problème drive cleaner (internet-explorer, window, c-cleaner, nettoyage)

moi86

20 Janvier 2007 19:08:45

j'ai effectué les memes choses en telechargant les logiciels
est ce que quelqu'un peut m'ai der svp voici les rapport:

voici le rapport de Hijackthis :
Logfile of HijackThis v1.99.1
Scan saved at 12:23:42, on 20/01/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Club-Internet\Lanceur\lanceur.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Shareaza\Shareaza.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Romain\Bureau\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Club Internet.lnk = C:\Program Files\Club-Internet\Lanceur\lanceur.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{52E5D461-E1B5-4A36-AF3A-C518BA29A186}: NameServer = 194.117.200.10 194.117.200.15
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

et voici le rapport de Blacklight :
01/20/07 12:24:41 [Info]: BlackLight Engine 1.0.55 initialized
01/20/07 12:24:41 [Info]: OS: 5.1 build 2600 (Service Pack 2)
01/20/07 12:24:42 [Note]: 7019 4
01/20/07 12:24:42 [Note]: 7005 0
01/20/07 12:24:58 [Note]: 7006 0
01/20/07 12:24:59 [Note]: 7011 1084
01/20/07 12:24:59 [Note]: 7026 0
01/20/07 12:24:59 [Note]: 7026 0
01/20/07 12:24:59 [Note]: 7024 3
01/20/07 12:24:59 [Info]: Hidden process: C:\windows\system32\opxiyajrlt.exe
01/20/07 12:25:09 [Note]: FSRAW library version 1.7.1021
01/20/07 12:29:37 [Info]: Hidden file: c:\WINDOWS\system32\opxiyajrlt.dat
01/20/07 12:29:37 [Note]: 10002 1
01/20/07 12:29:37 [Info]: Hidden file: C:\windows\system32\opxiyajrlt.exe
01/20/07 12:29:37 [Note]: 10002 1
01/20/07 12:29:40 [Info]: Hidden file: c:\WINDOWS\system32\opxiyajrlt_nav.dat
01/20/07 12:29:40 [Note]: 10002 1
01/20/07 12:29:47 [Info]: Hidden file: c:\WINDOWS\system32\opxiyajrlt_navps.dat
01/20/07 12:29:47 [Note]: 10002 1

Autres pages sur : probleme drive cleaner

| Etre averti des réponses
| Alerter

Répondre à moi86

Angeldark

20 Janvier 2007 19:09:49

BONSOIR!!!

Les manipulations sont à faire sans interruption et dans l'ordre
Si tu ne comprends pas quelque chose, demande des explications avant de commencer.

Enregistre cette page pour avoir accès à la procédure en mode sans échec :
- Fichier
- Enregistrer Sous...
- Nom du fichier : Procédure
- Type : Page Web, complète
- Pour l'emplacement, chosis ton Bureau
- Clique maintenant sur Enregistrer

Télécharge :

Brute Force Uninstaller (de Merjin).
Créé un nouveau dossier directement sur le C:\ et nomme-le BFU. Décompresse le fichier téléchargé dans ce nouveau dossier (C:\BFU)

Navipromo.zip et décompresse-le sur ton bureau.

FAIS UN CLIQUE-DROIT ICI et choisis "Enregistrer la cible du lien sous..." afin de télécharger EGDACCESS.bfu (de Metallica). Sauvegarde-le dans le dossier créé (C:\BFU).
Tu dois maintenant avoir deux fichiers dans le dossier C:\BFU : EGDACCESS.bfu et BFU.exe (très important).

Note : Si tu utlises Internet Explorer; lors de la sauvegarde, assure-toi que le champs "Type :" affiche "Tous les fichiers".

AIDE : Comment installer et utiliser BFU ?

Redémarre en mode Sans Échec : au redémarrage, tapote immédiatement la touche F8; tu verras un écran avec choix de démarrages apparaître. Utilisant les flèches du clavier, choisis "Mode Sans Échec" et valide avec "Entrée". Choisis ton compte usuel, et non Administrateur.

Lance le fichier Navipromo.bat qui se trouve sur ton bureau dans le dossier Navipromo.
Sélectionne d'abord l'option "Vérifications", et patiente quelques minutes. Lorsqu'il a terminé, ferme le rapport qui s'est ouvert.
Sélectionne ensuite l'option "Recherche et suppression automatique" en tapant sur la touche R.
S'il trouve quelque chose, tu verras défiler des lignes dans la fenêtre de commande et au bout de quelques instants, il faudra que tu appuies sur une touche pour que le nettoyage soit lancé.

Démarre "Brute Force Uninstaller" en double-cliquant BFU.exe (du dossier C:\BFU)

- Clique sur le petit dossier jaune, à la droite de la boîte Scriptline to execute, et double-clique sur :

EGDACCESS.bfu

- Dans la boîte "Scriptline to execute", tu devrais maintenant voir ceci : C:\BFU\EGDACCESS.bfu

Clique sur Execute et laisse-le faire son travail.

Attends que Complete script execution apparaisse pour cliquer sur OK.
Clique Exit pour fermer le programme BFU.

Redémarre normalement.

Poste les rapports :
- Hijackthis
- C:\egd.txt
- C:\Navipromo.txt

| Alerter

Répondre à Angeldark

moi86

20 Janvier 2007 19:53:23

Meric beaucoup d'avoir répondu j'ai effectué les différentes opérations voici les rapports:

Rapport Navipromo.bat 0.72 effectué le 20/01/2007 à 20:34:36,69
L'opération se déroule en mode sans échec sous le compte "Romain"

## Vérifications supplémentaires

Note : cette section est expérimentale, aucun fichier ne sera supprimé. Si des fichiers sont trouvés à l'aide de cette méthode, ils ne seront pas nécessairement dangereux.

* Navipromo

C:\WINDOWS\System32

opxiyajrlt.exe
opxiyajrlt_navps.dat
opxiyajrlt.dat
opxiyajrlt.dat

* Trojan Nebula

* Trojan Vundo

-------------

Rapport Navipromo.bat 0.71 effectué le 20/01/2007 à 20:35:18,51
L'opération se déroule en mode sans échec sous le compte "Romain"

** Recherche...

1/ opxiyajrlt trouvé, recherche de opxiyajrlt*
C:\WINDOWS\system32\opxiyajrlt.dat
C:\WINDOWS\system32\opxiyajrlt.exe
C:\WINDOWS\system32\opxiyajrlt_nav.dat
C:\WINDOWS\system32\opxiyajrlt_navps.dat
C:\WINDOWS\prefetch\OPXIYAJRLT.EXE-143C171B.pf

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
opxiyajrlt REG_SZ c:\windows\system32\opxiyajrlt.exe opxiyajrlt

------------------
Fin du rapport de recherche
Adware Navipromo trouvé 1 fois avec cette méthode

################################################

** Nettoyage...

1/ Déplacement de opxiyajrlt* vers C:\Navipromo\Backups...
C:\WINDOWS\System32\opxiyajrlt* déplacé avec succès !
C:\WINDOWS\prefetch\opxiyajrlt* déplacé avec succès

------------------
* Suppression clés et valeurs de registre
1 entrées de registre netttoyées

* Backups :

C:\Navipromo\Backups\ARPCache.reg
C:\Navipromo\Backups\HKCURun.reg
C:\Navipromo\Backups\HKLMRun.reg
C:\Navipromo\Backups\opxiyajrlt.dat
C:\Navipromo\Backups\opxiyajrlt.exe
C:\Navipromo\Backups\OPXIYAJRLT.EXE-143C171B.pf
C:\Navipromo\Backups\opxiyajrlt_nav.dat
C:\Navipromo\Backups\opxiyajrlt_navps.dat
C:\Navipromo\Backups\Uninstall.reg

Ajout d'extension .off aux backups

## Fin du rapport de Suppression

-------------

Rapport Navipromo.bat 0.71 effectué le 20/01/2007 à 20:45:03,33
L'opération se déroule en mode sans échec sous le compte "Romain"

** Recherche...

Fin du rapport de recherche
Adware Navipromo non trouvé avec cette méthode

Engagement de la méthode Heuristique

Rapport Navipromo.bat 0.72 effectué le 20/01/2007 à 20:45:03,53
L'opération se déroule en mode sans échec sous le compte "Romain"

## Suppression Heuristique

-------------

Rapport Navipromo.bat 0.71 effectué le 20/01/2007 à 20:45:25,04
L'opération se déroule en mode sans échec sous le compte "Romain"

** Recherche...

Fin du rapport de recherche
Adware Navipromo non trouvé avec cette méthode

Engagement de la méthode Heuristique

Rapport Navipromo.bat 0.72 effectué le 20/01/2007 à 20:45:25,13
L'opération se déroule en mode sans échec sous le compte "Romain"

## Suppression Heuristique

* Backups :

