resolu j'ai un logiciel qui ne se desinstalle plus

jojo2186 · le 20 août 2006

Résolu Voila j'ai du sans faire exprès installé un logiciel appelé "Popcorn.net" apparemment c'était un logiciel d'essai.Apres une période d'essai de 3 jours le logiciel ne peut plus se désinstaller.A chaque fois que j'ouvre mon ordinateur j'ai une publicité qui me dit que maintenant je sui obligé de payer pour obtenir le logiciel.

Dans le panneau de configuration et ajouter/supprimere des programmes, le logiciel est introuvable.

Quand j'effectue un recherche du fichier "popcorn" il ne trouve rien non plus.

Coment je dois procéder pour desinstaller ce logiciel?

merci d'avance

Modifié le 19 octobre 2006 par jojo2186

bruce lee · le 20 août 2006

Bonjour,

Pour supprimer les clé dans le registre:

telecharge la version original de hijackthis http://www.merijn.org/files/hijackthis.zip

déconnecte toi du net et installe le.

lance le en cliquant sur Do a system scan and save a logfile a la fin du scan le bloc note va s'ouvrir tu fais un copier coller de tout son contenu.

jojo2186 · le 20 août 2006

voici le rapport

Logfile of HijackThis v1.99.1

Scan saved at 12:28:14, on 20/08/2006

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\System32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Analog Devices\SoundMAX\SMTray.exe

C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe

C:\apps\ABoard\ABoard.exe

C:\APPS\OD2\OD2DLEngine.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe

C:\apps\ABoard\AOSD.exe

C:\WINDOWS\System32\LVCOMSX.EXE

C:\Program Files\Logitech\Video\LogiTray.exe

C:\Apps\Powercinema\PCMService.exe

C:\PROGRA~1\ACDSYS~1\DEVDET~1\DEVDET~1.EXE

C:\Program Files\Winamp\winampa.exe

C:\Program Files\License_Manager\license_manager.exe

C:\APPS\OD2\OD2State.exe

C:\WINDOWS\system32\slserv.exe

C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

C:\Program Files\Logitech\Video\FxSvr2.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\WinRAR\WinRAR.exe

C:\DOCUME~1\GUYPAT~1\LOCALS~1\Temp\Rar$EX00.516\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.updatesearches.com/search.php?qq=%1

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll

O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll

O4 - HKLM\..\Run: [smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe

O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe

O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe

O4 - HKLM\..\Run: [DOWNLOAD MANAGER] C:\APPS\OD2\OD2DLEngine.exe

O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"

O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE

O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe

O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe

O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"

O4 - HKLM\..\Run: [Camera Detector] C:\PROGRA~1\ACDSYS~1\DEVDET~1\DEVDET~1.EXE -autorun

O4 - HKLM\..\Run: [a-squared] "C:\Program Files\a-squared Anti-Malware\a2guard.exe"

O4 - HKLM\..\Run: [update] C:\Program Files\AntiVir PersonalEdition Classic\preupd.exe /CALLSCHEDULER /DM="0" /CALLSCHEDULER

O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [WINSOS VERIFY] "C:\Program Files\WINSOS\WINSOS.EXE" MINI

O4 - HKCU\..\Run: [Crocpopup] C:\Program Files\crocpopup\crocpopup.exe

O4 - HKCU\..\Run: [shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -tray

O4 - HKCU\..\Run: [License Manager] "C:\Program Files\License_Manager\license_manager.exe " /silent

O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Mémento.lnk = C:\quickenw\billmind.exe

O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html

O8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar3.dll/cmwordtrans.html

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html

O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html

O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html

O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html

O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar3.dll/cmbacklinks.html

O8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar3.dll/cmsimilar.html

O8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar3.dll/cmsearch.html

O8 - Extra context menu item: Télécharger avec &BitSpirit - C:\Program Files\BitSpirit\bsurl.htm

O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar3.dll/cmcache.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll

O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm

O15 - Trusted Zone: *.od2.com

O16 - DPF: {2F003D51-39FD-4D18-9016-95CF70B92ABE} - http://download.movienetworks.com/install/US/altpmtscab.cab

O16 - DPF: {8C875948-9C60-4381-9248-0DF180542D53} - http://installs.spamblockerutility.com/ins...ckerutility.cab

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab

O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab

O16 - DPF: {C36112BF-2FA3-4694-8603-3B510EA3B465} (Lycos File Upload Component) - http://f012.mail.caramail.lycos.fr/app/upl...ileUploader.cab

O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe

O23 - Service: MysqlInventime - Unknown owner - c:\mysql\bin\mysqld-nt.exe

O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe

O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

bruce lee · le 20 août 2006

re,

Hijackthis est tres mal placé, met le dans un dossier dédié.

