HKEY_CLASSES_ROOT\AU_ISC]
                        @="AU ISC Server Application"

                        [HKEY_CLASSES_ROOT\AU_ISC\CLSID]
                        @="{499C2688-85A5-41B5-B8A7-DCC8DCF797B4}"

                        [HKEY_CLASSES_ROOT\AU_ISC\CurVer]
                        @="AU_ISC.1"

                        [HKEY_CLASSES_ROOT\AU_ISC.1]
                        @="AU ISC Server Application"

                        [HKEY_CLASSES_ROOT\AU_ISC.1\CLSID]
                        @="{499C2688-85A5-41B5-B8A7-DCC8DCF797B4}"

                        [HKEY_CLASSES_ROOT\CDDBControl.CDDB]
                        @="CDDBControl.CDDB"

                        [HKEY_CLASSES_ROOT\CDDBControl.CDDB\Clsid]
                        @="{8B711BDF-005A-11D5-912C-CB19AE9BD205}"

                        [HKEY_CLASSES_ROOT\Connection Manager Profile]
                        @="Connection Manager Profile"

                        [HKEY_CLASSES_ROOT\Connection Manager Profile\shell]

                        [HKEY_CLASSES_ROOT\Database.Document]
                        @="Database Document"

                        [HKEY_CLASSES_ROOT\Database.Document\shell]

                        [HKEY_CLASSES_ROOT\eD2KDownloadManager.object]
                        @="eD2K downloadManager object"

                        [HKEY_CLASSES_ROOT\eD2KDownloadManager.object\CLSID]
                        @="{320154BB-D666-48F6-990E-172B32954620}"

                        [HKEY_CLASSES_ROOT\eD2KDownloadManager.object\CurVer]
                        @="eD2KDownloadManager.object.1"

                        [HKEY_CLASSES_ROOT\eD2KDownloadManager.object.1]
                        @="eD2K downloadManager object"

                        [HKEY_CLASSES_ROOT\eD2KDownloadManager.object.1\CLSID]
                        @="{320154BB-D666-48F6-990E-172B32954620}"

                        [HKEY_CLASSES_ROOT\IncrediAnimation.AnimationPlayer]
                        @="AnimationPlayer Class"

                        [HKEY_CLASSES_ROOT\IncrediAnimation.AnimationPlayer\CLSID]
                        @="{B5534644-E461-11D3-BBB2-0050DA276194}"

                        [HKEY_CLASSES_ROOT\IncrediAnimation.AnimationPlayer\CurVer]
                        @="IncrediAnimation.AnimationPlayer.1"

                        [HKEY_CLASSES_ROOT\IncrediAnimation.AnimationPlayer.1]
                        @="AnimationPlayer Class"

                        [HKEY_CLASSES_ROOT\IncrediAnimation.AnimationPlayer.1\CLSID]
                        @="{B5534644-E461-11D3-BBB2-0050DA276194}"

                        [HKEY_CLASSES_ROOT\IncrediBook.AddressBook]
                        @="AddressBook Class"

                        [HKEY_CLASSES_ROOT\IncrediBook.AddressBook\CLSID]
                        @="{BFCA32C0-E917-11D3-B720-005004C0C6BA}"

                        [HKEY_CLASSES_ROOT\IncrediBook.AddressBook\CurVer]
                        @="IncrediBook.AddressBook.1"

                        [HKEY_CLASSES_ROOT\IncrediBook.AddressBook.1]
                        @="AddressBook Class"

                        [HKEY_CLASSES_ROOT\IncrediBook.AddressBook.1\CLSID]
                        @="{BFCA32C0-E917-11D3-B720-005004C0C6BA}"

                        [HKEY_CLASSES_ROOT\IncrediBook.Contact]
                        @="Contact Class"

                        [HKEY_CLASSES_ROOT\IncrediBook.Contact\CLSID]
                        @="{BFCA32C2-E917-11D3-B720-005004C0C6BA}"

                        [HKEY_CLASSES_ROOT\IncrediBook.Contact\CurVer]
                        @="IncrediBook.Contact.1"

                        [HKEY_CLASSES_ROOT\IncrediBook.Contact.1]
                        @="Contact Class"

                        [HKEY_CLASSES_ROOT\IncrediBook.Contact.1\CLSID]
                        @="{BFCA32C2-E917-11D3-B720-005004C0C6BA}"

                        [HKEY_CLASSES_ROOT\IncrediBook.Group]
                        @="Group Class"

                        [HKEY_CLASSES_ROOT\IncrediBook.Group\CLSID]
                        @="{BFCA32C4-E917-11D3-B720-005004C0C6BA}"

                        [HKEY_CLASSES_ROOT\IncrediBook.Group\CurVer]
                        @="IncrediBook.Group.1"

                        [HKEY_CLASSES_ROOT\IncrediBook.Group.1]
                        @="Group Class"