Aucun résultat par la recherche heuristique

## Fin du rapport Heuristique

Logfile of HijackThis v1.99.1
Scan saved at 12:23:42, on 20/01/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Club-Internet\Lanceur\lanceur.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Shareaza\Shareaza.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Romain\Bureau\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Club Internet.lnk = C:\Program Files\Club-Internet\Lanceur\lanceur.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{52E5D461-E1B5-4A36-AF3A-C518BA29A186}: NameServer = 194.117.200.10 194.117.200.15
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

# For use with Merijn's Brute Force Uninstaller
# available from http://www.merijn.org/
#
# Script Name: EGDACCESS.BFU
# This script combines the old EGDACCESS.bfu and P2EClient.BFU
# Author: Pieter Arntz
#
# Thanks to ~Mark and Moe31 for their contributions

ProcessKill \mailskinner.exe|1
ProcessKill %WINDIR%\iedisco.exe|1
ProcessKill \GoAstro.exe|1
ProcessKill \MessengerSkinner.exe|1
ProcessKill \system32mwsrvacc.exe|1
ProcessKill \accinet.exe|1

ProcessKillIfContainsText %SYSDIR%\*.exe|qeu_ueAyqes_uew_te|0
ProcessKillIfContainsText %SYSDIR%\*.exe|WaXL5_jp0Ml

RegDeleteKey HKCR\egdhtml.egdialhtml
RegDeleteKey HKCR\egdhtml.egdialhtml.1
RegDeleteKey HKCR\egdialobject.egdial
RegDeleteKey HKCR\EGDialObject.EGDial.1
RegDeleteKey HKCR\eghtmldialer.htmldialer
RegDeleteKey HKCR\eghtmldialer.htmldialer.1
RegDeleteKey HKCR\ieaccess2.iedial
RegDeleteKey HKCR\ieaccess2.iedial.1
RegDeleteKey HKCR\P2ECOM.EGP2ECOM
RegDeleteKey HKCR\P2ECOM.EGP2ECOM.1
RegDeleteKey HKCR\EGAUTH.EGEGAUTH
RegDeleteKey HKCR\EGAUTH.EGEGAUTH.1
RegDeleteKey HKCR\EGCOMSERVICE.EGComSvc
RegDeleteKey HKCR\EGCOMSERVICE.EGComSvc.1
RegDeleteKey HKCR\EGCOMSERVICE2.EGComSvc2
RegDeleteKey HKCR\EGCOMSERVICE2.EGComSvc2.1
RegDeleteKey HKCR\EGCOMLIB.EGComLibrary
RegDeleteKey HKCR\EGCOMLIB.EGComLibrary.1
RegDeleteKey HKCR\Webcam2.VideoProducer
RegDeleteKey HKCR\Webcam2.VideoProducer.1

RegDeleteKey HKCR\CLSID\{01BE5BD7-B2DD-48B3-A759-59265A91E787}
RegDeleteKey HKCR\CLSID\{04CCFF26-7D52-4E42-BF6A-F8ECE0896EB7}
RegDeleteKey HKCR\CLSID\{04F414E9-E352-4BC3-963D-7BFE5A5F31A9}
RegDeleteKey HKCR\CLSID\{0594AF7E-573B-40DF-8165-E47AB2EAEFE8}
RegDeleteKey HKCR\CLSID\{07C9CFC7-DE33-4A0C-9FFB-CDFBA843B157}
RegDeleteKey HKCR\CLSID\{0878F049-D33E-45E0-A157-C36A6683CF25}
RegDeleteKey HKCR\CLSID\{093F9CF8-0DE1-491C-95D5-5EC257BD4CA3}
RegDeleteKey HKCR\CLSID\{0D1011B3-89C8-4F8E-8693-BB970E2E81E0}
RegDeleteKey HKCR\CLSID\{0DA910BC-6919-489E-B584-D9A4AAC7B8DE}
RegDeleteKey HKCR\CLSID\{0E79192A-C52C-4260-920F-639AC2296203}
RegDeleteKey HKCR\CLSID\{11F1D260-129E-4EB7-B37E-57E3D97A3DF1}
RegDeleteKey HKCR\CLSID\{14325268-79E0-4D2A-89A4-FFFC6E22741E}
RegDeleteKey HKCR\CLSID\{1604DF98-D1A5-44FE-844A-98D6FD0518D0}
RegDeleteKey HKCR\CLSID\{17BFC8DA-B4D6-4DB9-AA40-1CD32EDA9845}
RegDeleteKey HKCR\CLSID\{1CD49DC9-FD88-41FA-B892-47E037267D45}
RegDeleteKey HKCR\CLSID\{1CD4E2DC-2DA0-4154-8723-38CB04FB6A58}
RegDeleteKey HKCR\CLSID\{1EB17D1C-141D-4D9D-91CB-24D99215851D}
RegDeleteKey HKCR\CLSID\{201D3DA8-B495-4A3B-BEE8-6D8DDCCC5762}
RegDeleteKey HKCR\CLSID\{26D73573-F1B3-48C9-A989-E6CE071957A1}
RegDeleteKey HKCR\CLSID\{2A3DFC59-8A87-49A1-85D1-42903410911F}
RegDeleteKey HKCR\CLSID\{2ABE804B-4D3A-41BF-A172-304627874B45}
RegDeleteKey HKCR\CLSID\{2AEEAC34-FD74-4142-B891-4B05C0C03C87}
RegDeleteKey HKCR\CLSID\{2F668A6D-2EC7-4E3A-A485-819E210738D6}
RegDeleteKey HKCR\CLSID\{31DDC1FD-CEA3-4837-A6DC-87E67015ADC9}
RegDeleteKey HKCR\CLSID\{321F38B6-7E5F-470E-B58C-927523B7AF92}
RegDeleteKey HKCR\CLSID\{3446598E-00E4-4B5E-99A6-87ECCA8324A2}
RegDeleteKey HKCR\CLSID\{3616F4B5-F6AD-4E67-966A-C218673648A0}
RegDeleteKey HKCR\CLSID\{39EA2F6F-3F50-4F58-9C63-4B3D53B0926E}
RegDeleteKey HKCR\CLSID\{3ABC79F3-E345-43B9-A79F-5D5C7A8EC4DC}
RegDeleteKey HKCR\CLSID\{3CD945A2-E413-4956-B9D8-A67FB6A7CB66}
RegDeleteKey HKCR\CLSID\{3DAD912E-D2B9-4323-B7C9-7F2C5CC0C57B}
RegDeleteKey HKCR\CLSID\{469C7080-8EC8-43A6-AD97-45848113743C}
RegDeleteKey HKCR\CLSID\{486E48B5-ABF2-42BB-A327-2679DF3FB822}
RegDeleteKey HKCR\CLSID\{505098FD-5D61-4BC2-9B82-F969D0E932A2}
RegDeleteKey HKCR\CLSID\{50AD557E-3426-41FD-AFDD-2AF39BB1C387}
RegDeleteKey HKCR\CLSID\{54579C3D-A58D-4623-B5B5-465552BDA45B}
RegDeleteKey HKCR\CLSID\{54C75FB0-6B8B-4278-BF7B-77036F15A69E}
RegDeleteKey HKCR\CLSID\{5F4D3335-3194-4167-85AE-E7325F2695EF}
RegDeleteKey HKCR\CLSID\{5FD9726A-4977-449D-8352-25FDD8A510B5}
RegDeleteKey HKCR\CLSID\{602890BA-07A1-4A93-A89F-6BDDD8BB9BA5}
RegDeleteKey HKCR\CLSID\{624321F1-0581-49D8-99BD-2E952C2DF31B}
RegDeleteKey HKCR\CLSID\{6AA85413-165C-4200-8154-71166077B22E}
RegDeleteKey HKCR\CLSID\{6AA93DF6-6757-4338-9087-F7601DE18402}
RegDeleteKey HKCR\CLSID\{71CBDCD9-0830-4470-A890-35D364DA352C}
RegDeleteKey HKCR\CLSID\{71DA2A4E-ACB3-4065-9E41-8BC42EABE427}
RegDeleteKey HKCR\CLSID\{7504F0D5-644A-4103-9D02-95488B6CB9A1}
RegDeleteKey HKCR\CLSID\{77EF6DBF-3929-4081-AF2E-178D387E211C}
RegDeleteKey HKCR\CLSID\{78F584DF-BBF5-4296-839C-31DE60914DBC}
RegDeleteKey HKCR\CLSID\{82FC4503-8459-4239-9B85-0617BEAA950A}
RegDeleteKey HKCR\CLSID\{83F0D6AA-CD15-46B5-AA4E-BDB506B4AE53}
RegDeleteKey HKCR\CLSID\{87C1805D-C5AE-4455-AB39-E245BB516136}
RegDeleteKey HKCR\CLSID\{8B3B8135-9DAA-40E7-8941-962795F9C1CB}
RegDeleteKey HKCR\CLSID\{8D8BAF56-B581-4B90-A549-C4AC6B03F1BB}
RegDeleteKey HKCR\CLSID\{94742E3F-D9A1-4780-9A87-2FFA43655DA2}
RegDeleteKey HKCR\CLSID\{95460ABD-946A-46FF-9F56-268718323EEE}
RegDeleteKey HKCR\CLSID\{9D6ADDBF-8227-4D36-AE46-116AFBDAFCA0}
RegDeleteKey HKCR\CLSID\{9EB4F647-FE4A-42F9-9F5C-B8FB28DD02F9}
RegDeleteKey HKCR\CLSID\{A02780C3-7F77-4E28-855B-28890F3CF37A}
RegDeleteKey HKCR\CLSID\{A1C392A2-B274-46DB-89BE-1FBD476B9C93}
RegDeleteKey HKCR\CLSID\{AA59202C-5E41-48FC-AF7D-324F5FD6A9F1}
RegDeleteKey HKCR\CLSID\{AF7410C1-FBA3-415E-800A-4110CED40536}
RegDeleteKey HKCR\CLSID\{AFCF364F-F730-4B1E-B2D5-80F9172FBC44}
RegDeleteKey HKCR\CLSID\{B2B0AEDF-7CDF-4792-BB67-7654AD1E1B13}
RegDeleteKey HKCR\CLSID\{B3A5878E-5B4C-4D12-9156-4D7FD8D0AF6C}
RegDeleteKey HKCR\CLSID\{B843DA96-2B2D-447E-90AB-B92929AA11AF}
RegDeleteKey HKCR\CLSID\{BA14D944-0D8C-4F16-A950-6E53EEBB558F}
RegDeleteKey HKCR\CLSID\{BA749BC1-143E-430D-B1DA-1D2AF67A3658}
RegDeleteKey HKCR\CLSID\{BD3653E4-884B-43C4-970B-670802501B7F}
RegDeleteKey HKCR\CLSID\{BE5A7132-329F-4319-B781-2A83BFE51534}
RegDeleteKey HKCR\CLSID\{BFC9677B-8006-4336-9D49-2C797AEFCB9E}
RegDeleteKey HKCR\CLSID\{C2481ED1-9896-4D49-AE90-69858DFDE446}
RegDeleteKey HKCR\CLSID\{C660C559-903D-41A5-991B-ED7959096C35}
RegDeleteKey HKCR\CLSID\{C6760A07-A574-4705-B113-7856315922C3}
RegDeleteKey HKCR\CLSID\{C80B7FF6-CE60-4079-935E-520C045C30A6}
RegDeleteKey HKCR\CLSID\{C9269872-E3D6-4811-8E5E-835CA8CBD0B3}
RegDeleteKey HKCR\CLSID\{CB5D474E-A510-40A4-B5A4-838933BCBA64}
RegDeleteKey HKCR\CLSID\{CDD8BADE-B4C8-4E97-84B4-1DC9ABAD3EF3}
RegDeleteKey HKCR\CLSID\{CEFB7B49-9652-464F-8AFD-A577C0500F39}
RegDeleteKey HKCR\CLSID\{CF5F84EB-D3FC-4F98-BE3B-F5B56B962CED}
RegDeleteKey HKCR\CLSID\{D24A1963-9951-4153-A340-6648759EB77D}
RegDeleteKey HKCR\CLSID\{D7B59209-0ED9-4986-BD4A-527BE836C6B2}
RegDeleteKey HKCR\CLSID\{D8B94E9A-A34B-4253-BF48-C7CB7F2CFDB0}
RegDeleteKey HKCR\CLSID\{E114CD5B-17CE-4807-890E-7B1EDF9F2E5E}
RegDeleteKey HKCR\CLSID\{E19AB99F-AEC4-4B40-A5CA-F69D22522D77}
RegDeleteKey HKCR\CLSID\{E1D20694-74D9-472D-AF03-08C26173A67F}
RegDeleteKey HKCR\CLSID\{E24E8472-89B7-479F-8AD8-BBD7206A6A02}
RegDeleteKey HKCR\CLSID\{E3943A24-2F83-4505-9AE5-F705E81B50CB}
RegDeleteKey HKCR\CLSID\{E49A9FCB-FAA9-4C1F-A1C1-54920DA2CCA4}
RegDeleteKey HKCR\CLSID\{E7AE1661-EBEB-492B-AE0D-860DF24174C6}
RegDeleteKey HKCR\CLSID\{EC4AFBF3-4540-4306-AF10-4CAC509EA16B}
RegDeleteKey HKCR\CLSID\{EEECA057-AD0F-44A7-8BE5-8634CEDBDBD1}
RegDeleteKey HKCR\CLSID\{EF4DCD99-D26B-44A4-BA77-CFDCC97E7291}
RegDeleteKey HKCR\CLSID\{EFB23983-5803-4914-ADA3-C0EA2CFBDC37}
RegDeleteKey HKCR\CLSID\{F4653484-F38C-455F-BB15-1175E527754E}
RegDeleteKey HKCR\CLSID\{F72BC3F0-6C20-4793-9DDA-258589D8A907}
RegDeleteKey HKCR\CLSID\{F99973C8-43E7-48C4-9EF3-131B67301321}
RegDeleteKey HKCR\CLSID\{FA1D6D8F-C6ED-4752-8512-A33283240130}
RegDeleteKey HKCR\CLSID\{FA605711-8E72-46B2-AE49-BED11B2E729D}
RegDeleteKey HKCR\CLSID\{FA83E942-B796-46DE-9155-1632ECC5473B}
RegDeleteKey HKCR\CLSID\{FBF65A16-C9AB-465E-AECE-D2D9D5AB5E60}
RegDeleteKey HKCR\CLSID\{FDA26383-C0CF-4D32-AC37-769D7E14581F}
RegDeleteKey HKCR\CLSID\{FF521631-31DA-48AC-B4E9-390A7694C906}