Tu fais du P2P, je te conseil fortement d'arreter ca, rien de tel pour attraper des bestioles en tout genre....

Tu n'as pas le SP2; mais l'on verra ca apres ta desinfection

Si durant la procedure ci bas, il y a des etapes que tu n'as pas reussi a faire, merci de

continuer la procedure jusqu'au bout et de les signaler dans ta prochaine reponse.

1/Télécharge http://www.ewido.net/en/download/ Ewido anti-spyware

Lance Ewido et clique sur le bouton Update (barre d'outils - au haut). Sous Manual Update clique Start update.

Tu verras ceci juste au bas, lorsque la mise à jour sera complétée : "Update successful"

Ferme Ewido. Ne pas le lancer tout de suite.

2/demarre en mode sans echec http://www.sosordi.net/Faq/Faq.2.html

3/

demarrer/panneau de configuration/ajouts et suppresions de programmes et verifie la presence de:

License_Manager

si ce programme est present desinstalle le.

4/lance hijackthis en cliquant sur do a scan system only coche ces lignes:

O4 - HKCU\..\Run: [License Manager] "C:\Program Files\License_Manager\license_manager.exe " /silent

O16 - DPF: {2F003D51-39FD-4D18-9016-95CF70B92ABE} - http://download.movienetworks.com/install/US/altpmtscab.cab

O16 - DPF: {8C875948-9C60-4381-9248-0DF180542D53} - http://installs.spamblockerutility.com/ins...ckerutility.cab

Ferme toutes les fenêtres ouvertes sauf Hijackthis et clique sur fix checked

5/pour supprimer les fichiers nefastes on va tous les afficher en faisant comme ceci:

Démarrer, Poste de travail ou autre dossier, Menu Outils, Option des dossiers, onglet Affichage :
Cocher la case : Afficher les fichiers et dossiers cachés

Décocher la case : Masquer les extensions des fichiers dont le type est connu

Décocher la case : Masquer les fichiers protégés du système d'exploitation

cliquer sur "Appliquer"

cliquer sur le bouton "Appliquer à tous les dossiers" / OK

6/supprime ce qui est en gras:

C:\Program Files\ License_Manager<== tout le dossier

7/ Du mode Sans Échec, lance Ewido et clique sur le bouton Scanner (de la barre d'outils) et ensuite clique sur Complete System Scan. Le scan prendra un certain temps, donc sois patient.

Ewido affichera une liste des fichiers détectés, sur la gauche. En fin de scan, l'outil appliquera les "Actions" à appliquer automatiquement. Clique sur le bouton Apply all actions. Ewido affichera "All actions have been applied" du côté droit.

Clique sur "Save Report", puis "Save Report As". Ceci génère un rapport en fichier texte. Assure-toi de le sauvegarder dans un endroit sûr (sur ton Bureau, par exemple).

8/redemarre en mode normal

9/poste le rapport d'ewido ainsi qu'un nouveau log hijackthis.

bon courage, et si tu as la moindre question n'hesite surtout pas

@+

jojo2186 · le 13 septembre 2006

désolé pour le retard.j'ai un probleme avec ewido anti-spyware 4.0 .quand je clqiue sur start update il me dit "no update was available" que dois-je faire

bruce lee · le 13 septembre 2006

bonjour,

continue la procedure malgres tout.

bon courage

jojo2186 · le 17 septembre 2006

Bonjour je n'arrive pas a désinstaller License_Manager.Il me dit "Uninstall Warning" you are about to be redirected to a webpage.Are you sure you want to continué? si je met oui ou non que ce soir en mode sans echec ou pas il ne se passe rien du tout. Que dois-je faire? merci

bruce lee · le 17 septembre 2006

bonjour,

Clique "oui" malgres tout et poursuis le reste de la procedure.

NOTE: une fois que tu auras tout fait, reverifie et dis moi si le programme est toujours present.

jojo2186 · le 19 septembre 2006

voici le rapport ewido

---------------------------------------------------------

ewido anti-spyware - Scan Report

---------------------------------------------------------

+ Created at: 17:55:56 19/09/2006

+ Scan result:

C:\WINDOWS\Downloaded Program Files\APInstall_Tiny.dll -> Adware.AccessMedia : Cleaned with backup (quarantined).

