le virus Beagle/Bagle ?Fermé

Question

Bonjour,

Je me demande si je ne suis pas infecté par le virus Beagle/Bagle . Etant tombé sur un post donnant des manips à faire je viens de faire une recherche avec FindyKill et j'aimerais savoir si il faut que je lance spybot aussi. Voici le rapport Findykill:


############################## | FindyKill V6.005 |

# User : Laurent (Administrateurs) # PC-DE-LAURENT
# Update on 11/07/09 by Chiquitine29 & C_XX
# Start at: 13:44:37 | 12/07/2009
# Website : http://pagesperso-orange.fr/NosTools/index.html

# Genuine Intel(R) CPU           T2080  @ 1.73GHz
# Microsoft® Windows Vista™ Édition Familiale Premium  (6.0.6002 32-bit) # Service Pack 2
# Internet Explorer 8.0.6001.18783
# Windows Firewall Status : Enabled
# AV : avast! antivirus 4.8.1335 [VPS 090405-0] 4.8.1335 [ Enabled | Updated ]

# C:\ # Disque fixe local # 141,04 Go (64,52 Go free) [HDD] # NTFS
# D:\ # Disque CD-ROM
# E:\ # Disque CD-ROM
# F:\ # Disque amovible # 3,8 Go (2,02 Go free) # FAT32
# G:\ # Disque amovible

############################## | Processus actifs |

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\system32\svchost.exe
C:\Program Files\ATK Hotkey\ASLDRSrv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\FsUsbExService.Exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32	askeng.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
C:\Windows\System32\alg.exe
C:\Windows\ehome\ehsched.exe
C:\Windows\ehome\ehRecvr.exe
C:\Windows\system32	askeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\ATK Hotkey\Hcontrol.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Common Files\aol\1180039809\ee\aolsoftware.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
C:\Program Files\ATK Hotkey\ATKOSD.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\SweetIM\Messenger\SweetIM.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\Winamp Remote\bin\OrbTray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Common Files\TerraTec\Remote\TTTvRc.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\conime.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\wbem\wmiprvse.exe

################## | Registre Startup |

R1 - HKCU\..\Main: "Local Page"="C:\Windows\system32\blank.htm" 
R1 - HKCU\..\Main: "Search Page"="" 
R1 - HKCU\..\Main: "Start Page"="https://www.ask.com/?o=101764&l=dis" 
F2 - HKLM\..\logon:"Userinit"="C:\Windows\system32\userinit.exe," 
F2 - HKLM\..\logon:"LegalNoticeCaption"="" 
F2 - HKLM\..\logon:"LegalNoticeText"="" 
04 - HKLM\..\Run:  Windows Defender=%ProgramFiles%\Windows Defender\MSASCui.exe -hide 
04 - HKLM\..\Run:  SynTPEnh=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe 
04 - HKLM\..\Run:  RtHDVCpl=RtHDVCpl.exe 
04 - HKLM\..\Run:  HostManager=C:\Program Files\Common Files\AOL\1180039809\ee\AOLSoftware.exe 
04 - HKLM\..\Run:  RoxWatchTray="C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" 
04 - HKLM\..\Run:  Google Desktop Search="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup 
04 - HKLM\..\Run:  Picasa Media Detector=C:\Program Files\Picasa2\PicasaMediaDetector.exe 
04 - HKLM\..\Run:  toolbar_eula_launcher=C:\Program Files\Packard Bell\GOOGLE_EULA\EULALauncher.exe 
04 - HKLM\..\Run:  avast!=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe 
04 - HKLM\..\Run:  SweetIM=C:\Program Files\SweetIM\Messenger\SweetIM.exe 
04 - HKLM\..\Run:  SunJavaUpdateSched="C:\Program Files\Java\jre6\bin\jusched.exe" 
04 - HKLM\..\Run:  SSBkgdUpdate="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot 
04 - HKLM\..\Run:  PaperPort PTD="C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe" 
04 - HKLM\..\Run:  IndexSearch="C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" 
04 - HKLM\..\Run:  PPort11reminder="C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe" -r "C:\ProgramData\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini 
04 - HKLM\..\Run:  BrMfcWnd=C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN 
04 - HKLM\..\Run:  ControlCenter3=C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun 
04 - HKLM\..\Run:  NPSStartup= 
04 - HKLM\..\Run:  WinampAgent="C:\Program Files\Winamp\winampa.exe" 
04 - HKLM\..\Run:  Adobe Reader Speed Launcher="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" 
04 - HKLM\..\Run:  HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversionun\OptionalComponents= 
04 - HKCU\..\Run:  Sidebar=C:\Program Files\Windows Sidebar\sidebar.exe /autoRun  
04 - HKCU\..\Run:  StartCCC=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe  
04 - HKCU\..\Run:  SmpcSys=C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe  
04 - HKCU\..\Run:  ehTray.exe=C:\Windows\ehome\ehTray.exe  
04 - HKCU\..\Run:  BitTorrent DNA="C:\Program Files\DNA\btdna.exe"  
04 - HKCU\..\Run:  Sony Ericsson PC Suite="C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon  
04 - HKCU\..\Run:  DAEMON Tools Lite="C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun  
04 - HKCU\..\Run:  Orb="C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background  
04 - HKCU\..\Run:  WMPNSCFG=C:\Program Files\Windows Media Player\WMPNSCFG.exe  
04 - HKCU\..\Run:  Remote Control Editor="C:\Program Files\Common Files\TerraTec\Remote\TTTvRc.exe"  

################## | Fichiers # Dossiers infectieux |


################## | C:\Users\Laurent\Temporary Internet Files |


################## | All Drives ... |


################## | Registre # Clés Run infectieuses |

Présent ! HKLM\software\microsoft\security center\Svc "AntiVirusOverride" ( 0x1 )  

################## | Registre # Mountpoints2 |

HKCU\..\..\Explorer\MountPoints2\E
shell\AutoRun\command =E:\wd_windows_tools\WDSetup.exe 

HKCU\..\..\Explorer\MountPoints2\F
shell\AutoRun\command =F:\wd_windows_tools\WDSetup.exe 

HKCU\..\..\Explorer\MountPoints2\{852d44f5-49cb-11de-b0d2-00038a000015}
shell\AutoRun\command =F:\WDSetup.exe 

################## | Etat / Services / Informations |

# Affichage des fichiers cachés : OK
# Mode sans echec : OK
# (!) Uac = 0x0 
 
# Ndisuio -> Start = 3 ( Good = 3 | Bad = 4 ) 
# EapHost -> Start = 3 ( Good = 2 | Bad = 4 ) 
# Wlansvc -> Start = 2 ( Good = 2 | Bad = 4 ) 
# SharedAccess -> Start = 2 ( Good = 2 | Bad = 4 ) 
# windefend -> Start = 2 ( Good = 2 | Bad = 4 ) 
# wuauserv -> Start = 2 ( Good = 2 | Bad = 4 ) 
# wscsvc -> Start = 2 ( Good = 2 | Bad = 4 ) 


################## | Cracks / Keygens / Serials |

"C:\Users\Laurent\Downloads\The Sims 3 - Razor1911 Final MAXSPEED\Crack\TS3.exe"  
10/06/2009 23:36 |Size : 11285776 |Crc32 : d6ed3d29 |Md5 : 861fac71b1751e14f8bcef651021047b  
 

################## | ! Fin du rapport # FindyKill V6.005 ! |

Nic00 · Answer

Salut,

/!\ Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) susceptible d avoir été infectées sans les ouvrir 


&#9654; Fais un clic droit sur le raccourci FindyKill présent sur ton bureau et choisis "exécuter en tant qu'administrateur" . 

&#9654; Choisi l'option 2 (Suppression) 

 &#9654;Ton bureau disparaitra et le pc redémarrera . 

 &#9654;Au redémarrage, FindyKill scannera ton pc , laisse travailler l outil. 

&#9654; Ensuite post le rapport qui apparaitra avec le bureau. 

• Note : Le rapport FindyKill.txt est sauvegardé a la racine du disque.( C:\FindyKill.txt ) 

( CTRL+A Pour tout sélectionner , CTRL+C pour copier et CTRL+V pour coller )

flibustierdu42 · Answer

Merci Nic00 d'avoir répondu aussi vite, j'ai fait ce que tu m'as dit voici le rapport:


############################## | FindyKill V6.005 |

# User : Laurent (Administrateurs) # PC-DE-LAURENT
# Update on 11/07/09 by Chiquitine29 & C_XX
# Start at: 14:10:29 | 12/07/2009
# Website : http://pagesperso-orange.fr/NosTools/index.html

# Genuine Intel(R) CPU           T2080  @ 1.73GHz
# Microsoft® Windows Vista™ Édition Familiale Premium  (6.0.6002 32-bit) # Service Pack 2
# Internet Explorer 8.0.6001.18783
# Windows Firewall Status : Enabled
# AV : avast! antivirus 4.8.1335 [VPS 090405-0] 4.8.1335 [ Enabled | Updated ]

# C:\ # Disque fixe local # 141,04 Go (64,55 Go free) [HDD] # NTFS
# D:\ # Disque CD-ROM
# E:\ # Disque CD-ROM
# F:\ # Disque fixe local # 596,02 Go (442,41 Go free) [My Book] # FAT32

############################## | Processus actifs |

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\LogonUI.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Program Files\ATK Hotkey\ASLDRSrv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\setup\avast.setup
C:\Windows\system32\FsUsbExService.Exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32	askeng.exe
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Windows\system32\userinit.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Windows\Explorer.EXE
C:\Windows\system32unonce.exe
C:\Program Files\ATK Hotkey\Hcontrol.exe
C:\Windows\system32\conime.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\ATK Hotkey\ATKOSD.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
C:\Windows\System32\alg.exe
C:\Windows\system32\wbem\wmiprvse.exe

################## | Fichiers # Dossiers infectieux |


################## | C:\Users\Laurent\Temporary Internet Files |


################## | All Drives ... |

Supprimé ! F:\Setup.exe    
Supprimé ! F:\autorun.inf    
################## | Autres ... |


################## | Registre # Clés Run infectieuses |

# HKLM\software\microsoft\security center\Svc "AntiVirusOverride" # -> Reset sucessfully !  

################## | Registre # Mountpoints2 |

Supprimé ! HKCU\...\Explorer\MountPoints2\E\Shell\AutoRun\Command  
Supprimé ! HKCU\...\Explorer\MountPoints2\F\Shell\AutoRun\Command  
Supprimé ! HKCU\...\Explorer\MountPoints2\{357c688e-1fa8-11de-b1d2-00038a000015}\Shell\AutoRun\Command  
Supprimé ! HKCU\...\Explorer\MountPoints2\{852d44f5-49cb-11de-b0d2-00038a000015}\Shell\AutoRun\Command  

################## | Listing des fichiers présent |

[09/05/2009 22:30|--a------|16046] - C:\0x040c.ini
[09/05/2009 22:30|--a------|103424] - C:\1036.MST
[18/09/2006 23:43|--a------|24] - C:\autoexec.bat
[11/04/2009 08:36|-rahs----|333257] - C:\bootmgr
[25/05/2007 08:04|-ra-s----|8192] - C:\BOOTSECT.BAK
[18/09/2006 23:43|--a------|10] - C:\config.sys
[12/07/2009 13:50|--a------|9072] - C:\FindyKill rapport.txt
[12/07/2009 14:38|--a------|3854] - C:\FindyKill.txt
[?|?|?] - C:\hiberfil.sys
[24/05/2007 22:52|--ah-----|1808] - C:\IPH.PH
[?|?|?] - C:\pagefile.sys
[24/05/2007 22:46|--a------|335] - C:\RHDSetup.log
[09/05/2009 22:30|--a------|3686400] - C:\Samsung New PC Studio USB Driver Installer.msi
[31/03/2008 12:57|--a------|87] - F:\Install.ini
[11/04/2009 18:00|--a------|42882] - F:\VirtualDJ Local Database v5.xml

################## | Vaccination |

# C:\autorun.inf ( # Not infected ) -> Folder created by FindyKill.  
# F:\autorun.inf ( # Not infected ) -> Folder created by FindyKill.  

################## | Etat / Services / Informations |

# Mode sans echec : OK


# Affichage des fichiers cachés : OK

# Uac : OK 
 
# Ndisuio -> Start = 3 ( Good = 3 | Bad = 4 ) 
# EapHost -> Start = 2 ( Good = 2 | Bad = 4 ) 
# Wlansvc -> Start = 2 ( Good = 2 | Bad = 4 ) 
# SharedAccess -> Start = 2 ( Good = 2 | Bad = 4 ) 
# windefend -> Start = 2 ( Good = 2 | Bad = 4 ) 
# wuauserv -> Start = 2 ( Good = 2 | Bad = 4 ) 
# wscsvc -> Start = 2 ( Good = 2 | Bad = 4 ) 

################## | PEH ... |


################## | Cracks / Keygens / Serials |

"C:\Users\Laurent\Downloads\The Sims 3 - Razor1911 Final MAXSPEED\Crack\TS3.exe"  
10/06/2009 23:36 |Size : 11285776 |Crc32 : d6ed3d29 |Md5 : 861fac71b1751e14f8bcef651021047b  
 

################## | ! Fin du rapport # FindyKill V6.005 ! |

flibustierdu42 · Answer

En effectuant un scan avec kaspersky en ligne j'ai trouvé Backdoor.Win32.Poison.ajns mais je n'arrive pas à le supprimer, voici le rapport:

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0: rapport d'analyse
 dimanche 12 juillet 2009
 Système d'exploitation : Microsoft Windows Vista Home Premium Edition, 32-bit Service Pack 2 (build 6002)
 Version de Kaspersky Online Scanner : 7.0.26.13
 Dernière mise à jour de la base : Sunday, July 12, 2009 14:25:21
 Enregistrements dans la base : 2462784
--------------------------------------------------------------------------------

Paramètres d'analyse:
	analyser avec la base suivante: étendue
	Analyser les archives: oui
	Analyser les bases de messagerie: oui

Zone d'analyse - Poste de travail:
	C:\
	D:\
	E:\

Statistiques d'analyse:
	Objets analysés: 122562
	Menaces trouvées: 1
	Objets infectés trouvés: 1
	Objets suspects trouvés: 0
	Durée d'analyse: 00:49:13


Nom de fichier / Menace / Compteur de menaces
C:\Program Files\Electronic Arts\Les Sims 3\Game\Bin\TS3.exe	Infecté : Backdoor.Win32.Poison.ajns	1

La zone sélectionnée a été analysée.