                        [HKEY_CLASSES_ROOT\IncrediBook.Group.1\CLSID]
                        @="{BFCA32C4-E917-11D3-B720-005004C0C6BA}"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.AutoUpdate]
                        @="AutoUpdate Class"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.AutoUpdate\CLSID]
                        @="{9401BFDA-2F5C-4978-8075-7D8AFEC3AEE5}"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.AutoUpdate\CurVer]
                        @="IncrediFeatures.AutoUpdate.1"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.AutoUpdate.1]
                        @="AutoUpdate Class"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.AutoUpdate.1\CLSID]
                        @="{9401BFDA-2F5C-4978-8075-7D8AFEC3AEE5}"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.CommonSettings]
                        @="CommonSettings Class"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.CommonSettings\CLSID]
                        @="{CBF9925D-3C19-4F33-9DE4-446978645EBB}"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.CommonSettings\CurVer]
                        @="IncrediFeatures.CommonSettings.1"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.CommonSettings.1]
                        @="CommonSettings Class"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.CommonSettings.1\CLSID]
                        @="{CBF9925D-3C19-4F33-9DE4-446978645EBB}"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.EmoticonCenter]
                        @="EmoticonCenter Class"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.EmoticonCenter\CLSID]
                        @="{D0B6B45D-7BAF-4993-8EC2-F165BA440CD4}"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.EmoticonCenter\CurVer]
                        @="IncrediFeatures.EmoticonCenter.1"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.EmoticonCenter.1]
                        @="EmoticonCenter Class"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.EmoticonCenter.1\CLSID]
                        @="{D0B6B45D-7BAF-4993-8EC2-F165BA440CD4}"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.IMMessage]
                        @="IMMessage Class"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.IMMessage\CLSID]
                        @="{07D03588-7B5E-11D5-8784-0050DA2761C4}"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.IMMessage\CurVer]
                        @="IncrediFeatures.IMMessage.1"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.IMMessage.1]
                        @="IMMessage Class"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.IMMessage.1\CLSID]
                        @="{07D03588-7B5E-11D5-8784-0050DA2761C4}"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.LicenceManager]
                        @="LicenceManager Class"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.LicenceManager\CLSID]
                        @="{5862A1C2-7676-45AA-8C7D-2F803754D007}"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.LicenceManager\CurVer]
                        @="IncrediFeatures.LicenceManager.1"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.LicenceManager.1]
                        @="LicenceManager Class"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.LicenceManager.1\CLSID]
                        @="{5862A1C2-7676-45AA-8C7D-2F803754D007}"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.MultiSignature]
                        @="MultiSignature Class"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.MultiSignature\CLSID]
                        @="{328CC455-1F5E-4F1A-A6B7-A888AA9C0289}"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.MultiSignature\CurVer]
                        @="IncrediFeatures.MultiSignature.1"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.MultiSignature.1]
                        @="MultiSignature Class"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.MultiSignature.1\CLSID]
                        @="{328CC455-1F5E-4F1A-A6B7-A888AA9C0289}"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.ProfileManager]
                        @="ProfileManager Class"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.ProfileManager\CLSID]
                        @="{96D04D6A-7B1E-48A9-BEA6-99F9FE8341C7}"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.ProfileManager\CurVer]
                        @="IncrediFeatures.ProfileManager.1"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.ProfileManager.1]
                        @="ProfileManager Class"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.ProfileManager.1\CLSID]
                        @="{96D04D6A-7B1E-48A9-BEA6-99F9FE8341C7}"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.Signature]
                        @="Signature Class"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.Signature\CLSID]
                        @="{DA12A268-0ACB-11D4-859D-0050DA2761C4}"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.Signature\CurVer]
                        @="IncrediFeatures.Signature.1"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.Signature.1]
                        @="Signature Class"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.Signature.1\CLSID]
                        @="{DA12A268-0ACB-11D4-859D-0050DA2761C4}"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.Sound]
                        @="Sound Class"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.Sound\CLSID]
                        @="{0710C793-2117-11D5-B75D-005004C0C6BA}"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.Sound\CurVer]
                        @="IncrediFeatures.Sound.1"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.Sound.1]
                        @="Sound Class"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.Sound.1\CLSID]
                        @="{0710C793-2117-11D5-B75D-005004C0C6BA}"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.Spelling]
                        @="Spelling Class"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.Spelling\CLSID]
                        @="{84566316-EC70-11D5-881D-0050DA2761C4}"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.Spelling\CurVer]
                        @="IncrediFeatures.Spelling.1"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.Spelling.1]
                        @="Spelling Class"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.Spelling.1\CLSID]
                        @="{84566316-EC70-11D5-881D-0050DA2761C4}"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.StyleBox]
                        @="StyleBox Class"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.StyleBox\CLSID]
                        @="{C7681ACB-27AD-4025-8F53-643549159658}"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.StyleBox\CurVer]
                        @="IncrediFeatures.StyleBox.1"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.StyleBox.1]
                        @="StyleBox Class"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.StyleBox.1\CLSID]
                        @="{C7681ACB-27AD-4025-8F53-643549159658}"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.TypeMessageTAF]
                        @="TypeMessageTAF Class"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.TypeMessageTAF\CLSID]
                        @="{FEBD6230-F4F6-4E79-89CD-4BEBDC4A96AE}"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.TypeMessageTAF\CurVer]
                        @="IncrediFeatures.TypeMessageTAF.1"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.TypeMessageTAF.1]
                        @="TypeMessageTAF Class"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.TypeMessageTAF.1\CLSID]
                        @="{FEBD6230-F4F6-4E79-89CD-4BEBDC4A96AE}"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.TypeMessageVIP]
                        @="TypeMessageVIP Class"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.TypeMessageVIP\CLSID]
                        @="{47B10849-77FA-463b-8973-10241FF9DB37}"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.TypeMessageVIP\CurVer]
                        @="IncrediFeatures.TypeMessageVIP.1"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.TypeMessageVIP.1]
                        @="TypeMessageVIP Class"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.TypeMessageVIP.1\CLSID]
                        @="{47B10849-77FA-463b-8973-10241FF9DB37}"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.WebNotification]
                        @="WebNotification Class"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.WebNotification\CLSID]
                        @="{1D2A25B6-20D1-4C5B-9E6A-4DC7906192B4}"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.WebNotification\CurVer]
                        @="IncrediFeatures.WebNotification.1"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.WebNotification.1]
                        @="WebNotification Class"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.WebNotification.1\CLSID]
                        @="{1D2A25B6-20D1-4C5B-9E6A-4DC7906192B4}"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.WebViewer]
                        @="WebViewer Class"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.WebViewer\CLSID]
                        @="{4EAA7268-FC1E-47C6-87EF-8915475CBC88}"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.WebViewer\CurVer]
                        @="IncrediFeatures.WebViewer.1"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.WebViewer.1]
                        @="WebViewer Class"

                        [HKEY_CLASSES_ROOT\IncrediFeatures.WebViewer.1\CLSID]
                        @="{4EAA7268-FC1E-47C6-87EF-8915475CBC88}"

                        [HKEY_CLASSES_ROOT\IncrediImport.AOLImporter]
                        @="AOLImporter Class"

                        [HKEY_CLASSES_ROOT\IncrediImport.AOLImporter\CLSID]
                        @="{17513EFA-F27A-4781-B6A6-EE988D96E71C}"

                        [HKEY_CLASSES_ROOT\IncrediImport.AOLImporter\CurVer]
                        @="IncrediImport.AOLImporter.1"

                        [HKEY_CLASSES_ROOT\IncrediImport.AOLImporter.1]
                        @="AOLImporter Class"

                        [HKEY_CLASSES_ROOT\IncrediImport.AOLImporter.1\CLSID]
                        @="{17513EFA-F27A-4781-B6A6-EE988D96E71C}"

                        [HKEY_CLASSES_ROOT\IncrediImport.EudoraImporter]
                        @="EudoraImporter Class"

                        [HKEY_CLASSES_ROOT\IncrediImport.EudoraImporter\CLSID]
                        @="{EC8717C9-F660-11D3-ADE2-0050DA744DF1}"

                        [HKEY_CLASSES_ROOT\IncrediImport.EudoraImporter\CurVer]
                        @="IncrediImport.EudoraImporter.1"

                        [HKEY_CLASSES_ROOT\IncrediImport.EudoraImporter.1]
                        @="EudoraImporter Class"

                        [HKEY_CLASSES_ROOT\IncrediImport.EudoraImporter.1\CLSID]
                        @="{EC8717C9-F660-11D3-ADE2-0050DA744DF1}"

                        [HKEY_CLASSES_ROOT\IncrediImport.ExpressImporter]
                        @="ExpressImporter Class"

                        [HKEY_CLASSES_ROOT\IncrediImport.ExpressImporter\CLSID]
                        @="{EC8717B8-F660-11D3-ADE2-0050DA744DF1}"

                        [HKEY_CLASSES_ROOT\IncrediImport.ExpressImporter\CurVer]
                        @="IncrediImport.ExpressImporter.1"

                        [HKEY_CLASSES_ROOT\IncrediImport.ExpressImporter.1]
                        @="ExpressImporter Class"

                        [HKEY_CLASSES_ROOT\IncrediImport.ExpressImporter.1\CLSID]
                        @="{EC8717B8-F660-11D3-ADE2-0050DA744DF1}"

                        [HKEY_CLASSES_ROOT\IncrediImport.HotmailImporter]
                        @="HotmailImporter Class"

