HELP ! un méchant virus trojan-gen win32 [Résolu/Fermé]

Signaler
Messages postés
19
Date d'inscription
lundi 23 février 2009
Statut
Membre
Dernière intervention
24 février 2009
-
 verdeka -
Bonjour,
Mon ordi est infesté par un virus et je n'arrive pas à en venir à bout, il a neutralisé mon antivirus 'avast) et m'empêche d'en installer d'autres.
Avast avant d'expirer m'a donné le nom de son assassin : trojan-gen (other) et quand je veux le lancerou tout autre anti virus que j'installe j'ai un message d'erreur qui me dit que ce n'est pas une application valide Win 32...
Merci à toute personne qui peut m'aider

65 réponses

il faut que je refasse l'étape 19 ?
J'ai plus les yeux en face des touches là
Messages postés
85925
Date d'inscription
dimanche 11 juillet 2010
Statut
Modérateur
Dernière intervention
30 octobre 2019
10 091
C'est bien ça.
Messages postés
85925
Date d'inscription
dimanche 11 juillet 2010
Statut
Modérateur
Dernière intervention
30 octobre 2019
10 091
---> Télécharge EliBaglA.exe :
http://www.zonavirus.com/datos/descargas/95/elibagla.asp

---> Clique en bas de la page sur le bouton Descargar Elibagla.
Enregistre ce fichier sur le bureau.

---> Double-clique sur EliBaglA.exe pour l'ouvrir.

---> Assure-toi que dans le menu déroulant Unidad qu'il y ait bien C:\
Vérifie aussi que l'option en bas de la fenêtre Eliminar Ficheros Automaticamente est bien cochée.

---> Clique sur le bouton Explorar pour lancer l'analyse.

---> L'analyse finie, redémarre, poste le rapport d'EliBaglA qui se trouve ici C:\InfoSat.txt
je voudrais bien mais je n'arrive pas à me connecter avec le portable
Messages postés
85925
Date d'inscription
dimanche 11 juillet 2010
Statut
Modérateur
Dernière intervention
30 octobre 2019
10 091
Même en refaisant l'option 2 de FindyKill ?
j'y retourne :(
pour quiter satinfo je fais explorar ou salir
Messages postés
85925
Date d'inscription
dimanche 11 juillet 2010
Statut
Modérateur
Dernière intervention
30 octobre 2019
10 091
Salir.
je m'en doutait mais bon...
pas de boite noire à l'horizon
voila le rapport :
Tue Feb 24 02:50:30 2009
EliBagle v12.25 (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 23 de Febrero del 2009)
----------------------------------------------
Lista de Acciones (por Acción Directa):
Eliminada Carpeta "%AppData%\Drivers"

