pubs intempestives sous orangeFermé

Question

bonjour voila mon probleme il est que quand je me connecte avec orange et que je lance mon navigateur orange .. souvent quand je lance un site j'ai pleins de fenetres de pubs qui se mettent c'est a dire yen a au moins une bonne cinquantaine qui se metten et pu moyen des les arreter je suis obligé de couper le pc de faire un reset .. j'ai meme essayé en les arretant en faisant ctrl alt + suppr mais rien n'y fait ça redemarre .. cela fait deux fois deja que ça m'arrive c'est pas tous les jours que j'ai çà et mon frere aussi qui est aussi chez orange il lui arrive la meme chose .. je voudrais savoir si quelqu'un d'entres vous lui arrive la meme chose et comment faire pour ne plus avoir çà .. c'est la premiere fois je n'ai jamais eu de pop up avec orange .. merci a vous

Damiendu21 · Answer

télécharge la barre google et enclanche le bloquage des pubs !!
adresse du site : https://www.01net.com/telecharger/windows/Internet/moteur_rech/fiches/19541.html

ced57680 · Answer

non merci je rapelle que je suis sous le navigateur orange je n'ai pas envie d'installer un truc en plus .. doit bien y avoir autre choses a faire que çà

Utilisateur anonyme · Answer

Hello

ton pc est probablement infecté, la barre d'outil google ça sert à rien, un bon navigateur intégre déjà un bloqueur de pub efficace et une option de recherche..

Télécharge HijackThis : 
---> http://www.trendsecure.com/portal/en-US/threat_analytics/HiJackThis_v2.exe

Installe le dans son propre dossier :
- clic droit sur le bureau, tu choisis "nouveau dossier" puis installe-le à l'intérieur.
Fais un clic droit sur Hijackthis, choisis "renommer" puis marque ceci : abcde.exe 
Double-clic sur HijackThis. Clic sur "I Accept" puis clic sur "do a system scan and save logfile" 
Puis copie et colle ici le rapport qu'il va te générer.

Démo pour HijackThis si besoin  :
http://pageperso.aol.fr/balltrap34/demohijack.htm


ET


Fais un clic droit sur ce lien :Enregistrer la cible (du lien) sous... et enregistre-le sur ton bureau.
 http://perso.orange.fr/il.mafioso/Navifix/Navilog1.zip 

Fais un clic droit sur navilog1.zip et choisis "tout extraire"
Ensuite double clique sur navilog1.exe pour lancer l'installation.
Une fois l'installation terminée, le fix s'exécutera automatiquement.
(Si ce n'est pas le cas, double-clique sur le raccourci Navilog1 présent sur le bureau).

Laisse-toi guider. Au menu principal choisis F, ensuite choisis 1 et valides.
(ne fais pas le choix 2,3 ou 4 sansmon avis)

Patiente jusqu'au message :
*** Analyse Termine le ..... ***

Appuie sur une touche comme demandé, le bloc-note va s'ouvrir.
Copie-colle l'intégralité dans un nouveau message
Le rapport est aussi sauvegardé à la racine du disque (fixnavi.txt)

ced57680 · Answer

Logfile of HijackThis v1.99.1
Scan saved at 15:27:53, on 25/08/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Program Files\Wanadoo\GestionnaireInternet.exe
C:\Program Files\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\Program Files\Wanadoo\Watch.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\PROGRA~1\Wanadoo\WOOBrowser\WOOBrowser.exe
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Bluetooth Manager.lnk = ?
O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar	oolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A78B4E74-361C-45AB-93DD-4E458624C100}: NameServer = 80.10.246.1 80.10.246.132
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: MsgPlusLoader.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O21 - SSODL: syshosts - {39A4062C-4E3A-486F-A550-017C85EF142A} - syshosts.dll (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

ced57680 · Answer

j'ai ces pop up a chaque fois que je vais sur le meme site direct les fentres apparaissent a une vitesse folle .. et c pas facile de tout arreter .. ça soule koi

Utilisateur anonyme · Answer

Je t'ai mis quelques chose à suivree, c'est incomplet ce que tu as posté ..

ced57680 · Answer

oui je sais je n'ai posté ke le rapport hijackthis .. je n'ai pas fais le reste car je suis pas tres calé en informatique javais peur de faire nimporte koi

Utilisateur anonyme · Answer

Mon but est pas de faire planter des PC, si tu souhaites avoir de l'aide via des personnes n'y connaissant rien, tu peux remettre un message t'inquiéte pas c'est pas ce qu'il manque, sur ce ..

ced57680 · Answer

je me doute que ton but n'est pas de faire çà .. d'ailleurs je n'ai rien dit contre toi c'est juste que moi j'ai le chic pour faire tout a l'envers c tout mais je vais le faire et je posterais le resultat .. voila merci

ced57680 · Answer

Search Navipromo version 2.0.9 commencé le 27/08/2007 à 13:46:10,67
 
!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Poster ce rapport sur le forum pour le faire analyser !!!
!!! Ne pas lancer la partie désinfection sans l'avis d'un spécialiste !!!

Fix lancé depuis C:\Program Files
avilog1
Mise a jour le 20.08.2007 a 22h30 by IL-MAFIOSO

Executé en mode normal

*** Recherche Programmes installes *** 

 


*** Recherche dossiers dans C:\WINDOWS ***




*** Recherche dossiers dans C:\Program Files ***




*** Recherche dossiers dans C:\Documents and Settings\All Users\Application Data ***




*** Recherche dossiers dans C:\Documents and Settings\LEMAIRE\Application Data ***



*** Recherche avec BlackLight Engine/F-secure ***
BlackLight Engine est un produit de F-secure, pour + d'infos :
https://www.f-secure.com/en


F-SECURE BLACKLIGHT ROOTKIT ELIMINATOR
======================================

Copyright 2005-2006 F-Secure Corporation. All rights reserved.
This is a beta version. It will expire on 1st of October, 2007.
Version information: 2.2.1064.

[+] Started on 08/27/07 at 13:46:12.
[+] Initializing ...
[+] Starting scan, press Ctrl-C to abort.
[+] Scanning for hidden items ............................................
[+] Scan complete.
[+] Summary: 0 hidden item(s) found, 0 scheduled for renaming.
[+] Exited on 08/27/07 at 13:50:01 (return code = 0).


*** Recherche avec GenericNaviSearch ***
!!! Tous Ces résultats peuvent révéler des fichiers légitimes !!!
!!! A verifier impérativement avant toute suppression manuelle !!!

Fichiers trouvés :

Aucun Fichier trouvé !

Fichiers suspects :

Aucun Fichier suspect trouvé !



*** Recherche fichiers *** 




*** Recherche cles registre ***


Recherche dans [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs] 
 
 

Recherche dans [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage] 
 
 

Recherche Clé Magic Control 
 


*** Module de Recherche complémentaire *** 
(Recherche fichiers spécifiques) 
 
1)Recherche fichiers connus:


2)Recherche Heuristique :
* 
** 
*** 
**** 
***** 
****** 
******* 
******** 


3)Recherche Certificats :

Certificat Egroup absent !


*** Analyse Terminé le 27/08/2007 à 13:50:17,92 ***

ced57680 · Answer

que pense tu alors de ce que je t'ai posté ??

Utilisateur anonyme · Answer

Elles ressemblent à quoi ces pubs ?