Nic00 · Answer

Pas étonnant ça viens de tes cracks (tu ne peux t'en prendre qu'à toi même), supprime les.


&#9654; Télécharge random's system information tool (RSIT) 
http://images.malwareremoval.com/random/RSIT.exe
&#9654;Enregistre le sur ton Bureau
&#9654; Double clique sur RSIT.exe pour l’exécuter. 

&#9654; Clique sur "continue" à l'écran Disclaimer. 

&#9654; Si l'outil HIjackThis  n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera et tu n’auras qu’à  accepter la licence. 

&#9654; Une fois le scan terminé , 2 rapports vont apparaitre. 
&#9654; Poste les dans ton prochain message 
&#9654; Note : les rapports se trouvent aussi ici : ( log.txt & info.txt )
&#9654;Tuto : https://forum.pcastuces.com/randoms_system_information_tool_rsit-f31s31.htm

flibustierdu42 · Answer

Je peux surtout m'en prendre à ma copine lol donc suffit que je supprime ces cracks et que je fasse la manip que tu m'indiques.
Ok je fais ça et je te posts les rapports.
Encore merci.

Nic00 · Answer

Ce que tu vas télécharger c'est pour diagnostiquer les problèmes du PC.
Parce que là sans rapport c'est compliqué...

flibustierdu42 · Answer

Ok ok je fais ça et je te posts les resultats

Nic00 · Answer

Ok

flibustierdu42 · Answer

Voilà ce que ça me donne:

okLogfile of random's system information tool 1.06 (written by random/random)
Run by Laurent at 2009-07-12 17:21:29
Microsoft® Windows Vista™ Édition Familiale Premium  Service Pack 2
System drive C: has 66 GB (46%) free of 144 GB
Total RAM: 1791 MB (49% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:22:13, on 12/07/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\Windows\system32	askeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Common Files\aol\1180039809\ee\aolsoftware.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\SweetIM\Messenger\SweetIM.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Common Files\TerraTec\Remote\TTTvRc.exe
C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Users\Laurent\Program Files\DNA\btdna.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SndVol.exe
C:\Users\Laurent\Desktop\RSIT.exe
C:\Program Files	rend micro\Laurent.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Google\Google_BAE\BAE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - (no file)
O3 - Toolbar: TerraTec Home Cinema - {AD6E6555-FB2C-47D4-8339-3E2965509877} - C:\PROGRA~1\TerraTec\TERRAT~1\THCDES~1.DLL
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1180039809\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [toolbar_eula_launcher] C:\Program Files\Packard Bell\GOOGLE_EULA\EULALauncher.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\SweetIM\Messenger\SweetIM.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe"
O4 - HKLM\..\Run: [IndexSearch] "C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe"
O4 - HKLM\..\Run: [PPort11reminder] "C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe" -r "C:\ProgramData\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini
O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKCU\..\Run: [SmpcSys] C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Users\Laurent\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [Remote Control Editor] "C:\Program Files\Common Files\TerraTec\Remote\TTTvRc.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: OFFICE One Startup v7.lnk = ?
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix: 
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ATK Hotkey\ASLDRSrv.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: FsUsbExService - Teruten - C:\Windows\system32\FsUsbExService.Exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktopManager.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

flibustierdu42 · Answer

et le 2 ème :

info.txt logfile of random's system information tool 1.06 2009-07-12 17:22:20

======Uninstall list======

-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
-->MsiExec.exe /I{0394CDC8-FABD-4ed8-B104-03393876DFDF}
-->MsiExec.exe /I{0D330013-4A99-46D6-83C6-2C959C68DBFF}
-->MsiExec.exe /I{0D397393-9B50-4c52-84D5-77E344289F87}
-->MsiExec.exe /I{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}
-->MsiExec.exe /I{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}
-->MsiExec.exe /I{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}
-->MsiExec.exe /I{83FFCFC7-88C6-41c6-8752-958A45325C82}
-->MsiExec.exe /I{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}
Adobe Flash Player 10 ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\Windows\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 8-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *AdobeReader*
Adobe Reader 9.1 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A91000000001}
Adobe Shockwave Player-->MsiExec.exe /X{A7DB362E-16DC-4E29-8A34-E74381E00B5B}
AnalogX Virtual Piano-->C:\Program Files\AnalogX\VPiano\vpianou.exe
AOL - Assistant de désinstallation-->C:\Program Files\Common Files\AOL\uninstaller.exe
Archiveur WinRAR-->C:\Program Files\WinRAR\uninstall.exe
Atheros Driver Installation Program-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{28006915-2739-4EBE-B5E8-49B25D32EB33}\setup.exe" -l0x40c  -removeonly
ATK Hotkey-->C:\Program Files\InstallShield Installation Information\{3912D529-02BC-4CA8-B5ED-0D0C20EB6003}\Setup.exe -runfromtemp -l0x0009 -removeonly
Audacity 1.3.7 (Unicode)-->"C:\Program Files\Audacity 1.3 Beta (Unicode)\unins000.exe"
Avanquest update-->C:\Program Files\InstallShield Installation Information\{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}\setup.exe -runfromtemp -l0x040c -removeonly
avast! Antivirus-->C:\Program Files\Alwil Software\Avast4\aswRunDll.exe "C:\Program Files\Alwil Software\Avast4\Setup\setiface.dll",RunSetup
Bison 11/28/2006,6.32.03.002-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *CMOS*
Brother MFL-Pro Suite-->"C:\Program Files\InstallShield Installation Information\{A3FEC306-FBFF-4B0D-95B9-F9C67C65079E}\Setup.exe"  -runfromtemp -l0x040c Brunin03.dll -removeonly
Browser Address Error Redirector-->regsvr32 /u /s "C:\Program Files\Google\Google_BAE\BAE.dll"
Choice Guard-->MsiExec.exe /I{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}
Ciel Devis Factures 6.0-->MsiExec.exe /I{F29DDAD0-447D-4BDB-80CB-4276B4D5C9A7}
Cinergy Hybrid XE V1.00.08.06-->"C:\Program Files\Common Files\TerraTec\CinergyDriverInstall\Cinergy_Hybrid_XE\uninstall.exe"
Creator 9-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *CREATOR9*
DivX Codec-->C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
DivX Converter-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
DivX Player-->C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
DivX Plus DirectShow Filters-->C:\Program Files\DivX\DivXDSFiltersUninstall.exe /DSFILTERS
DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
FaceFilter Studio Brother Edition-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F59205C8-E5FB-43F5-AAB2-16C1760D4F59}\Setup.exe" -l0x40c  /uninstall
FindyKill-->C:\FindyKill\Uninstal.exe
Firefox-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *FirefoxFR*
Flash Player 9 Internet Explorer-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *Flashplayer*
Football Manager 2009-->"C:\Program Files\Sports Interactive\Football Manager 2009\Uninstall_Football Manager 2009\Uninstall Football Manager 2009.exe"
FormatFactory 1.80-->C:\Program Files\FormatFactory\uninst.exe
Google BAE-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *GoogleBAE*
Google Desktop-->C:\Program Files\Google\Google Desktop Search\GoogleDesktopSetup.exe -uninstall
Google Earth-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *GOOGLE_EARTH*
Google Earth-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3DE5E7D4-7B88-403C-A3FD-2017A8240C5B}\setup.exe" -l0x40c  -removeonly
Google Toolbar for Internet Explorer-->MsiExec.exe /I{DBEA1034-5882-4A88-8033-81C4EF0CFA29}
Google Toolbar for Internet Explorer-->regsvr32 /u /s "c:\program files\google\googletoolbar1.dll"
GoogleDesktop-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *GoogleDesktop*
GoogleToolbar-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *GoogleToolbar*
HDReg France-->MsiExec.exe /I{0ED40D2A-7131-4FE7-941E-5C329336F712}
HijackThis 2.0.2-->"C:\Program Files	rend micro\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall  /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
Infocentre Rev. 2.0-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *Infocentre*
Installation Windows Live-->C:\Program Files\Windows Live\Installer\wlarp.exe
Installation Windows Live-->MsiExec.exe /I{7370DF47-B4F9-4279-BFC3-3F09919F720D}
Java(TM) 6 Update 13-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216013FF}
Les Sims™ 3-->"C:\Program Files\InstallShield Installation Information\{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}\Sims3Setup.exe" -runfromtemp -l0x040c -removeonly
Metaboli-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *METABOLI*
Microsoft .NET Framework 1.1 Hotfix (KB929729)-->"C:\Windows\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\Windows\Microsoft.NET\Framework\v1.1.4322\Updates\M929729\M929729Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 3.5 Language Pack SP1 - fra-->MsiExec.exe /I{3E31821C-7917-367E-938E-E65FC413EA31}
Microsoft .NET Framework 3.5 SP1-->c:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Works 8.5-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *MSWorks85*
Microsoft Works-->MsiExec.exe /I{6B1CB38D-E2E4-4a30-933D-EFDEBA76AD9C}
Microsoft WSE 3.0 Runtime-->MsiExec.exe /X{E3E71D07-CD27-46CB-8448-16D4FB29AA13}
Module linguistique Microsoft .NET Framework 3.5 SP1- fra-->C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack SP1 - fra\setup.exe
Mozilla Firefox (3.0.11)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
Multi Virus Cleaner 2009-->"C:\Program Files\AxBx\Multi Virus Cleaner 2009\unins000.exe"
NIS2007-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *NIS2007_FR*
OFFICE One 150 Templates v7-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BA147801-8946-4BBE-BE17-A2199CE52C81}\setup.exe" -l0x40c  -removeonly
OFFICE One 7.0-->MsiExec.exe /I{1EF377AC-035A-48BE-8EF7-D18D36308CE9}
OFFICE One ClipArt v7-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B8F3555E-B918-445E-97D1-BC4861C4EF59}\setup.exe" -l0x40c  -removeonly
OFFICE One Fonts v7-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{CC0C788C-7C68-47A9-BFBF-0DF7B205B4CC}\setup.exe" -l0x40c  -removeonly
OFFICE One License v7-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E1A7B28B-AA31-442C-A4FA-598B65A7F5DA}\setup.exe" -l0x40c  -removeonly
OFFICE One Menu v7-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{85C5827E-106F-4497-8066-B7CFEBBEA91D}\setup.exe" -l0x40c  -removeonly
OFFICE One Notes v7-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5D2683BE-2C44-4DB5-BECD-87B324077A7F}\setup.exe" -l0x40c  -removeonly
OFFICE One QuickZip v7-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{87DEF84E-51A5-4A0E-91C2-E012E92DE69B}\setup.exe" -l0x40c  -removeonly
OFFICE One Safety-Box v7-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B243ABE9-57C2-4B97-BA6B-37DF6C0208ED}\setup.exe" -l0x40c  -removeonly
OFFICE One Startup v7-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FEC30F06-A382-47D1-B828-859AC641EB1D}\setup.exe" -l0x40c  -removeonly
Office One-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *OFFICE*
Outil de téléchargement Windows Live-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}
Packard Bell Demo-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *PB_DEMO*
Packard Bell ImageWriter-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *ImageWriter*
Packard Bell LCD Test-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *LCDTest*
Packard Bell Updator-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *Updator*
Paint.NET v3.36-->MsiExec.exe /X{43602F34-1AA3-44FB-AEB2-D08C2C73743F}
PaperPort Image Printer-->MsiExec.exe /X{332CC6BF-E6C7-48EE-BA3D-435E576AD67F}
PianoFX STUDIO 4.0-->"C:\Program Files\PianoFX\unins000.exe"
Picasa2-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *Picasa2*
Realtek 8139 and 8139C+ Ethernet Network Card Driver for Windows Vista-->C:\Program Files\InstallShield Installation Information\{AE46ABD3-D625-467F-B5A7-8D3FFF077F0D}\setup.exe -runfromtemp -l0x040c -removeonly
Realtek High Definition Audio Driver-->RtlUpd.exe -r -m
Roxio Creator 9 LE-->MsiExec.exe /I{B7FB0C86-41A4-4402-9A33-912C462042A0}
RTC Client API v1.2-->MsiExec.exe /X{44CDBD1B-89FB-4E02-8319-2A4C550F664A}
SAMSUNG Mobile Composite Device Software-->C:\Windows\system32\Samsung_USB_Drivers\6\SSBCUninstall.exe
SAMSUNG Mobile Modem Driver Set-->C:\Windows\system32\Samsung_USB_Drivers\3\SSCDUninstall.exe
Samsung Mobile phone USB driver Software-->C:\Windows\system32\Samsung_USB_Drivers\5\SSSDUninstall.exe
SAMSUNG Mobile USB Modem 1.0 Software-->C:\Windows\system32\Samsung_USB_Drivers\1\SS_Uninstall.exe
SAMSUNG Mobile USB Modem Software-->C:\Windows\system32\Samsung_USB_Drivers\2\SSM_Uninstall.exe
Samsung New PC Studio USB Driver Installer-->"C:\Program Files\InstallShield Installation Information\{AF7E85DC-317C-47F5-810E-B82EE093A612}\setup.exe" -runfromtemp -l0x040c -removeonly
Samsung New PC Studio USB Driver Installer-->MsiExec.exe /I{AF7E85DC-317C-47F5-810E-B82EE093A612}
Samsung New PC Studio-->"C:\Program Files\InstallShield Installation Information\{F193FC0E-9E18-40FC-A974-509A1BDD240A}\setup.exe" -runfromtemp -l0x040c -removeonly
Samsung New PC Studio-->MsiExec.exe /X{F193FC0E-9E18-40FC-A974-509A1BDD240A}
ScanSoft PaperPort 11-->MsiExec.exe /I{B6C89654-A6A2-477C-873B-724EC1C56407}
SetUp My PC-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *SETUPMYPC_FR*
Shockwave player 10-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *Shockwave*
Skype 2.5.2.151-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *SKYPE*
Skype™ 4.0-->MsiExec.exe /X{24D753CA-6AE9-4E30-8F5F-EFC93E08BF3D}
Sony Ericsson PC Suite 4.010.00-->C:\Program Files\InstallShield Installation Information\{2FFE93F0-BB72-4E52-8761-354D1AAA9387}\ISAdmin.exe -runfromtemp -l0x040c -removeonly
Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
SweetIM for Messenger 2.6-->MsiExec.exe /X{023EC958-023C-42D1-B2A4-E9E4BEF599FC}
Synaptics Pointing Device Driver-->rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall
TerraTec Home Cinema-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{63B9BAB5-F36A-4A3B-9E5C-68A7F212BFB9}\setup.exe" -l0x40c 
The Chronicles of Riddick - Assault on Dark Athena-->C:\Program Files\InstallShield Installation Information\{12C85315-0989-4C28-8956-33458F464DD6}\setup.exe -runfromtemp -l0x040c -removeonly
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""
USB2.0 350K WebCam-->Rundll32.exe BisonRem.dll,WinMainRmv
VC80CRTRedist - 8.0.50727.762-->MsiExec.exe /I{767CC44C-9BBC-438D-BAD3-FD4595DD148B}
Video ATI v8.332-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *VIDEO_RIO*
Viewpoint Media Player-->C:\Program Files\Viewpoint\Viewpoint Experience Technology\mtsAxInstaller.exe /u
Virtual DJ - Atomix Productions-->C:\PROGRA~1\VIRTUA~1\UNWISE.EXE C:\PROGRA~1\VIRTUA~1\INSTALL.LOG
VLC media player 0.9.9-->C:\Program Files\VideoLAN\VLC\uninstall.exe
Winamp Remote-->"C:\Program Files\Winamp Remote\uninstall.exe"
Winamp-->"C:\Program Files\Winamp\UninstWA.exe"
Windows Live Call-->MsiExec.exe /I{82C7B308-0BDD-49D8-8EA5-9CD3A3F9DF41}
Windows Live Communications Platform-->MsiExec.exe /I{3B4E636E-9D65-4D67-BA61-189800823F52}
Windows Live Messenger-->MsiExec.exe /X{059C042E-796A-4ACC-A81A-ECC2010BB78C}
Windows Live OneCare safety scanner-->"C:\Program Files\Windows Live Safety Center\UnInstall.exe"
Windows Live OneCare safety scanner-->MsiExec.exe /X{FE0646A7-19D0-41B4-A2BB-2C35D644270D}
Windows Media Player Firefox Plugin-->MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}