HKLM\SOFTWARE\Classes\AppID\{9DA1990B-9BCA-4c80-AEFB-11A40FA849F9} -> Adware.Generic : Cleaned with backup (quarantined).

HKLM\SOFTWARE\Classes\CLSID\{0D0FAB5C-2BE4-4126-A28E-828FEBCE1E55} -> Adware.Generic : Cleaned with backup (quarantined).

HKLM\SOFTWARE\Classes\CLSID\{9DA04BBD-71BB-020C-436E-42FECBB98F05} -> Adware.Generic : Cleaned with backup (quarantined).

HKLM\SOFTWARE\Classes\Interface\{1131081D-81ED-46F0-8B03-B728AEAFFD12} -> Adware.Generic : Cleaned with backup (quarantined).

HKLM\SOFTWARE\Classes\Interface\{214345B8-BB69-498D-A168-29F58F15D806} -> Adware.Generic : Cleaned with backup (quarantined).

HKLM\SOFTWARE\Classes\TypeLib\{80ED1EB2-55FB-4434-BD41-E1645A370158} -> Adware.Generic : Cleaned with backup (quarantined).

C:\WINDOWS\Downloaded Program Files\HbInstIE.dll -> Adware.HotBar : Cleaned with backup (quarantined).

C:\Program Files\VirusBlast -> Adware.VirusBlast : Cleaned with backup (quarantined).

C:\Program Files\VirusBlast\Logs -> Adware.VirusBlast : Cleaned with backup (quarantined).

C:\Program Files\VirusBlast\Logs\vblast_activity-06242006-131808.log -> Adware.VirusBlast : Cleaned with backup (quarantined).

C:\Program Files\VirusBlast\sdebug.log -> Adware.VirusBlast : Cleaned with backup (quarantined).

C:\RECYCLER\S-1-5-21-847128399-1166195051-1909902306-1006\Dc62\license_manager.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP26\A0168829.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP26\A0169256.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP26\A0169815.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP26\A0170134.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP26\A0170469.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP26\A0171031.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP26\A0171603.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP26\A0172191.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP26\A0172542.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP26\A0172771.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP26\A0172834.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP26\A0173169.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP26\A0173668.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP26\A0174385.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP26\A0174974.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP26\A0175565.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP26\A0176138.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP26\A0176743.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP26\A0177278.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP26\A0177856.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP26\A0178419.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP26\A0179103.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP26\A0179665.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP26\A0180036.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP27\A0180773.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP27\A0181324.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP27\A0181666.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP27\A0183588.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP27\A0184057.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP27\A0184759.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP27\A0185339.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP28\A0185616.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP28\A0185698.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP28\A0186088.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP28\A0186692.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP28\A0187253.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP28\A0187823.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP28\A0188138.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP28\A0188592.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP28\A0189163.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP28\A0189495.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP28\A0189884.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP28\A0190384.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP28\A0190991.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP28\A0191295.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP28\A0191707.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP29\A0192283.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP29\A0192658.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP30\A0193255.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP30\A0193566.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP30\A0193971.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP30\A0194325.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP30\A0194769.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP30\A0195044.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP30\A0195395.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP30\A0196008.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP31\A0196607.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP31\A0196916.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP31\A0197286.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP31\A0197864.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP31\A0198459.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP31\A0199021.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP31\A0199444.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP32\A0199461.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP32\A0199615.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP32\A0199929.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP32\A0200268.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP32\A0200617.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP32\A0200964.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP32\A0201656.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP32\A0201738.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP32\A0202097.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP32\A0202715.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP32\A0203271.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP32\A0203708.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP32\A0203953.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP32\A0204249.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP32\A0204637.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP32\A0204995.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP32\A0205549.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP32\A0205870.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP32\A0205970.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP32\A0206326.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP32\A0206661.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP32\A0207077.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP32\A0207411.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP32\A0208195.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP32\A0208525.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP32\A0208887.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP32\A0209467.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP33\A0211233.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP33\A0212049.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP33\A0212527.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP33\A0213033.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP33\A0213372.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP33\A0213980.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP33\A0214543.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP34\A0215175.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP34\A0216329.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP34\A0216457.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP34\A0216835.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP34\A0217411.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP34\A0217740.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP34\A0218161.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP34\A0218737.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP34\A0219351.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP34\A0219945.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP34\A0220320.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP34\A0220612.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP34\A0221684.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP34\A0222257.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP35\A0222505.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP35\A0222600.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP35\A0222863.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP35\A0222991.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP35\A0223318.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP35\A0223621.exe -> Adware.WeirWeb : Cleaned with backup (quarantined).