Tue Feb 24 02:50:43 2009
EliBagle v12.25 (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 23 de Febrero del 2009)
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando "C:\"
C:\Program Files\Synaptics\SynTP\SYNTPLPR.EXE --> Eliminado Bagle.dldr
C:\Program Files\Windows Live\Messenger\MSNMSGR.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP404\A0081597.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP404\A0081598.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP404\A0081599.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP404\A0081623.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP404\A0081624.SYS --> Eliminado Bagle(rootkit)
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP404\A0081630.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP404\A0081639.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP404\A0081640.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP404\A0081641.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP404\A0081642.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP404\A0081662.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP404\A0081684.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP404\A0081744.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP404\A0081766.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP404\A0081782.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP404\A0081804.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP404\A0081819.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP404\A0081877.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP404\A0081893.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP404\A0081915.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP404\A0081931.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP404\A0081969.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP404\A0081992.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP404\A0082028.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP404\A0082041.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP404\A0082063.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP404\A0082076.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP404\A0082111.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP404\A0082133.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP404\A0082146.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP404\A0082180.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP404\A0082202.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP404\A0082215.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP404\A0082237.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP404\A0082250.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP404\A0082271.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP404\A0082284.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP404\A0082338.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP404\A0082352.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP404\A0082373.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP406\A0082392.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP407\A0082513.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP407\A0082521.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP407\A0082522.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP407\A0082523.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP407\A0082524.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP407\A0082565.EXE --> Eliminado Proxy.Mitglieder
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP407\A0082608.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP407\A0082609.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP407\A0082619.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP407\A0082648.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP407\A0082649.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP407\A0082668.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP407\A0082669.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP407\A0082715.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP407\A0082716.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP401\A0078148.SYS --> Eliminado Bagle(rootkit)
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP401\A0078317.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP401\A0078319.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP401\A0078397.SYS --> Eliminado Bagle(rootkit)
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP401\A0078421.SYS --> Eliminado Bagle(rootkit)
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP401\A0078454.SYS --> Eliminado Bagle(rootkit)
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP401\A0078462.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP401\A0078483.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP401\A0078484.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP401\A0078486.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP401\A0078487.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP401\A0079454.SYS --> Eliminado Bagle(rootkit)
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP401\A0079463.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP401\A0079467.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP401\A0079468.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP401\A0079660.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP403\A0079838.SYS --> Eliminado Bagle(rootkit)
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP403\A0079846.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP403\A0079847.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP403\A0080023.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP403\A0080159.SYS --> Eliminado Bagle(rootkit)
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP403\A0080169.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP403\A0080170.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP403\A0080187.SYS --> Eliminado Bagle(rootkit)
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP403\A0080194.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP403\A0080196.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{B73BB89E-F71E-44AB-9CBB-529A0BD06C2C}\RP403\A0080200.EXE --> Eliminado Bagle
C:\Qoobox\Quarantine\C\Program Files\Google\GoogleToolbarNotifier\GOOGLETOOLBARNOTIFIER.EXE.VIR --> Eliminado Bagle.dldr
C:\_OTMoveIt\MovedFiles\02242009_012527\documents and settings\jean thiebaut\Application Data\drivers\WINUPGRO.EXE --> Eliminado Bagle.dldr
C:\_OTMoveIt\MovedFiles\02242009_012527\documents and settings\jean thiebaut\Application Data\drivers\SROSA2.SYS --> Eliminado Bagle(rootkit)
C:\_OTMoveIt\MovedFiles\02242009_012527\documents and settings\jean thiebaut\Application Data\drivers\downld\2689718.EXE --> Eliminado Bagle.dldr
C:\_OTMoveIt\MovedFiles\02242009_012527\documents and settings\jean thiebaut\Application Data\drivers\downld\3140625.EXE --> Eliminado Bagle

Nº Total de Directorios: 6653
Nº Total de Ficheros: 91852
Nº de Ficheros Analizados: 17021
Nº de Ficheros Infectados: 90
Nº de Ficheros Limpiados: 90
Messages postés
85925
Date d'inscription
dimanche 11 juillet 2010
Statut
Modérateur
Dernière intervention
30 octobre 2019
10 091
---> Désinstalle FindyKill.

---> Menu Démarrer > Exécuter > Tape combofix /u et valide.

- Télécharge Random's System Information Tool (RSIT) (par random/random) sur ton Bureau.

- Double-clique sur RSIT.exe afin de lancer le programme.

- Clique sur Continue à l'écran Disclaimer.

- Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.

- Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (c'est celui qui apparaît à l'écran) ainsi que de info.txt (que tu verras dans la barre des tâches).