======Hosts File======

127.0.0.1	www.007guard.com
127.0.0.1	007guard.com
127.0.0.1	008i.com
127.0.0.1	www.008k.com
127.0.0.1	008k.com
127.0.0.1	www.00hq.com
127.0.0.1	00hq.com
127.0.0.1	010402.com
127.0.0.1	www.032439.com
127.0.0.1	032439.com

======Security center information======

AV: avast! antivirus 4.8.1335 [VPS 090405-0]
AS: Spybot - Search and Destroy (disabled)
AS: Windows Defender
AS: avast! antivirus 4.8.1335 [VPS 090405-0]

======System event log======

Computer Name: PC-de-Laurent
Event Code: 4374
Message: Windows Servicing a déterminé que ce package KB936330(Service Pack) n’est pas applicable à ce système.
Record Number: 22559
Source Name: Microsoft-Windows-Servicing
Time Written: 20090405085005.000000-000
Event Type: Avertissement
User: AUTORITE NT\SYSTEM

Computer Name: PC-de-Laurent
Event Code: 4374
Message: Windows Servicing a déterminé que ce package KB936330(Service Pack) n’est pas applicable à ce système.
Record Number: 22555
Source Name: Microsoft-Windows-Servicing
Time Written: 20090405084948.000000-000
Event Type: Avertissement
User: AUTORITE NT\SYSTEM

Computer Name: PC-de-Laurent
Event Code: 4374
Message: Windows Servicing a déterminé que ce package KB936330(Service Pack) n’est pas applicable à ce système.
Record Number: 22554
Source Name: Microsoft-Windows-Servicing
Time Written: 20090405084948.000000-000
Event Type: Avertissement
User: AUTORITE NT\SYSTEM

Computer Name: PC-de-Laurent
Event Code: 4374
Message: Windows Servicing a déterminé que ce package KB936330(Service Pack) n’est pas applicable à ce système.
Record Number: 22551
Source Name: Microsoft-Windows-Servicing
Time Written: 20090405084947.000000-000
Event Type: Avertissement
User: AUTORITE NT\SYSTEM

Computer Name: PC-de-Laurent
Event Code: 7000
Message: Le service Planificateur LiveUpdate automatique n'a pas pu démarrer en raison de l'erreur : 
Le chemin d'accès spécifié est introuvable.
Record Number: 22507
Source Name: Service Control Manager
Time Written: 20090405084547.000000-000
Event Type: Erreur
User: 

=====Application event log=====

Computer Name: PC-de-Laurent
Event Code: 1002
Message: Le programme wlsetup-custom.exe version 14.0.8064.206 a cessé d’interagir avec Windows et a été fermé. Pour déterminer si des informations supplémentaires sont disponibles, consultez l’historique du problème dans l’application Rapports et solutions aux problèmes du Panneau de configuration. ID de processus : 3b8 Heure de début : 01c9b3be56e6a8fe Heure de fin : 32
Record Number: 504
Source Name: Application Hang
Time Written: 20090402181711.000000-000
Event Type: Erreur
User: 

Computer Name: PC-de-Laurent
Event Code: 1002
Message: Le programme FIREFOX.EXE version 1.8.20061.1023 a cessé d’interagir avec Windows et a été fermé. Pour déterminer si des informations supplémentaires sont disponibles, consultez l’historique du problème dans l’application Rapports et solutions aux problèmes du Panneau de configuration. ID de processus : 10e4 Heure de début : 01c9b3b8437f337e Heure de fin : 17
Record Number: 491
Source Name: Application Hang
Time Written: 20090402174534.000000-000
Event Type: Erreur
User: 

Computer Name: PC-de-Laurent
Event Code: 1008
Message: Le service Windows Search tente de supprimer l’ancien catalogue. 

Record Number: 442
Source Name: Microsoft-Windows-Search
Time Written: 20090402170628.000000-000
Event Type: Avertissement
User: 

Computer Name: LH-8OPOVA71G85R
Event Code: 4440
Message: Le fichier journal du CRM a initialement été créé sur un ordinateur ne portant pas le même nom. Il a été mis à jour avec le nom de l'ordinateur actuel. Si cet avertissement s'affiche lorsque le nom de l'ordinateur a été modifié, aucune action supplémentaire n'est requise. LH-8OPOVA71G85R

ID de l'application serveur : {02D4B3F1-FD88-11D1-960D-00805FC79235}
ID d'instance d'application serveur :
{AD36F03E-0FBC-4B64-9443-FF7B339D9366}
Nom de l'application serveur : System Application
Version du fichier Comsvcs.dll : ENU 2001.12.6930.16386 shp
Record Number: 414
Source Name: Microsoft-Windows-Complus
Time Written: 20090402170150.000000-000
Event Type: Avertissement
User: 

Computer Name: LH-8OPOVA71G85R
Event Code: 1036
Message: Échec de InitializePrintProvider pour le fournisseur inetpp.dll. Cela peut se produire à la suite d’une instabilité du système ou d’une insuffisance des ressources système.
Record Number: 412
Source Name: Microsoft-Windows-SpoolerSpoolss
Time Written: 20090402170139.000000-000
Event Type: Avertissement
User: AUTORITE NT\SYSTEM

=====Security event log=====

Computer Name: LH-8OPOVA71G85R
Event Code: 5038
Message: L’intégrité du code a déterminé que le hachage de l’image d’un fichier n’est pas valide. Le fichier peut être endommagé en raison d’une modification non autorisée ou le hachage non valide peut indiquer une erreur d’unité de disque potentielle.

Nom du fichier :	\Device\HarddiskVolume2\OEM\boot\winpe\Windows\System32\fveapi.dll	
Record Number: 244
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20070524213844.877424-000
Event Type: Échec de l'audit
User: 

Computer Name: LH-8OPOVA71G85R
Event Code: 4672
Message: Privilèges spéciaux attribués à la nouvelle ouverture de session.

Sujet :
	ID de sécurité :		S-1-5-18
	Nom du compte :		SYSTEM
	Domaine du compte :		AUTORITE NT
	ID d’ouverture de session :		0x3e7

Privilèges :		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
Record Number: 243
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20070524213734.221174-000
Event Type: Succès de l'audit
User: 

Computer Name: LH-8OPOVA71G85R
Event Code: 4624
Message: L’ouverture de session d’un compte s’est correctement déroulée.

Sujet :
	ID de sécurité :		S-1-5-18
	Nom du compte :		LH-8OPOVA71G85R$
	Domaine du compte :		WORKGROUP
	ID d’ouverture de session :		0x3e7

Type d’ouverture de session :			5

Nouvelle ouverture de session :
	ID de sécurité :		S-1-5-18
	Nom du compte :		SYSTEM
	Domaine du compte :		AUTORITE NT
	ID d’ouverture de session :		0x3e7
	GUID d’ouverture de session :		{00000000-0000-0000-0000-000000000000}

Informations sur le processus :
	ID du processus :		0x26c
	Nom du processus :		C:\Windows\System32\services.exe

Informations sur le réseau :
	Nom de la station de travail :	
	Adresse du réseau source :	-
	Port source :		-

Informations détaillées sur l’authentification :
	Processus d’ouverture de session :		Advapi  
	Package d’authentification :	Negotiate
	Services en transit :	-
	Nom du package (NTLM uniquement) :	-
	Longueur de la clé :		0

Cet événement est généré lors de la création d’une ouverture de session. Il est généré sur l’ordinateur sur lequel l’ouverture de session a été effectuée.

Le champ Objet indique le compte sur le système local qui a demandé l’ouverture de session. Il s’agit le plus souvent d’un service, comme le service Serveur, ou un processus local tel que Winlogon.exe ou Services.exe.

Le champ Type d’ouverture de session indique le type d’ouverture de session qui s’est produit. Les types les plus courants sont 2 (interactif) et 3 (réseau).

Le champ Nouvelle ouverture de session indique le compte pour lequel la nouvelle ouverture de session a été créée, par exemple, le compte qui s’est connecté.

Les champs relatifs au réseau indiquent la provenance d’une demande d’ouverture de session à distance. Le nom de la station de travail n’étant pas toujours disponible, peut être laissé vide dans certains cas.

Les champs relatifs aux informations d’authentification fournissent des détails sur cette demande d’ouverture de session spécifique.
	- Le GUID d’ouverture de session est un identificateur unique pouvant servir à associer cet événement à un événement KDC .
	- Les services en transit indiquent les services intermédiaires qui ont participé à cette demande d’ouverture de session.
	- Nom du package indique quel est le sous-protocole qui a été utilisé parmi les protocoles NTLM.
	- La longueur de la clé indique la longueur de la clé de session générée. Elle a la valeur 0 si aucune clé de session n’a été demandée.
Record Number: 242
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20070524213734.221174-000
Event Type: Succès de l'audit
User: 

Computer Name: LH-8OPOVA71G85R
Event Code: 4648
Message: Tentative d’ouverture de session en utilisant des informations d’identification explicites.

Sujet :
	ID de sécurité :		S-1-5-18
	Nom du compte :		LH-8OPOVA71G85R$
	Domaine du compte :		WORKGROUP
	ID d’ouverture de session :		0x3e7
	GUID d’ouverture de session :		{00000000-0000-0000-0000-000000000000}

Compte dont les informations d’identification ont été utilisées :
	Nom du compte :		SYSTEM
	Domaine du compte :		AUTORITE NT
	GUID d’ouverture de session :		{00000000-0000-0000-0000-000000000000}

Serveur cible :
	Nom du serveur cible :	localhost
	Informations supplémentaires :	localhost

Informations sur le processus :
	ID du processus :		0x26c
	Nom du processus :		C:\Windows\System32\services.exe

Informations sur le réseau :
	Adresse du réseau :	-
	Port :			-

Cet événement est généré lorsqu’un processus tente d’ouvrir une session pour un compte en spécifiant explicitement les informations d’identification de ce compte. Ceci se produit le plus souvent dans les configurations par lot comme les tâches planifiées, ou avec l’utilisation de la commande RUNAS.
Record Number: 241
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20070524213734.221174-000
Event Type: Succès de l'audit
User: 

Computer Name: LH-8OPOVA71G85R
Event Code: 1102
Message: Le journal d’audit a été effacé.
Objet :
	ID de sécurité :	S-1-5-21-2565092149-2647568196-1649830275-500
	Nom de compte :	Administrator
	Nom de domaine :	LH-8OPOVA71G85R
	ID de connexion :	0x2c070
Record Number: 240
Source Name: Microsoft-Windows-Eventlog
Time Written: 20070524213718.361799-000
Event Type: Succès de l'audit
User: 

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"Path"=C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Program Files\ATI Technologies\ATI.ACE\Core-Static;C:\Program Files\Common Files\Roxio Shared\DLLShared\;C:\Program Files\Common Files\Roxio Shared\9.0\DLLShared\;C:\Program Files\Common Files\Teleca Shared;C:\Program Files\Common Files\DivX Shared\
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=x86
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 14 Stepping 12, GenuineIntel
"PROCESSOR_REVISION"=0e0c
"NUMBER_OF_PROCESSORS"=2
"RoxioCentral"=C:\Program Files\Common Files\Roxio Shared\9.0\Roxio Central33\

-----------------EOF-----------------

Nic00 · Answer

&#9654;Télécharge Toolbar S&D:
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2 

&#9654; Lances l'installation en exécutant le fichier téléchargé... 

&#9654; Double-clique sur le raccourci de Toolbar, qui se trouve sur ton bureau, pour lancer l'application. 

&#9654;sélectionnes la langue, puis valides par la touche '' Entrée '' de ton clavier... 

&#9654; Au menu, choisis l'option1 (recherche) et patientes jusqu'à la fin de la recherche. 

&#9654; Un rapport sera généré à la fin. Poste-le stp.






Télécharge Ad-Remover :

http://sd-1.archive-host.com/membres/up/16506160323759868/AD-R.exe 
/!\ Déconnectes toi et fermes toutes applications en cours

&#9654; Double clique sur "Ad-R.exe" pour lancer l'installation en laissant les paramètres d'installation par défaut .

&#9654; Double clique sur l'icône Ad-remover situé sur ton bureau.