RegDeleteKey HKCR\TypeLib\{06EC63CC-4823-4836-ABB8-AB5F3971FA5C}
RegDeleteKey HKCR\TypeLib\{0E594D22-ACE6-43A2-BCDA-BB7C65D3FE8C}
RegDeleteKey HKCR\TypeLib\{1F445F82-42C0-46F3-9A2E-6ADB79046D41}
RegDeleteKey HKCR\TypeLib\{7699AEF9-F83A-44FA-B374-AA02CEDF247D}
RegDeleteKey HKCR\TypeLib\{83F0D6AA-CD15-46B5-AA4E-BDB506B4AE53}
RegDeleteKey HKCR\TypeLib\{AD9B275B-E42D-4C7F-9FFB-29B5FB81688B}
RegDeleteKey HKCR\TypeLib\{E8C88115-4951-425B-8C45-4DFC5A5540EE}
RegDeleteKey HKCR\TypeLib\{F3A257E6-FA04-4B30-A1B6-6B89EB814544}

RegDeleteKey HKCR\Interface\{2E30AC01-99D7-4E9C-B13E-94E1701B0AC9}
RegDeleteKey HKCR\Interface\{2F668A6D-2EC7-4E3A-A485-819E210738D6}
RegDeleteKey HKCR\Interface\{3947AC1D-DB09-4353-BBCC-55B97F5035EF}
RegDeleteKey HKCR\Interface\{62BFAEC2-82A5-4117-A98B-FEA89413D924}
RegDeleteKey HKCR\Interface\{7B1B5E44-8E90-4EE2-9049-CC0C5D8A918F}
RegDeleteKey HKCR\Interface\{81C2F7F3-F930-455E-9AA5-0876D387C787}
RegDeleteKey HKCR\Interface\{8F0A06F6-DF4D-4D54-B8CA-E8EEDBAE6DDB}
RegDeleteKey HKCR\Interface\{901166A5-F137-4B27-BC4C-CA611DEBDCED}
RegDeleteKey HKCR\Interface\{A58F3D09-4543-4396-8BE7-105F14DD6ED5}
RegDeleteKey HKCR\Interface\{A7B323DA-0D0C-4298-8DE0-4F2AC4773284}
RegDeleteKey HKCR\Interface\{C13FA88A-D264-4BC8-92ED-52EB8181E209}
RegDeleteKey HKCR\Interface\{F8ACA5A0-060A-478A-8368-1407780D2251}

RegDeleteKey HKCU\Software\livesvc
RegDeleteKey HKCU\Software\EGDHTML
RegDeleteKey HKCU\Software\egroup
RegDeleteKey HKCU\Software\P2EClient
RegDeleteKey HKCU\software\egdhtml
RegDeleteKey HKCU\Software\epk_extr
RegDeleteKey HKCU\software\mc
RegDeleteKey HKUS\software\egdhtml
RegDeleteKey HKLM\SOFTWARE\InternetGameBox
RegDeleteKey HKLM\SOFTWARE\GoRecord
RegDeleteKey HKLM\SOFTWARE\GoAstro
RegDeleteKey HKLM\SOFTWARE\SudoPlanet
RegDeleteKey HKLM\SOFTWARE\WebMediaPlayer
RegDeleteKey HKLM\SOFTWARE\MessengerSkinner

RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{01BE5BD7-B2DD-48B3-A759-59265A91E787}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{04CCFF26-7D52-4E42-BF6A-F8ECE0896EB7}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{04F414E9-E352-4BC3-963D-7BFE5A5F31A9}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{0594AF7E-573B-40DF-8165-E47AB2EAEFE8}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{07C9CFC7-DE33-4A0C-9FFB-CDFBA843B157}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{0878F049-D33E-45E0-A157-C36A6683CF25}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{093F9CF8-0DE1-491C-95D5-5EC257BD4CA3}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{0D1011B3-89C8-4F8E-8693-BB970E2E81E0}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{0DA910BC-6919-489E-B584-D9A4AAC7B8DE}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{0E79192A-C52C-4260-920F-639AC2296203}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{11F1D260-129E-4EB7-B37E-57E3D97A3DF1}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{14325268-79E0-4D2A-89A4-FFFC6E22741E}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{1604DF98-D1A5-44FE-844A-98D6FD0518D0}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{17BFC8DA-B4D6-4DB9-AA40-1CD32EDA9845}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{1CD49DC9-FD88-41FA-B892-47E037267D45}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{1CD4E2DC-2DA0-4154-8723-38CB04FB6A58}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{1EB17D1C-141D-4D9D-91CB-24D99215851D}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{201D3DA8-B495-4A3B-BEE8-6D8DDCCC5762}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{26D73573-F1B3-48C9-A989-E6CE071957A1}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{2A3DFC59-8A87-49A1-85D1-42903410911F}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{2ABE804B-4D3A-41BF-A172-304627874B45}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{2AEEAC34-FD74-4142-B891-4B05C0C03C87}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{2F668A6D-2EC7-4E3A-A485-819E210738D6}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{31DDC1FD-CEA3-4837-A6DC-87E67015ADC9}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{321F38B6-7E5F-470E-B58C-927523B7AF92}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{3446598E-00E4-4B5E-99A6-87ECCA8324A2}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{3616F4B5-F6AD-4E67-966A-C218673648A0}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{39EA2F6F-3F50-4F58-9C63-4B3D53B0926E}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{3DAD912E-D2B9-4323-B7C9-7F2C5CC0C57B}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{469C7080-8EC8-43A6-AD97-45848113743C}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{486E48B5-ABF2-42BB-A327-2679DF3FB822}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{505098FD-5D61-4BC2-9B82-F969D0E932A2}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{50AD557E-3426-41FD-AFDD-2AF39BB1C387}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{54579C3D-A58D-4623-B5B5-465552BDA45B}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{54C75FB0-6B8B-4278-BF7B-77036F15A69E}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{5F4D3335-3194-4167-85AE-E7325F2695EF}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{5FD9726A-4977-449D-8352-25FDD8A510B5}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{602890BA-07A1-4A93-A89F-6BDDD8BB9BA5}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{624321F1-0581-49D8-99BD-2E952C2DF31B}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{6AA85413-165C-4200-8154-71166077B22E}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{6AA93DF6-6757-4338-9087-F7601DE18402}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{71CBDCD9-0830-4470-A890-35D364DA352C}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{71DA2A4E-ACB3-4065-9E41-8BC42EABE427}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{7504F0D5-644A-4103-9D02-95488B6CB9A1}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{77EF6DBF-3929-4081-AF2E-178D387E211C}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{78F584DF-BBF5-4296-839C-31DE60914DBC}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{82FC4503-8459-4239-9B85-0617BEAA950A}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{83F0D6AA-CD15-46B5-AA4E-BDB506B4AE53}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{87C1805D-C5AE-4455-AB39-E245BB516136}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8B3B8135-9DAA-40E7-8941-962795F9C1CB}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8D8BAF56-B581-4B90-A549-C4AC6B03F1BB}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{94742E3F-D9A1-4780-9A87-2FFA43655DA2}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{95460ABD-946A-46FF-9F56-268718323EEE}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{9EB4F647-FE4A-42F9-9F5C-B8FB28DD02F9}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{A02780C3-7F77-4E28-855B-28890F3CF37A}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{A1C392A2-B274-46DB-89BE-1FBD476B9C93}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{AA59202C-5E41-48FC-AF7D-324F5FD6A9F1}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{AF7410C1-FBA3-415E-800A-4110CED40536}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{AFCF364F-F730-4B1E-B2D5-80F9172FBC44}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{B2B0AEDF-7CDF-4792-BB67-7654AD1E1B13}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{B3A5878E-5B4C-4D12-9156-4D7FD8D0AF6C}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{BA14D944-0D8C-4F16-A950-6E53EEBB558F}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{BA749BC1-143E-430D-B1DA-1D2AF67A3658}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{BD3653E4-884B-43C4-970B-670802501B7F}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{BE5A7132-329F-4319-B781-2A83BFE51534}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{BFC9677B-8006-4336-9D49-2C797AEFCB9E}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{C2481ED1-9896-4D49-AE90-69858DFDE446}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{C660C559-903D-41A5-991B-ED7959096C35}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{C6760A07-A574-4705-B113-7856315922C3}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{C80B7FF6-CE60-4079-935E-520C045C30A6}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{C9269872-E3D6-4811-8E5E-835CA8CBD0B3}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CB5D474E-A510-40A4-B5A4-838933BCBA64}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CDD8BADE-B4C8-4E97-84B4-1DC9ABAD3EF3}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CEFB7B49-9652-464F-8AFD-A577C0500F39}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CF5F84EB-D3FC-4F98-BE3B-F5B56B962CED}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{D7B59209-0ED9-4986-BD4A-527BE836C6B2}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{D8B94E9A-A34B-4253-BF48-C7CB7F2CFDB0}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E19AB99F-AEC4-4B40-A5CA-F69D22522D77}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E114CD5B-17CE-4807-890E-7B1EDF9F2E5E}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E1D20694-74D9-472D-AF03-08C26173A67F}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E24E8472-89B7-479F-8AD8-BBD7206A6A02}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E3943A24-2F83-4505-9AE5-F705E81B50CB}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E3943A24-2F83-4505-9AE5-F705E81B50CB}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E49A9FCB-FAA9-4C1F-A1C1-54920DA2CCA4}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E7AE1661-EBEB-492B-AE0D-860DF24174C6}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{EC4AFBF3-4540-4306-AF10-4CAC509EA16B}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{EEECA057-AD0F-44A7-8BE5-8634CEDBDBD1}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{EF4DCD99-D26B-44A4-BA77-CFDCC97E7291}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{EFB23983-5803-4914-ADA3-C0EA2CFBDC37}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{F4653484-F38C-455F-BB15-1175E527754E}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{F72BC3F0-6C20-4793-9DDA-258589D8A907}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{F99973C8-43E7-48C4-9EF3-131B67301321}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{FA1D6D8F-C6ED-4752-8512-A33283240130}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{FA605711-8E72-46B2-AE49-BED11B2E729D}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{FA83E942-B796-46DE-9155-1632ECC5473B}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{FBF65A16-C9AB-465E-AECE-D2D9D5AB5E60}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{FDA26383-C0CF-4D32-AC37-769D7E14581F}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{FF521631-31DA-48AC-B4E9-390A7694C906}

RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{01BE5BD7-B2DD-48B3-A759-59265A91E787}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{04CCFF26-7D52-4E42-BF6A-F8ECE0896EB7}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{04F414E9-E352-4BC3-963D-7BFE5A5F31A9}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{0594AF7E-573B-40DF-8165-E47AB2EAEFE8}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{07C9CFC7-DE33-4A0C-9FFB-CDFBA843B157}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{0878F049-D33E-45E0-A157-C36A6683CF25}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{093F9CF8-0DE1-491C-95D5-5EC257BD4CA3}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{0D1011B3-89C8-4F8E-8693-BB970E2E81E0}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{0DA910BC-6919-489E-B584-D9A4AAC7B8DE}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{0E79192A-C52C-4260-920F-639AC2296203}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{11F1D260-129E-4EB7-B37E-57E3D97A3DF1}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{14325268-79E0-4D2A-89A4-FFFC6E22741E}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{1604DF98-D1A5-44FE-844A-98D6FD0518D0}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{17BFC8DA-B4D6-4DB9-AA40-1CD32EDA9845}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{1CD49DC9-FD88-41FA-B892-47E037267D45}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{1CD4E2DC-2DA0-4154-8723-38CB04FB6A58}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{1EB17D1C-141D-4D9D-91CB-24D99215851D}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{201D3DA8-B495-4A3B-BEE8-6D8DDCCC5762}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{26D73573-F1B3-48C9-A989-E6CE071957A1}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{2A3DFC59-8A87-49A1-85D1-42903410911F}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{2ABE804B-4D3A-41BF-A172-304627874B45}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{2AEEAC34-FD74-4142-B891-4B05C0C03C87}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{2F668A6D-2EC7-4E3A-A485-819E210738D6}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{31DDC1FD-CEA3-4837-A6DC-87E67015ADC9}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{321F38B6-7E5F-470E-B58C-927523B7AF92}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{3446598E-00E4-4B5E-99A6-87ECCA8324A2}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{3616F4B5-F6AD-4E67-966A-C218673648A0}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{39EA2F6F-3F50-4F58-9C63-4B3D53B0926E}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{3ABC79F3-E345-43B9-A79F-5D5C7A8EC4DC}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{3DAD912E-D2B9-4323-B7C9-7F2C5CC0C57B}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{469C7080-8EC8-43A6-AD97-45848113743C}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{486E48B5-ABF2-42BB-A327-2679DF3FB822}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{505098FD-5D61-4BC2-9B82-F969D0E932A2}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{50AD557E-3426-41FD-AFDD-2AF39BB1C387}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{54579C3D-A58D-4623-B5B5-465552BDA45B}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{54C75FB0-6B8B-4278-BF7B-77036F15A69E}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{5F4D3335-3194-4167-85AE-E7325F2695EF}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{5FD9726A-4977-449D-8352-25FDD8A510B5}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{602890BA-07A1-4A93-A89F-6BDDD8BB9BA5}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{624321F1-0581-49D8-99BD-2E952C2DF31B}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{6AA85413-165C-4200-8154-71166077B22E}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{6AA93DF6-6757-4338-9087-F7601DE18402}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{71CBDCD9-0830-4470-A890-35D364DA352C}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{71DA2A4E-ACB3-4065-9E41-8BC42EABE427}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{7504F0D5-644A-4103-9D02-95488B6CB9A1}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{77EF6DBF-3929-4081-AF2E-178D387E211C}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{78F584DF-BBF5-4296-839C-31DE60914DBC}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{82FC4503-8459-4239-9B85-0617BEAA950A}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{83F0D6AA-CD15-46B5-AA4E-BDB506B4AE53}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{87C1805D-C5AE-4455-AB39-E245BB516136}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{8B3B8135-9DAA-40E7-8941-962795F9C1CB}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{8D8BAF56-B581-4B90-A549-C4AC6B03F1BB}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{94742E3F-D9A1-4780-9A87-2FFA43655DA2}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{95460ABD-946A-46FF-9F56-268718323EEE}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{9EB4F647-FE4A-42F9-9F5C-B8FB28DD02F9}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{A02780C3-7F77-4E28-855B-28890F3CF37A}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{A1C392A2-B274-46DB-89BE-1FBD476B9C93}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{AA59202C-5E41-48FC-AF7D-324F5FD6A9F1}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{AF7410C1-FBA3-415E-800A-4110CED40536}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{AFCF364F-F730-4B1E-B2D5-80F9172FBC44}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{B2B0AEDF-7CDF-4792-BB67-7654AD1E1B13}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{B3A5878E-5B4C-4D12-9156-4D7FD8D0AF6C}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{BA14D944-0D8C-4F16-A950-6E53EEBB558F}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{BA749BC1-143E-430D-B1DA-1D2AF67A3658}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{BD3653E4-884B-43C4-970B-670802501B7F}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{BE5A7132-329F-4319-B781-2A83BFE51534}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{BFC9677B-8006-4336-9D49-2C797AEFCB9E}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{C2481ED1-9896-4D49-AE90-69858DFDE446}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{C660C559-903D-41A5-991B-ED7959096C35}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{C6760A07-A574-4705-B113-7856315922C3}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{C80B7FF6-CE60-4079-935E-520C045C30A6}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{C9269872-E3D6-4811-8E5E-835CA8CBD0B3}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{CB5D474E-A510-40A4-B5A4-838933BCBA64}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{CDD8BADE-B4C8-4E97-84B4-1DC9ABAD3EF3}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{CEFB7B49-9652-464F-8AFD-A577C0500F39}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{CF5F84EB-D3FC-4F98-BE3B-F5B56B962CED}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{D7B59209-0ED9-4986-BD4A-527BE836C6B2}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{D8B94E9A-A34B-4253-BF48-C7CB7F2CFDB0}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{E114CD5B-17CE-4807-890E-7B1EDF9F2E5E}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{E19AB99F-AEC4-4B40-A5CA-F69D22522D77}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{E1D20694-74D9-472D-AF03-08C26173A67F}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{E24E8472-89B7-479F-8AD8-BBD7206A6A02}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{E3943A24-2F83-4505-9AE5-F705E81B50CB}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{E7AE1661-EBEB-492B-AE0D-860DF24174C6}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{E49A9FCB-FAA9-4C1F-A1C1-54920DA2CCA4}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{EC4AFBF3-4540-4306-AF10-4CAC509EA16B}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{EEECA057-AD0F-44A7-8BE5-8634CEDBDBD1}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{EF4DCD99-D26B-44A4-BA77-CFDCC97E7291}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{EFB23983-5803-4914-ADA3-C0EA2CFBDC37}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{F4653484-F38C-455F-BB15-1175E527754E}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{F72BC3F0-6C20-4793-9DDA-258589D8A907}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{F99973C8-43E7-48C4-9EF3-131B67301321}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{FA1D6D8F-C6ED-4752-8512-A33283240130}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{FA605711-8E72-46B2-AE49-BED11B2E729D}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{FA83E942-B796-46DE-9155-1632ECC5473B}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{FBF65A16-C9AB-465E-AECE-D2D9D5AB5E60}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{FDA26383-C0CF-4D32-AC37-769D7E14581F}|Compatibility Flags|1024
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{FF521631-31DA-48AC-B4E9-390A7694C906}|Compatibility Flags|1024

RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Instant Access
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|cpntmgc
RegDelValue HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Instant Access
RegDelValue HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|MailSkinner
RegDelValue HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|MC
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|go-astro
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|messengerskinner
RegDelValue HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|messengerskinner
RegDelValue HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices|MC
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce|msupd
RegSetStringValue HKLM\SYSTEM\CurrentControlSet\Services\Winsock\Autodial|AutodialDllName32|wininet.dll
RegSetStringValue HKLM\SYSTEM\CurrentControlSet\Services\Winsock\Autodial|AutodialFcnName32|InternetAutodialCallback
RegDeleteKey HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Instant Access
RegDeleteKey HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MailSkinner
RegDeleteKey HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\InternetGameBox
RegDeleteKey HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GoRecord
RegDeleteKey HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GoAstro
RegDeleteKey HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SudoPlanet
RegDeleteKey HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WebMediaPlayer
RegDeleteKey HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MessengerSkinner

RegDeleteKey HKCR\AxInst.IgbInstall
RegDeleteKey HKCR\AxInst.IgbInstall.1
RegDeleteKey HKCR\CLSID\{E68718BB-5451-4F6F-B8B8-41B4AB672747}
RegDeleteKey HKCR\AppID\AppID\AxInst.EXE
RegDeleteKey HKCR\AppID\{7AA54C6E-DBF0-4A63-AFE0-6582094C46DE}
RegDeleteKey HKCR\Interface\{66C13795-9AA0-4244-B1A8-37F9E99FB079}
RegDeleteKey HKCR\Interface\{9E03C295-4FDF-4828-A99C-85EB0D848DC0}
RegDeleteKey HKCR\TypeLib\{C9F88FA1-51F1-43C8-A0FC-EAC4537D8392}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E68718BB-5451-4F6F-B8B8-41B4AB672747}
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{E68718BB-5451-4F6F-B8B8-41B4AB672747}|Compatibility Flags|1024
RegDelValue HKCU\software\microsoft\windows\currentversion\wintrust\trust providers\software publishing\trust database\0|ELECTRONIC GROUP
RegDeleteKey HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\GoAstro.exe
RegDeleteKey HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SudoPlanet.exe
RegDeleteKey HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\GoRecord.exe
RegDeleteKey HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\InternetGameBox.exe
RegDeleteKey HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\WebMediaPlayer.exe
RegDeleteKey HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MessengerSkinner.exe

DllUnregister %SYSDIR%\MSWBM32.DLL|1
DllUnregister %PROGRAMFILES%\MailSkinner\OESkinner.dll|1

ProcessKillIfContainsText %SYSDIR%\*.exe|qeu_ueAyqes_uew_te|0
ProcessKillIfContainsText %SYSDIR%\*.exe|WaXL5_jp0Ml