¤ Télécharge ce programme puis double clic dessus (ferme ton antivirus s'il te détecte quoi que ce soit)
http://www.suspectfile.com/systemscan/

* Coche uniquement ces cases, décoche tout le reste :

- Recent Files, 60 days
- Registry Run Key

Puis clic sur scan now, soit patient.
Une fois qu'il aura terminé, un rapport va s'ouvrir, copie et colle son contenu ici et vérifie qu'il soit bien en entier, si besoin crée deux messages.

ced57680 · Answer

je n'ai pas le temps de voir c quoi toutes ces pubs ya tellement de fenetres qui s'ouvrent a une vitesse folle que je ne vois pas a quoi ça correspond.. SystemScan - www.suspectfile.com - ver. 3.2.0 Running on: Windows XP HOME Edition, Service Pack 2 (2600.5.1) System directory: C:\WINDOWS Date: 28/08/2007 Time: 15:09:08 Output limited to: -Recent files -Registry Run Keys ===================== Recent files (60 days old)===================== ----- recent files in C:\ 04/07/2007 17:41:35 (DIR) 0 byte 55 days old -- chat.ced57 13/08/2007 23:13:47 216 byte 15 days old -- boot.ini 27/08/2007 13:44:30 (DIR) 0 byte 1 days old -- Program Files 27/08/2007 13:50:17 2389 byte 1 days old -- fixnavi.txt 27/08/2007 22:42:51 (DIR) 0 byte 1 days old -- My Music 28/08/2007 13:48:00 (DIR)1610612736 byte 0 days old -- pagefile.sys 28/08/2007 13:48:17 (DIR) 0 byte 0 days old -- WINDOWS 28/08/2007 15:09:08 (DIR) 0 byte 0 days old -- suspectfile ----- recent files in C:\WINDOWS\ 11/07/2007 20:24:35 (DIR) 0 byte 48 days old -- $NtUninstallKB936357$ 21/07/2007 15:54:33 (DIR) 0 byte 38 days old -- Downloaded Installations 21/07/2007 15:56:20 (DIR) 0 byte 38 days old -- Fonts 21/07/2007 15:56:58 (DIR) 0 byte 38 days old -- Installer 22/07/2007 13:53:56 1409 byte 37 days old -- QTFont.for 06/08/2007 16:48:55 (DIR) 0 byte 22 days old -- Downloaded Program Files 12/08/2007 01:24:57 54156 byte 16 days old -- QTFont.qfn 13/08/2007 23:13:47 227 byte 15 days old -- system.ini 13/08/2007 23:13:47 624 byte 15 days old -- win.ini 15/08/2007 19:38:27 (DIR) 0 byte 13 days old -- $hf_mig$ 15/08/2007 19:39:49 (DIR) 0 byte 13 days old -- $NtUninstallKB936782_WMP11$ 15/08/2007 19:40:18 (DIR) 0 byte 13 days old -- $NtUninstallKB937143$ 15/08/2007 19:40:32 (DIR) 0 byte 13 days old -- $NtUninstallKB938127$ 15/08/2007 19:41:39 (DIR) 0 byte 13 days old -- $NtUninstallKB938829$ 15/08/2007 19:41:45 (DIR) 0 byte 13 days old -- $NtUninstallKB921503$ 15/08/2007 19:41:51 (DIR) 0 byte 13 days old -- $NtUninstallKB938828$ 15/08/2007 19:41:56 (DIR) 0 byte 13 days old -- $NtUninstallKB936021$ 16/08/2007 02:15:35 (DIR) 0 byte 12 days old -- Debug 24/08/2007 15:45:17 (DIR) 0 byte 4 days old -- Help 27/08/2007 13:51:24 (DIR) 0 byte 1 days old -- system32 28/08/2007 00:19:09 32532 byte 0 days old -- SchedLgU.Txt 28/08/2007 13:48:06 2048 byte 0 days old -- bootstat.dat 28/08/2007 13:48:14 50 byte 0 days old -- wiaservc.log 28/08/2007 13:48:16 159 byte 0 days old -- wiadebug.log 28/08/2007 13:48:17 0 byte 0 days old -- 0.log 28/08/2007 13:48:22 (DIR) 0 byte 0 days old -- inf 28/08/2007 13:48:32 (DIR) 0 byte 0 days old -- Temp 28/08/2007 13:49:01 1856003 byte 0 days old -- WindowsUpdate.log 28/08/2007 14:44:49 116 byte 0 days old -- NeroDigital.ini 28/08/2007 15:04:36 (DIR) 0 byte 0 days old -- Internet Logs 28/08/2007 15:09:08 (DIR) 0 byte 0 days old -- Prefetch ----- recent files in C:\WINDOWS\Downloaded Program Files\ ----- recent files in C:\WINDOWS\system\ ----- recent files in C:\WINDOWS\system32\ 22/07/2007 12:11:23 192184 byte 37 days old -- FNTCACHE.DAT 29/07/2007 02:23:44 (DIR) 0 byte 30 days old -- Macromed 30/07/2007 19:18:40 33624 byte 29 days old -- wups.dll 30/07/2007 19:18:48 21336 byte 29 days old -- wuaueng.dll.mui 30/07/2007 19:19:04 38232 byte 29 days old -- wucltui.dll.mui 30/07/2007 19:19:12 43352 byte 29 days old -- wups2.dll 30/07/2007 19:19:16 53080 byte 29 days old -- wuauclt.exe 30/07/2007 19:19:20 92504 byte 29 days old -- cdm.dll 30/07/2007 19:19:28 216408 byte 29 days old -- wuaucpl.cpl 30/07/2007 19:19:28 203096 byte 29 days old -- wuweb.dll 30/07/2007 19:19:32 325976 byte 29 days old -- wucltui.dll 30/07/2007 19:19:36 549720 byte 29 days old -- wuapi.dll 30/07/2007 19:19:42 1712984 byte 29 days old -- wuaueng.dll 30/07/2007 19:19:52 30040 byte 29 days old -- wuapi.dll.mui 30/07/2007 19:20:06 30040 byte 29 days old -- wuaucpl.cpl.mui 03/08/2007 06:34:10 16789464 byte 25 days old -- MRT.exe 16/08/2007 13:32:34 (DIR) 0 byte 12 days old -- drivers 24/08/2007 21:41:07 (DIR) 0 byte 4 days old -- CatRoot2 24/08/2007 21:41:22 (DIR) 0 byte 4 days old -- dllcache 28/08/2007 13:48:19 62925 byte 0 days old -- nvapps.xml 28/08/2007 13:48:20 55080 byte 0 days old -- vsconfig.xml 28/08/2007 13:48:27 13646 byte 0 days old -- wpa.dbl ----- recent files in C:\WINDOWS\system32\drivers\ 16/08/2007 13:32:27 821536 byte 12 days old -- avg7core.sys ----- recent files in C:\WINDOWS emp\ 27/08/2007 18:26:17 256 byte 1 days old -- ZLT027df.TMP 27/08/2007 18:26:18 256 byte 1 days old -- ZLT027e2.TMP 28/08/2007 13:48:08 256 byte 0 days old -- ZLT0211e.TMP 28/08/2007 13:48:09 255 byte 0 days old -- WGAErrLog.txt 28/08/2007 13:48:09 256 byte 0 days old -- ZLT02121.TMP 28/08/2007 13:48:32 409 byte 0 days old -- WGANotify.settings ----- recent files in C:\Program Files\ 21/07/2007 15:56:17 (DIR) 0 byte 38 days old -- Adobe 01/08/2007 01:03:58 (DIR) 0 byte 27 days old -- Mozilla Firefox 10/08/2007 18:08:11 (DIR) 0 byte 18 days old -- Spybot - Search & Destroy 15/08/2007 19:40:23 (DIR) 0 byte 13 days old -- Internet Explorer 25/08/2007 15:27:45 (DIR) 0 byte 3 days old -- Hijackthis Version Française 27/08/2007 13:51:24 (DIR) 0 byte 1 days old -- Navilog1 27/08/2007 22:40:03 (DIR) 0 byte 1 days old -- eMule 28/08/2007 14:03:09 (DIR) 0 byte 0 days old -- Wanadoo ----- recent files in C:\Program Files\Fichiers communs\ 21/07/2007 15:57:06 (DIR) 0 byte 38 days old -- Adobe ----- recent files in C:\Documents and Settings\LEMAIRE\Application Data\ 21/07/2007 15:56:33 (DIR) 0 byte 38 days old -- Adobe 21/07/2007 15:57:41 (DIR) 0 byte 38 days old -- AdobeUM 29/07/2007 02:18:22 (DIR) 0 byte 30 days old -- Macromedia 27/08/2007 14:34:04 (DIR) 0 byte 1 days old -- uTorrent 28/08/2007 13:48:33 (DIR) 0 byte 0 days old -- AVG7 ----- recent files in C:\DOCUME~1\LEMAIRE\LOCALS~1\Temp\ 28/08/2007 13:48:23 (DIR) 0 byte 0 days old -- WPDNSE 28/08/2007 14:17:37 (DIR) 0 byte 0 days old -- plugtmp 28/08/2007 15:08:22 16384 byte 0 days old -- ~DF1A03.tmp 28/08/2007 15:08:22 (DIR) 0 byte 0 days old -- nsq57.tmp ===================== REGISTRY SCAN ===================== -----HKLM\Software\Microsoft\Windows\CurrentVersion\Run----- [Run] "NvCplDaemon"="RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" "nwiz"="nwiz.exe /install" "NvMediaCenter"="RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" "AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP" "Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" "ZoneAlarm Client"="\"C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe\"" [Run\OptionalComponents] [Run\OptionalComponents\IMAIL] "Installed"="1" [Run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [Run\OptionalComponents\MSFS] "Installed"="1" -----HKCU\Software\Microsoft\Windows\CurrentVersion\Run----- [Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" -----HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run----- [Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" "AVG7_Run"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE" -----HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run----- -----HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run----- -----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows----- [Windows] "AppInit_DLLs"="MsgPlusLoader.dll" -----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad----- [ShellServiceObjectDelayLoad] "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" #### HKCR\CLSID\{7849596a-48ea-486e-8937-a2a3009f31a9}\InprocServer32 @=expand:"%SystemRoot%\system32\SHELL32.dll" "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" #### HKCR\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32 @=expand:"%SystemRoot%\system32\SHELL32.dll" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" #### HKCR\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32 @=expand:"%SystemRoot%\system32\webcheck.dll" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" #### HKCR\CLSID\{35CEC8A3-2BE6-11D2-8773-92E220524153}\InprocServer32 @="C:\WINDOWS\system32\stobject.dll" "WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}" #### HKCR\CLSID\{AAA288BA-9A4C-45B0-95D7-94D524869DB5}\InprocServer32 @="C:\WINDOWS\system32\WPDShServiceObj.dll" "syshosts"="{39A4062C-4E3A-486F-A550-017C85EF142A}" #### HKCR\CLSID\{39A4062C-4E3A-486F-A550-017C85EF142A}\InprocServer32 @="syshosts.dll" -----HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks----- [ShellExecuteHooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" #### HKCR\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\InprocServer32 @="shell32.dll" -----HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon----- [Winlogon] "Shell"="Explorer.exe" "System"="" "Userinit"="C:\WINDOWS\system32\userinit.exe," "VmApplet"="rundll32 shell32,Control_RunDLL \"sysdm.cpl\"" "UIHost"=expand:"logonui.exe" "LogonType"=dword:00000001 "WinStationsDisabled"="0" [Winlogon\GPExtensions] [Winlogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}] "@="Quota du disque Microsoft" "DllName"=expand:"dskquota.dll" [Winlogon\GPExtensions\{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}] "@="Mappage de zones Internet Explorer" "DllName"=expand:"iedkcs32.dll" [Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}] "DllName"=expand:"scecli.dll" "@="Security" [Winlogon\GPExtensions\{A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B}] "DllName"=expand:"iedkcs32.dll" "@="Personnalisation de Internet Explorer" [Winlogon\GPExtensions\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}] "DllName"=expand:"scecli.dll" "@="EFS recovery" [Winlogon\GPExtensions\{C631DF4C-088F-4156-B058-4375F0853CD8}] "@="Microsoft Offline Files" "DllName"=expand:"%SystemRoot%\System32\cscui.dll" [Winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}] "@="Installation de logiciel" "DllName"=expand:"appmgmts.dll" [Winlogon\Notify] [Winlogon\Notify\crypt32chain] "DllName"=expand:"crypt32.dll" "Logoff"="ChainWlxLogoffEvent" [Winlogon\Notify\cryptnet] "DllName"=expand:"cryptnet.dll" "Logoff"="CryptnetWlxLogoffEvent" [Winlogon\Notify\cscdll] "DLLName"="cscdll.dll" "Logon"="WinlogonLogonEvent" "Logoff"="WinlogonLogoffEvent" "ScreenSaver"="WinlogonScreenSaverEvent" "Startup"="WinlogonStartupEvent" "StartShell"="WinlogonStartShellEvent" [Winlogon\Notify\ScCertProp] "DLLName"="wlnotify.dll" "Logon"="SCardStartCertProp" "Logoff"="SCardStopCertProp" "Lock"="SCardSuspendCertProp" "Unlock"="SCardResumeCertProp" "Enabled"=dword:00000001 [Winlogon\Notify\Schedule] "DllName"=expand:"wlnotify.dll" "StartShell"="SchedStartShell" "Logoff"="SchedEventLogOff" [Winlogon\Notify\sclgntfy] "Logoff"="WLEventLogoff" "DllName"=expand:"sclgntfy.dll" [Winlogon\Notify\SensLogn] "DLLName"="WlNotify.dll" "Lock"="SensLockEvent" "Logon"="SensLogonEvent" "Logoff"="SensLogoffEvent" "Safe"=dword:00000001 "MaxWait"=dword:00000258 "StartScreenSaver"="SensStartScreenSaverEvent" "StopScreenSaver"="SensStopScreenSaverEvent" "Startup"="SensStartupEvent" "StartShell"="SensStartShellEvent" "PostShell"="SensPostShellEvent" "Disconnect"="SensDisconnectEvent" "Reconnect"="SensReconnectEvent" "Unlock"="SensUnlockEvent" [Winlogon\Notify ermsrv] "DllName"=expand:"wlnotify.dll" "Logoff"="TSEventLogoff" "Logon"="TSEventLogon" "PostShell"="TSEventPostShell" "StartShell"="TSEventStartShell" "Startup"="TSEventStartup" "MaxWait"=dword:00000258 "Reconnect"="TSEventReconnect" "Disconnect"="TSEventDisconnect" [Winlogon\Notify\WgaLogon] "Logon"="WLEventLogon" "Logoff"="WLEventLogoff" "Startup"="WLEventStartup" "StartScreenSaver"="WLEventStartScreenSaver" "StopScreenSaver"="WLEventStopScreenSaver" "Lock"="WLEventLock" "Unlock"="WLEventUnlock" "StartShell"="WLEventStartShell" "PostShell"="WLEventPostShell" "Disconnect"="WLEventDisconnect" "Reconnect"="WLEventReconnect" "SafeMode"=dword:00000001 "MaxWait"=dword:ffffffff "DllName"=expand:"WgaLogon.dll" [Winlogon\Notify\WgaLogon\Settings] [Winlogon\Notify\wlballoon] "DLLName"="wlnotify.dll" "Logon"="RegisterTicketExpiredNotificationEvent" "Logoff"="UnregisterTicketExpiredNotificationEvent" [Winlogon\SpecialAccounts] [Winlogon\SpecialAccounts\UserList] "HelpAssistant"=dword:00000000 "TsInternetUser"=dword:00000000 "SQLAgentCmdExec"=dword:00000000 "NetShowServices"=dword:00000000 "IWAM_"=dword:00010000 "IUSR_"=dword:00010000 "VUSR_"=dword:00010000 -----HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon----- [Winlogon] "ParseAutoexec"="1" "ExcludeProfileDirs"="Local Settings;Temporary Internet Files;Historique;Temp" "BuildNumber"=dword:00000a28 -----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options----- [Image File Execution Options\Your Image File Name Here without a path] "Debugger"="ntsd -d" -----HKLM\System\CurrentControlSet\Control\Session Manager\----- [Session Manager] "BootExecute"=multi:"autocheck autochk *\00\00" [Session Manager\SubSystems] "Windows"=expand:"%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16" -----HKLM\SYSTEM\CurrentControlSet\Control\WOW----- [WOW] "cmdline"=expand:"%SystemRoot%\system32 tvdm.exe" "wowcmdline"=expand:"%SystemRoot%\system32 tvdm.exe -a %SystemRoot%\system32\krnl386" -----HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run----- -----HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce----- [RunOnce] -----HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx----- [RunOnceEx] -----HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices----- -----HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce----- -----HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce----- [RunOnce] -----HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx----- -----HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices----- -----HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run----- -----HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce----- -----HKLM\Software\Microsoft\Command Processor\Autorun----- -----HKCU\Software\Microsoft\Command Processor\Autorun----- -----HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load----- -----HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Startup----- -----HKCU\Software\Policies\Microsoft\Windows\System\Scripts\Logon----- -----HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Logon----- -----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\Runonce----- -----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\Run----- -----HKLM\System\CurrentControlSet\Control\Terminal Server\Wds dpwd\StartupPrograms----- -----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\Runonce----- -----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler----- [SharedTaskScheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui" #### HKCR\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InprocServer32 @=expand:"%SystemRoot%\system32\browseui.dll" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant" #### HKCR\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InprocServer32 @=expand:"%SystemRoot%\system32\browseui.dll" -----HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects----- [Browser Helper Objects] [Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] @="" -----HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks----- [URLSearchHooks] "{08C06D61-F1F3-4799-86F8-BE1A89362C85}"="" #### HKCR\CLSID\{08C06D61-F1F3-4799-86F8-BE1A89362C85}\InprocServer32 @="C:\PROGRA~1\Wanadoo\SEARCH~1.DLL" -----HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder----- [startupfolder] [startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk] "path"="C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Reader.lnk" "backup"="C:\WINDOWS\pss\Lancement rapide d'Adobe Reader.lnkCommon Startup" "location"="Common Startup" "command"="C:\PROGRA~1\Adobe\ACROBA~1.0\Reader\READER~1.EXE " "item"="Lancement rapide d'Adobe Reader" [startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Logitech Desktop Messenger.lnk] "path"="C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Logitech Desktop Messenger.lnk" "backup"="C:\WINDOWS\pss\Logitech Desktop Messenger.lnkCommon Startup" "location"="Common Startup" "command"="C:\PROGRA~1\Logitech\DESKTO~1\8876480\Program\LOGITE~1.EXE -startup" "item"="Logitech Desktop Messenger" [startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Logitech SetPoint.lnk] "path"="C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Logitech SetPoint.lnk" "backup"="C:\WINDOWS\pss\Logitech SetPoint.lnkCommon Startup" "location"="Common Startup" "command"="C:\PROGRA~1\Logitech\SetPoint\SetPoint.exe " "item"="Logitech SetPoint" -----HKCU\Control Panel\Desktop\----- [Desktop] [Desktop\WindowMetrics] -----HKEY_CLASSES_ROOT\exefile\shell\open\command----- [command] @="\"%1\" %*" -----HKEY_CLASSES_ROOT\comfile\shell\open\command----- [command] @="\"%1\" %*" -----HKEY_CLASSES_ROOT\batfile\shell\open\command----- [command] @="\"%1\" %*" -----HKEY_CLASSES_ROOT\piffile\shell\open\command----- [command] @="\"%1\" %*" -----HKEY_CLASSES_ROOT\scrFile\shell\open\command----- [command] @="\"%1\" /S" -----HKEY_CLASSES_ROOT\htafile\shell\open\command----- [Command] @="C:\WINDOWS\system32\mshta.exe \"%1\" %*" -----HKEY_CLASSES_ROOT\logfile\shell\open\command----- -----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL----- [URL] [URL\DefaultPrefix] @="http://" [URL\Prefixes] "ftp"="ftp://" "gopher"="gopher://" "home"="http://" "mosaic"="http://" "www"="http://" -----HKLM\SYSTEM\CurrentControlSet\Control\Lsa----- [Lsa] "Authentication Packages"=multi:"msv1_0\00\00" "Bounds"=hex:00,30,00,00,00,20,00,00 "Security Packages"=multi:"kerberos\00msv1_0\00schannel\00wdigest\00\00" "ImpersonatePrivilegeUpgradeToolHasRun"=dword:00000001 "LsaPid"=dword:00000294 "SecureBoot"=dword:00000001 "auditbaseobjects"=dword:00000000 "crashonauditfail"=dword:00000000 "disabledomaincreds"=dword:00000000 "everyoneincludesanonymous"=dword:00000000 "fipsalgorithmpolicy"=dword:00000000 "forceguest"=dword:00000001 "fullprivilegeauditing"=hex:00 "limitblankpassworduse"=dword:00000001 "lmcompatibilitylevel"=dword:00000000 "nodefaultadminowner"=dword:00000001 "nolmhash"=dword:00000000 "restrictanonymous"=dword:00000000 "restrictanonymoussam"=dword:00000001 "Notification Packages"=multi:"scecli\00\00" [Lsa\AccessProviders] "ProviderOrder"=multi:"Windows NT Access Provider\00\00" [Lsa\AccessProviders\Windows NT Access Provider] "ProviderPath"=expand:"%SystemRoot%\system32 tmarta.dll" [Lsa\Audit] [Lsa\Audit\PerUserAuditing] [Lsa\Audit\PerUserAuditing\System] [Lsa\Data] @Class="58d1c0b7" "Pattern"=hex:37,25,58,af,e3,b6,02,42,a1,c3,38,9d,32,49,64,0b,35,38,64,31,63,\ 30,62,37,00,fd,07,00,e2,37,00,00,34,fa,07,00,56,82,74,75,20,fa,07,00,40,fd,\ 07,00,4c,fd,07,00,c2,75,1b,50,8f,ed,d1,bf,73,42,9d,58 [Lsa\GBG] @Class="c2ed288f" "GrafBlumGroup"=hex:59,af,65,e0,76,dc,04,47,8c [Lsa\JD] @Class="739d50bf" "Lookup"=hex:35,97,c3,82,80,69 [Lsa\Kerberos] [Lsa\Kerberos\Domains] [Lsa\Kerberos\SidCache] [Lsa\msv1_0] "ntlmminclientsec"=dword:00000000 "ntlmminserversec"=dword:00000000 [Lsa\Skew1] @Class="1b7542c2" "SkewMatrix"=hex:0c,43,9d,85,7b,72,90,fc,77,fc,99,ce,45,de,c9,2c [Lsa\SSO] [Lsa\SSO\Passport1.4] "SSOURL"="http://www.passport.com" [Lsa\SspiCache] "Time"=hex:ea,4c,0b,ae,70,fe,c6,01 [Lsa\SspiCache\digest.dll] "Name"="Digest" "Comment"="Digest SSPI Authentication Package" "Capabilities"=dword:00004050 "RpcId"=dword:0000ffff "Version"=dword:00000001 "TokenSize"=dword:0000ffff "Time"=hex:00,a0,ca,bb,e3,7a,c4,01 "Type"=dword:00000031 [Lsa\SspiCache\msapsspc.dll] "Name"="DPA" "Comment"="DPA Security Package" "Capabilities"=dword:00000037 "RpcId"=dword:00000011 "Version"=dword:00000001 "TokenSize"=dword:00000300 "Time"=hex:00,a0,ca,bb,e3,7a,c4,01 "Type"=dword:00000031 [Lsa\SspiCache\msnsspc.dll] "Name"="MSN" "Comment"="MSN Security Package" "Capabilities"=dword:00000037 "RpcId"=dword:00000012 "Version"=dword:00000001 "TokenSize"=dword:00000300 "Time"=hex:00,a0,ca,bb,e3,7a,c4,01 "Type"=dword:00000031 -----HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess----- [SharedAccess] "DependOnGroup"=multi:"\00" "DependOnService"=multi:"Netman\00WinMgmt\00\00" "Description"="Assure la traduction d'adresses de réseau, l'adressage, les services de résolution de noms et/ou les services de prévention d'intrusion pour un réseau de petite entreprise ou un réseau domestique." "DisplayName"="Pare-feu Windows / Partage de connexion Internet" "ErrorControl"=dword:00000001 "ImagePath"=expand:"%SystemRoot%\system32\svchost.exe -k netsvcs" "ObjectName"="LocalSystem" "Start"=dword:00000002 "Type"=dword:00000020 [SharedAccess\Epoch] "Epoch"=dword:00003936 [SharedAccess\Parameters] "ServiceDll"=expand:"%SystemRoot%\System32\ipnathlp.dll" [SharedAccess\Parameters\FirewallPolicy] [SharedAccess\Parameters\FirewallPolicy\DomainProfile] [SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications] [SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\Program Files\Fichiers communs\AOL\ACS\AOLacsd.exe"="C:\Program Files\Fichiers communs\AOL\ACS\AOLacsd.exe:*:Enabled:AOL" "C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe"="C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe:*:Enabled:AOL" "C:\Program Files\AOL 9.0\waol.exe"="C:\Program Files\AOL 9.0\waol.exe:*:Enabled:AOL 9.0" "C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:MSN Messenger 7.5" "C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger" [SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall"=dword:00000000 [SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications] [SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\Program Files\Fichiers communs\AOL\ACS\AOLacsd.exe"="C:\Program Files\Fichiers communs\AOL\ACS\AOLacsd.exe:*:Enabled:AOL" "C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe"="C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe:*:Enabled:AOL" "C:\Program Files\AOL 9.0\waol.exe"="C:\Program Files\AOL 9.0\waol.exe:*:Enabled:AOL 9.0" "C:\Program Files\eMule\emule.exe"="C:\Program Files\eMule\emule.exe:*:Enabled:eMule" "C:\Program Files\Grisoft\AVG Free\avginet.exe"="C:\Program Files\Grisoft\AVG Free\avginet.exe:*:Enabled:avginet.exe" "C:\Program Files\Grisoft\AVG Free\avgamsvr.exe"="C:\Program