&#9654; Au menu principal choisi l'option "L" et appuie sur Entrée.

 &#9654;Postes le rapport qui apparait à la fin.

&#9654;Le rapport est sauvegardé aussi sous C:\Ad-report.log 

(CTRL+A Pour tout sélectionner, CTRL+C pour copier et CTRL+V pour coller)

flibustierdu42 · Answer

Ok je fais tout ça et je te posts les rapports

Nic00 · Answer

Ok.

flibustierdu42 · Answer

J'ai réussi à faire avec Ad-Remover mais le premier Toolbar S&D impossible de faire une recherche il se lance et se coupe, je comprends pas trop.
Voici le rapport d'Ad-Remover:

.
======= RAPPORT D'AD-REMOVER 1.1.4.5_O | UNIQUEMENT XP/VISTA/SEVEN =======
.
Mit à jour par C_XX le 24/06/2009 à 7:10 PM
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Lancé à: 17:57:48, 12/07/2009 | Mode Normal | Option: CLEAN
Exécuté de: C:\Program Files\Ad-remover\
Système d'exploitation: Microsoft® Windows Vista™ Home Premium Service Pack 2 v6.0.6002
Nom du PC: PC-DE-LAURENT | Utilisateur actuel: Laurent
.
Administrateur: Administrateur *Desactive* 
N'est pas administrateur: ASPNET 
N'est pas administrateur: Invité 
Administrateur: Laurent 
Administrateur: Mcx1 
. 
============== ÉLÉMENT(S) NEUTRALISÉ(S) ============== 
.
.
HKCR\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}
HKCR\CLSID\{9afb8248-617f-460d-9366-d71cdeda3179}
HKCR\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064}
HKCR\MediaPlayer.GraphicsUtils
HKCR\MediaPlayer.GraphicsUtils.1
HKCR\MgMediaPlayer.GifAnimator
HKCR\MgMediaPlayer.GifAnimator.1
HKCR\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKCU\Software\SweetIM
HKLM\Software\Classes\Interface\{A439801C-961D-452C-AB42-7848E9CBD289}
HKLM\Software\Classes\Interface\{F4EBB1E2-21F3-4786-8CF4-16EC5925867F}
HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe
HKLM\Software\SweetIM
HKCU\Software\Microsoft\Internet Explorer\InternetRegistry\Registry\User\S-1-5-21-42713692-2771490721-309879846-1002\Software\Sweetim
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Sweetim
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\07D5290CDBDAE4242926B8E6CA650501
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\08E33F7B61DEFF24BB9673ED7D467636
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\0E3D8A5B48622A445A7DF73FEFF32C3F
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\1AC67655DD68F8240B2860F2D511EBD8
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\34EDDB1BFB3A2D448845F3EFD0F15A43
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\427EA997C413D1D47907CBFC7B2DB432
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\4318DF19719275242801CBE292063A4C
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\45FC115D1FEAEF849A4E1610D6EC8BF0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\46A5861A389ADB844AF89E31BC9DF0A1
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\49B0E1A6FF50BBE4289E4E23DE6EA0C7
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\4CCCAC049F34D0540AAC13011398BEDB
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5C4389D0BFB302C479DE4178BD5D9EBA
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5D19F074C042AD34BAB463D4175A062E
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5D2B09BDEF4FE54418E6F3373CDBC7AC
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\61B65D3397A1FBF4CB1571B5E4F6B5B0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\68E8A05C60DD9254591DBD16C94EDDBF
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\697E782CF574CC34CBB9566440BA12BC
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\6AE27A8613CF7EA4782F2886F67295E5
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\7CE172051F585E04187BCB97570BFA74
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\86A901BA5265452499DCBF719C378EE3
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\88ABD1CD5C40EC84789A7F6EF86DAC5E
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\980289C22F80A7C4BB9323DC61255E4E
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\9A4B7EF3789F871419D9302583B20C15
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\A6C53B0F76C44004A8F36716213017DB
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\B59F2D8189784CC46A4597F2842480B0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\BD746FB95FB8E5B45BF66BE54D5FD91F
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\CCF399FCD6D2D3F46BF02A1378654FC9
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D149C1355C98DE24E82CEFBD996FE06A
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\DB59FDB786388EA4D897F3EE715683AC
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\DB8DAD19CFBCC2049A4477183787E8C5
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E1C820A74ED67374BA048B52CB3C3804
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E337925F629CF4C4FB08F3D9674DD839
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\EC65F200D112357449C8B1BC3CFA03D0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\F327D0C73C0973644A21E8CC852267A0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\FA96423FE2B98E248A3B23548D1E22D9
.
C:\PROGRA~2\SweetIM\Messenger 
C:\PROGRA~2\SweetIM\Messenger\conf 
C:\PROGRA~2\SweetIM\Messenger\data 
C:\PROGRA~2\SweetIM\Messenger\logs 
C:\PROGRA~2\SweetIM\Messenger\update 
C:\PROGRA~2\SweetIM\Messenger\conf\adapter.xml 
C:\PROGRA~2\SweetIM\Messenger\conf\autoupdate.xml 
C:\PROGRA~2\SweetIM\Messenger\conf\logger.xml 
C:\PROGRA~2\SweetIM\Messenger\conf\messages.xml 
C:\PROGRA~2\SweetIM\Messenger\conf\sweetim.xml 
C:\PROGRA~2\SweetIM\Messenger\conf\sweetimapp.xml 
C:\PROGRA~2\SweetIM\Messenger\conf\users 
C:\PROGRA~2\SweetIM\Messenger\conf\users\laurentflibustier42@hotmail.fr 
C:\PROGRA~2\SweetIM\Messenger\conf\users\main_user_config.xml 
C:\PROGRA~2\SweetIM\Messenger\conf\users\laurentflibustier42@hotmail.fr\content_update_notification.xml 
C:\PROGRA~2\SweetIM\Messenger\conf\users\laurentflibustier42@hotmail.fr\emoticons_shortcut.xml 
C:\PROGRA~2\SweetIM\Messenger\conf\users\laurentflibustier42@hotmail.fr\user_config.xml 
C:\PROGRA~2\SweetIM\Messenger\data\contentdb 
C:\PROGRA~2\SweetIM\Messenger\data\contentdb\00010970.dat 
C:\PROGRA~2\SweetIM\Messenger\data\contentdb\000200C0.dat 
C:\PROGRA~2\SweetIM\Messenger\data\contentdb\000300A2.dat 
C:\PROGRA~2\SweetIM\Messenger\data\contentdb\000300B9.dat 
C:\PROGRA~2\SweetIM\Messenger\data\contentdb\0004005D.dat 
C:\PROGRA~2\SweetIM\Messenger\data\contentdb\00040066.dat 
C:\PROGRA~2\SweetIM\Messenger\data\contentdb\000800C4.dat 
C:\PROGRA~2\SweetIM\Messenger\data\contentdb\cache_indx.dat 
C:\PROGRA~2\SweetIM 
/!\ NON SUPPRIMÉ: C:\Program Files\SweetIM\Messenger  
C:\Program Files\SweetIM\Messenger\default.xml 
/!\ NON SUPPRIMÉ: C:\Program Files\SweetIM\Messenger\mgAdaptersProxy.dll  
C:\Program Files\SweetIM\Messenger\mgAIMAuto.dll 
C:\Program Files\SweetIM\Messenger\mgAIMMessengerAdapter.dll 
C:\Program Files\SweetIM\Messenger\mgArchive.dll 
C:\Program Files\SweetIM\Messenger\mgcommon.dll 
C:\Program Files\SweetIM\Messenger\mgcommunication.dll 
C:\Program Files\SweetIM\Messenger\mgconfig.dll 
C:\Program Files\SweetIM\Messenger\mgFlashPlayer.dll 
C:\Program Files\SweetIM\Messenger\mghooking.dll 
C:\Program Files\SweetIM\Messenger\mgICQAuto.dll 
C:\Program Files\SweetIM\Messenger\mgICQMessengerAdapter.dll 
C:\Program Files\SweetIM\Messenger\mgIEPlayer.dll 
C:\Program Files\SweetIM\Messenger\mglogger.dll 
C:\Program Files\SweetIM\Messenger\mgMediaPlayer.dll 
C:\Program Files\SweetIM\Messenger\mgMsnAuto.dll 
C:\Program Files\SweetIM\Messenger\mgMsnMessengerAdapter.dll 
C:\Program Files\SweetIM\Messenger\mgsimcommon.dll 
C:\Program Files\SweetIM\Messenger\mgSweetIM.dll 
C:\Program Files\SweetIM\Messenger\mgUpdateSupport.dll 
C:\Program Files\SweetIM\Messenger\mgxml_wrapper.dll 
C:\Program Files\SweetIM\Messenger\mgYahooAuto.dll 
C:\Program Files\SweetIM\Messenger\mgYahooMessengerAdapter.dll 
C:\Program Files\SweetIM\Messenger\msvcp71.dll 
/!\ NON SUPPRIMÉ: C:\Program Files\SweetIM\Messenger\msvcr71.dll  
C:\Program Files\SweetIM\Messengeresources 
C:\Program Files\SweetIM\Messenger\SweetIM.exe 
C:\Program Files\SweetIM\Messengeresources\images 
C:\Program Files\SweetIM\Messengeresources\images\AudibleButton.png 
C:\Program Files\SweetIM\Messengeresources\images\DisplayPicturesButton.png 
C:\Program Files\SweetIM\Messengeresources\images\EmoticonButton.png 
C:\Program Files\SweetIM\Messengeresources\images\NudgeButton.png 
C:\Program Files\SweetIM\Messengeresources\images\SoundFxButton.png 
C:\Program Files\SweetIM\Messengeresources\images\WinksButton.png 
/!\ NON SUPPRIMÉ: C:\Program Files\SweetIM 
C:\Windows\Installer\2a5e91.msi 

(!) -- Fichiers temporaires supprimés.

.
============== Scan additionnel ==============
.

* Mozilla FireFox Version 3.0.11 *

 Nom du profil: eywjmkaq.default (Laurent)
.
(Prefs.js) user_pref("browser.search.defaultenginename", "Google"); 
(Prefs.js) user_pref("browser.search.defaulturl", "hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q="); 
(Prefs.js) user_pref("browser.startup.homepage", "hxxp://fr.start2.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:fr:official"); 
(Prefs.js) user_pref("browser.startup.homepage_override.mstone", "rv:1.9.0.11"); 
.
. 

* Internet Explorer Version 8.0.6001.18783 *

[HKEY_CURRENT_USER\..\Internet Explorer\Main]

Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Start Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://search.msn.com/spbasic.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://fr.msn.com/

[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

   Tabs: res://ieframe.dll/tabswelcome.htm

.
============== Processus Caches/Bloque ==============
.
PID: 1240	[LOCKED] audiodg.exe
.

============== Suspect (Cracks, Serials ... ) ==============

. 
C:\Users\Laurent\AppData\Local\Temp\Temp1_ARMA2Patch_102_58134.zip 
C:\Users\Laurent\AppData\Local\Temp\Temp2_ARMA2Patch_102_58134.zip 
C:\Users\Laurent\AppData\Local\Temp\Temp3_ARMA2Patch_102_58134.zip 
C:\Users\Laurent\AppData\Local\Temp\Temp4_ARMA2Patch_102_58134.zip 
C:\Users\Laurent\AppData\Local\Temp\Temp5_ARMA2Patch_102_58134.zip 
C:\Users\Laurent\AppData\Local\Temp\Temp6_ARMA2Patch_102_58134.zip 
C:\Users\Laurent\AppData\Local\Temp\Temp7_ARMA2Patch_102_58134.zip 
C:\Users\Laurent\AppData\Local\Temp\Temp8_ARMA2Patch_102_58134.zip 
C:\Users\Laurent\AppData\Local\Temp\Temp1_ARMA2Patch_102_58134.zip\Patch_1.00_to_1.02.58134 
C:\Users\Laurent\AppData\Local\Temp\Temp2_ARMA2Patch_102_58134.zip\Patch_1.00_to_1.02.58134 
C:\Users\Laurent\AppData\Local\Temp\Temp3_ARMA2Patch_102_58134.zip\Patch_1.00_to_1.02.58134 
C:\Users\Laurent\AppData\Local\Temp\Temp4_ARMA2Patch_102_58134.zip\Patch_1.00_to_1.02.58134 
C:\Users\Laurent\AppData\Local\Temp\Temp5_ARMA2Patch_102_58134.zip\Patch_1.00_to_1.02.58134 
C:\Users\Laurent\AppData\Local\Temp\Temp6_ARMA2Patch_102_58134.zip\Patch_1.00_to_1.02.58134 
C:\Users\Laurent\AppData\Local\Temp\Temp7_ARMA2Patch_102_58134.zip\Patch_1.00_to_1.02.58134 
C:\Users\Laurent\AppData\Local\Temp\Temp8_ARMA2Patch_102_58134.zip\Patch_1.00_to_1.02.58134 
C:\Users\Laurent\AppData\Roaming\BitTorrent\ARMA2Patch_102_58134.zip.torrent 
C:\Users\Laurent\AppData\Roaming\BitTorrent\Football Manager 2009 +patch 9.1+fix patch+pack language.rar.torrent 
C:\Users\Laurent\Desktop\divers\jeux\football_manager_2008_patch_802.exe 
C:\Users\Laurent\Downloads\ARMA2Patch_102_58134.zip 
.
===================================
.
13049 Octet(s) - C:\Ad-Report-CLEAN.log 
.
57 Fichier(s) - C:\Users\Laurent\AppData\Local\Temp 
2 Fichier(s) - C:\Windows\Temp 
.
20 Fichier(s) - C:\Program Files\Ad-remover\BACKUP
29 Fichier(s) - C:\Program Files\Ad-remover\QUARANTINE
.
Fin à: 18:26:44 | 12/07/2009
.
============== E.O.F ==============
.