FileDelete %SYSTEMDRIVE%\dfuck.ico
FileDelete %SYSTEMDRIVE%\Video Party.ico

FileDelete %ALLUSERSDESKTOP%\Instant Access.lnk
FileDelete %ALLUSERSDESKTOP%\NoCreditCard.lnk
FileDelete %ALLUSERSDESKTOP%\Join The Orgy.lnk
FileDelete %ALLUSERSDESKTOP%\GoRecord.lnk
FileDelete %ALLUSERSDESKTOP%\GoAstro.lnk
FileDelete %ALLUSERSDESKTOP%\InternetGameBox.lnk
FileDelete %ALLUSERSDESKTOP%\SudoPlanet.lnk
FileDelete %ALLUSERSDESKTOP%\WebMediaPlayer.lnk

FileDelete %DESKTOP%\Instant Access.lnk
FileDelete %DESKTOP%\NoCreditCard.lnk
FileDelete %DESKTOP%\Join The Orgy.lnk
FileDelete %DESKTOP%\GoRecord.lnk
FileDelete %DESKTOP%\GoAstro.lnk
FileDelete %DESKTOP%\InternetGameBox.lnk
FileDelete %DESKTOP%\SudoPlanet.lnk
FileDelete %DESKTOP%\WebMediaPlayer.lnk

FileDelete %PROGRAMS%\GoRecord 2
FileDelete %PROGRAMS%\GoAstro
FileDelete %PROGRAMS%\InternetGameBox
FileDelete %PROGRAMS%\SudoPlanet
FileDelete %PROGRAMS%\WebMediaPlayer
FileDelete %PROGRAMS%\MessengerSkinner

FileDelete %ALLUSERSSTARTMENU%\Instant access
FileDelete %ALLUSERSSTARTMENU%\NoCreditCard
FileDelete %ALLUSERSSTARTMENU%\Join The Orgy
FileDelete %ALLUSERSSTARTMENU%\GoRecord 2
FileDelete %ALLUSERSSTARTMENU%\GoAstro
FileDelete %ALLUSERSSTARTMENU%\InternetGameBox
FileDelete %ALLUSERSSTARTMENU%\SudoPlanet
FileDelete %ALLUSERSSTARTMENU%\WebMediaPlayer

FileDelete %WINDIR%\Downloaded Program Files\dhtmlaccess.inf
FileDelete %WINDIR%\Downloaded Program Files\dtc32.inf
FileDelete %WINDIR%\Downloaded Program Files\EGAUTH.inf
FileDelete %WINDIR%\Downloaded Program Files\EGDACCESS.inf
FileDelete %WINDIR%\Downloaded Program Files\EGDACCESS_ASPIV4.inf
FileDelete %WINDIR%\Downloaded Program Files\EGCOMSERVICE_pack.inf
FileDelete %WINDIR%\Downloaded Program Files\egdhtml.inf
FileDelete %WINDIR%\Downloaded Program Files\egdial.dll
FileDelete %WINDIR%\Downloaded Program Files\egdhtml_****.dll
FileDelete %WINDIR%\Downloaded Program Files\egdhtml_pack.inf
FileDelete %WINDIR%\Downloaded Program Files\eghtmldialer.inf
FileDelete %WINDIR%\Downloaded Program Files\eghtmldialer.dll
FileDelete %WINDIR%\Downloaded Program Files\eglivecam_****.dll
FileDelete %WINDIR%\Downloaded Program Files\eglivecam.dll
FileDelete %WINDIR%\Downloaded Program Files\ia.inf
FileDelete %WINDIR%\Downloaded Program Files\ieaccess2.inf
FileDelete %WINDIR%\Downloaded Program Files\ieaccess2.dll
FileDelete %WINDIR%\Downloaded Program Files\netcmp32.inf
FileDelete %WINDIR%\Downloaded Program Files\netia32.inf
FileDelete %WINDIR%\Downloaded Program Files\Netslv32.inf
FileDelete %WINDIR%\Downloaded Program Files\Netslv32.dll
FileDelete %WINDIR%\Downloaded Program Files\netpe32.inf
FileDelete %WINDIR%\Downloaded Program Files\nethv32.inf
FileDelete %WINDIR%\Downloaded Program Files\LiveService.inf
FileDelete %WINDIR%\Downloaded Program Files\one2oneSvc.inf
FileDelete %WINDIR%\Downloaded Program Files\sysnetsvc32.inf
FileDelete %WINDIR%\Downloaded Program Files\syswbsvc32.inf
FileDelete %WINDIR%\Downloaded Program Files\sysinetsvc32.inf
FileDelete %WINDIR%\Downloaded Program Files\sysiasvc32.inf

FileDelete %WINDIR%\access.exe
FileDelete %WINDIR%\dialx.exe
FileDelete %WINDIR%\ExeDialer.exe
FileDelete %WINDIR%\msupd.exe
FileDelete %WINDIR%\system32mwsrvacc.exe

FileDelete %WINDIR%\tmlpcert2005
FileDelete %WINDIR%\tmlpcert2007

FileDelete %WINDIR%\eg_auth_*.dll
FileDelete %WINDIR%\eg_auth_srv_10*.dll
FileDelete %WINDIR%\eg_auth_srv_mut0*.dll
FileDelete %WINDIR%\ieaccess2.dll
FileDelete %WINDIR%\system\eghtmldialer.dll
FileDelete %WINDIR%\System\ieaccess2.dll
FileDelete %WINDIR%\System\egdial.dll
FileDelete %WINDIR%\p2esocks_10*.dll

FileDelete %SYSDIR%\authclient.exe
FileDelete %SYSDIR%\dhtmlexe.exe
FileDelete %SYSDIR%\eglivecam.exe
FileDelete %SYSDIR%\P2EClient.exe
FileDelete %SYSDIR%\AxInst.exe
FileDelete %SYSDIR%\axsetup.dll
FileDelete %SYSDIR%\EGACCESS.dll
FileDelete %SYSDIR%\EGACCESS*.dll
FileDelete %SYSDIR%\egaccess4.DLL
FileDelete %SYSDIR%\egaccess4_10*.dll
FileDelete %SYSDIR%\EGDACCESS_*10*.dll
FileDelete %SYSDIR%\EGDACCESS.dll
FileDelete %SYSDIR%\egaccess*.inf
FileDelete %SYSDIR%\EGDACCESS*.inf
FileDelete %SYSDIR%\EGDHTML2.DLL
FileDelete %SYSDIR%\EGDHTML_*.dll
FileDelete %SYSDIR%\EGAUTH.dll
FileDelete %SYSDIR%\eg_auth_srv_10*.dll
FileDelete %SYSDIR%\EGCOMLIB*.dll
FileDelete %SYSDIR%\EGCOMSERVICE2.dll
FileDelete %SYSDIR%\EGCOMSERVICE_*.dll
FileDelete %SYSDIR%\EGDownloader.dll
FileDelete %SYSDIR%\EGLIVECAM_10*.DLL
FileDelete %SYSDIR%\egdial.dll
FileDelete %SYSDIR%\eglivecam.dll
FileDelete %SYSDIR%\ia.dll
FileDelete %SYSDIR%\ieaccess2.dll
FileDelete %SYSDIR%\IaLdr32.exe
FileDelete %SYSDIR%\IaLdr32.inf
FileDelete %SYSDIR%\LiveService_*.dll
FileDelete %SYSDIR%\msegcompid.dll
FileDelete %SYSDIR%\msclock32.dll
FileDelete %SYSDIR%\msclock32*.dll
FileDelete %SYSDIR%\mservice.dll
FileDelete %SYSDIR%\msplock32.dll
FileDelete %SYSDIR%\msplock32*.dll
FileDelete %SYSDIR%\mswbm32.dll
FileDelete %SYSDIR%\mseggrpid.dll
FileDelete %SYSDIR%\netia32.dll
FileDelete %SYSDIR%\nethv32.dll
FileDelete %SYSDIR%\Netslv32.dll
FileDelete %SYSDIR%\One2OneService.dll
FileDelete %SYSDIR%\one2oneSvc.dll
FileDelete %SYSDIR%\p2esocks_*.dll
FileDelete %SYSDIR%\P2ECOM.dll
FileDelete %SYSDIR%\svcia32.dll
FileDelete %SYSDIR%\syswbsvc32.dll
FileDelete %SYSDIR%\sysiasvc32.dll
FileDelete %SYSDIR%\sysia32svc.dll
FileDelete %SYSDIR%\sysinetsvc32.dll
FileDelete %SYSDIR%\svcsysnet32.dll
FileDelete %SYSDIR%\sysnetsvc32.dll
FileDelete %SYSDIR%\*_navps.dat
FileDelete %SYSDIR%\*_nav.dat
FileDelete %SYSDIR%\nvs2.inf
FileDelete %SYSDIR%\linewsrv.exe
FileDelete %SYSDIR%\mwsrvacc.exe
FileDelete %SYSDIR%\accinet.exe