                        [HKEY_CLASSES_ROOT\IncrediImport.HotmailImporter\CLSID]
                        @="{F1B4B6F1-55D1-11d6-B7AD-005004C0C6BA}"

                        [HKEY_CLASSES_ROOT\IncrediImport.HotmailImporter\CurVer]
                        @="IncrediImport.HotmailImporter.1"

                        [HKEY_CLASSES_ROOT\IncrediImport.HotmailImporter.1]
                        @="HotmailImporter Class"

                        [HKEY_CLASSES_ROOT\IncrediImport.HotmailImporter.1\CLSID]
                        @="{F1B4B6F1-55D1-11d6-B7AD-005004C0C6BA}"

                        [HKEY_CLASSES_ROOT\IncrediImport.Importer]
                        @="Importer Class"

                        [HKEY_CLASSES_ROOT\IncrediImport.Importer\CLSID]
                        @="{E1B6DE2A-F997-11D3-BBDB-0050DA276194}"

                        [HKEY_CLASSES_ROOT\IncrediImport.Importer\CurVer]
                        @="IncrediImport.Importer.1"

                        [HKEY_CLASSES_ROOT\IncrediImport.Importer.1]
                        @="Importer Class"

                        [HKEY_CLASSES_ROOT\IncrediImport.Importer.1\CLSID]
                        @="{E1B6DE2A-F997-11D3-BBDB-0050DA276194}"

                        [HKEY_CLASSES_ROOT\IncrediImport.IncrediMailImporter]
                        @="IncrediMailImporter Class"

                        [HKEY_CLASSES_ROOT\IncrediImport.IncrediMailImporter\CLSID]
                        @="{44C8EC50-93BD-4633-9A82-CA0D4F1DD3A7}"

                        [HKEY_CLASSES_ROOT\IncrediImport.IncrediMailImporter\CurVer]
                        @="IncrediImport.IncrediMailImporter.1"

                        [HKEY_CLASSES_ROOT\IncrediImport.IncrediMailImporter.1]
                        @="IncrediMailImporter Class"

                        [HKEY_CLASSES_ROOT\IncrediImport.IncrediMailImporter.1\CLSID]
                        @="{44C8EC50-93BD-4633-9A82-CA0D4F1DD3A7}"

                        [HKEY_CLASSES_ROOT\IncrediImport.IncrediMailImporter2]
                        @="IncrediMailImporter2 Class"

                        [HKEY_CLASSES_ROOT\IncrediImport.IncrediMailImporter2\CLSID]
                        @="{00E9F275-1525-4fd3-8CEE-6BAF5B4A4B4A}"

                        [HKEY_CLASSES_ROOT\IncrediImport.IncrediMailImporter2\CurVer]
                        @="IncrediImport.IncrediMailImporter2.1"

                        [HKEY_CLASSES_ROOT\IncrediImport.IncrediMailImporter2.1]
                        @="IncrediMailImporter2 Class"

                        [HKEY_CLASSES_ROOT\IncrediImport.IncrediMailImporter2.1\CLSID]
                        @="{00E9F275-1525-4fd3-8CEE-6BAF5B4A4B4A}"

                        [HKEY_CLASSES_ROOT\IncrediImport.NetscapeImporter]
                        @="NetscapeImporter Class"

                        [HKEY_CLASSES_ROOT\IncrediImport.NetscapeImporter\CLSID]
                        @="{EC8717B4-F660-11D3-ADE2-0050DA744DF1}"

                        [HKEY_CLASSES_ROOT\IncrediImport.NetscapeImporter\CurVer]
                        @="IncrediImport.NetscapeImporter.1"

                        [HKEY_CLASSES_ROOT\IncrediImport.NetscapeImporter.1]
                        @="NetscapeImporter Class"

                        [HKEY_CLASSES_ROOT\IncrediImport.NetscapeImporter.1\CLSID]
                        @="{EC8717B4-F660-11D3-ADE2-0050DA744DF1}"

                        [HKEY_CLASSES_ROOT\IncrediImport.OutlookImporter]
                        @="OutlookImporter Class"

                        [HKEY_CLASSES_ROOT\IncrediImport.OutlookImporter\CLSID]
                        @="{EC8717B6-F660-11D3-ADE2-0050DA744DF1}"

                        [HKEY_CLASSES_ROOT\IncrediImport.OutlookImporter\CurVer]
                        @="IncrediImport.OutlookImporter.1"

                        [HKEY_CLASSES_ROOT\IncrediImport.OutlookImporter.1]
                        @="OutlookImporter Class"

                        [HKEY_CLASSES_ROOT\IncrediImport.OutlookImporter.1\CLSID]
                        @="{EC8717B6-F660-11D3-ADE2-0050DA744DF1}"

                        [HKEY_CLASSES_ROOT\IncrediMail.Kernel]
                        @="Kernel Class"

                        [HKEY_CLASSES_ROOT\IncrediMail.Kernel\CLSID]
                        @="{E9BC70A8-D70C-11D3-BBAE-0050DA276194}"

                        [HKEY_CLASSES_ROOT\IncrediMail.Kernel\CurVer]
                        @="IncrediMail.Kernel.1"

                        [HKEY_CLASSES_ROOT\IncrediMail.Kernel.1]
                        @="Kernel Class"

                        [HKEY_CLASSES_ROOT\IncrediMail.Kernel.1\CLSID]
                        @="{E9BC70A8-D70C-11D3-BBAE-0050DA276194}"

                        [HKEY_CLASSES_ROOT\IncrediManager.CommandComponent]
                        @="CommandComponent Class"

                        [HKEY_CLASSES_ROOT\IncrediManager.CommandComponent\CLSID]
                        @="{5FAEF4A9-C5D0-11D4-BCC1-0050DA276194}"

                        [HKEY_CLASSES_ROOT\IncrediManager.CommandComponent\CurVer]
                        @="IncrediManager.CommandComponent.1"

                        [HKEY_CLASSES_ROOT\IncrediManager.CommandComponent.1]
                        @="CommandComponent Class"

                        [HKEY_CLASSES_ROOT\IncrediManager.CommandComponent.1\CLSID]
                        @="{5FAEF4A9-C5D0-11D4-BCC1-0050DA276194}"

                        [HKEY_CLASSES_ROOT\IncrediManager.FindMessage]
                        @="FindMessage Class"

                        [HKEY_CLASSES_ROOT\IncrediManager.FindMessage\CLSID]
                        @="{3762BAB7-8E00-4B51-AA7E-E57ED7552794}"

                        [HKEY_CLASSES_ROOT\IncrediManager.FindMessage\CurVer]
                        @="IncrediManager.FindMessage.1"

                        [HKEY_CLASSES_ROOT\IncrediManager.FindMessage.1]
                        @="FindMessage Class"

                        [HKEY_CLASSES_ROOT\IncrediManager.FindMessage.1\CLSID]
                        @="{3762BAB7-8E00-4B51-AA7E-E57ED7552794}"

                        [HKEY_CLASSES_ROOT\IncrediManager.Manager]
                        @="Manager Class"

                        [HKEY_CLASSES_ROOT\IncrediManager.Manager\CLSID]
                        @="{CB073682-BD1F-11D3-BB90-0050DA276194}"