Nic00 · Answer

Ok, tout ça c'est à virer:

C:\Users\Laurent\AppData\Local\Temp\Temp1_ARMA2Patch_102_58134.zip
C:\Users\Laurent\AppData\Local\Temp\Temp2_ARMA2Patch_102_58134.zip
C:\Users\Laurent\AppData\Local\Temp\Temp3_ARMA2Patch_102_58134.zip
C:\Users\Laurent\AppData\Local\Temp\Temp4_ARMA2Patch_102_58134.zip
C:\Users\Laurent\AppData\Local\Temp\Temp5_ARMA2Patch_102_58134.zip
C:\Users\Laurent\AppData\Local\Temp\Temp6_ARMA2Patch_102_58134.zip
C:\Users\Laurent\AppData\Local\Temp\Temp7_ARMA2Patch_102_58134.zip
C:\Users\Laurent\AppData\Local\Temp\Temp8_ARMA2Patch_102_58134.zip
C:\Users\Laurent\AppData\Local\Temp\Temp1_ARMA2Patch_102_58134.zip\Patch_1.00_to_1.02.58134
C:\Users\Laurent\AppData\Local\Temp\Temp2_ARMA2Patch_102_58134.zip\Patch_1.00_to_1.02.58134
C:\Users\Laurent\AppData\Local\Temp\Temp3_ARMA2Patch_102_58134.zip\Patch_1.00_to_1.02.58134
C:\Users\Laurent\AppData\Local\Temp\Temp4_ARMA2Patch_102_58134.zip\Patch_1.00_to_1.02.58134
C:\Users\Laurent\AppData\Local\Temp\Temp5_ARMA2Patch_102_58134.zip\Patch_1.00_to_1.02.58134
C:\Users\Laurent\AppData\Local\Temp\Temp6_ARMA2Patch_102_58134.zip\Patch_1.00_to_1.02.58134
C:\Users\Laurent\AppData\Local\Temp\Temp7_ARMA2Patch_102_58134.zip\Patch_1.00_to_1.02.58134
C:\Users\Laurent\AppData\Local\Temp\Temp8_ARMA2Patch_102_58134.zip\Patch_1.00_to_1.02.58134
C:\Users\Laurent\AppData\Roaming\BitTorrent\ARMA2Patch_102_58134.zip.torrent
C:\Users\Laurent\AppData\Roaming\BitTorrent\Football Manager 2009 +patch 9.1+fix patch+pack language.rar.torrent
C:\Users\Laurent\Desktop\divers\jeux\football_manager_2008_patch_802.exe
C:\Users\Laurent\Downloads\ARMA2Patch_102_58134.zip 

et pour ToolBar S&D, voici un tuto:

https://www.malekal.com/adwcleaner-supprimer-virus-adwares-pup/

Fais ceci pour le lancer: clic-droit>>Exécuter en tant qu'administrateur

flibustierdu42 · Answer

Pour les virer je les mets tout simplement à la poubelle? Ma question est stupide je pense mais je préfère demander quand même désolé

Nic00 · Answer

Oui et ensuite tu vide la corbeille :)

flibustierdu42 · Answer

Bon j'ai viré ces fichiers, donc là tout devrait rentrer dans l'ordre? Si oui merci bien pour ton aide.

flibustierdu42 · Answer

PS: j'ai bien vidé la corbeille aussi ;)

Nic00 · Answer

Non on a pas fini!

Et Toolbar alors ?

flibustierdu42 · Answer

Tooblard ben je réessaie une énième fois mais le truc quand je le lance dès que je sélectionne recherche ça se ferme et plus de nouvelles :(

Nic00 · Answer

Réessaye de cette manière:


Fais le scan en mode sans échec (tapotes la touche F8 au démarrage du PC)

Puis désactive l’UAC:
Panneau de configuration>comptes utilisateurs>activer/désactiver le contrôle  des comptes utilisateurs>décoche la cas puis fais OK

flibustierdu42 · Answer

ok je fais ça de suite

flibustierdu42 · Answer

Voilà j'ai fait ce que tu m'as dit mais du coup j'ai 4 rapport qui ont été créer au redemarrage MOM-1, SmpcSystray, MCDChk, PBCareNot c'est ça qu'il faut que je t'envoie???

flibustierdu42 · Answer

En fouillant dans mon ordi j'ai aussi trouver Changelog ToolBar, le hic c'est les dates mais là mystère, je suis vraiment trop une quiche en informatique voilà le rapport :


  -- Changelog ToolBar S&D --


==================================
Upd: December 21, 2008 ( v 1.2.8 )
==================================

"%ProgramFiles%\Mozilla Firefox\searchplugins\crawlersrch.xml"

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CToolbar_UNINSTALL]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEC0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEBF}]

[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4A7C84E2-E95C-43C6-8DD3-03ABCD0EB60E}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{506F578A-91E1-46CE-830F-E2F4268E9966}]

[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Crawler Search]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\Extensions]
"{4B3803EA-5230-4DC3-A7FC-33638F3D3542}"=-

Folder : Smart-Shopper

==================================
Upd: December 19, 2008 ( v 1.2.7 )
==================================

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Dealio Toolbar 3.2]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Search Settings]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{23A287DB-449A-462F-BDE1-8635A61671CE}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6638A9DE-0745-4292-8A2E-AE530E7B9B3F}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{6638A9DE-0745-4292-8A2E-AE530E7B9B3F}"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"KiweeHook"=-

# [Service] ASKService
# [Service] ASKUpgrade

Folder : Kiwee Toolbar

==================================
Upd: December 4, 2008  ( v 1.2.6 )
==================================

"%ProgramFiles%\Mozilla Firefox\plugins
pbasic.dll"
"%ProgramFiles%\Mozilla Firefox\chrome\chrome\content\browser.js"

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4d1c4e81-a32a-416b-bcdb-33b3ef3617d3}]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SearchSettings]

[-HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{4d1c4e81-a32a-416b-bcdb-33b3ef3617d3}]

==================================
Upd: November 20, 2008 ( v 1.2.5 )
==================================

"%Windir%\Downloaded Program Files\ZangoInstaller.dll"

Folder : M3Development_WhenUSave_Installer

[-HKEY_CLASSES_ROOT\zangoinstaller.zangoinstaller]
[-HKEY_CLASSES_ROOT\zangoinstaller.zangoinstaller.1]

[-HKEY_CLASSES_ROOT\TypeLib\{ff0312e0-f60c-4109-94b8-0a564a58e43b}]

[-HKEY_CLASSES_ROOT\Interface\{a077a462-0b6c-43bd-af09-5e55a0cc902c}]

[-HKEY_CLASSES_ROOT\CLSID\{99410cde-6f16-42ce-9d49-3807f78f0287}]
[-HKEY_CLASSES_ROOT\clsid\{0579b4b6-0293-4d73-b02d-5ebb0ba0f0a2}]

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\DAEMON Tools Toolbar]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AskBar]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AskSBar Uninstall]

[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\Accoona Search]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{CF739809-1C6C-47C0-85B9-569DBB141420}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2}"=-

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b5146c40-189a-4311-bda9-fbae3e023187}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{43D9E6F0-1776-4897-AE14-ECEDECBAFEC0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{5A074B21-F830-49DE-A31B-5BB9D7F6B407}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{5A074B29-F830-49DE-A31B-5BB9D7F6B407}]

[-HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea1-a523-4961-b6bb-170de4475cca}]
[-HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18eab-a523-4961-b6bb-170de4475cca}]
[-HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00a6faf1-072e-44cf-8957-5838f569a31d}]
[-HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1a93c934-025b-4c3a-b38e-9654a7003239}]
[-HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6f282b65-56bf-4bd1-a8b2-a4449a05863d}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{e79dfbca-5697-4fbd-94e5-5b2a9c7c1612}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{32099AAC-C132-4136-9E9A-4E364A424E17}"=-
"{F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA}"=-
"{b5146c40-189a-4311-bda9-fbae3e023187}"=-

==================================
Upd: October 27, 2008  ( v 1.2.4 )
==================================

# Other infection

==================================
Upd: October 23, 2008  ( v 1.2.3 )
==================================

# Other infection

==================================
Upd: October 4, 2008   ( v 1.2.2 )
==================================

Folder : alot
Folder : baidu
Folder : Starware381

"%ProgramFiles%\Mozilla Firefox\plugins\NPAskSBr.dll"

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02496EBD-8455-48db-B3C7-5DAC97D9F5A7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5AA2BA46-9913-4dc7-9620-69AB0FA17AE7}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion­\Uninstall\starware381]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{a7f05ee4-0426-454f-8013-c41e3596e9e9}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{02496EBD-8455-48db-B3C7-5DAC97D9F5A7}]

[-HKEY_CLASSES_ROOT\Interface\{92b82580-b1d5-4528-8b42-35526141a4d0}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Baidu]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BIE"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks]
"{02496EBD-8455-48db-B3C7-5DAC97D9F5A7}"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{5AA2BA46-9913-4dc7-9620-69AB0FA17AE7}"=-

[-HKEY_CURRENT_USER\SOFTWARE\starware381]
[-HKEY_CURRENT_USER\SOFTWARE\starware354]

===================================
Upd: September 24, 2008 ( v 1.2.1 )
===================================

"%Windir%\system32\iiyrelekeynmmfbh.dll"

Folder : AskBarDis
Folder : 2ACA5CC3-0F83-453D-A079-1076FE1A8B65

[-HKEY_CLASSES_ROOT\coresrv.coreservices]
[-HKEY_CLASSES_ROOT\coresrv.coreservices.1]
[-HKEY_CLASSES_ROOT\coresrv.lfgax]
[-HKEY_CLASSES_ROOT\coresrv.lfgax.1]
[-HKEY_CLASSES_ROOT\hbmain.commband]
[-HKEY_CLASSES_ROOT\hbr.hbmain.1]
[-HKEY_CLASSES_ROOT\hostol.mailanim]
[-HKEY_CLASSES_ROOT\hostol.mailanim.1]
[-HKEY_CLASSES_ROOT\hostol.webmailsend]
[-HKEY_CLASSES_ROOT\hostol.webmailsend.1]
[-HKEY_CLASSES_ROOT\instie.hbinstobj]
[-HKEY_CLASSES_ROOT\instie.hbinstobj.1]
[-HKEY_CLASSES_ROOT\srv.coreservices]
[-HKEY_CLASSES_ROOT\srv.coreservices.1]
[-HKEY_CLASSES_ROOT	oolbar.htmlmenuui]
[-HKEY_CLASSES_ROOT	oolbar.htmlmenuui.1]
[-HKEY_CLASSES_ROOT	oolbar.toolbarctl]
[-HKEY_CLASSES_ROOT	oolbar.toolbarctl.1]
[-HKEY_CLASSES_ROOT\zango.desktopflash]
[-HKEY_CLASSES_ROOT\zango.desktopflash.1]
[-HKEY_CLASSES_ROOT\zangoax.clientdetector]
[-HKEY_CLASSES_ROOT\zangoax.clientdetector.1]
[-HKEY_CLASSES_ROOT\zangoax.userprofiles]
[-HKEY_CLASSES_ROOT\zangoax.userprofiles.1]
[-HKEY_CLASSES_ROOT\funwebproducts.iecookiesmanager.1]
[-HKEY_CLASSES_ROOT\asapcom.asapclass]
[-HKEY_CLASSES_ROOT\asapcom.asapclass.1]
[-HKEY_CLASSES_ROOT\asapcom.asapenvelope]
[-HKEY_CLASSES_ROOT\asapcom.asapenvelope.1]
[-HKEY_CLASSES_ROOT\asapcom.asapmain]
[-HKEY_CLASSES_ROOT\asapcom.asapmain.1]
[-HKEY_CLASSES_ROOT\asapcom.asapmessage]
[-HKEY_CLASSES_ROOT\asapcom.asapmessage.1]
[-HKEY_CLASSES_ROOT\asapcom.asaprecipients]
[-HKEY_CLASSES_ROOT\asapcom.asaprecipients.1]
[-HKEY_CLASSES_ROOT\xml.xml]
[-HKEY_CLASSES_ROOT\xml.xml.1]
[-HKEY_CLASSES_ROOT\asearchassist.adefaultsearch]
[-HKEY_CLASSES_ROOT\asearchassist.adefaultsearch.1]

[-HKEY_CLASSES_ROOT\CLSID\{286e500c-ef0a-4aa3-a94d-e495f653ef4b}]
[-HKEY_CLASSES_ROOT\CLSID\{319260ab-be0c-4025-8569-7a27ed2faab9}]
[-HKEY_CLASSES_ROOT\CLSID\{8ac5bc54-b13b-4642-99f9-0baa2d116184}]
[-HKEY_CLASSES_ROOT\CLSID\{9809a6b4-70b1-4bb2-b3b5-b415763a534e}]
[-HKEY_CLASSES_ROOT\CLSID\{d5178f77-c5e6-4e8f-9787-48b5d7eccce8}]
[-HKEY_CLASSES_ROOT\CLSID\{500bca15-57a7-4eaf-8143-8c619470b13d}]
[-HKEY_CLASSES_ROOT\CLSID\{f80c1d93-0d22-436e-963e-9d3156997a4e}]
[-HKEY_CLASSES_ROOT\CLSID\{1e5b2693-d348-4ca7-8364-4f5e51bf9c6d}]
[-HKEY_CLASSES_ROOT\CLSID\{2e54ac53-efa4-4831-a3f6-b47b1a1937cf}]
[-HKEY_CLASSES_ROOT\CLSID\{8971cb48-9fca-445a-be77-e8e8a4cc9df7}]
[-HKEY_CLASSES_ROOT\CLSID\{bfc08cff-c737-4433-bd5a-0ee7efcfee54}]
[-HKEY_CLASSES_ROOT\CLSID\{5b2e150d-4c8a-40e4-8c36-dd9c02771c67}]
[-HKEY_CLASSES_ROOT\CLSID\{627d894a-8a77-416e-b522-432eaf2c818e}]
[-HKEY_CLASSES_ROOT\CLSID\{54a3f8b7-228e-4ed8-895b-de832b2c3959}]
[-HKEY_CLASSES_ROOT\CLSID\{7138f250-5b72-48dd-adfb-9a83b429dd9e}]
[-HKEY_CLASSES_ROOT\CLSID\{bd937ffe-0352-4fde-88f2-c30d1a9b25cf}]
[-HKEY_CLASSES_ROOT\CLSID\{bf1bf02c-5a86-4ecf-adac-472c54c4d21e}]
[-HKEY_CLASSES_ROOT\CLSID\{b88e4484-3ff6-4ea9-815b-a54fe20d4387}]
[-HKEY_CLASSES_ROOT\CLSID\{ab502149-ccf3-3f33-2241-84152b364b18}]
[-HKEY_CLASSES_ROOT\CLSID\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
[-HKEY_CLASSES_ROOT\CLSID\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[-HKEY_CLASSES_ROOT\CLSID\{b0cb585f-3271-4e42-88d9-ae5c9330d554}]
[-HKEY_CLASSES_ROOT\CLSID\{d2221ccb-f2bb-4858-aad4-57c754153603}]
[-HKEY_CLASSES_ROOT\CLSID\{93b0fa7b-50f6-41b4-ac7e-612a72ce8c3c}]
[-HKEY_CLASSES_ROOT\CLSID\{ea0b6a1a-6a59-4a58-9c41-9966504898a5}]

