Fenetre pop

rapport de hijackthis


------- LOGFILE OF AD-REMOVER 1.0.9.3 | ONLY XP/VISTA -------

Updated by C_XX on 17/01/2009 at 12:00

*** LIMITED TO ***

Boonty/Boontygames
Eorezo
Everest casino/Everest poker
Funwebproduct/Myway/Mywebsearch
It's TV
Sweetim

******************

Start at: 17:48:50 | Fri 23/01/2009 | Microsoft® Windows Vista™ Home Premium SP1 (V6.0.6001)
Boot mode: MSE
Option: CLEAN | Executed from: C:\Program Files\Ad-remover\Ad-remover.bat
Pc: PC-DE-JOHNNY | User: johnny ( Current user is an administrator)
Drive(s):
- C:\ (File System: NTFS)
- D:\ (File System: NTFS)
System Drive: C:\
Windows Directory: C:\Windows\
System Directory: C:\Windows\System32\

--- Running Processes: 24

(!) ---- IE start pages reset

+--------------------| Boonty/Boonty Games Elements Deleted :

.
/!\ NOT DELETED - HKCR\boontybox
/!\ NOT DELETED - HKLM\Software\Boonty
/!\ NOT DELETED - HKLM\Software\Classes\boontybox
/!\ NOT DELETED - HKLM\SYSTEM\ControlSet001\Services\Boonty Games
/!\ NOT DELETED - HKLM\SYSTEM\ControlSet002\Enum\Root\LEGACY_BOONTY_GAMES
/!\ NOT DELETED - HKLM\SYSTEM\ControlSet002\Services\Boonty Games
/!\ NOT DELETED - HKLM\SYSTEM\CurrentControlSet\Services\Boonty Games
.
C:\ProgramData\BOONTY

+--------------------| Eorezo Elements Deleted :

.
/!\ NOT DELETED - HKCR\Interface\{B0D071A1-36B3-4757-A126-14C89C56013A}
/!\ NOT DELETED - HKCR\Typelib\{B4C656C9-F2E9-4E77-B3F4-443DF2BD778F}
HKCU\SOFTWARE\EoRezo
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{64F56FC1-1272-44CD-BA6E-39723696E350}
/!\ NOT DELETED - HKLM\SOFTWARE\EoRezo
/!\ NOT DELETED - HKLM\SOFTWARE\Classes\AppID\{362A53B2-2913-4F8A-82F5-7E0A23FDC6F9}
/!\ NOT DELETED - HKLM\SOFTWARE\Classes\AppID\EoRezoBHO.DLL
/!\ NOT DELETED - HKLM\SOFTWARE\Classes\TypeLib\{B6ACB3F1-6A83-432C-B854-3E1056F87F4E}
/!\ NOT DELETED - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64F56FC1-1272-44CD-BA6E-39723696E350}
/!\ NOT DELETED - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C7B76B90-3455-4AE6-A752-EAC4D19689E5}
.
C:\Users\johnny\AppData\Roaming\EoRezo

+--------------------| Everest Casino/Everest Poker Elements Deleted :

.
/!\ NOT DELETED - HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Everest Poker
.
C:\Program Files\Everest Poker
C:\Users\Public\Desktop\Everest Poker.lnk

+--------------------| Funwebproducts/Myway/Mywebsearch/Myglobalsearch Elements Deleted :

.
.

+--------------------| It's TV Elements Deleted :

HKCU\SOFTWARE\ItsLabel
.
C:\Users\johnny\AppData\Roaming\ItsLabel

+--------------------| Sweetim Elements Deleted :

.
/!\ NOT DELETED - HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\\{BC4FFE41-DE9F-46FA-B455-AAD49B9F9938}
HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\INTERNETREGISTRY\REGISTRY\USER\S-1-5-21-3603102019-2234686749-2930555637-1000\SOFTWARE\SWEETIM
/!\ NOT DELETED - HKLM\~\USERDATA\S-1-5-18\COMPONENTS\980289C22F80A7C4BB9323DC61255E4E
/!\ NOT DELETED - HKLM\~\USERDATA\S-1-5-18\COMPONENTS\FA96423FE2B98E248A3B23548D1E22D9
/!\ NOT DELETED - HKCR\Typelib\{58906392-79C4-497C-ACC6-6942B59F1A08}
HKCU\SOFTWARE\SWEETIE
HKCU\SOFTWARE\SweetIM
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1A0AADCD-3A72-4B5F-900F-E3BB5A838E2A}
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{BC4FFE41-DE9F-46fa-B455-AAD49B9F9938}
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
/!\ NOT DELETED - HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}
/!\ NOT DELETED - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A}
/!\ NOT DELETED - HKLM\SOFTWARE\SweetIM
.
C:\Users\johnny\AppData\Roaming\Mozilla\Firefox\Profiles\djgklwtr.default\searchplugins\sweetim.xml
C:\Users\johnny\AppData\Roaming\Microsoft\Windows\Cookies\johnny@sweetim[1].txt

(!) ---- Temp files deleted.
(!) ---- Recycle bin emptied in all drives.