                        [HKEY_CLASSES_ROOT\IncrediManager.Manager\CurVer]
                        @="IncrediManager.Manager.1"

                        [HKEY_CLASSES_ROOT\IncrediManager.Manager.1]
                        @="Manager Class"

                        [HKEY_CLASSES_ROOT\IncrediManager.Manager.1\CLSID]
                        @="{CB073682-BD1F-11D3-BB90-0050DA276194}"

                        [HKEY_CLASSES_ROOT\IncrediManager.Premium]
                        @="Premium Class"

                        [HKEY_CLASSES_ROOT\IncrediManager.Premium\CLSID]
                        @="{E6253BEA-C3B2-4FB0-8F7F-B5B8C83674E5}"

                        [HKEY_CLASSES_ROOT\IncrediManager.Premium\CurVer]
                        @="IncrediManager.Premium.1"

                        [HKEY_CLASSES_ROOT\IncrediManager.Premium.1]
                        @="Premium Class"

                        [HKEY_CLASSES_ROOT\IncrediManager.Premium.1\CLSID]
                        @="{E6253BEA-C3B2-4FB0-8F7F-B5B8C83674E5}"

                        [HKEY_CLASSES_ROOT\IncrediManager.VipSupport]
                        @="VipSupport Class"

                        [HKEY_CLASSES_ROOT\IncrediManager.VipSupport\CLSID]
                        @="{A43BC58F-4453-49FF-9929-9D1E78D90062}"

                        [HKEY_CLASSES_ROOT\IncrediManager.VipSupport\CurVer]
                        @="IncrediManager.VipSupport.1"

                        [HKEY_CLASSES_ROOT\IncrediManager.VipSupport.1]
                        @="VipSupport Class"

                        [HKEY_CLASSES_ROOT\IncrediManager.VipSupport.1\CLSID]
                        @="{A43BC58F-4453-49FF-9929-9D1E78D90062}"

                        [HKEY_CLASSES_ROOT\IncrediMessage]
                        @="IncrediMail Internet Mail Message"

                        [HKEY_CLASSES_ROOT\IncrediMessage\shell]

                        [HKEY_CLASSES_ROOT\IncrediNotifier.CoNotifierPlayer]
                        @="CoNotifierPlayer Class"

                        [HKEY_CLASSES_ROOT\IncrediNotifier.CoNotifierPlayer\CLSID]
                        @="{181C43E6-AF9E-46EA-A51E-2D63B975A15D}"

                        [HKEY_CLASSES_ROOT\IncrediNotifier.CoNotifierPlayer\CurVer]
                        @="IncrediNotifier.CoNotifierPlayer.1"

                        [HKEY_CLASSES_ROOT\IncrediNotifier.CoNotifierPlayer.1]
                        @="CoNotifierPlayer Class"

                        [HKEY_CLASSES_ROOT\IncrediNotifier.CoNotifierPlayer.1\CLSID]
                        @="{181C43E6-AF9E-46EA-A51E-2D63B975A15D}"

                        [HKEY_CLASSES_ROOT\IncrediNotifier.Notifier]
                        @="Notifier Class"

                        [HKEY_CLASSES_ROOT\IncrediNotifier.Notifier\CLSID]
                        @="{80BCA063-A0D1-4F29-888C-6B67C392F5DA}"

                        [HKEY_CLASSES_ROOT\IncrediNotifier.Notifier\CurVer]
                        @="IncrediNotifier.Notifier.1"

                        [HKEY_CLASSES_ROOT\IncrediNotifier.Notifier.1]
                        @="Notifier Class"

                        [HKEY_CLASSES_ROOT\IncrediNotifier.Notifier.1\CLSID]
                        @="{80BCA063-A0D1-4F29-888C-6B67C392F5DA}"

                        [HKEY_CLASSES_ROOT\IncrediParser.BodyPart]
                        @="BodyPart Class"

                        [HKEY_CLASSES_ROOT\IncrediParser.BodyPart\CLSID]
                        @="{087EF34C-BBC4-11D3-BB8D-0050DA276194}"

                        [HKEY_CLASSES_ROOT\IncrediParser.BodyPart\CurVer]
                        @="IncrediParser.BodyPart.1"

                        [HKEY_CLASSES_ROOT\IncrediParser.BodyPart.1]
                        @="BodyPart Class"

                        [HKEY_CLASSES_ROOT\IncrediParser.BodyPart.1\CLSID]
                        @="{087EF34C-BBC4-11D3-BB8D-0050DA276194}"

                        [HKEY_CLASSES_ROOT\IncrediParser.ContainerShell]
                        @="ContainerShell Class"

                        [HKEY_CLASSES_ROOT\IncrediParser.ContainerShell\CLSID]
                        @="{25D41C19-246A-4643-B0CA-08F5D1D07EE6}"

                        [HKEY_CLASSES_ROOT\IncrediParser.ContainerShell\CurVer]
                        @="IncrediParser.ContainerShell.1"

                        [HKEY_CLASSES_ROOT\IncrediParser.ContainerShell.1]
                        @="ContainerShell Class"

                        [HKEY_CLASSES_ROOT\IncrediParser.ContainerShell.1\CLSID]
                        @="{25D41C19-246A-4643-B0CA-08F5D1D07EE6}"

                        [HKEY_CLASSES_ROOT\IncrediParser.Encoder]
                        @="Encoder Class"

                        [HKEY_CLASSES_ROOT\IncrediParser.Encoder\CLSID]
                        @="{28D1EE40-E73D-422D-A2AC-D23F8D3071B2}"

                        [HKEY_CLASSES_ROOT\IncrediParser.Encoder\CurVer]
                        @="IncrediParser.Encoder.1"

                        [HKEY_CLASSES_ROOT\IncrediParser.Encoder.1]
                        @="Encoder Class"

                        [HKEY_CLASSES_ROOT\IncrediParser.Encoder.1\CLSID]
                        @="{28D1EE40-E73D-422D-A2AC-D23F8D3071B2}"

                        [HKEY_CLASSES_ROOT\IncrediParser.Header]
                        @="Header Class"

                        [HKEY_CLASSES_ROOT\IncrediParser.Header\CLSID]
                        @="{7A2E77CA-BDE2-11D3-BB91-0050DA276194}"

                        [HKEY_CLASSES_ROOT\IncrediParser.Header\CurVer]
                        @="IncrediParser.Header.1"

                        [HKEY_CLASSES_ROOT\IncrediParser.Header.1]
                        @="Header Class"

                        [HKEY_CLASSES_ROOT\IncrediParser.Header.1\CLSID]
                        @="{7A2E77CA-BDE2-11D3-BB91-0050DA276194}"

                        [HKEY_CLASSES_ROOT\IncrediParser.MailMessage]
                        @="MailMessage Class"

                        [HKEY_CLASSES_ROOT\IncrediParser.MailMessage\CLSID]
                        @="{50E5E612-B7DD-11D3-BB7F-0050DA276194}"

                        [HKEY_CLASSES_ROOT\IncrediParser.MailMessage\CurVer]
                        @="IncrediParser.MailMessage.1"

                        [HKEY_CLASSES_ROOT\IncrediParser.MailMessage.1]
                        @="MailMessage Class"