Note : Les rapports sont sauvegardés dans le dossier C:\rsit.
Logfile of random's system information tool 1.05 (written by random/random)
Run by jean thiebaut at 2009-02-24 03:21:36
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 6 GB (11%) free of 56 GB
Total RAM: 1023 MB (56% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 03:21:44, on 24/02/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Live\Family Safety\fsssvc.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\WINDOWS\ATK0100\HControl.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\ASUS\ASUS Live Update\ALU.exe
C:\Program Files\ASUS\NB Probe\NBProbe.exe
C:\Program Files\ASUS\Wireless Console\wcourier.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\ASUSTeK\ASUSDVD\PDVDServ.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe
C:\Program Files\SweetIM\Messenger\SweetIM.exe
C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Windows Live\Family Safety\fsui.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ASUS\Asus ChkMail\ChkMail.exe
C:\Program Files\adslTV\adsltv.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\jean thiebaut\Bureau\RSIT.exe
C:\Program Files\trend micro\jean thiebaut.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: MyBloop Toolbar - {8369045e-5ba3-41ad-9551-afe9f4f5207c} - C:\Program Files\MyBloop\tbMyB1.dll
R3 - URLSearchHook: SweetIM ToolbarURLSearchHook Class - {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Windows Live Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Utilitaires\Antivirus\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\PROGRA~1\eoRezo\EoAdv\EOREZO~1.DLL
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: MyBloop Toolbar - {8369045e-5ba3-41ad-9551-afe9f4f5207c} - C:\Program Files\MyBloop\tbMyB1.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: SWEETIE - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: MyBloop Toolbar - {8369045e-5ba3-41ad-9551-afe9f4f5207c} - C:\Program Files\MyBloop\tbMyB1.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IntelZeroConfig] C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [ASUS Live Update] C:\Program Files\ASUS\ASUS Live Update\ALU.exe
O4 - HKLM\..\Run: [NB Probe] C:\Program Files\ASUS\NB Probe\NBProbe.exe
O4 - HKLM\..\Run: [Wireless Console] C:\Program Files\ASUS\Wireless Console\wcourier.exe
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [EPSON Stylus DX3800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE /P26 "EPSON Stylus DX3800 Series" /O6 "USB001" /M "Stylus DX3800"
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAShCut.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\ASUSTeK\ASUSDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\SweetIM\Messenger\SweetIM.exe
O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe"
O4 - HKLM\..\Run: [IndexSearch] "C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe"
O4 - HKLM\..\Run: [PPort11reminder] "C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe" -r "C:\Documents and Settings\All Users\Application Data\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini"
O4 - HKLM\..\Run: [fssui] "C:\Program Files\Windows Live\Family Safety\fsui.exe" -autorun
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [a-squared] "D:\Utilitaires\Antivirus\a-squared Anti-Malware\a2guard.exe"
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe /boot
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [EPSON Stylus DX3800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE /P26 "EPSON Stylus DX3800 Series" /M "Stylus DX3800" /EF "HKCU"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Startup: adsl TV.LNK = C:\Program Files\adslTV\adsltv.exe
O4 - Global Startup: ASUS ChkMail.lnk = C:\Program Files\ASUS\Asus ChkMail\ChkMail.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Internet Cleaner - {45819E58-6E84-4A5D-BD65-A706981E5BE8} - C:\Program Files\Internet Cleaner\ICleaner.exe (HKCU)
O9 - Extra 'Tools' menuitem: Internet Cleaner - {45819E58-6E84-4A5D-BD65-A706981E5BE8} - C:\Program Files\Internet Cleaner\ICleaner.exe (HKCU)
O14 - IERESET.INF: START_PAGE_URL=https://www.asus.com/fr/
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Unknown owner - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe (file missing)
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Unknown owner - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe (file missing)
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: spmgr - Unknown owner - C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
Messages postés
85925
Date d'inscription
dimanche 11 juillet 2010
Statut
Modérateur
Dernière intervention
30 octobre 2019
10 091
● Télécharge AD-Remover (de Cyrildu17 / C_XX) sur ton Bureau.

/!\ Déconnecte-toi et ferme toutes applications en cours /!\

● Double-clique sur le programme d'installation, installe-le dans son emplacement par défaut (C:\Program files).
● Double-clique sur le raccourci d'Ad-remover située sur ton Bureau.
● Au menu principal, choisis l'option "A".
● Poste le rapport qui apparaît à la fin.