Files\Grisoft\AVG Free\avgamsvr.exe:*:Enabled:avgamsvr.exe" "C:\Program Files\Grisoft\AVG Free\avgcc.exe"="C:\Program Files\Grisoft\AVG Free\avgcc.exe:*:Enabled:avgcc.exe" "C:\Program Files\Grisoft\AVG Free\avgemc.exe"="C:\Program Files\Grisoft\AVG Free\avgemc.exe:*:Enabled:avgemc.exe" "C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:MSN Messenger 7.5" "C:\Program Files\uTorrent\utorrent.exe"="C:\Program Files\uTorrent\utorrent.exe:*:Enabled:µTorrent" "C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger" "C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype" [SharedAccess\Setup] "ServiceUpgrade"=dword:00000001 [SharedAccess\Setup\InterfacesUnfirewalledAtUpdate] "All"=dword:00000001 -----HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Firewall\----- -----HKEY_LOCAL_MACHINE\SOFTWARE\Winsock2----- -----HKLM\Software\Microsoft\Ole----- [Ole] "DefaultLaunchPermission"=hex:01,00,04,80,5c,00,00,00,6c,00,00,00,00,00,00,00,\ 14,00,00,00,02,00,48,00,03,00,00,00,00,00,18,00,1f,00,00,00,01,02,00,00,00,\ 00,00,05,20,00,00,00,20,02,00,00,00,00,14,00,0b,00,00,00,01,01,00,00,00,00,\ 00,05,04,00,00,00,00,00,14,00,0b,00,00,00,01,01,00,00,00,00,00,05,12,00,00,\ 00,01,02,00,00,00,00,00,05,20,00,00,00,20,02,00,00,01,02,00,00,00,00,00,05,\ 20,00,00,00,20,02,00,00 "MachineLaunchRestriction"=hex:01,00,04,80,48,00,00,00,58,00,00,00,00,00,00,00,\ 14,00,00,00,02,00,34,00,02,00,00,00,00,00,18,00,1f,00,00,00,01,02,00,00,00,\ 00,00,05,20,00,00,00,20,02,00,00,00,00,14,00,0b,00,00,00,01,01,00,00,00,00,\ 00,01,00,00,00,00,01,02,00,00,00,00,00,05,20,00,00,00,20,02,00,00,01,02,00,\ 00,00,00,00,05,20,00,00,00,20,02,00,00 "MachineAccessRestriction"=hex:01,00,04,80,44,00,00,00,54,00,00,00,00,00,00,00,\ 14,00,00,00,02,00,30,00,02,00,00,00,00,00,14,00,03,00,00,00,01,01,00,00,00,\ 00,00,05,07,00,00,00,00,00,14,00,07,00,00,00,01,01,00,00,00,00,00,01,00,00,\ 00,00,01,02,00,00,00,00,00,05,20,00,00,00,20,02,00,00,01,02,00,00,00,00,00,\ 05,20,00,00,00,20,02,00,00 "EnableDCOM"="Y" [Ole\AppCompat] [Ole\AppCompat\ActivationSecurityCheckExemptionList] "{A50398B8-9075-4FBF-A7A1-456BF21937AD}"="1" "{AD65A69D-3831-40D7-9629-9B0B50A93843}"="1" "{0040D221-54A1-11D1-9DE0-006097042D69}"="1" "{2A6D72F1-6E7E-4702-B99C-E40D3DED33C3}"="1" -----HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU\----- -----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\----- [Security Center] "FirstRunDisabled"=dword:00000001 "AntiVirusDisableNotify"=dword:00000000 "FirewallDisableNotify"=dword:00000000 "UpdatesDisableNotify"=dword:00000000 "AntiVirusOverride"=dword:00000000 "FirewallOverride"=dword:00000000 [Security Center\Monitoring] [Security Center\Monitoring\AhnlabAntiVirus] [Security Center\Monitoring\ComputerAssociatesAntiVirus] [Security Center\Monitoring\KasperskyAntiVirus] [Security Center\Monitoring\McAfeeAntiVirus] [Security Center\Monitoring\McAfeeFirewall] [Security Center\Monitoring\PandaAntiVirus] [Security Center\Monitoring\PandaFirewall] [Security Center\Monitoring\SophosAntiVirus] [Security Center\Monitoring\SymantecAntiVirus] [Security Center\Monitoring\SymantecFirewall] [Security Center\Monitoring\TinyFirewall] [Security Center\Monitoring\TrendAntiVirus] [Security Center\Monitoring\TrendFirewall] [Security Center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001 -----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\----- [SystemRestore] "DisableSR"=dword:00000000 "CreateFirstRunRp"=dword:00000001 "DSMin"=dword:000000c8 "DSMax"=dword:00000190 "RPSessionInterval"=dword:00000000 "RPGlobalInterval"=dword:00015180 "RPLifeInterval"=dword:0076a700 "CompressionBurst"=dword:0000003c "TimerInterval"=dword:00000078 "DiskPercent"=dword:0000000c "ThawInterval"=dword:00000384 "RestoreDiskSpaceError"=dword:00000000 [SystemRestore\Cfg] "DiskPercent"=dword:0000000c "MachineGuid"="{FDD873F1-8541-43A1-9964-F5D81E24E966}" [SystemRestore\SnapshotCallbacks] @="" -----HKEY_CURRENT_USER\Software\VB and VBA Program Settings----- [VB and VBA Program Settings] [VB and VBA Program Settings\CCleaner] [VB and VBA Program Settings\CCleaner\Options] -----HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\----- [MountPoints2] [MountPoints2\C] "BaseClass"="Drive" [MountPoints2\D] "BaseClass"="Drive" [MountPoints2\E] "BaseClass"="Drive" [MountPoints2\F] "BaseClass"="Drive" [MountPoints2\G] "BaseClass"="Drive" [MountPoints2\H] "BaseClass"="Drive" [MountPoints2\I] "BaseClass"="Drive" [MountPoints2\J] "BaseClass"="Drive" [MountPoints2\{21a1c980-85fe-11db-b208-00038a000015}] "BaseClass"="Drive" "_AutorunStatus"=hex:01,01,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\ ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\ ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\ ff,ff,00,00,10,00,00,08,00,00,00 [MountPoints2\{60c01a26-c8c6-11db-b284-00016cad8cb6}] "BaseClass"="Drive" "_AutorunStatus"=hex:01,00,01,00,00,01,00,df,df,5f,df,5f,5f,5f,5f,df,df,5f,5f,\ 5f,df,df,df,5f,5f,5f,df,df,df,5f,5f,df,5f,5f,5f,5f,5f,01,00,01,01,ee,ff,ff,\ ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\ ff,ff,00,01,00,00,00,08,07,00,00 [MountPoints2\{60c01a26-c8c6-11db-b284-00016cad8cb6}\shell] @="None" [MountPoints2\{60c01a26-c8c6-11db-b284-00016cad8cb6}\shell\Autoplay] "MUIVerb"="@shell32.dll,-8504" [MountPoints2\{60c01a26-c8c6-11db-b284-00016cad8cb6}\shell\Autoplay\DropTarget] "CLSID"="{f26a669a-bcbb-4e37-abf9-7325da15f931}" #### HKCR\CLSID\{f26a669a-bcbb-4e37-abf9-7325da15f931}\InprocServer32 @=expand:"%SystemRoot%\system32\SHELL32.dll" [MountPoints2\{7373f741-690e-11db-b1ca-806d6172696f}] "BaseClass"="Drive" "_AutorunStatus"=hex:01,00,01,00,00,01,00,df,df,5f,cf,5f,5f,5f,5f,cf,cf,5f,5f,\ 5f,cf,cf,cf,5f,5f,5f,cf,cf,cf,5f,5f,cf,5f,5f,5f,5f,5f,cf,5f,5f,5f,5f,5f,df,\ df,5f,5f,5f,5f,cf,cf,cf,cf,cf,cf,cf,cf,5f,cf,cf,df,5f,5f,5f,5f,5f,5f,5f,5f,\ 5f,5f,00,60,00,00,00,00,00,00,00 [MountPoints2\{7373f742-690e-11db-b1ca-806d6172696f}] "BaseClass"="Drive" "_AutorunStatus"=hex:01,00,01,00,00,01,00,df,df,5f,cf,5f,5f,5f,5f,cf,cf,5f,5f,\ 5f,cf,cf,cf,5f,5f,5f,cf,cf,cf,5f,5f,cf,5f,5f,5f,5f,5f,cf,5f,5f,5f,5f,5f,df,\ df,5f,5f,5f,5f,cf,cf,cf,cf,cf,cf,cf,cf,5f,cf,cf,df,5f,5f,5f,5f,5f,5f,5f,5f,\ 5f,5f,00,20,00,00,00,00,00,00,00 "_CommentFromDesktopINI"="" [MountPoints2\{7373f742-690e-11db-b1ca-806d6172696f}\_Autorun] [MountPoints2\{7373f742-690e-11db-b1ca-806d6172696f}\_Autorun\DefaultIcon] @="E:\data\Orange.ico" [MountPoints2\{7373f743-690e-11db-b1ca-806d6172696f}] "BaseClass"="Drive" [MountPoints2\{7373f744-690e-11db-b1ca-806d6172696f}] "BaseClass"="Drive" [MountPoints2\{7373f745-690e-11db-b1ca-806d6172696f}] "BaseClass"="Drive" [MountPoints2\{7373f746-690e-11db-b1ca-806d6172696f}] "BaseClass"="Drive" [MountPoints2\{746eeb74-6b43-11db-b1d4-00038a000015}] "BaseClass"="Drive" "_AutorunStatus"=hex:01,01,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\ ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\ ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\ ff,ff,00,00,10,00,00,00,00,00,00 [MountPoints2\{99480794-690d-11db-a8c6-806d6172696f}] "BaseClass"="Drive" [MountPoints2\{e8f982b3-6a90-11db-b1d3-00038a000015}] "BaseClass"="Drive" "_AutorunStatus"=hex:01,00,01,00,00,01,00,df,df,5f,df,5f,5f,5f,5f,df,df,5f,5f,\ 5f,df,df,df,5f,5f,5f,df,df,df,5f,5f,df,5f,5f,5f,5f,5f,00,5f,5f,5f,5f,5f,cf,\ cf,5f,5f,5f,5f,01,01,00,ee,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\ ff,ff,00,00,10,00,00,08,02,00,00 [MountPoints2\{e8f982b3-6a90-11db-b1d3-00038a000015}\shell] @="None" [MountPoints2\{e8f982b3-6a90-11db-b1d3-00038a000015}\shell\Autoplay] "MUIVerb"="@shell32.dll,-8504" [MountPoints2\{e8f982b3-6a90-11db-b1d3-00038a000015}\shell\Autoplay\DropTarget] "CLSID"="{f26a669a-bcbb-4e37-abf9-7325da15f931}" #### HKCR\CLSID\{f26a669a-bcbb-4e37-abf9-7325da15f931}\InprocServer32 @=expand:"%SystemRoot%\system32\SHELL32.dll" -----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions----- [AdvancedOptions] -----HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions----- -----HKLM\Software\Microsoft\Active Setup\Installed Components----- [Installed Components] [Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] #### HKCR\CLSID\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\InprocServer32 @="C:\WINDOWS\system32\wmpdxm.dll" "Stubpath"="C:\WINDOWS\inf\unregmp2.exe /ShowWMP" "@="Microsoft Windows Media Player" "ComponentID"="WMPACCESS" [Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}] "@="Internet Explorer" "ComponentID"="IEACCESS" "StubPath"=expand:"%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE" [Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS] "@="Personnalisation du navigateur" "ComponentID"="BRANDING.CAB" "StubPath"="RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP" [Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] "@="Outlook Express" "ComponentID"="OEACCESS" "StubPath"=expand:"%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE" [Installed Components\{03F998B2-0E00-11D3-A498-00104B6EB52E}] #### HKCR\CLSID\{03F998B2-0E00-11D3-A498-00104B6EB52E}\InprocServer32 @="C:\Program Files\Viewpoint\Viewpoint Experience Technology\AxMetaStream_03040043.dll" "@="Viewpoint Media Player" "ComponentID"="Viewpoint" [Installed Components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}] "@="Rendu VML (Vector Graphics Rendering)" "ComponentID"="MSVML" [Installed Components\{1B00725B-C455-4DE6-BFB6-AD540AD427CD}] #### HKCR\CLSID\{1B00725B-C455-4DE6-BFB6-AD540AD427CD}\InprocServer32 @="C:\Program Files\Viewpoint\Viewpoint Experience Technology\AxMetaStream_03040043.dll" "@="Viewpoint Media Player" "ComponentID"="Viewpoint" [Installed Components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}] #### HKCR\CLSID\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}\InprocServer32 @="C:\WINDOWS\system32\wmpdxm.dll" "ComponentID"="NetShow" "StubPath"="" [Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] #### HKCR\CLSID\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\InprocServer32 @="C:\WINDOWS\system32\wmpdxm.dll" "ComponentID"="Microsoft Windows Media Player" "StubPath"="" "@="Microsoft Windows Media Player 6.4" [Installed Components\{233C1507-6A77-46A4-9443-F871F945D258}] #### HKCR\CLSID\{233C1507-6A77-46A4-9443-F871F945D258}\InprocServer32 @="C:\WINDOWS\system32\Macromed\Director\swdir.dll" "ComponentID"="Director" "@="Adobe Shockwave Director 10.2" [Installed Components\{283807B5-2C60-11D0-A31D-00AA00B92C03}] #### HKCR\CLSID\{283807B5-2C60-11D0-A31D-00AA00B92C03}\InprocServer32 @="C:\WINDOWS\system32\danim.dll" "@="DirectAnimation" "ComponentID"="DirectAnimation" [Installed Components\{2A202491-F00D-11cf-87CC-0020AFEECF20}] "ComponentID"="Director" "@="Adobe Shockwave Director 10.2" [Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] "@="Themes Setup" "ComponentID"="Theme Component" "StubPath"=expand:"%SystemRoot%\system32 egsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32 hemeui.dll" [Installed Components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}] "@="Liaison de données Dynamic HTML pour Java" "ComponentID"="TridataJava" [Installed Components\{3af36230-a269-11d1-b5bf-0000f8051515}] "@="Logiciel de navigation hors connexion" "ComponentID"="MobilePk" [Installed Components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}] "@="Uniscribe" "ComponentID"="USP10" [Installed Components\{4278c270-a269-11d1-b5bf-0000f8051515}] "@="Création avancée" "ComponentID"="AdvAuth" [Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] "@="Microsoft Outlook Express 6" "ComponentID"="MailNews" "StubPath"=expand:"\"%ProgramFiles%\Outlook Express\setup50.exe\" /APP:OE /CALLER:WINNT /user /install" [Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] "@="NetMeeting 3.01" "ComponentID"="NetMeeting" "StubPath"="rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT" [Installed Components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}] "@="DirectShow" "ComponentID"="activemovie" [Installed Components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}] "@="DirectDrawEx" "ComponentID"="DirectDrawEx" [Installed Components\{45ea75a0-a269-11d1-b5bf-0000f8051515}] "@="Aide sur Internet Explorer" "ComponentID"="HelpCont" [Installed Components\{4f216970-c90c-11d1-b5c7-0000f8051515}] "@="Classes Java DirectAnimation" "ComponentID"="DAJava" [Installed Components\{4f645220-306d-11d2-995d-00c04f98bbc9}] "@="Microsoft Windows Script 5.6" "ComponentID"="MSVBScript" [Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}] "KeyFileName"="C:\Program Files\Messenger\msmsgs.exe" "@="Windows Messenger 4.7" "ComponentID"="Messenger" "StubPath"="rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser" [Installed Components\{5A8D6EE0-3E18-11D0-821E-444553540000}] "(Default)"="Internet Connection Wizard" "ComponentID"="ICW" [Installed Components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}] "@="Outils d'installation Internet Explorer" "ComponentID"="GenSetup" [Installed Components\{630b1da0-b465-11d1-9948-00c04f98bbc9}] "@="Améliorations pour la navigation" "ComponentID"="ExtraPack" "KeyFileName"="C:\WINDOWS\system32\msieftp.dll" [Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}] #### HKCR\CLSID\{6BF52A52-394A-11d3-B153-00C04F79FAA6}\InprocServer32 @="C:\WINDOWS\system32\wmp.dll" "@="Microsoft Windows Media Player" "ComponentID"="Microsoft Windows Media Player" "StubPath"="rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp11.inf,PerUserStub" [Installed Components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}] "@="Accès au site MSN" "ComponentID"="MSN_Auth" [Installed Components\{73FA19D0-2D75-11D2-995D-00C04F98BBC9}] "@="Dossiers Web" "ComponentID"="WebFolders" "StubPath"="" [Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}] "@="Carnet d'adresses 6" "ComponentID"="WAB" "StubPath"=expand:"\"%ProgramFiles%\Outlook Express\setup50.exe\" /APP:WAB /CALLER:WINNT /user /install" [Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}] "@="Mise à jour du Bureau Windows" "ComponentID"="IE4Shell_NT" "StubPath"=expand:"regsvr32.exe /s /n /i:U shell32.dll" [Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}] "@="Internet Explorer 6" "ComponentID"="BASEIE40_W2K" "StubPath"=expand:"%SystemRoot%\system32\ie4uinit.exe" [Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\AuthorizedCDFPrefix] [Installed Components\{9381D8F2-0288-11D0-9501-00AA00B911A5}] "@="Liaison de données Dynamic HTML" "ComponentID"="Tridata" [Installed Components\{ACC563BC-4266-43f0-B6ED-9D38C4202C7E}] [Installed Components\{C9E9A340-D1F1-11D0-821E-444553540600}] "@="Polices de base Internet Explorer" "ComponentID"="Fontcore" [Installed Components\{CC2A9BA0-3BDD-11D0-821E-444553540000}] "@="Planificateur de tâches" "ComponentID"="MSTASK" [Installed Components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}] "ComponentID"="Windows Movie Maker v2.1" [Installed Components\{D27CDB6E-AE6D-11cf-96B8-444553540000}] "@="Adobe Flash Player 9 ActiveX" "ComponentID"="Flash" [Installed Components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}] "@="Aide HTML" "ComponentID"="HTMLHelp" [Installed