                        [HKEY_CLASSES_ROOT\IncrediParser.MailMessage.1\CLSID]
                        @="{50E5E612-B7DD-11D3-BB7F-0050DA276194}"

                        [HKEY_CLASSES_ROOT\IncrediParser.MessageFinderShell]
                        @="MessageFinderShell Class"

                        [HKEY_CLASSES_ROOT\IncrediParser.MessageFinderShell\CLSID]
                        @="{734D218A-B5AA-4A73-BE14-B5F9411EBA45}"

                        [HKEY_CLASSES_ROOT\IncrediParser.MessageFinderShell\CurVer]
                        @="IncrediParser.MessageFinderShell.1"

                        [HKEY_CLASSES_ROOT\IncrediParser.MessageFinderShell.1]
                        @="MessageFinderShell Class"

                        [HKEY_CLASSES_ROOT\IncrediParser.MessageFinderShell.1\CLSID]
                        @="{734D218A-B5AA-4A73-BE14-B5F9411EBA45}"

                        [HKEY_CLASSES_ROOT\IncrediParser.MessageStoreShell]
                        @="MessageStoreShell Class"

                        [HKEY_CLASSES_ROOT\IncrediParser.MessageStoreShell\CLSID]
                        @="{A0C301D9-59A5-45eb-90E8-D60D8149F5A5}"

                        [HKEY_CLASSES_ROOT\IncrediParser.MessageStoreShell\CurVer]
                        @="IncrediParser.MessageStoreShell.1"

                        [HKEY_CLASSES_ROOT\IncrediParser.MessageStoreShell.1]
                        @="MessageStoreShell Class"

                        [HKEY_CLASSES_ROOT\IncrediParser.MessageStoreShell.1\CLSID]
                        @="{A0C301D9-59A5-45eb-90E8-D60D8149F5A5}"

                        [HKEY_CLASSES_ROOT\IncrediShellExt.IMMenuShellExt]
                        @="IMMenuShellExt Class"

                        [HKEY_CLASSES_ROOT\IncrediShellExt.IMMenuShellExt\CLSID]
                        @="{F8984111-38B6-11D5-8725-0050DA2761C4}"

                        [HKEY_CLASSES_ROOT\IncrediShellExt.IMMenuShellExt\CurVer]
                        @="IncrediShellExt.IMMenuShellExt.1"

                        [HKEY_CLASSES_ROOT\IncrediShellExt.IMMenuShellExt.1]
                        @="IMMenuShellExt Class"

                        [HKEY_CLASSES_ROOT\IncrediShellExt.IMMenuShellExt.1\CLSID]
                        @="{F8984111-38B6-11D5-8725-0050DA2761C4}"

                        [HKEY_CLASSES_ROOT\IncrediSupport.AccountsManager]
                        @="AccountsManager Class"

                        [HKEY_CLASSES_ROOT\IncrediSupport.AccountsManager\CLSID]
                        @="{2EE7969F-6FC8-4D04-89AC-5109298ABC39}"

                        [HKEY_CLASSES_ROOT\IncrediSupport.AccountsManager\CurVer]
                        @="IncrediSupport.AccountsManager.1"

                        [HKEY_CLASSES_ROOT\IncrediSupport.AccountsManager.1]
                        @="AccountsManager Class"

                        [HKEY_CLASSES_ROOT\IncrediSupport.AccountsManager.1\CLSID]
                        @="{2EE7969F-6FC8-4D04-89AC-5109298ABC39}"

                        [HKEY_CLASSES_ROOT\IncrediSupport.JunkFilterManager]
                        @="JunkFilterManager Class"

                        [HKEY_CLASSES_ROOT\IncrediSupport.JunkFilterManager\CLSID]
                        @="{37DD327E-8A52-448d-9072-BBADFC62DDC4}"

                        [HKEY_CLASSES_ROOT\IncrediSupport.JunkFilterManager\CurVer]
                        @="IncrediSupport.JunkFilterManager.1"

                        [HKEY_CLASSES_ROOT\IncrediSupport.JunkFilterManager.1]
                        @="JunkFilterManager Class"

                        [HKEY_CLASSES_ROOT\IncrediSupport.JunkFilterManager.1\CLSID]
                        @="{37DD327E-8A52-448d-9072-BBADFC62DDC4}"

                        [HKEY_CLASSES_ROOT\IncrediSupport.Settings]
                        @="Settings Class"

                        [HKEY_CLASSES_ROOT\IncrediSupport.Settings\CLSID]
                        @="{A8D94870-BEA6-11D3-BB92-0050DA276194}"

                        [HKEY_CLASSES_ROOT\IncrediSupport.Settings\CurVer]
                        @="IncrediSupport.Settings.1"

                        [HKEY_CLASSES_ROOT\IncrediSupport.Settings.1]
                        @="Settings Class"

                        [HKEY_CLASSES_ROOT\IncrediSupport.Settings.1\CLSID]
                        @="{A8D94870-BEA6-11D3-BB92-0050DA276194}"

                        [HKEY_CLASSES_ROOT\IncrediSupport.Viewers]
                        @="Viewers Class"

                        [HKEY_CLASSES_ROOT\IncrediSupport.Viewers\CLSID]
                        @="{805FB5B9-6344-11D6-B7AF-005004C0C6BA}"

                        [HKEY_CLASSES_ROOT\IncrediSupport.Viewers\CurVer]
                        @="IncrediSupport.Viewers.1"

                        [HKEY_CLASSES_ROOT\IncrediSupport.Viewers.1]
                        @="Viewers Class"

                        [HKEY_CLASSES_ROOT\IncrediSupport.Viewers.1\CLSID]
                        @="{805FB5B9-6344-11D6-B7AF-005004C0C6BA}"

                        [HKEY_CLASSES_ROOT\IncrediTools.ContentPlugProtocol]
                        @="ContentPlugProtocol Class"

                        [HKEY_CLASSES_ROOT\IncrediTools.ContentPlugProtocol\CLSID]
                        @="{8BACC255-A3CF-4e27-BAF1-D531B1AE02FD}"

                        [HKEY_CLASSES_ROOT\IncrediTools.ContentPlugProtocol\CurVer]
                        @="IncrediTools.ContentPlugProtocol.1"

                        [HKEY_CLASSES_ROOT\IncrediTools.ContentPlugProtocol.1]
                        @="ContentPlugProtocol Class"

                        [HKEY_CLASSES_ROOT\IncrediTools.ContentPlugProtocol.1\CLSID]
                        @="{8BACC255-A3CF-4e27-BAF1-D531B1AE02FD}"

                        [HKEY_CLASSES_ROOT\IncrediTools.Magic]
                        @="Magic Class"

                        [HKEY_CLASSES_ROOT\IncrediTools.Magic\CLSID]
                        @="{B84092B9-8658-11D5-8793-0050DA2761C4}"

                        [HKEY_CLASSES_ROOT\IncrediTools.Magic\CurVer]
                        @="IncrediTools.Magic.1"

                        [HKEY_CLASSES_ROOT\IncrediTools.Magic.1]
                        @="Magic Class"

                        [HKEY_CLASSES_ROOT\IncrediTools.Magic.1\CLSID]
                        @="{B84092B9-8658-11D5-8793-0050DA2761C4}"