(Le rapport est sauvegardé aussi sous C:\Ad-report(date).log)

(CTRL+A pour tout sélectionner, CTRL+C pour copier et CTRL+V pour coller)

Note :

"Process.exe", une composante de l'outil, est détectée par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, firewall...) d'où l'alerte émise par ces antivirus.
------- LOGFILE OF AD-REMOVER 1.1.1.4 | ONLY XP/VISTA -------

Updated by C_XX on 22/02/2009 at 21:00

Start at: 3:29:27 | Mar 24/02/2009 | Boot mode: Normal Boot
Option: SCAN | Executed from: C:\Program Files\Ad-remover\Ad-remover.bat
Operating System: Microsoft® Windows XP™ Service Pack 3 (version 5.1.2600)
Computer Name: NOM-2FF949DF057
Current User: jean thiebaut - Administrator
Drive(s):
- C:\ (File System: FAT32)
- D:\ (File System: NTFS)
- E:\ (File System: CDFS)
System Drive: C:\
Windows Directory: C:\WINDOWS\
System Directory: C:\WINDOWS\System32\

--- Running Processes: 59

+-----------------| Boonty/Boonty Games Elements Found:

.
.

+-----------------| Eorezo Elements Found:

HKCR\CLSID\{64F56FC1-1272-44CD-BA6E-39723696E350}
HKCR\EoRezoBHO.EoBho
HKCR\EoRezoBHO.EoBho.1
HKCR\Interface\{B0D071A1-36B3-4757-A126-14C89C56013A}
HKCR\Typelib\{B4C656C9-F2E9-4E77-B3F4-443DF2BD778F}
HKCU\Software\EoRezo
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{64F56FC1-1272-44CD-BA6E-39723696E350}
HKLM\Software\EoRezo
HKLM\Software\Classes\CLSID\{64F56FC1-1272-44CD-BA6E-39723696E350}
HKLM\Software\Classes\EoRezoBHO.EoBho
HKLM\Software\Classes\EoRezoBHO.EoBho.1
HKLM\Software\Classes\TypeLib\{B4C656C9-F2E9-4E77-B3F4-443DF2BD778F}
HKLM\Software\Classes\Interface\{B0D071A1-36B3-4757-A126-14C89C56013A}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64F56FC1-1272-44CD-BA6E-39723696E350}
.
C:\Program Files\EoRezo
C:\Program Files\EoRezo\EoAdv
C:\Documents and Settings\jean thiebaut\Application Data\EoRezo
C:\Documents and Settings\jean thiebaut\Application Data\EoRezo\EoPhoto
C:\Documents and Settings\jean thiebaut\Application Data\EoRezo\EoSudoku
C:\Documents and Settings\jean thiebaut\Application Data\EoRezo\EoWeather
C:\Documents and Settings\jean thiebaut\Application Data\EoRezo\db
C:\Documents and Settings\jean thiebaut\Application Data\EoRezo\EoPhoto\images_classic_gris
C:\Documents and Settings\jean thiebaut\Application Data\EoRezo\EoPhoto\images_big_bleu
C:\Documents and Settings\jean thiebaut\Application Data\EoRezo\EoPhoto\images_classic_bleu
C:\Documents and Settings\jean thiebaut\Application Data\EoRezo\EoPhoto\images_classic
C:\Documents and Settings\jean thiebaut\Application Data\EoRezo\EoSudoku\images_classic_noir
C:\Documents and Settings\jean thiebaut\Application Data\EoRezo\EoSudoku\images_classic_mauve
C:\Documents and Settings\jean thiebaut\Application Data\EoRezo\EoSudoku\images_classic_vert
C:\Documents and Settings\jean thiebaut\Application Data\EoRezo\EoSudoku\images_classic_rouge
C:\Documents and Settings\jean thiebaut\Application Data\EoRezo\EoWeather\images
C:\Documents and Settings\jean thiebaut\Application Data\EoRezo\EoWeather\images_station_meteo
C:\Documents and Settings\jean thiebaut\Application Data\EoRezo\EoWeather\images_classic

+-----------------| Infected Poker Softwares Elements Found:

.