FileDelete %SYSDIR%\backgrd.jpg
FileDelete %SYSDIR%\baground.jpg

FolderDelete %PROGRAMFILES%\dialpass
FolderDelete %PROGRAMFILES%\eghtmldialer
FolderDelete %PROGRAMFILES%\egroup
FolderDelete %PROGRAMFILES%\Instant Access
FolderDelete %PROGRAMFILES%\MailSkinner
FolderDelete %PROGRAMFILES%\InternetGameBox
FolderDelete %PROGRAMFILES%\GoRecord2
FolderDelete %PROGRAMFILES%\GoAstro
FolderDelete %PROGRAMFILES%\SudoPlanet
FolderDelete %PROGRAMFILES%\WebMediaPlayer
FolderDelete %PROGRAMFILES%\MessengerSkinner

# mslagent block

DllUnregister %WINDIR%\mslagent\2_mslagent.dll|1
DllUnregister %WINDIR%\navmpc\2_navmpc.dll|1

RegDelValue HKLM\Software\Microsoft\Windows\CurrentVersion\Run|mslagent
RegDelValue HKCU\Software\Microsoft\Windows\CurrentVersion\Run|mslagent
RegDeleteKey HKCR\CLSID\{4A6FA2EB-F381-4503-87D0-BE4CC57DEB8E}
RegDeleteKey HKCR\CLSID\{75A603E7-8BB7-4272-ABBE-9846FF1241C1}
RegDeleteKey HKCR\CLSID\{DE614603-6320-4046-A7A7-6A69CEC26F14}
RegDeleteKey HKCR\CLSID\{D7A82A12-05F5-42D8-B30D-6EF995075D2D}
RegDeleteKey HKCR\Interface\{1EF28CC5-8D97-4310-B71B-CA34EE15B897}
RegDeleteKey HKCR\Interface\{43CDAD65-AA0D-4701-8108-117F86613B69}
RegDeleteKey HKCR\Interface\{510C3373-4842-4944-8729-0AFF6725A132}
RegDeleteKey HKCR\Interface\{6D3F48F4-B40A-4C3F-A95C-85E23C3A8A91}
RegDeleteKey HKCR\TypeLib\{5630B768-1C09-4105-9E03-E35985E36B0B}
RegDeleteKey HKCR\TypeLib\{82C0673C-F1D1-47BA-B904-AB0DE82300BC}
RegDeleteKey HKCR\TypeLib\{BA49BD6A-039C-428E-AF33-8C1288D75A7B}
RegDeleteKey HKCR\TypeLib\{CA72BD3D-6044-4429-8C9A-76D90F4B29A8}
RegDeleteKey HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{021BB032-80A8-4FB6-B3D5-CF27B1553B95}
RegDeleteKey HKCR\MagicControl.MagicComponent
RegDeleteKey HKCR\MagicControl.MagicComponent.1
RegDeleteKey HKCR\mslagent.3
RegDeleteKey HKCR\mslagent.3.1
RegDeleteKey HKCR\NaviHelper.NaviHelperObject
RegDeleteKey HKCR\NaviHelper.NaviHelperObject.1
RegDeleteKey HKCR\NaviPromo.EGNaviScoring
RegDeleteKey HKCR\NaviPromo.EGNaviScoring.1
RegDeleteKey HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\mslagent
RegDeleteKey HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\navmpc
FolderDelete %WINDIR%\mslagent
FolderDelete %WINDIR%\navmpc
FolderDelete %WINDIR%\msskinner
FolderDelete %WINDIR%\wintrim
FolderDelete %WINDIR%\wincomp
FolderDelete %WINDIR%\winmgts
FolderDelete %WINDIR%\simcss
FolderDelete %WINDIR%\mc
FileDelete %SYSDIR%\msklive.dll

SystemEmptyTempFolder

OptionUseRecycleBin
FileDeleteIfContainsText %SYSDIR%\*.exe|qeu_ueAyqes_uew_te
FileDeleteIfContainsText %SYSDIR%\*.exe|WaXL5_jp0Ml
FileDeleteIfContainsText %SYSDIR%\*.exe|iedisco

FileDeleteIfMD5Match %SYSDIR%\*.exe|60000E6EBEFF360898E43A6E2685E1B0
FileDeleteIfContainsText %SYSDIR%\*.dat|42.sa
FileDeleteIfContainsText %SYSDIR%\*.dat|PNDOCDT@
FileDeleteIfMD5Match %SYSDIR%\*.dat|C87EE35149404EA3C7AC361130E121FA

FolderCreate %SYSDIR%\bfubackups
FileMoveIfContainsHex %SYSDIR%\*.exe|%SYSDIR%\bfubackups|50,45,00,00,4C,01,04,00,8A,04,3D,44

FileDelete %SYSDIR%\*_navps.dat
FileDelete %SYSDIR%\*_nav.dat

FileDelete C:\egd.txt
SystemRun regedit|/e C:\egd.txt "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"|0

| Alerter

Répondre à moi86

Angeldark

20 Janvier 2007 19:58:34

Installe d'urgence un antivirus comme Antivir :
http://www.malekal.com/tutorial_antivir.php
Fais un scan complet puis poste le rapport.

| Alerter

Répondre à Angeldark

moi86

20 Janvier 2007 20:09:53

le rapport il s'affiche quand

| Alerter

Répondre à moi86

Angeldark

20 Janvier 2007 20:11:24

Tout est indiqué dans mon lien.

| Alerter

Répondre à Angeldark

moi86

20 Janvier 2007 21:49:08

ca y est voici le rapport

AntiVir PersonalEdition Classic
Report file date: samedi 20 janvier 2007 21:27

Scanning for 569934 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Username: Romain
Computer name: POITIERS-79A189

Version information:
BUILD.DAT : 217 12749 Bytes 05/12/2006 17:00:00
AVSCAN.EXE : 7.0.3.2 208936 Bytes 05/12/2006 15:30:07
AVSCAN.DLL : 7.0.3.1 35880 Bytes 05/12/2006 16:00:22
LUKE.DLL : 7.0.3.2 143400 Bytes 31/10/2006 16:07:46
LUKERES.DLL : 7.0.2.0 9256 Bytes 05/12/2006 16:00:22
ANTIVIR0.VDF : 6.35.0.1 7371264 Bytes 31/05/2006 15:30:06
ANTIVIR1.VDF : 6.36.1.24 2212864 Bytes 14/11/2006 09:12:08
ANTIVIR2.VDF : 6.36.1.113 221696 Bytes 01/12/2006 09:12:12
ANTIVIR3.VDF : 6.37.0.3 6144 Bytes 01/12/2006 09:12:14
AVEWIN32.DLL : 7.3.0.15 1982976 Bytes 04/12/2006 17:18:38
AVPREF.DLL : 7.0.2.0 23592 Bytes 03/11/2006 10:53:44
AVREP.DLL : 6.37.0.3 983080 Bytes 01/12/2006 09:05:52
AVRPBASE.DLL : 7.0.0.0 2162728 Bytes 30/03/2006 08:43:31
AVPACK32.DLL : 7.2.0.5 368680 Bytes 23/10/2006 15:21:31
AVREG.DLL : 7.0.1.1 30760 Bytes 23/10/2006 10:52:27
NETNT.DLL : No Information!
RCIMAGE.DLL : 7.0.1.3 2097192 Bytes 08/11/2006 12:26:26
RCTEXT.DLL : 7.0.12.1 77864 Bytes 05/12/2006 16:00:21

Configuration settings for the scan:
Jobname..........................: Local Hard Disks
Configuration file...............: C:\Program Files\AntiVir PersonalEdition Classic\alldiscs.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: D:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium
Expanded search settings.........: 0x00001000

Start of the scan: samedi 20 janvier 2007 21:27

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Modules have been scanned
Scan process 'avcenter.exe' - '1' Modules have been scanned
Scan process 'avgnt.exe' - '1' Modules have been scanned
Scan process 'avguard.exe' - '1' Modules have been scanned
Scan process 'sched.exe' - '1' Modules have been scanned
Scan process 'IEXPLORE.EXE' - '1' Modules have been scanned
Scan process 'wuauclt.exe' - '1' Modules have been scanned
Scan process 'hpzeng09.exe' - '1' Modules have been scanned
Scan process 'alg.exe' - '1' Modules have been scanned
Scan process 'devldr32.exe' - '1' Modules have been scanned
Scan process 'lanceur.exe' - '1' Modules have been scanned
Scan process 'msmsgs.exe' - '1' Modules have been scanned
Scan process 'explorer.exe' - '1' Modules have been scanned
Scan process 'vsmon.exe' - '0' Modules have been scanned
Scan process 'wdfmgr.exe' - '1' Modules have been scanned
Scan process 'svchost.exe' - '1' Modules have been scanned
Scan process 'aswUpdSv.exe' - '1' Modules have been scanned
Scan process 'spoolsv.exe' - '1' Modules have been scanned
Scan process 'svchost.exe' - '1' Modules have been scanned
Scan process 'svchost.exe' - '1' Modules have been scanned
Scan process 'svchost.exe' - '1' Modules have been scanned
Scan process 'svchost.exe' - '1' Modules have been scanned
Scan process 'svchost.exe' - '1' Modules have been scanned
Scan process 'lsass.exe' - '1' Modules have been scanned
Scan process 'services.exe' - '1' Modules have been scanned
Scan process 'winlogon.exe' - '1' Modules have been scanned
Scan process 'csrss.exe' - '1' Modules have been scanned
Scan process 'smss.exe' - '1' Modules have been scanned
27 processes with 27 modules were scanned

Start scanning boot sectors:
Boot sector 'C:\'
[NOTE] No virus was found!
Boot sector 'D:\'
[NOTE] No virus was found!