                        [HKEY_CLASSES_ROOT\IncrediTools.SoundManager]
                        @="SoundManager Class"

                        [HKEY_CLASSES_ROOT\IncrediTools.SoundManager\CLSID]
                        @="{0B9A0840-1EC3-11D5-B75C-005004C0C6BA}"

                        [HKEY_CLASSES_ROOT\IncrediTools.SoundManager\CurVer]
                        @="IncrediTools.SoundManager.1"

                        [HKEY_CLASSES_ROOT\IncrediTools.SoundManager.1]
                        @="SoundManager Class"

                        [HKEY_CLASSES_ROOT\IncrediTools.SoundManager.1\CLSID]
                        @="{0B9A0840-1EC3-11D5-B75C-005004C0C6BA}"

                        [HKEY_CLASSES_ROOT\IncrediTools.ThumbnailCreator]
                        @="ThumbnailCreator Class"

                        [HKEY_CLASSES_ROOT\IncrediTools.ThumbnailCreator\CLSID]
                        @="{140BBD3E-C68E-4077-B7EC-D4DC46242EF5}"

                        [HKEY_CLASSES_ROOT\IncrediTools.ThumbnailCreator\CurVer]
                        @="IncrediTools.ThumbnailCreator.1"

                        [HKEY_CLASSES_ROOT\IncrediTools.ThumbnailCreator.1]
                        @="ThumbnailCreator Class"

                        [HKEY_CLASSES_ROOT\IncrediTools.ThumbnailCreator.1\CLSID]
                        @="{140BBD3E-C68E-4077-B7EC-D4DC46242EF5}"

                        [HKEY_CLASSES_ROOT\IncrediView.AttachPlugProt]
                        @="AttachPlugProt Class"

                        [HKEY_CLASSES_ROOT\IncrediView.AttachPlugProt\CLSID]
                        @="{57DE7416-A3EB-47C8-B44D-72F79539A360}"

                        [HKEY_CLASSES_ROOT\IncrediView.AttachPlugProt\CurVer]
                        @="IncrediView.AttachPlugProt.1"

                        [HKEY_CLASSES_ROOT\IncrediView.AttachPlugProt.1]
                        @="AttachPlugProt Class"

                        [HKEY_CLASSES_ROOT\IncrediView.AttachPlugProt.1\CLSID]
                        @="{57DE7416-A3EB-47C8-B44D-72F79539A360}"

                        [HKEY_CLASSES_ROOT\IncrediView.FieldsEditDesigner]
                        @="FieldsEditDesigner Class"

                        [HKEY_CLASSES_ROOT\IncrediView.FieldsEditDesigner\CLSID]
                        @="{CB382C7A-8852-458A-8900-C456C96FDB8C}"

                        [HKEY_CLASSES_ROOT\IncrediView.FieldsEditDesigner\CurVer]
                        @="IncrediView.FieldsEditDesigner.1"

                        [HKEY_CLASSES_ROOT\IncrediView.FieldsEditDesigner.1]
                        @="FieldsEditDesigner Class"

                        [HKEY_CLASSES_ROOT\IncrediView.FieldsEditDesigner.1\CLSID]
                        @="{CB382C7A-8852-458A-8900-C456C96FDB8C}"

                        [HKEY_CLASSES_ROOT\IncrediView.MsgView]
                        @="MsgView Class"

                        [HKEY_CLASSES_ROOT\IncrediView.MsgView\CLSID]
                        @="{7E58CC0F-BC50-11D3-855B-0050DA2761C4}"

                        [HKEY_CLASSES_ROOT\IncrediView.MsgView\CurVer]
                        @="IncrediView.MsgView.1"

                        [HKEY_CLASSES_ROOT\IncrediView.MsgView.1]
                        @="MsgView Class"

                        [HKEY_CLASSES_ROOT\IncrediView.MsgView.1\CLSID]
                        @="{7E58CC0F-BC50-11D3-855B-0050DA2761C4}"

                        [HKEY_CLASSES_ROOT\IncrediView.ViewEditDesigner]
                        @="ViewEditDesigner Class"

                        [HKEY_CLASSES_ROOT\IncrediView.ViewEditDesigner\CLSID]
                        @="{11B72805-205F-11D6-8855-0050DA2761C4}"

                        [HKEY_CLASSES_ROOT\IncrediView.ViewEditDesigner\CurVer]
                        @="IncrediView.ViewEditDesigner.1"

                        [HKEY_CLASSES_ROOT\IncrediView.ViewEditDesigner.1]
                        @="ViewEditDesigner Class"

                        [HKEY_CLASSES_ROOT\IncrediView.ViewEditDesigner.1\CLSID]
                        @="{11B72805-205F-11D6-8855-0050DA2761C4}"

                        [HKEY_CLASSES_ROOT\IncrediView.ViewShowDesigner]
                        @="ViewShowDesigner Class"

                        [HKEY_CLASSES_ROOT\IncrediView.ViewShowDesigner\CLSID]
                        @="{4750EC81-293B-11D6-885E-0050DA2761C4}"

                        [HKEY_CLASSES_ROOT\IncrediView.ViewShowDesigner\CurVer]
                        @="IncrediView.ViewShowDesigner.1"

                        [HKEY_CLASSES_ROOT\IncrediView.ViewShowDesigner.1]
                        @="ViewShowDesigner Class"

                        [HKEY_CLASSES_ROOT\IncrediView.ViewShowDesigner.1\CLSID]
                        @="{4750EC81-293B-11D6-885E-0050DA2761C4}"

                        [HKEY_CLASSES_ROOT\Microsoft.ActiveXPlugin]
                        @="ActiveXPlugin Object"

                        [HKEY_CLASSES_ROOT\Microsoft.ActiveXPlugin\CLSID]
                        @="{06DD38D3-D187-11CF-A80D-00C04FD74AD8}"

                        [HKEY_CLASSES_ROOT\Microsoft.ActiveXPlugin\CurVer]
                        @="Microsoft.ActiveXPlugin.1"

                        [HKEY_CLASSES_ROOT\Microsoft.ActiveXPlugin\NotInsertable]

                        [HKEY_CLASSES_ROOT\Microsoft.ActiveXPlugin.1]
                        @="ActiveXPlugin Object"

                        [HKEY_CLASSES_ROOT\Microsoft.ActiveXPlugin.1\CLSID]
                        @="{06DD38D3-D187-11CF-A80D-00C04FD74AD8}"

                        [HKEY_CLASSES_ROOT\Microsoft.ActiveXPlugin.1\NotInsertable]

                        [HKEY_CLASSES_ROOT\Minitel.Document]

                        [HKEY_CLASSES_ROOT\Minitel.Document\shell]

                        [HKEY_CLASSES_ROOT\movfile]

                        [HKEY_CLASSES_ROOT\movfile\shell]

                        [HKEY_CLASSES_ROOT\OfficePrinter.Document]
                        @="OfficePrinter Document"

                        [HKEY_CLASSES_ROOT\OfficePrinter.Document\shell]

                        [HKEY_CLASSES_ROOT\ppifile]
                        @="Fichier de configuration du Passeport Microsoft"