C:\WINDOWS\Temp\MT\BelledeSexe[1].exe -> Dialer.CapreDeam.o : Cleaned with backup (quarantined).

C:\WINDOWS\Downloaded Program Files\CONFLICT.1\USDR6V_0001_D08M1005NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.l : Ignored.

C:\WINDOWS\Downloaded Program Files\CONFLICT.2\USDR6V_0001_D08M1005NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.l : Ignored.

C:\WINDOWS\Downloaded Program Files\USDR6V_0001_D08M1005NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.l : Ignored.

C:\Documents and Settings\GUY Patrick\Cookies\guy patrick@adtech[2].txt -> TrackingCookie.Adtech : Cleaned.

C:\Documents and Settings\GUY Patrick\Cookies\guy patrick@bluestreak[2].txt -> TrackingCookie.Bluestreak : Cleaned.

C:\Documents and Settings\GUY Patrick\Local Settings\Temp\Cookies\guy patrick@bluestreak[1].txt -> TrackingCookie.Bluestreak : Cleaned.

C:\Documents and Settings\GUY Patrick\Cookies\guy patrick@fl01.ct2.comclick[1].txt -> TrackingCookie.Comclick : Cleaned.

C:\Documents and Settings\GUY Patrick\Local Settings\Temp\Cookies\guy patrick@fl01.ct2.comclick[1].txt -> TrackingCookie.Comclick : Cleaned.

C:\Documents and Settings\GUY Patrick\Cookies\guy patrick@estat[1].txt -> TrackingCookie.Estat : Cleaned.

C:\Documents and Settings\GUY Patrick\Local Settings\Temp\Cookies\guy patrick@estat[1].txt -> TrackingCookie.Estat : Cleaned.

C:\Documents and Settings\GUY Patrick\Cookies\guy patrick@as1.falkag[2].txt -> TrackingCookie.Falkag : Cleaned.

C:\Documents and Settings\GUY Patrick\Local Settings\Temp\Cookies\guy patrick@as-eu.falkag[2].txt -> TrackingCookie.Falkag : Cleaned.

C:\Documents and Settings\GUY Patrick\Cookies\guy patrick@serving-sys[2].txt -> TrackingCookie.Serving-sys : Cleaned.

C:\Documents and Settings\GUY Patrick\Cookies\guy patrick@www.smartadserver[2].txt -> TrackingCookie.Smartadserver : Cleaned.

C:\Documents and Settings\GUY Patrick\Local Settings\Temp\Cookies\guy patrick@www.smartadserver[1].txt -> TrackingCookie.Smartadserver : Cleaned.

C:\Documents and Settings\GUY Patrick\Local Settings\Temp\Cookies\guy patrick@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Cleaned.

C:\Documents and Settings\GUY Patrick\Cookies\guy patrick@weborama[1].txt -> TrackingCookie.Weborama : Cleaned.

C:\Documents and Settings\GUY Patrick\Local Settings\Temp\Cookies\guy patrick@weborama[2].txt -> TrackingCookie.Weborama : Cleaned.

C:\Documents and Settings\GUY Patrick\Cookies\guy patrick@zedo[2].txt -> TrackingCookie.Zedo : Cleaned.

::Report end

et voici le rapport hijack

Logfile of HijackThis v1.99.1

Scan saved at 18:11:16, on 19/09/2006

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\System32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\ewido anti-spyware 4.0\guard.exe

C:\Program Files\Analog Devices\SoundMAX\SMTray.exe

C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe

C:\apps\ABoard\ABoard.exe

C:\APPS\OD2\OD2DLEngine.exe

C:\Program Files\QuickTime\qttask.exe

C:\apps\ABoard\AOSD.exe

C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe

C:\WINDOWS\System32\LVCOMSX.EXE

C:\Program Files\Logitech\Video\LogiTray.exe

C:\Apps\Powercinema\PCMService.exe

C:\PROGRA~1\ACDSYS~1\DEVDET~1\DEVDET~1.EXE

C:\APPS\OD2\OD2State.exe

C:\Program Files\Winamp\winampa.exe

C:\WINDOWS\system32\slserv.exe

C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Logitech\Video\FxSvr2.exe

C:\Program Files\MSN Messenger\msnmsgr.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Program Files\WinRAR\WinRAR.exe

C:\DOCUME~1\GUYPAT~1\LOCALS~1\Temp\Rar$EX00.047\HijackThis.exe