Starting to scan the registry.
The registry was scanned ( 7 files ).

Starting the file scan:

Begin scan in 'C:\'
C:\hiberfil.sys
[WARNING] The file could not be opened!
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\WINDOWS\system32\instreg_tmp.exe
[DETECTION] Is the Trojan horse TR/Agent.BHO.A
[INFO] The file was moved to '46258888.qua'!
Begin scan in 'D:\'

End of the scan: samedi 20 janvier 2007 22:35
Used time: 1:08:33 min

The scan has been done completely.

2848 Scanning directories
152148 Files were scanned
1 viruses and/or unwanted programs were found
0 files were deleted
0 files were repaired
1 files were moved to quarantine
0 files were renamed
2 Files cannot be scanned
152147 Files not concerned
997 Archives were scanned
2 Warnings
4 Notes

| Alerter

Répondre à moi86

Angeldark

20 Janvier 2007 21:50:28

Reeposte un rapport Hijackthis stp.

| Alerter

Répondre à Angeldark

moi86

20 Janvier 2007 21:51:23

Logfile of HijackThis v1.99.1
Scan saved at 12:23:42, on 20/01/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Club-Internet\Lanceur\lanceur.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Shareaza\Shareaza.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Romain\Bureau\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Club Internet.lnk = C:\Program Files\Club-Internet\Lanceur\lanceur.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{52E5D461-E1B5-4A36-AF3A-C518BA29A186}: NameServer = 194.117.200.10 194.117.200.15
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

| Alerter

Répondre à moi86

Angeldark

20 Janvier 2007 21:57:10

Un nouveau rapport

| Alerter

Répondre à Angeldark

moi86

20 Janvier 2007 21:58:46

fo ke je fasse un nouveau rapport

| Alerter

Répondre à moi86

moi86

20 Janvier 2007 21:59:19

Logfile of HijackThis v1.99.1
Scan saved at 22:59:14, on 20/01/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Club-Internet\Lanceur\lanceur.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\AntiVir PersonalEdition Classic\avcenter.exe
C:\Documents and Settings\Romain\Bureau\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O4 - HKLM\..\Run: [opxiyajrlt] c:\windows\system32\opxiyajrlt.exe opxiyajrlt
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Club Internet.lnk = C:\Program Files\Club-Internet\Lanceur\lanceur.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{52E5D461-E1B5-4A36-AF3A-C518BA29A186}: NameServer = 194.117.200.10 194.117.200.15
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

| Alerter

Répondre à moi86

moi86

20 Janvier 2007 22:20:32

alors ca donne koi?

| Alerter

Répondre à moi86

Angeldark

21 Janvier 2007 12:11:04

Re,

Des restes d'Egdaccess.

Avant de commencer, lis la licence de Blacklight (F-Secure)
En lisant ce document, tu as pris connaissance et accepté les conditions d'utilisation de ce programme inclus dans Navilog1.zip.

Télécharge maintenant Navilog1.zip (Il Mafioso)
Enregistre-le sur ton Bureau.
Dézippe le contenu de l'archive en faisant un Clique droit sur Navilog1.zip puis en choisissant Tout Extraire.

Double clique sur Navilog1.bat.
Laisse-toi guider par l'utilitaire. Choisis l'option 1 puis valide.
! N'utilise pas l'option 2, 3 et 4 sans notre accord !
Patiente jusqu'à l'apparition de ce message :
"*** Analyse Termine le ..... ***"
Appuie sur une touche comme demandé. Le Bloc-notes va s'ouvrir. Poste-nous son contenu de cette manière :

-> Edition / Sélectionner tout
-> Edition / Copier
-> Clique-Droit / Coller dans ta réponse

NOTE : Le rapport se trouve également ici : C:\fixnavi.txt

| Alerter

Répondre à Angeldark

moi86

21 Janvier 2007 13:22:21

en gros la licence elle dis koi je comprend pas

| Alerter

Répondre à moi86

moi86

21 Janvier 2007 13:26:49

y a des trucs a payer pour utiliser ce logiciel

| Alerter

Répondre à moi86

Angeldark

21 Janvier 2007 13:27:56

C'est un licence typique : pas le droit de modifier le logiciel, de le diffuser sur un lien différent que celui de F-Secure sans son accord...

| Alerter

Répondre à Angeldark

moi86

21 Janvier 2007 13:42:49

voila le rapport

Search Navipromo version 1.0.2 commencé le 21/01/2007 à 14:35:20,61

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Poster ce rapport sur le forum pour le faire analyser !!!
!!! Ne pas lancer la partie désinfection sans l'avis d'un spécialiste !!!

Fix lancé depuis C:\Documents and Settings\Romain\Bureau\navilog1
Mise a jour le 17.01.2007 a 23h00 by IL-MAFIOSO

Executé en mode normal

*** Recherche Programmes installes ***

*** Recherche dossiers dans C:\WINDOWS ***

*** Recherche dossiers dans C:\Program Files ***

*** Recherche avec BlackLight Engine/F-secure ***
BlackLight Engine est un produit de F-secure, pour + d'infos :
http://www.f-secure.com/blacklight/blacklight_help.html

F-SECURE BLACKLIGHT ROOTKIT ELIMINATOR
======================================

Copyright 2005-2006 F-Secure Corporation. All rights reserved.
This is a beta version. It will expire on 1st of April, 2007.
Version information: 2.2.1055.

[+] Started on 01/21/07 at 14:35:22.
[+] Initializing ...
[+] Starting scan, press Ctrl-C to abort.
[+] Scanning for hidden items .............................................
[+] Scan complete.
[+] Summary: 0 hidden item(s) found, 0 scheduled for renaming.
[+] Exited on 01/21/07 at 14:39:30 (return code = 0).

*** Recherche fichiers ***

*** Recherche cles registre ***

Recherche dans [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs]

Recherche dans [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage]

Recherche Clé Magic Control

*** Module de recherche complémentaire ***
(recherche fichiers spécifiques)
Le résultat peut révéler des fichiers légitimes !

*
**
***
****
*****
******

*** Analyse Terminé le 21/01/2007 à 14:42:06,71 ***

| Alerter

Répondre à moi86

Angeldark

21 Janvier 2007 14:04:15

C'est ok.

Fixe cette ligne avec Hijackthis :

O4 - HKLM\..\Run: [opxiyajrlt] c:\windows\system32\opxiyajrlt.exe opxiyajrlt

D'autres problèmes ?

| Alerter

Répondre à Angeldark

moi86

21 Janvier 2007 14:08:32

non tout est ok donc maintenant je n'aurais plus la page drive cleaner qui va aparaitre

il faut qu eje fasse quoi acvec hijackthis

| Alerter

Répondre à moi86

moi86

21 Janvier 2007 14:11:23

j'ai un petit renseignement encore
j'ai un pote qui a telecharger un jeu pc et qui me la passé et je l'ai installé ca marche mais quand je lance le jeu il me demande le cd original comment dois-je faire pour ke ca marche

| Alerter

Répondre à moi86

moi86

21 Janvier 2007 14:22:52

alors je fais koi avec :
O4 - HKLM\..\Run: [opxiyajrlt] c:\windows\system32\opxiyajrlt.exe opxiyajrlt

| Alerter

Répondre à moi86

Angeldark

21 Janvier 2007 14:39:27

Re,

- Lance Hijackthis ->Do a system scan only
->Coche la ligne ci-dessous :

O4 - HKLM\..\Run: [opxiyajrlt] c:\windows\system32\opxiyajrlt.exe opxiyajrlt

Clique sur Fix checked (en bas à gauche)

Citation :

j'ai un petit renseignement encore
j'ai un pote qui a telecharger un jeu pc et qui me la passé et je l'ai installé ca marche mais quand je lance le jeu il me demande le cd original comment dois-je faire pour ke ca marche

Tu as besoin du CD pour jouer.
-> Achète le jeux

| Alerter

Répondre à Angeldark

Tom's guide dans le monde