[-HKEY_CLASSES_ROOT\TypeLib\{ad71e48f-6f47-4b63-9312-fae879541c4d}]
[-HKEY_CLASSES_ROOT\TypeLib\{08755390-f46d-4d09-968c-3430166b3189}]
[-HKEY_CLASSES_ROOT\TypeLib\{ccc6e232-aa4c-4813-a019-9c14b27776b6}]
[-HKEY_CLASSES_ROOT\TypeLib\{229d2451-a617-4b30-b5e8-8138694240cb}]
[-HKEY_CLASSES_ROOT\TypeLib\{c23fa5a4-1fea-419f-8b14-f7465df062bc}]
[-HKEY_CLASSES_ROOT\Typelib\{0923208c-e259-4ed5-a778-cb607da350ad}]
[-HKEY_CLASSES_ROOT\Typelib\{dd1cb2d7-161d-4b84-ae5c-08d3faed894f}]
[-HKEY_CLASSES_ROOT\TypeLib\{9720de03-5820-4059-b4a4-639d5e52bd09}]
[-HKEY_CLASSES_ROOT\Typelib\{45397063-d7d0-47c2-9508-26487608a298}]
[-HKEY_CLASSES_ROOT\Typelib\{71e9cf40-af72-4b55-bd3f-1fea2a0eaea6}]
[-HKEY_CLASSES_ROOT\Typelib\{b9f51d42-cca0-4408-bb02-d433d1865a3a}]
[-HKEY_CLASSES_ROOT\Typelib\{f8ee014f-b34c-4544-8e45-95a7971d323b}]
[-HKEY_CLASSES_ROOT\TypeLib\{bce2e826-d0f5-41c8-97be-28a6f540ceeb}]

[-HKEY_CLASSES_ROOT\Interface\{014da6cc-189f-421a-88cd-07cfe51­cff10}]
[-HKEY_CLASSES_ROOT\Interface\{00b77587-be1b-4201-b8e9-09fcf50ab771}]
[-HKEY_CLASSES_ROOT\Interface\{49155dae-c471-40fa-98ee-b2b3cad115ce}]
[-HKEY_CLASSES_ROOT\Interface\{4d783385-0dda-4188-a529-c97dc3d67cbd}]
[-HKEY_CLASSES_ROOT\Interface\{34e29700-0d13-46aa-b9a5-ace68e21a091}]
[-HKEY_CLASSES_ROOT\Interface\{e420a65f-9984-4b8c-9fa9-1ed69d3b0a13}]
[-HKEY_CLASSES_ROOT\Interface\{3661af2d-c27b-499c-9bcf-66c8502a3806}]
[-HKEY_CLASSES_ROOT\Interface\{99123ac9-7dda-4c82-b252-44c2804bf392}]
[-HKEY_CLASSES_ROOT\Interface\{6e10479b-31e8-4a3b-81b1-ddaf39097f19}]
[-HKEY_CLASSES_ROOT\Interface\{1985fce1-4043-4346-ae70-d0a0cd90bdd3}]
[-HKEY_CLASSES_ROOT\Interface\{2b81f920-6660-4f76-93bf-b1c67bf5d1a0}]
[-HKEY_CLASSES_ROOT\Interface\{3f0915b8-b238-4c2d-ad1e-60db1e14d27a}]
[-HKEY_CLASSES_ROOT\Interface\{5a4737a8-b92a-4e54-970e-c2891d98ce3f}]
[-HKEY_CLASSES_ROOT\Interface\{ace99e77-aa2a-43c2-8c9d-caf2020fdf2b}]
[-HKEY_CLASSES_ROOT\Interface\{e0fb1610-b25b-49f6-be20-751b2f230e6f}]
[-HKEY_CLASSES_ROOT\Interface\{ea58c2ea-be26-49dd-9b9a-c8e4e5ca7791}]
[-HKEY_CLASSES_ROOT\Interface\{fca28ac5-c1e1-4d67-a5ae-c44d6c374d9f}]
[-HKEY_CLASSES_ROOT\Interface\{067c6a37-72ea-4437-863a-5be20c246f3c}]
[-HKEY_CLASSES_ROOT\Interface\{1a2af056-1fe1-47ca-993d-5d09d18e674e}]
[-HKEY_CLASSES_ROOT\Interface\{b247f5bf-bd9d-4ecd-8fc1-365f36a1fda1}]
[-HKEY_CLASSES_ROOT\Interface\{bbbfb891-98ae-4678-86f3-bd5a2eed86c9}]
[-HKEY_CLASSES_ROOT\Interface\{1230cf51-6bc4-4a23-b3f1-c7cf0afed619}]
[-HKEY_CLASSES_ROOT\Interface\{2e623b96-b166-4c70-8169-820761794299}]
[-HKEY_CLASSES_ROOT\Interface\{4e8b851b-05b0-4baf-b24d-d0dfe88dded3}]
[-HKEY_CLASSES_ROOT\Interface\{50c3e2b3-4fd7-4cb9-91f9-641a6e6b3689}]
[-HKEY_CLASSES_ROOT\Interface\{62b0b239-f9ac-4a5b-bfae-62c7a23f7627}]
[-HKEY_CLASSES_ROOT\Interface\{726f0ab9-b842-4ae4-90c7-230e233e6a99}]
[-HKEY_CLASSES_ROOT\Interface\{b9cc2b92-5611-453f-8381-8b6f72d9c0b8}]
[-HKEY_CLASSES_ROOT\Interface\{c4543e64-1498-410d-8e72-4744eea99ab9}]
[-HKEY_CLASSES_ROOT\Interface\{397a208b-3d09-4b3e-93e8-ca171886612e}]
[-HKEY_CLASSES_ROOT\Interface\{421745e9-16df-4ee4-a758-d51f939c49cb}]
[-HKEY_CLASSES_ROOT\Interface\{4331ec56-0aab-499e-8757-dd2ee44ad671}]
[-HKEY_CLASSES_ROOT\Interface\{54286c3a-e044-4e65-bd44-528d6ae28a18}]
[-HKEY_CLASSES_ROOT\Interface\{5f2b9de7-f878-4762-8cfe-e9c58f082f0e}]
[-HKEY_CLASSES_ROOT\Interface\{8654592e-952a-4e7c-a960-304763b35fa6}]
[-HKEY_CLASSES_ROOT\Interface\{8e98faf8-794f-47f9-af90-15305564ed81}]
[-HKEY_CLASSES_ROOT\Interface\{bc8c2e5f-d8b4-4997-bce3-8775c3707956}]
[-HKEY_CLASSES_ROOT\Interface\{d082721f-4bd4-4b8b-bb82-06753ee6174f}]
[-HKEY_CLASSES_ROOT\Interface\{d24f9d3c-5d4c-47f8-9ab7-632b44ad6a0d}]
[-HKEY_CLASSES_ROOT\Interface\{f43ec88b-b6c8-4969-a763-e2bf55602cce}]
[-HKEY_CLASSES_ROOT\Interface\{21447c90-6ec1-4fc1-9379-bd515008aedb}]
[-HKEY_CLASSES_ROOT\Interface\{32c97a37-e2b8-4097-9330-5f3e1125e181}]
[-HKEY_CLASSES_ROOT\Interface\{b0c3de1b-e3ff-4dd0-9229-f452cf9c678e}]
[-HKEY_CLASSES_ROOT\Interface\{d2d94732-a74d-433c-98f7-9ed740e82ae9}]
[-HKEY_CLASSES_ROOT\Interface\{dfd5d79b-ef2f-4a51-9821-5b469f05262e}]

[-HKEY_CLASSES_ROOT\AppID\{dbf00e12-281c-4dc8-a7ec-1ff45182439b}]
[-HKEY_CLASSES_ROOT\AppID\ZangoSA_df.exe]
[-HKEY_CLASSES_ROOT\AppID\{0507fdde-f3b7-49f5-9e8f-c557e991f39b}]
[-HKEY_CLASSES_ROOT\AppID\WeatherOnTray.EXE]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ab502149-ccf3-3f33-2241-84152b364b18}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{bd937ffe-0352-4fde-88f2-c30d1a9b25cf}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{eddbb5ee-bb64-4bfc-9dbe-e7c85941335b}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{014da6cb-189f-421a-88cd-07cfe51cff10}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{93b0fa7b-50f6-41b4-ac7e-612a72ce8c3c}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{7e66936c-fea0-4984-ad26-7b6661ac5b2e}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{946B3E9E-E21A-49c8-9F63-900533FAFE14}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{946B3E9E-E21A-49c8-9F63-900533FAFE15}]

[-HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Products\568267acfc5644dab06f058006ddbae3]

[-HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Features\9ee2330ae5f4470cac801baac83818c9]

[-HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{93b0fa7b-50f6-41b4-ac7e-612a72ce8c3c}]
[-HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{7e66936c-fea0-4984-ad26-7b6661ac5b2e}]

[-HKEY_CURRENT_USER\SOFTWARE\zangosa]

[-HKEY_LOCAL_MACHINE\SOFTWARE\zango]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"{6cfbd76d-7a06-26a5-076f-24c6af0b5257}"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks]
"{944864a5-3916-46e2-96a9-a2e84f3f1208}"=-

===================================
Upd: September 14, 2008 ( v 1.2.0 )
===================================

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyWay Search Assistant]

[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks\{4D25F926-B9FE-4682-BF72-8AB8210D6D75}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4D25F921-B9FE-4682-BF72-8AB8210D6D75}]

[-HKEY_CLASSES_ROOT\CLSID\{4d25f926-b9fe-4682-bf72-8ab8210d6d75}]

===================================
Upd: September 13, 2008 ( v 1.1.9 )
===================================

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll] 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BitComet"=-

===================================
Upd: September 7, 2008  ( v 1.1.8 )
===================================

Folder : Multi_Media
Folder : Multi_Media_France
Folder : MultiMedia France Toolbar

Firefox Extension : {7009fcd4-05be-44f4-9583-93fe419ab7b0}

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7009fcd4-05be-44f4-9583-93fe419ab7b0}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{7009fcd4-05be-44f4-9583-93fe419ab7b0}"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks]
"{7009fcd4-05be-44f4-9583-93fe419ab7b0}"=-

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Ask Toolbar]

===================================
Upd: September 4, 2008  ( v 1.1.7 )
===================================

"%Windir%\system32
slFC.dll"

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{914f1f82-eab1-874f-1284-6a9136e6d163}]

===================================
Upd: August 30, 2008    ( v 1.1.6 )
===================================

"%Windir%\System32\dmubsi.dll"
"%Windir%\System32\dspvfx.dll"

"%Temp%
s*.tmp"
"%Temp%\whenu.ini"
"%Temp%\banner.bmp"
"%Temp%\VVSNInst.exe"
"%Temp%\730.WUT\whenu.inf"
"%Temp%\730.WUT\vvsn.cab"
"%Temp%\WUS3E.bat"

"%ProgramFiles%\Torrent Search"
"%ProgramFiles%\Torrent-Search"

"%Programs%\Torrent Search"

"%Desktop%\Torrent Search.lnk"

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e0c7b854-d5ce-4db6-9804-be1438603d89}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{24D0D7D2-1D72-4ADA-82DE-AE07910CA084}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9D1F87E7-4D72-41AB-9D57-D101A08F20E5}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8DAC4A72-BA26-4329-B66E-8D973035B524}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B9D5EA38-F5A0-456B-B05B-DFF81FBFEF0F}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{678DB4CC-A041-4565-B49B-3F5ADE9558E3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{78E4BE47-F8C7-405E-87A6-84F4ABAB32EC}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\dmubsw.clsdll]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\HyperTerminal.HyperTerminalExt]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\HyperTerminal.HyperTerminalExt.1]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Torrent Search]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Rasmpc]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Torrent Search]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{e0c7b854-d5ce-4db6-9804-be1438603d89}"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks]
"{e0c7b854-d5ce-4db6-9804-be1438603d89}"=-

Folder : AskBarFr

================================
Maj/Upd : 26/08/2008 ( v 1.1.5 )
================================

Folder : Platrium
Folder : PlatriumSA

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B12ACA14-C7FB-44FE-883B-6121FD02BAD3}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Platrium]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D53E4ACF-EDF5-4071-903B-F84B64FC1EA2}"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PlatriumWeather"=-
"PlatriumSA"=-

[-HKEY_LOCAL_MACHINE\SOFTWARE\Platrium]

[-HKEY_CLASSES_ROOT\clsid\{d53e4acf-edf5-4071-903b-f84b64fc1ea2}]
[-HKEY_CLASSES_ROOT\BRNstIE.Stock.1]
[-HKEY_CLASSES_ROOT\BRNstIE.Stock]
[-HKEY_CLASSES_ROOT\funwebproducts.iecookiesmanager]
[-HKEY_CLASSES_ROOT\funwebproducts.iecookiesmanager.1]

================================
Maj/Upd : 24/08/2008 ( v 1.1.4 )
================================

Folder : AskPBar

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0A94B111-4504-4e26-AB05-E61E474AA38B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F4D76F01-7896-458a-890F-E1F05C46069F}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{F4D76F09-7896-458a-890F-E1F05C46069F}"=-

================================
Maj/Upd : 22/08/2008 ( v 1.1.3 )
================================

Folder : Burn4Free
Folder : Burn4Free CD and DVD

"%Windir%\Burn4Free_Toolbar_Uninstaller_????.exe"
"%Windir%\Prefetch\BURN4FREE_SETUP.EXE*.pf"
"%Windir%\Prefetch\BURN4FREE.EXE*.pf"
"%Windir%\System32\b4fm.dll"
"%Common Desktop%\Burn4Free.lnk"
"%Desktop%\burn4free_setup.exe"
"%Appdata%\Microsoft\Internet Explorer\Quick Launch\Burn4Free.lnk"

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1C311AAA-D8B1-4A0A-BEE5-2387FEC583DA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4F11ACBB-393F-4C86-A214-FF3D0D155CC3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D187A56B-A33F-4CBE-9D77-459FC0BAE012}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.b4f]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\b4fm.SxContextMenu1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Burn4Free project]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D187A56B-A33F-4CBE-9D77-459FC0BAE012}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Burn4Free]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Burn4Free Toolbar]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Search settings 1.2]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Burn4Free]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{4F11ACBB-393F-4C86-A214-FF3D0D155CC3}"=-
"{70DE7956-479D-4EB7-8641-2B45774C350E}"=-

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{4F11ACBB-393F-4C86-A214-FF3D0D155CC3}"=-
"{70DE7956-479D-4EB7-8641-2B45774C350E}"=-

[-HKEY_CURRENT_USER\Software\Burn4Free]

[-HKEY_CLASSES_ROOT\CLSID\{D187A56B-A33F-4CBE-9D77-459FC0BAE012}]
[-HKEY_CLASSES_ROOT\CLSID\{4F11ACBB-393F-4C86-A214-FF3D0D155CC3}]
[-HKEY_CLASSES_ROOT\CLSID\{1C311AAA-D8B1-4A0A-BEE5-2387FEC583DA}]
[-HKEY_CLASSES_ROOT\Burn4Free project]
[-HKEY_CLASSES_ROOT\b4fm.SxContextMenu1]
[-HKEY_CLASSES_ROOT\.b4f]

Processus - Burn4Free.exe

================================
Maj/Upd : 21/08/2008 ( v 1.1.2 )
================================

Folder : DAEMON Tools Toolbar
Folder : Bit Lord 1.1
Folder : BitLord
Folder : VVSN

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BitLord]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\BitLord.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\bittorrent]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BitLordUnfinishedFile]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.bc!]