************* /!\ REGISTRY ELEMENT(S) NOT DELETED /!\ *************

"HKCR\boontybox"
"HKLM\Software\Boonty"
"HKLM\Software\Classes\boontybox"
"HKLM\SYSTEM\ControlSet001\Services\Boonty Games"
"HKLM\SYSTEM\ControlSet002\Enum\Root\LEGACY_BOONTY_GAMES"
"HKLM\SYSTEM\ControlSet002\Services\Boonty Games"
"HKLM\SYSTEM\CurrentControlSet\Services\Boonty Games"
"HKCR\Interface\{B0D071A1-36B3-4757-A126-14C89C56013A}"
"HKCR\Typelib\{B4C656C9-F2E9-4E77-B3F4-443DF2BD778F}"
"HKLM\SOFTWARE\EoRezo"
"HKLM\SOFTWARE\Classes\AppID\{362A53B2-2913-4F8A-82F5-7E0A23FDC6F9}"
"HKLM\SOFTWARE\Classes\AppID\EoRezoBHO.DLL"
"HKLM\SOFTWARE\Classes\TypeLib\{B6ACB3F1-6A83-432C-B854-3E1056F87F4E}"
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64F56FC1-1272-44CD-BA6E-39723696E350}"
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C7B76B90-3455-4AE6-A752-EAC4D19689E5}"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Everest Poker"
"HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR" /V "{BC4FFE41-DE9F-46FA-B455-AAD49B9F9938}"
"HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\COMPONENTS\980289C22F80A7C4BB9323DC61255E4E"
"HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\COMPONENTS\FA96423FE2B98E248A3B23548D1E22D9"
"HKCR\Typelib\{58906392-79C4-497C-ACC6-6942B59F1A08}"
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}"
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A}"
"HKLM\SOFTWARE\SweetIM"

SECOND RUN ...

RESIST ! - ""HKCR\boontybox""
RESIST ! - ""HKLM\Software\Boonty""
RESIST ! - ""HKLM\Software\Classes\boontybox""
DELETED ! - ""HKLM\SYSTEM\ControlSet001\Services\Boonty Games""
RESIST ! - ""HKLM\SYSTEM\ControlSet002\Enum\Root\LEGACY_BOONTY_GAMES""
DELETED ! - ""HKLM\SYSTEM\ControlSet002\Services\Boonty Games""
DELETED ! - ""HKLM\SYSTEM\CurrentControlSet\Services\Boonty Games""
RESIST ! - ""HKCR\Interface\{B0D071A1-36B3-4757-A126-14C89C56013A}""
RESIST ! - ""HKCR\Typelib\{B4C656C9-F2E9-4E77-B3F4-443DF2BD778F}""
RESIST ! - ""HKLM\SOFTWARE\EoRezo""
RESIST ! - ""HKLM\SOFTWARE\Classes\AppID\{362A53B2-2913-4F8A-82F5-7E0A23FDC6F9}""
RESIST ! - ""HKLM\SOFTWARE\Classes\AppID\EoRezoBHO.DLL""
RESIST ! - ""HKLM\SOFTWARE\Classes\TypeLib\{B6ACB3F1-6A83-432C-B854-3E1056F87F4E}""
DELETED ! - ""HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64F56FC1-1272-44CD-BA6E-39723696E350}""
DELETED ! - ""HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C7B76B90-3455-4AE6-A752-EAC4D19689E5}""
DELETED ! - ""HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Everest Poker""
DELETED ! - ""HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR" /V "{BC4FFE41-DE9F-46FA-B455-AAD49B9F9938}""
RESIST ! - ""HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\COMPONENTS\980289C22F80A7C4BB9323DC61255E4E""
RESIST ! - ""HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\COMPONENTS\FA96423FE2B98E248A3B23548D1E22D9""
RESIST ! - ""HKCR\Typelib\{58906392-79C4-497C-ACC6-6942B59F1A08}""
DELETED ! - ""HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}""
DELETED ! - ""HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A}""
RESIST ! - ""HKLM\SOFTWARE\SweetIM""


+--------------------| Added Scan :


+---------- SCANNING PREFS.JS ... ( # MOZILLA USER PREFERENCES )

..\djgklwtr.default\prefs.js :

~~~~ MOZILLA FIREFOX VERSION 3.0.5 ~~~~

* BROWSER SEARCH DEFAULT ENGINE: "SweetIM Search"
* BROWSER SEARCH SELECTED ENGINE: "Google"
* BROWSER SEARCH DEFAULT URL: "https://search.sweetim.com/search.asp?src=2&q="
* BROWSER STARTUP HOMEPAGE: "https://www.google.fr/webhp?client=firefox-a&rls=org.mozilla:fr:official&channel=s&hl=fr&btnG=Recherche+Google&gws_rd=ssl"

.
REMOVED - user_pref("browser.search.defaultenginename", "SweetIM Search");
REMOVED - user_pref("browser.search.defaulturl", "https://search.sweetim.com/search.asp?src=2&q=");
REMOVED - user_pref("keyword.URL", "https://search.sweetim.com/search.asp?src=2&q=");

+---------------------------------------------------------------------------+


~~~~ INTERNET EXPLORER VERSION 7.0.6001.18000 ~~~~

+--[HKEY_CURRENT_USER\..\INTERNET EXPLORER\MAIN]

Start page : hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

+--[HKEY_LOCAL_MACHINE\..\INTERNET EXPLORER\MAIN]

Start page : hxxp://home.sweetim.com

+---------------------------------------------------------------------------+

[~9026 BYTES] - "C:\AD-REPORT-CLEAN-23.01.2009.LOG"
[~51948 BYTES] - "C:\AD-REPORT-SCAN-23.01.2009.LOG"

End at: 17:51:13 | 23/01/2009 - Time elapsed: 2 minutes, 22 seconds

+---------------------------------------------------------------------------+
+------------------------------- [ E.O.F - 149 Lines ]
+---------------------------------------------------------------------------+