Components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}] "@="Active Directory Service Interface" "ComponentID"="ADSI" -----Comparing registry keys CCS1 vs CCS2 ----- < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Dhcp\Parameters {A78B4E74-361C-45AB-93DD-4E458624C100} REG_BINARY 0F000000000000000000000000000000FA0ED446F9000000000000000000000000000000FA0ED44601000000000000000000000000000000FA0ED4462B000000000000000000000000000000FA0ED4462C000000000000000000000000000000FA0ED44606000000000000000000000000000000FA0ED446 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Dhcp\Parameters {A78B4E74-361C-45AB-93DD-4E458624C100} REG_BINARY 0F0000000000000000000000000000006CFCD246F90000000000000000000000000000006CFCD246010000000000000000000000000000006CFCD2462B0000000000000000000000000000006CFCD2462C0000000000000000000000000000006CFCD246060000000000000000000000000000006CFCD246 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Eventlog\Application\AVG7 EventMessageFile REG_SZ C:\Program Files\Grisoft\AVG Free\avglog.dll > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Application\AVG7 EventMessageFile REG_SZ C:\PROGRA~1\Grisoft\AVGFRE~1\avglog.dll < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Eventlog\Application\AVG7 CategoryMessageFile REG_SZ C:\Program Files\Grisoft\AVG Free\avglog.dll > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Application\AVG7 CategoryMessageFile REG_SZ C:\PROGRA~1\Grisoft\AVGFRE~1\avglog.dll < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Eventlog\Application\ESENT EventMessageFile REG_EXPAND_SZ C:\WINDOWS\system32\ESENT.dll > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Application\ESENT EventMessageFile REG_EXPAND_SZ c:\windows\system32\ESENT.dll < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Eventlog\Application\ESENT CategoryMessageFile REG_EXPAND_SZ C:\WINDOWS\system32\ESENT.dll > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Application\ESENT CategoryMessageFile REG_EXPAND_SZ c:\windows\system32\ESENT.dll > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\DS > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\LSA > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\NetDDE Object > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\SC Manager > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\Security > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\Security Account Manager > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\Spooler > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\MRxDAV\EncryptedDirectories < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\mssmbios\Data < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\NetBT\Parameters\Interfaces\Tcpip_{A78B4E74-361C-45AB-93DD-4E458624C100} NetbiosOptions REG_DWORD 2 (0x2) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfDisk\Performance WbemAdapFileSignature REG_BINARY BB4F5688033F8B87B57ECE502EC84465 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfDisk\Performance WbemAdapFileTime REG_BINARY 00A0CABBE37AC401 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfDisk\Performance WbemAdapFileSize REG_DWORD 27136 (0x6A00) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfDisk\Performance WbemAdapStatus REG_DWORD 0 (0x0) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfNet\Performance WbemAdapFileSignature REG_BINARY 7FD03F93453FAFBABB6E29B11E9E731C < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfNet\Performance WbemAdapFileTime REG_BINARY 00A0CABBE37AC401 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfNet\Performance WbemAdapFileSize REG_DWORD 17408 (0x4400) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfNet\Performance WbemAdapStatus REG_DWORD 0 (0x0) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfOS\Performance WbemAdapFileSignature REG_BINARY 9619B5D1C9A8BD4E94D544AEA564F03F < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfOS\Performance WbemAdapFileTime REG_BINARY 00A0CABBE37AC401 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfOS\Performance WbemAdapFileSize REG_DWORD 26624 (0x6800) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfOS\Performance WbemAdapStatus REG_DWORD 0 (0x0) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfProc\Performance WbemAdapFileSignature REG_BINARY CDB0291E7050A577452DB4D40D582E54 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfProc\Performance WbemAdapFileTime REG_BINARY 00A0CABBE37AC401 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfProc\Performance WbemAdapFileSize REG_DWORD 35840 (0x8C00) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfProc\Performance WbemAdapStatus REG_DWORD 0 (0x0) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\SharedAccess\Epoch Epoch REG_DWORD 14646 (0x3936) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\SharedAccess\Epoch Epoch REG_DWORD 14641 (0x3931) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Spooler\Performance WbemAdapFileSignature REG_BINARY 50A03AF114D7DD2ECB9F6B0EC496D2F8 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Spooler\Performance WbemAdapFileTime REG_BINARY 00A0CABBE37AC401 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Spooler\Performance WbemAdapFileSize REG_DWORD 146944 (0x23E00) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Spooler\Performance WbemAdapStatus REG_DWORD 0 (0x0) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\srescan\Parameters\Loaded < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\TapiSrv\Performance WbemAdapFileSignature REG_BINARY 0483F001E58AF7EA90B23BA9ACB367D3 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\TapiSrv\Performance WbemAdapFileTime REG_BINARY 00A0CABBE37AC401 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\TapiSrv\Performance WbemAdapFileSize REG_DWORD 5632 (0x1600) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\TapiSrv\Performance WbemAdapStatus REG_DWORD 0 (0x0) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters DhcpNameServer REG_SZ 10.0.0.138 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters DhcpDomain REG_SZ lan < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Tcpip\Parameters\Interfaces\{A78B4E74-361C-45AB-93DD-4E458624C100} NTEContextList REG_MULTI_SZ 0x00000003\0\0 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters\Interfaces\{A78B4E74-361C-45AB-93DD-4E458624C100} NTEContextList REG_MULTI_SZ \0 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Tcpip\Parameters\Interfaces\{A78B4E74-361C-45AB-93DD-4E458624C100} DhcpIPAddress REG_SZ 90.40.20.63 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters\Interfaces\{A78B4E74-361C-45AB-93DD-4E458624C100} DhcpIPAddress REG_SZ 0.0.0.0 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Tcpip\Parameters\Interfaces\{A78B4E74-361C-45AB-93DD-4E458624C100} DhcpSubnetMask REG_SZ 255.255.255.255 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters\Interfaces\{A78B4E74-361C-45AB-93DD-4E458624C100} DhcpSubnetMask REG_SZ 0.0.0.0 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Tcpip\Parameters\Interfaces\{A78B4E74-361C-45AB-93DD-4E458624C100} NameServer REG_SZ 80.10.246.130 80.10.246.3 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters\Interfaces\{A78B4E74-361C-45AB-93DD-4E458624C100} NameServer REG_SZ Result compared: Different -----Comparing registry keys CCS1 vs CCS3 ----- < Value: HKEY_LOCAL_MACHINE\system\controlset001\services Result compared: Identical ========================================== Scan completed in 0,7 minutes End of report