                        [HKEY_CLASSES_ROOT\ppifile\shell]

                        [HKEY_CLASSES_ROOT\QuickTimeMovie]
                        @="QuickTime Movie"

                        [HKEY_CLASSES_ROOT\QuickTimeMovie\shell]

                        [HKEY_CLASSES_ROOT\RealDownloadExpress.InfoWindow]
                        @="RealDownload Express InfoWindow Class"

                        [HKEY_CLASSES_ROOT\RealDownloadExpress.InfoWindow\CLSID]
                        @="{56336BCA-3D8A-11d6-A00B-0050DA18DE71}"

                        [HKEY_CLASSES_ROOT\RealDownloadExpress.InfoWindow\CurVer]
                        @="RealDownloadExpress.InfoWindow.1"

                        [HKEY_CLASSES_ROOT\RealDownloadExpress.InfoWindow.1]
                        @="RealDownload Express InfoWindow Class"

                        [HKEY_CLASSES_ROOT\RealDownloadExpress.InfoWindow.1\CLSID]
                        @="{56336BCA-3D8A-11d6-A00B-0050DA18DE71}"

                        [HKEY_CLASSES_ROOT\RTCIMSP.RTCIMService]
                        @="RTCIMService Class"

                        [HKEY_CLASSES_ROOT\RTCIMSP.RTCIMService\CLSID]
                        @="{83D4679F-B6D7-11D2-BF36-00C04FB90A03}"

                        [HKEY_CLASSES_ROOT\RTCIMSP.RTCIMService\CurVer]
                        @="RTCIMSP.RTCIMService.1"

                        [HKEY_CLASSES_ROOT\RTCIMSP.RTCIMService.1]
                        @="RTCIMService Class"

                        [HKEY_CLASSES_ROOT\RTCIMSP.RTCIMService.1\CLSID]
                        @="{83D4679F-B6D7-11D2-BF36-00C04FB90A03}"

                        [HKEY_CLASSES_ROOT\TIMFile]

                        [HKEY_CLASSES_ROOT\TIMFile\Shell]

                        [HKEY_CLASSES_ROOT\VTXFile]

                        [HKEY_CLASSES_ROOT\VTXFile\Shell]

                        [HKEY_CLASSES_ROOT\Applications\Heredis8.exe]

                        [HKEY_CLASSES_ROOT\Applications\Heredis8.exe\shell]

                        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\HijackThis.exe]
                        @="C:\\Program Files\\Hijackthis Version Française\\hijackthis.exe"
                        "Path"="C:\\Program Files\\Hijackthis Version Française"

                        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\HijackThis]
                        "DisplayName"="HijackThis 1.99.1"
                        "UninstallString"="C:\\Program Files\\Hijackthis Version Française\\HijackThis.exe /uninstall"
                        "DisplayIcon"="C:\\Program Files\\Hijackthis Version Française\\HijackThis.exe"
                        "DisplayVersion"="1.99.1"
                        "Publisher"="Soeperman Enterprises Ltd."
                        "URLInfoAbout"="http://ww11.spywareinfo.com/~merijn/"

                        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{3877C2CD-F137-4144-BDB2-0A811492F920}]
                        "SlowInfoCache"=hex:28,02,00,00,00,00,00,00,ff,ff,ff,ff,ff,ff,ff,ff,00,00,00,\
                        00,00,00,00,00,ff,ff,ff,ff,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
                        00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
                        00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
                        00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
                        00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
                        00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
                        00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
                        00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
                        00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
                        00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
                        00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
                        00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
                        00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
                        00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
                        00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
                        00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
                        00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
                        00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
                        00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
                        00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
                        00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
                        00,00,00,00,00,00,00,00
                        "Changed"=dword:00000000

                        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{A394E835-C8D6-4B4B-884B-D2709059F3BE}]
                        "SlowInfoCache"=hex:28,02,00,00,01,00,00,00,00,70,01,00,00,00,00,00,52,8a,c2,\
                        8d,0b,c3,c6,01,00,00,00,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,\
                        61,00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,4e,00,65,00,74,00,77,\
                        00,6f,00,72,00,6b,00,20,00,4d,00,6f,00,6e,00,69,00,74,00,6f,00,72,00,5c,00,\
                        6e,00,65,00,74,00,6d,00,6f,00,6e,00,2e,00,65,00,78,00,65,00,00,00,00,00,00,\
                        00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
                        00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
                        00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
                        00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
                        00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
                        00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
                        00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
                        00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
                        00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
                        00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
                        00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
                        00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
                        00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
                        00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
                        00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
                        00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
                        00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
                        00,00,00,00,00,00,00,00
                        "Changed"=dword:00000000

                        [HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]
                        "C:\\Program Files\\CyberLink\\PowerDVD\\PowerDVD.exe"="PowerDVD"

                        [HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]
                        "C:\\sysprep\\factory.exe"="Utilitaire de pré installation d'usine"

                        [HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]
                        "C:\\sysprep\\sysprep.exe"="utilitaire sysprep"

                        [HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]
                        "C:\\Documents and Settings\\Administrateur\\Local Settings\\Temporary Internet Files\\Content.IE5\\Y7QDWTQZ\\setupfre[1].exe"="setupfre[1]"

                        [HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]
                        "C:\\DOCUME~1\\ADMINI~1\\LOCALS~1\\Temp\\_av_sfx.tm~a00564\\avast.setup"="avast! antivirus Update"

                        [HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]
                        "C:\\Documents and Settings\\Administrateur\\Local Settings\\Temporary Internet Files\\Content.IE5\\Y7QDWTQZ\\aswclnr[1].exe"="Virus/Worm Cleaner Application"

                        [HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]
                        "C:\\Documents and Settings\\Administrateur\\Local Settings\\Temporary Internet Files\\Content.IE5\\Y7QDWTQZ\\aswclnr[1].tmp"="Virus/Worm Cleaner Application"

                        [HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]
                        "C:\\Documents and Settings\\Administrateur\\Local Settings\\Temporary Internet Files\\Content.IE5\\S32JKLSX\\FxLodear[1].exe"="Symantec Trojan.Lodear/Trojan.Lodav Removal Tool"

                        [HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]
                        "C:\\Documents and Settings\\Administrateur\\Local Settings\\Temporary Internet Files\\Content.IE5\\S32JKLSX\\trsetup[1].exe"="Trojan Remover Setup "

                        [HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]
                        "C:\\DOCUME~1\\ADMINI~1\\LOCALS~1\\Temp\\is-NOCBP.tmp\\is-EU6RP.tmp"="Setup/Uninstall"

                        [HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]
                        "C:\\DOCUME~1\\ADMINI~1\\LOCALS~1\\Temp\\is-C4ENP.tmp\\is-UEDUJ.tmp"="Setup/Uninstall"

                        le rapport ewidoo
                        wido anti-spyware - Scan Report
                        ---------------------------------------------------------

                        + Created at: 19:34:06 21/08/2006

                        + Scan result:

                        HKLM\SOFTWARE\Classes\AppID\Altnet Signing Module.EXE -> Adware.Altnet : Cleaned.
                        HKLM\SOFTWARE\Classes\AppID\adm.EXE -> Adware.Altnet : Cleaned.
                        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Hotbarb -> Adware.HotBar : Cleaned.
                        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Hotbarc -> Adware.HotBar : Cleaned.
                        C:\Documents and Settings\juliette\Cookies\juliette@247realmedia[2].txt -> TrackingCookie.247realmedia : Cleaned.
                        C:\Documents and Settings\juliette\Cookies\juliette@adtech[1].txt -> TrackingCookie.Adtech : Cleaned.
                        C:\Documents and Settings\juliette\Cookies\juliette@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
                        C:\Documents and Settings\juliette\Cookies\juliette@bluestreak[2].txt -> TrackingCookie.Bluestreak : Cleaned.
                        C:\Documents and Settings\juliette\Cookies\juliette@estat[1].txt -> TrackingCookie.Estat : Cleaned.
                        C:\Documents and Settings\juliette\Cookies\juliette@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned.
                        C:\Documents and Settings\juliette\Cookies\juliette@www.smartadserver[2].txt -> TrackingCookie.Smartadserver : Cleaned.
                        C:\Documents and Settings\juliette\Cookies\juliette@weborama[2].txt -> TrackingCookie.Weborama : Cleaned.

                        ::Report end
                        puis le hijackthis
                        Logfile of HijackThis v1.99.1
                        Scan saved at 20:33:32, on 21/08/2006
                        Platform: Windows XP SP2 (WinNT 5.01.2600)
                        MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

                        Running processes:
                        C:\WINDOWS\System32\smss.exe
                        C:\WINDOWS\system32\winlogon.exe
                        C:\WINDOWS\system32\services.exe
                        C:\WINDOWS\system32\lsass.exe
                        C:\WINDOWS\system32\svchost.exe
                        C:\WINDOWS\System32\svchost.exe
                        C:\WINDOWS\system32\LEXBCES.EXE
                        C:\WINDOWS\system32\spoolsv.exe
                        C:\Program Files\ewido anti-spyware 4.0\guard.exe
                        C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
                        C:\WINDOWS\System32\nvsvc32.exe
                        C:\WINDOWS\system32\pctspk.exe
                        C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
                        C:\WINDOWS\system32\SatSrv.exe
                        C:\WINDOWS\System32\svchost.exe
                        C:\WINDOWS\system32\ZoneLabs\vsmon.exe
                        C:\WINDOWS\system32\ZoneLabs\isafe.exe
                        C:\WINDOWS\Explorer.EXE
                        C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                        C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
                        C:\WINDOWS\system32\sstray.exe
                        C:\Program Files\ewido anti-spyware 4.0\ewido.exe
                        C:\WINDOWS\system32\ctfmon.exe
                        C:\Program Files\Skype\Phone\Skype.exe
                        C:\WINDOWS\system32\rundll32.exe
                        C:\Program Files\MSN Messenger\MsnMsgr.Exe
                        C:\Program Files\Internet Explorer\iexplore.exe
                        C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

                        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://actus.sfr.fr
                        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer avec Club-Internet
                        R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
                        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                        O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                        O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
                        O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                        O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
                        O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
                        O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
                        O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
                        O4 - HKLM\..\Run: [Dit] Dit.exe
                        O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                        O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
                        O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                        O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
                        O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
                        O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
                        O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
                        O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
                        O8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
                        O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
                        O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
                        O8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
                        O8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
                        O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
                        O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
                        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                        O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                        O17 - HKLM\System\CCS\Services\Tcpip\..\{8620F741-9FFE-43FE-A526-1C55ED88E46F}: NameServer = 194.17.200.10,194.117.200.15
                        O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
                        O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
                        O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                        O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                        O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
                        O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
                        O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe.exe
                        O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
                        O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
                        O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
                        O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
                        O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
                        O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
                        O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
                        O23 - Service: Steganos AntiTheft (SatSrv) - Unknown owner - C:\WINDOWS\system32\SatSrv.exe
                        O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

                        je dois te dire que pour spybot en mode sans echec, il arrivait pas à retirer 1 truc (bearshare je crois) et donc il m'a proposé de un scan au démarrage. il l'a fait et a encore trouvé d'autrestrucs;;

                        Voilà
                        Hou la la, heureusement que vous êtes là pour nous guider parceque c'est de la folie...
                        Bon ben à tout à l'heure...
                        0
                        1. zouzou
                          Par contre il me refusait d'ouvrir avast parcequil y avit undll manquant alors je suis allée le télécharger sur internet. Avast est bien là mais il n'est plus en bas à droite, comme d'habitude et Kerio n'est plus là non plus il me dit "cannot connect to service"
                          Je les retélecharge?
                          0
                          1. ^^Marie^^
                            Je répète

                            \Steganos Security Suite 2006 ===> Est-ce que tu t’en sert ?????

                            O4 - HKCU\..\Run: [SSS2006] "C:\Program Files\Steganos Security Suite 2006\SSS2006.exe" –boot
                            O23 - Service: Steganos AntiTheft (SatSrv) - Unknown owner - C:\WINDOWS\system32\SatSrv.exe

                            0
                            1. zouzou
                              a vrai dire non, je sais même pas ce que c'est... Désolée
                              0
                              1. ^^Marie^^
                                Supprime
                                Regarde dans ajout supp des programme ====>supprime
                                et tu supprimes les lignes

                                A+++++++++++++
                                0
                                1. zouzou
                                  ca y est mais par contre, ca veut dire quoi supprimer les lignes?
                                  En tout cas merci infinimentde m'avoir prise en charge...
                                  0
                                  1. ^^Marie^^
                                    Re,

                                    Vérifie dans ajout/supp des programmes si tu as

                                    Steganos Security Suite 2006

                                    Si oui, supprime le complètement.

                                    Tiens nous au courant

                                    A++

                                    0
                                    1. zouzou
                                      Bonjour Marie, me revoilà!!

                                      Ben en fait, non je n'ai plus Steganos security.
                                      Mais je pense que ya toujours des problemes, car quand je démarre des programmes ils semblent s'executer, ya le sablier puis plus rien...

                                      Par contre, j'ai Kério et Avast qui refonctionnent correctement.

                                      Voilà les news.
                                      Merci de ton aide!!
                                      0
                                      1. zouzou
                                        je confirme que quekquechose doit encore clocher tant mon ordi rame; et quand je l'ai fermé tout à l'heure(il ramait trop) alors que dans la fenetre appilcation yavait rien du tout pourtant ca m'a mis un ou deux messages comme quoii je sais plus quelle appliction était en cours..
                                        penses tu que ce soit grave ?
                                        0
                                        1. ^^Marie^^
                                          Slt,

                                          Remets un Hitjackthis, j'ai pu faire des impasses aussi.
                                          Fait pas trop chaud chez toi ?
                                          As-tu penser à défragmenter un peu ton PC ??

                                          A++
                                          0
                                          • 1
                                          • 2

                                          Discussions similaires

                                          infection
                                          céline0034

                                          12 réponses
                                          Infection
                                          toast3r

                                          44 réponses
                                          problème infection ?
                                          emma

                                          76 réponses
                                          Infection FileRepMetagen
                                          Fab8769

                                          9 réponses
                                          Infection Luckystarting
                                          @ssomw@r

                                          20 réponses