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\BitLord]
[-HKEY_CURRENT_USER\Software\BitLord]

[-HKEY_CLASSES_ROOT\bittorrent]
[-HKEY_CLASSES_ROOT\BitLordUnfinishedFile]
[-HKEY_CLASSES_ROOT\.bc!]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VVSN"=-

Processus - BitLord.exe
Processus - vvsn.exe

================================
Maj/Upd : 20/08/2008 ( v 1.1.1 )
================================

Reset values :

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="res://ieframe.dll/tabswelcome.htm"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Start Page"="https://www.msn.com/fr-fr/"
"Window Title"=""

================================
Maj/Upd : 19/08/2008 ( v 1.1.0 )
================================

# [Service] MyWebSearchService

Folder : Accoona
Folder : ActiveShopper
Folder : ADS Plugins
Folder : Adssite Advanced Toolbar
Folder : Adssite Games Collection
Folder : Adult-Links
Folder : AdvancedTool
Folder : AltNet
Folder : AntivirusGold
Folder : AskSBar
Folder : AskTBar
Folder : Browser Accelerator
Folder : Browser Optimizer Dcads
Folder : Browser Optimizer Superiorads
Folder : BrowsingAdvisor
Folder : BrowsingEnhancer
Folder : BrowsingProgram
Folder : BrowsingSoftware
Folder : BrowsingTool
Folder : Burn4Free Toolbar
Folder : ContextAdvisor
Folder : ContextEnhancer
Folder : ContextProgram
Folder : ContextTool
Folder : Crawler
Folder : Dcads Advanced Toolbar
Folder : Dcads Games Collection
Folder : Dealio
Folder : DR_S
Folder : dynamic toolbar
Folder : ErrorsTool
Folder : EZshopper
Folder : FastFinder
Folder : FBrowserAdvisor
Folder : FBrowsingAdvisor
Folder : FFTOOLBAR ToolBar
Folder : Flyordie_games
Folder : FunWebProducts
Folder : Fun Web Products
Folder : GamesBar
Folder : Gossiper
Folder : Hbtools
Folder : HbTools_Icons
Folder : Hotbar
Folder : HotbarSA
Folder : INSTAFIN
Folder : INSTAFINK
Folder : Instant Buzz
Folder : IntelligentAdvisor
Folder : InternetProgram
Folder : InternetSoftware
Folder : ISTbar
Folder : IstSvc
Folder : KaZaA
Folder : Kugoo
Folder : live-online-tv
Folder : Mirar
Folder : Morpheus Toolbar
Folder : My Downloaded Games
Folder : MyGlobalSearch
Folder : MyQuickSearch
Folder : MySearch
Folder : MyToolbar
Folder : MyTotalSearch
Folder : Myway
Folder : MyWaySA
Folder : MyWaySearch
Folder : MyWebSearch
Folder : MyWebSearchWB
Folder : PlayMP3z
Folder : NavExcel
Folder : NavExcel Search Toolbar
Folder : NavigationAdvisor
Folder : NavigationEnhancer
Folder : NavigationProgram
Folder : NavigationTool
Folder : Need2Find
Folder : Online_TV_toolbar
Folder : PageRevisor
Folder : PCHealthCenter
Folder : Piolet
Folder : Piolet Toolbar
Folder : Push toolbar
Folder : P2P_Energy
Folder : P2P Networking
Folder : P2P_Torrent
Folder : Rax Search
Folder : RXToolbar
Folder : Sbar Toolbar
Folder : SearchEssistant
Folder : searchessistant toolbar
Folder : SearchSettings
Folder : Search Settings
Folder : Seekmo
Folder : Seekmo Programs
Folder : seekmo search assistant
Folder : ShopNav
Folder : Shopper Report
Folder : ShopperReports
Folder : ShoppingReport
Folder : SideFind
Folder : SLMSS
Folder : Slotchbar
Folder : SmartShopper
Folder : Snrg
Folder : SpamBlockerUtility
Folder : Starware
Folder : Starware305
Folder : Starware316
Folder : Starware343
Folder : Starware347
Folder : Starware354
Folder : Starware370
Folder : Starware390
Folder : StatsTool
Folder : SurfAccuracy
Folder : ToolBar888
Folder : TrustIn Bar
Folder : Try2Find
Folder : UCmore
Folder : VMNToolbar
Folder : VSAdd-in
Folder : VS Toolbar
Folder : WeatherDPA
Folder : WeatherStudio
Folder : WhenU
Folder : WinAble
Folder : Wssclient
Folder : XXXToolbar
Folder : YourSiteBar
Folder : Zango
Folder : 2020Search
Folder : 7Search
Folder : 8848

"%Systemdrive%\dfndr.exe"
"%Systemdrive%\dfndrff_7.exe"
"%Systemdrive%\kybrd.exe"
"%Systemdrive%\kybrdff_7.exe"
"%Systemdrive%
wnm.exe"

"%Windir%\adrsb.exe"
"%Windir%\autolfn.exe"
"%Windir%\azentretien.dll"
"%Windir%\CJet.exe"
"%Windir%\csrss.exe"
"%Windir%\dpvsetup.exe"
"%Windir%\dsndup.exe"
"%Windir%\gxvpsafm.dll"
"%Windir%\iewww.exe"
"%Windir%\iun6002.exe"
"%Windir%\label.exe"
"%Windir%\lasss.exe"
"%Windir%\mdm.exe"
"%Windir%\mmc.exe"
"%Windir%\mshepl.exe"
"%Windir%\mshta.exe"
"%Windir%\mssetup.exe"
"%Windir%\msswchx.exe"
"%Windir%\mstask.exe"
"%Windir%
etdde.exe"
"%Windir%
ne.bin"
"%Windir%
nv.bin"
"%Windir%
nmgr.dat"
"%Windir%
nmgr.exe"
"%Windir%
nmgr.ocx"
"%Windir%
tvdm.exe"
"%Windir%\omi.dll"
"%Windir%\osk.exe"
"%Windir%edirect7.exe"
"%Windir%\sbar.dll"
"%Windir%\sfita.exe"
"%Windir%\smdat32a.sys"
"%Windir%\smdat32m.sys"
"%Windir%\smss.exe"
"%Windir%\spoolsv.exe"
"%Windir%\sptsupd.exe"
"%Windir%\subst.exe"
"%Windir%\svchost.exe"
"%Windir%\SYSfit.exe"
"%Windir%\ups.exe"
"%Windir%\waladhpr.exe"
"%Windir%\w32tm.exe"
"%Windir%\xcopy.exe"

"%Windir%\System\mdc.dll"

"%Windir%\System32\adrot-uninst.exe"
"%Windir%\System32\adrotate.dll"
"%Windir%\System32\adrotate1.dll"
"%Windir%\System32\adspipe.dll"
"%WinDir%\system32\adssite-remove.exe"
"%WinDir%\system32\adssite_sidebar.dll"
"%WinDir%\system32\adssite_sidebar_uninstall.exe"
"%Windir%\System32\adv.dll"
"%Windir%\System32\azesearch4.ocx"
"%Windir%\System32\brrotate.dll"
"%Windir%\System32\ca2.dll"
"%Windir%\System32\cpmrotate.dll"
"%Windir%\System32\czuehf.exe"
"%Windir%\System32\Dcads-remove.exe"
"%WinDir%\system32\dcads_sidebar.dll"
"%WinDir%\system32\dcads_sidebar_uninstall.exe"
"%Windir%\System32\DcadsSocial-uninstall.exe"
"%WinDir%\system32\dcadssuggest.dll"
"%Windir%\System32\eplaceSearch.dll"
"%Windir%\System32\ewxcksr.exe"
"%Windir%\System32\fufudc.exe"
"%Windir%\System32\f3PSSavr.scr"
"%Windir%\System32\globobar.ocx"
"%Windir%\System32\gzmrotate.dll"
"%WinDir%\system32\gzmrt.dll"
"%Windir%\System32\ha3f.exe"
"%Windir%\System32\hookdump.exe"
"%Windir%\System32\HyperLinker3.exe"
"%Windir%\System32\iasad.dll"
"%Windir%\System32\iasada.dll"
"%Windir%\System32\jbhbolcl.exe"
"%Windir%\System32\kcnzrop6.exe"
"%Windir%\System32\lmdv.bin"
"%Windir%\System32\lmf32v.dll"
"%Windir%\System32\mnopdb.exe"
"%Windir%\System32\mwsvm.exe"
"%Windir%\System32\mwsvm.ocx"
"%WinDir%\system32\mysidesearch_sidebar_uninstall.exe"
"%WinDir%\system32\mysidesearch_sidebar.dll"
"%WinDir%\system32
injaext-uninstall.exe"
"%Windir%\System32
odeipproc.dll"
"%Windir%\System32
ss2C.dll"
"%Windir%\System32
slFC.dll"
"%Windir%\System32\otpddpea5.dll"
"%Windir%\System32\PreUninstall.exe"
"%Windir%\System32\PreUninstallFF.exe"
"%Windir%\System32\p2p.exe"
"%Windir%\System32\P2P Networking"
"%Windir%\system32\QaBar.dll"
"%Windir%\system32\QcBar.dll"
"%Windir%\System32a8pv.exe"
"%WinDir%\system32ightonadz-uninst.exe"
"%Windir%\System32\ShowFF.exe"
"%Windir%\System32\SmartShopper"
"%WinDir%\system32\sprt_ads.dll"
"%WinDir%\system32\superiorads-uninst.exe"
"%Windir%\System32\syssfitb.dll"
"%Windir%\System32	bc.dll"
"%Windir%\System32\TopSearch.dll"
"%Windir%\System32	ubby.dll"
"%Windir%\System32\uninst.exe"
"%Windir%\System32\uninst.log"
"%Windir%\System32\uninsticn.exe"
"%Windir%\System32\vtlbar1.dll"
"%Windir%\system32\WinATS.dll"
"%Windir%\System32\WinDmy.dll"
"%Windir%\System32\WinNB*.dll"
"%Windir%\System32\winnook.exe"
"%Windir%\System32\zolk.dll"
"%Windir%\System32\zolker005.dll"
"%Windir%\System32\zolker009.dll"
"%Windir%\System32\zolker010.dll"
"%Windir%\System32\zolker011.dll"
"%Windir%\System32\ztoolb005.dll"
"%Windir%\System32\ztoolb006.dll"
"%Windir%\System32\ztoolb010.dll"
"%Windir%\System32\ztoolber.dll"
"%Windir%\system32\{0936fcf1-60ca-f7bf-5899-d2dbff2fa288}.dll"

"%Windir%\system32\SearchTool
su9F8.dll"
"%Windir%\system32\SearchTool\SearchTool.dll"

"%Windir%\System32\drivers\ csrss.exe"

"%Windir%\System32\Macromed\Flash\FlashPlayerTrust\activeshopper.cfg"

"%Fonts%\acrsec.fon"
"%Fonts%\acrsecB.fon"
"%Fonts%\acrsecI.fon"

"%Windir%\Downloaded Program Files\dotcomtoolbar.asp"
"%Windir%\Downloaded Program Files\hbtools.inf"
"%Windir%\Downloaded Program Files\hotbar.inf"
"%Windir%\Downloaded Program Files\instafin.dll"
"%Windir%\Downloaded Program Files\istactivex.dll"
"%Windir%\Downloaded Program Files\logo.bmp"
"%Windir%\Downloaded Program Files\logo.gif"
"%Windir%\Downloaded Program Files\logo2.gif"
"%Windir%\Downloaded Program Files\MirarSetup.exe"
"%Windir%\Downloaded Program Files\mwsearch.dll"
"%Windir%\Downloaded Program Files\MySearch.CAB"
"%Windir%\Downloaded Program Files
av.bmp"
"%Windir%\Downloaded Program Files
av_hot.bmp"
"%Windir%\Downloaded Program Files	oolbar_nieuw14.dll"
"%Windir%\Downloaded Program Files\ysbactivex.dll"
"%Windir%\downloaded program files\webp2pinstaller.dll"

"%Programfiles%\Internet Explorer\msimg32.dll"
"%programfiles%\internet explorer\setup.exe"

"%Programfiles%\Mozilla Firefox\plugins\NPMyWebS.dll"

"%ProgramFiles%\MSN Messenger\msimg32.dll"
"%ProgramFiles%\MSN Messengeriched20.dll"

"%ProgramFiles%\ieshnv.ini"
"%ProgramFiles%\ieshnv.bmp"
"%ProgramFiles%\ieshnv.dat"
"%ProgramFiles%\ieshnv.lng"