Utilisateur anonyme · Answer

Ok, tu peux désinstaller Navilog1 vi aajouter/supprimer des programmes ainsi que Desktop Messenger si encore installé (inutile est suspect)
Tu peux jeter systemscan.


Télécharge MSNFix de Laurent
http://sosvirus.changelog.fr/MSNFix.zip 

Décompresse-le  et double clic sur le fichier MSNFix.bat. 
- Exécute l'option R. 
--Si l'infection est détectée, exécute l'option N
- Sauvegarde ce rapport puis fais un copier/coller de ce rapport sur le forum.



Puis :
Fais ce scan en ligne avec Bitdefender, tout est indiqué ici
https://kerio.probb.fr/t673-bitdefender-antivirus-en-ligne

ced57680 · Answer

ecoute j'arrive pas a mettre msn fix là ça marche pas je le decompresse et tout mais ça me met une erreur comme quoi le fichier msnfix.bat doit etre placé dans le dossier msnfix ce ke j'ai fait mais ça marche pas ..  ça me emt commande introuvable pourtant j'ai bien fait comme tu me dis ...

Utilisateur anonyme · Answer

Garde MSNfix de côté, fais le scan chez Bitdefender, je te dirais comment faire après j'ai plus le temps là ;-)

ced57680 · Answer

ok je vais faire çà merci ..

ced57680 · Answer

BitDefender Online Scanner - Rapport d'analyse

BitDefender Online Scanner

Rapport d'analyse généré à: Tue, Aug 28, 2007 - 16:45:32

Voie d'analyse: C:\;D:\;E:\;F:\;G:\;H:\;I:\;

Statistiques
Temps	00:28:20
Fichiers	76504
Directoires	2737
Secteurs de boot	2
Archives	665
Paquets programmes	4096

Résultats
Virus identifiés	0
Fichiers infectés	0
Fichiers suspects	0
Avertissements	0
Désinfectés	0
Fichiers effacés	0

Info sur les moteurs
Définition virus	750279
Version des moteurs	AVCORE v1.0 (build 2411) (i386) (Jul 9 2007 12:10:22)
Analyse des plugins	14
Archive des plugins	38
Unpack des plugins	6
E-mail plugins	6
Système plugins	1

Paramètres d'analyse
Première action	Désinfecté
Seconde Action	Supprimé
Heuristique	Oui
Acceptez les avertissements	Oui
Extensions analysées	*;
Excludez les extensions
Analyse d'emails	Oui
Analyse des Archives	Oui
Analyser paquets programmes	Oui
Analyse des fichiers	Oui
Analyse de boot	Oui

Fichier analysé	Statut
Aucun virus trouvé.

ced57680 · Answer

j'ai posté le rapport mais tu ne m'as tjs pas repondu.. bref je met ce message car depuis pres de 3 semaines je n'ai plus eu ces pubs et là je viens de me connecter et d'aller sur le site où je vais tous les jours et paf toutes les pubs sont revenues ... je ne sais pas comment ça se fait alors qu'elles n'etait plus apparues depuis pas mal de temps

Pubs intempestives sous orange

19 réponses

Discussions similaires

Newsletters