"%Temp%\ASearchAssist.dll"
"%Temp%\ICD1.tmp"
"%Temp%\ISTbar.dll"
"%Temp%\is-B3DFI.tmp"
"%Temp%\mc*.tmp"
"%Temp%\mit3.tmp"
"%Temp%\mit3.tmp.cab"
"%Temp%\TBQuiesceKB.exe"
"%Temp%\sidefind.exe"
"%Temp%\s11k..exe"
"%Temp%	em*.tmp.exe"
"%Temp%\11-9df8e247b1ab6e4ea9303b15294a3428.exe"
"%Temp%\875455-NOSB.exe"

"%Temp%\Random_Folder\Toolbar.exe"

"%Personal%\work7\load03.exe"
"%Personal%\work7\loadppc.exe"

"%Startup%\MyTotalSearch Email Plugin.lnk"
"%Startup%\MyWebSearch Email Plugin.lnk"

"%Desktop%\atoolbar200002.exe"
"%Desktop%\DealioKit127.exe"
"%Desktop%\m00.exe"
"%Desktop%\SetupActiv.exe"
"%Desktop%\sportsinteraction.com - bet on sports!.lnk"

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E552EEFC-DE97-45D4-BA1A-F534A1B4A579}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{04011C11-2F3B-44ed-977C-270CA669C6B2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0E677221-E309-4341-81BD-3CC3018BF5B3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0E1230F8-EA50-42A9-983C-D22ABC2EED3B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6C4ECE5C-7CB8-36C5-6F3B-D414CE8F8E22}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0a452a47-c5a8-4854-a237-4b9b06b376f0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0494D0D1-F8E0-41ad-92A3-14154ECE70AC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C1E58A84-95B3-4630-B8C2-D06B77B7A0FC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1648E328-3E5A-4EA5-A9C6-E5F09EE272DA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{26E45419-7205-4fac-BBFE-174BC7337A79}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{971C3384-F75E-4562-95B3-CBE7417529BC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{10F3E8BD-257A-4702-A2F5-DC02055B068C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6FC3C36D-7635-4D43-BA62-0D9D2F2CD06E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9C8A568E-4201-478a-8536-526CF371D2E2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AB71E94E-3DC4-41eb-BBD5-31E82C9FD1D4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7D9362F8-77D8-4b29-97B5-621D550890C0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C004D9F0-A742-4DC7-AFD0-BC29CE3FE04A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{100eb1fd-d03e-47fd-81f3-ee91287f9465}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6A87B991-A31F-4130-AE72-6D0C294BF082}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{07B18EA1-A523-4961-B6BB-170DE4475CCA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4AD44D3E-7316-4251-B754-9B10EC96AF92}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E015787-B1E3-404a-95DE-3E71E1FA0305}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C7C90A5E-BE0A-44DD-83D2-1BE138460BAC}] 
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D80C4E21-C346-4E21-8E64-20746AA20AEB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E60A8FF7-B9B4-8ABC-10E8-10F2461DFA50}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{391C0909-C026-3B63-FFDB-93FFF4E81675}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D93B3CA5-6552-0DAA-353B-FB9D4F20B168}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4B8AE75C-A139-558A-AB5B-5F07BC2FD566}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0D39A900-0F3A-4C29-A254-3E65244FDC34}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5bf48cbf-6ca5-495a-c3f9-0574983d4eb2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{14b3d246-6274-40b5-8d50-6c2ade2ab29b}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1ADBCCE8-CF84-441E-9B38-AFC7A19C06A4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{2a8a997f-bb9f-48f6-aa2b-2762d50f9289}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{36A91CEC-6C71-4758-B492-397BFC8E96A2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4035DE1B-D54A-411E-9EE7-923295D2E86E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{45A4902E-4479-4EAE-A186-8D0F7E4C78DE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4C6C4BA2-1646-0F3A-1FAE-B393C162C92E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4E7BD74F-2B8D-469E-90F0-F66AB581A933}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4E7BD74F-2B8D-469E-DCF7-F96DA086B434}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4E7BD74F-2B8D-469E-86FF-FD60BB9AAE3B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4E7BD74F-2B8D-469E-C0FF-FD7FF4D5FA7D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5ed7d3de-6dbe-4516-8712-01b1b64b7057}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00a6faf1-072e-44cf-8957-5838f569a31d}]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{5929cd6e-2062-44a4-b2c5-2c7e78fbab38}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5ABBD91B-0215-2FE1-7A7E-753F05B40CB8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5CFEE306-E014-48A4-876D-06FF09EBB0F3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5ED7D3DE-6DBE-4516-8712-436325722327}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5f90c0e3-4c0a-4d54-a8ac-5afe6163a99e}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6548BF73-58FF-71D5-F97D-17C71E323709}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6A6E50DC-BFA8-4B40-AB1B-159E03E829FD}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6A87B991-A31F-4130-AE72-6D0C294BF082}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6F282B65-56BF-4BD1-A8B2-A4449A05863D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7475D3FD-5D85-49DB-8B9B-6968467B2D80}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{74CC49F7-EB32-4A08-B204-948962A6E3DB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{753B9349-7E46-4E5C-A27F-A60A6BF1EAB5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{832BEBED-C3DA-4534-A2C2-B2FFF220C820}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{87E68009-29A8-D669-F7C2-B31D08635C50}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{88C9B3C7-06B6-5C05-CFEC-C09DBC10CC30}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{944864A5-3916-46E2-96A9-A2E84F3F1208}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9A9C9B69-F908-4AAB-8D0C-10EA8997F37E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9EAC0102-5E61-2312-BC2D-4D54434D5443}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9EAC0102-5E61-2312-BC2D-76746C56544C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9CB65201-89C4-402c-BA80-02D8C59F9B1D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A3FDD654-A057-4971-9844-4ED8E67DBBB8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF7E9EBB-E1CF-7F7C-C608-13185698F3E9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B5F3970B-745E-46AC-B890-E08F69777D80}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B886C1F4-D1D3-45F5-F45E-75EB024320AC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CA356D79-679B-4b4c-8E49-5AF97014F4C1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0661233-42D4-F7F1-80E1-8A9E0E99E71D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D6FC35D1-04AB-4D40-94CF-2E5AE4D0F8D2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{da7ff3f8-08be-4cac-bc00-94d91c6ae7f4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{da7ff3f8-08be-4cac-bc00-94d91c6ae7f4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{da7ff3f8-08be-4cac-bc00-94d91c6ae7f4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E4D1D56C-3EC9-2F5D-FAA3-4112CCDD61DC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E82E0739-0AAE-4E99-9052-B40F7DABFA34}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{bc4be15d-6a34-4356-9e97-79e43da32b1d}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F1E96EDC-E0C8-BE98-1F15-C29DBED83B53}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{f65b197f-8260-4d52-909a-f70118e646eb}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F8EACE56-0AF4-3AE3-6EF8-F8CC39675729}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FE063DB1-4EC0-403e-8DD8-394C54984B2C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{014DA6C1-189F-421a-88CD-07CFE51CFF10}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{0494D0D1-F8E0-41ad-92A3-14154ECE70AC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{100EB1FD-D03E-47FD-81F3-EE91287F9465}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{2BA1C226-EC1B-4471-A65F-D0688AC6EE3A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{4E7BD74F-2B8D-469E-C0FF-FD7FF4D5FA7D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{5f90c0e3-4c0a-4d54-a8ac-5afe6163a99e}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{6F282B65-56BF-4BD1-A8B2-A4449A05863D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{90B8B761-DF2B-48AC-BBE0-BCC03A819B3B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{E552EEFC-DE97-45D4-BA1A-F534A1B4A579}]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{4e7bd74f-2b8d-46a1-83b8-bd2ae6d9fa2e}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2bae58c2-79f9-45d1-a286-81f911301c3a}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9F17C005-7BF0-4f13-8473-F3C3D2619DBD}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EDDF3383-EC5F-49DF-A8B6-CEC2D8F6164C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F7C7AA47-BCA6-451D-8DBC-C10A8F75C8C7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A057A204-BACC-4D26-8287-79A187E26987}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{07b18eab-a523-4961-b6bb-170de4475cca}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{25560540-9571-4d7b-9389-0f166788785a}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{2eff3cf7-99c1-4c29-bc2b-68e057e22340}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3dc201fb-e9c9-499c-a11f-23c360d7c3f8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3e720452-b472-4954-b7aa-33069eb53906}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{63d0ed2c-b45b-4458-8b3b-60c69bbbd83c}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{63d0ed2c-b45b-4458-8b3b-60c69bbbd83c}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7473d294-b7bb-4f24-ae82-7e2ce94bb6a9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{98d9753d-d73b-42d5-8c85-4469cda897ab}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9ff05104-b030-46fc-94b8-81276e4e27df}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{a6573479-9075-4a65-98a6-19fd29cf7374}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{69725738-CD68-4f36-8D02-8C43722EE5DA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{A3E67DAA-DA01-4da5-98BE-3088B554A11E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D95C7240-0282-4c01-93F5-673BCA03DA86}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{90b5a95a-afd5-4d11-b9bd-a69d53d22226}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8109fd3d-d891-4f80-8339-50a4913ace6f}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{f0d4b23b-da4b-4daf-81e4-dfee4931a4aa}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{25560540-9571-4d7b-9389-0f166788785a}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{2eff3cf7-99c1-4c29-bc2b-68e057e22340}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3dc201fb-e9c9-499c-a11f-23c360d7c3f8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{63d0ed2c-b45b-4458-8b3b-60c69bbbd83c}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{98d9753d-d73b-42d5-8c85-4469cda897ab}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{07b18eab-a52­3-4961-b6bb-170de4475cca}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{25560540-957­1-4d7b-9389-0f166788785a}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{2eff3cf7-99c­1-4c29-bc2b-68e057e22340}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3dc201fb-e9c­9-499c-a11f-23c360d7c3f8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{98d9753d-d73­b-42d5-8c85-4469cda897ab}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3e720452-b47­2-4954-b7aa-33069eb53906}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{63d0ed2c-b45­b-4458-8b3b-60c69bbbd83c}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7473d294-b7b­b-4f24-ae82-7e2ce94bb6a9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9ff05104-b03­0-46fc-94b8-81276e4e27df}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{a6573479-907­5-4a65-98a6-19fd29cf7374}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{e79dfbca-569­7-4fbd-94e5-5b2a9c7c1612}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{0566A191-D675-4911-9C7E-50EDBEF90F32}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5f90c0e3-4c0a-4d54-a8ac-5afe6163a99e}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59c7fc09-1c83-4648-b3e6-003d2bbc7481}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68af847f-6e91-45dd-9b68-d6a12c30e5d7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170b96c-28d4-4626-8358-27e6caeef907}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d1a71fa0-ff48-48dd-9b6d-7a13a3e42127}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ddb1968e-ead6-40fd-8dae-ff14757f60c7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{f138d901-86f0-4383-99b6-9cdd406036da}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EDDBB5EE-BB64-4bfc-9DBE-E7C85941335B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FBF1B8D2-9A06-4174-A8B5-E38606DDB92B}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{42F2C9BA-614F-47C0-B3E3-ECFD34EED658}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{7C559105-9ECF-42B8-B3F7-832E75EDD959}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8a0dcbdb-6e20-489c-9041-c1e8a0352e75}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8A0DCBDA-6E20-489C-9041-C1E8A0352E75}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{5F1ABCDB-A875-46C1-8345-B72A4567E483}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CODE Store Database\Distribution Units\{BFA03761-5565-41b3-93D9-82B354C0A8EC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{79B96C72-C0D0-4DC8-BC7E-9F314A918228}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{C109664B-CEB1-420B-B353-D55A561536DD}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{1A93C934-025B-4c3a-B38E-9654A7003239}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEBF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEC0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{119DBEDA-9c41-4F97-94B4-B6BCD01133CF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{88E50F1D-4790-4C6B-BEE3-D54E46B6EEF6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{066040F0-5018-4E15-8AA0-81D36136D989}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{c5428486-50a0-4a02-9d20-520b59a9f9b2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{c5428486-50a0-4a02-9d20-520b59a9f9b3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{10E42047-DEB9-4535-A118-B3F6EC39B807}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{BFA03761-5565-41b3-93D9-82B354C0A8EC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{C5428486-50A0-4a02-9D20-520B59A9F9B2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{C5428486-50A0-4a02-9D20-520B59A9F9B3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{E908B145-C847-4e85-B315-07E2E70DECF8}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{3EA5C408-2437-4c40-ADAC-DFDA9AEEEA96}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\{9CB65206-89C4-402c-BA80-02D8C59F9B1D}]

Nic00 · Answer

Non ce n'est toujours pas ça.

Tu as essayé en mode sans échec + désactivé l'uac + exécuter en tant qu'administrateur ?

flibustierdu42 · Answer

En mode sans échec j'avais recherche des erreurs et je viens d'essayer toolbarsd c'est encore pareil quand je tape 1 pour recherche puis entrer la fenêtre se ferme.
Je sais pas d'où ça peut venir.

Nic00 · Answer

&#9654; Télécharges ToolsCleaner2 sur ton bureau
 http://pc-system.fr/ lances le ( clic droit...) 
&#9654;Cliques sur '' recherche" et laisses le scanner ton pc, puis clique sur suppression pour finaliser... un rapport sera généré 
&#9654;Postes le...



>> Télécharge CCleaner: 
http://download.piriform.com 

>Installe-le en prenant soin de décocher les diverses options dont la barre Yahoo et la mise à jour. 

> Lance CCleaner puis Clique sur "Options", "Avancé" et décoche la case "Effacer uniquement les fichiers, du dossier Temp de Windows, plus vieux que 48 heures". 

>Pour les autres paramètres, laisse-le avec ses réglages par défaut. 

> Puis dans le menu Nettoyeur 
> Clique sur Analyse (laisser travailler cela peut durer longtemps la 1ere fois) 
> Clique sur le bouton Lancer le nettoyage. 
> Clique une seconde fois sur le bouton Lancer le nettoyage 
> Fait de même pour le menu "Chercher des erreurs"



=>Refais l'étape pour Toolbar S&D: 

http://www.commentcamarche.net/forum/affich 13321366 le virus beagle bagle#11

Le virus Beagle/Bagle ?

28 réponses

Discussions similaires

Newsletters