+-----------------| FunWebProducts/MyWay/MyWebSearch/MyGlobalSearch Elements Found:

.
.

+-----------------| It's TV Elements Found:

.

+-----------------| Sweetim Elements Found:

HKCR\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}
HKCR\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064}
HKCR\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCR\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKCR\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}
HKCR\Interface\{A439801C-961D-452C-AB42-7848E9CBD289}
HKCR\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}
HKCR\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}
HKCR\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}
HKCR\Interface\{F4EBB1E2-21F3-4786-8CF4-16EC5925867F}
HKCR\MediaPlayer.GraphicsUtils
HKCR\MediaPlayer.GraphicsUtils.1
HKCR\MgMediaPlayer.GifAnimator
HKCR\MgMediaPlayer.GifAnimator.1
HKCR\SWEETIE.IEToolbar
HKCR\SWEETIE.IEToolbar.1
HKCR\SWEETIE.SWEETIE
HKCR\SWEETIE.SWEETIE.3
HKCR\SweetIM_URLSearchHook.ToolbarURLSearchHook
HKCR\SweetIM_URLSearchHook.ToolbarURLSearchHook.1
HKCR\Toolbar3.SWEETIE
HKCR\Toolbar3.SWEETIE.1
HKCR\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}
HKCR\Typelib\{EEE6C35E-6118-11DC-9C72-001320C79847}
HKCR\Typelib\{EEE6C35F-6118-11DC-9C72-001320C79847}
HKCU\Software\SweetIM
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKLM\Software\Classes\MediaPlayer.GraphicsUtils
HKLM\Software\Classes\MediaPlayer.GraphicsUtils.1
HKLM\Software\Classes\MgMediaPlayer.GifAnimator
HKLM\Software\Classes\MgMediaPlayer.GifAnimator.1
HKLM\Software\Classes\SWEETIE.IEToolbar
HKLM\Software\Classes\SWEETIE.IEToolbar.1
HKLM\Software\Classes\SWEETIE.SWEETIE
HKLM\Software\Classes\SWEETIE.SWEETIE.3
HKLM\Software\Classes\SweetIM_URLSearchHook.ToolbarURLSearchHook
HKLM\Software\Classes\SweetIM_URLSearchHook.ToolbarURLSearchHook.1
HKLM\Software\Classes\Toolbar3.SWEETIE
HKLM\Software\Classes\Toolbar3.SWEETIE.1
HKLM\Software\Classes\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}
HKLM\Software\Classes\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}
HKLM\Software\Classes\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}
HKLM\Software\Classes\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}
HKLM\Software\Classes\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064}
HKLM\Software\Classes\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKLM\Software\Classes\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKLM\Software\Classes\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}
HKLM\Software\Classes\Interface\{A439801C-961D-452C-AB42-7848E9CBD289}
HKLM\Software\Classes\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}
HKLM\Software\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}
HKLM\Software\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}
HKLM\Software\Classes\Interface\{F4EBB1E2-21F3-4786-8CF4-16EC5925867F}
HKLM\Software\Microsoft\ESENT\Process\SweetIM
HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{266C7330-C0F4-49E5-8F20-A56F9F822875}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKLM\Software\SweetIM
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\Sweetim
HKCU\Software\Microsoft\Internet Explorer\UrlSearchHooks\\{EEE6C35D-6118-11DC-9C72-001320C79847}
HKLM\Software\Microsoft\Internet Explorer\Toolbar\\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\07D5290CDBDAE4242926B8E6CA650501
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\08E33F7B61DEFF24BB9673ED7D467636
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\0E3D8A5B48622A445A7DF73FEFF32C3F
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\1AC67655DD68F8240B2860F2D511EBD8
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\34EDDB1BFB3A2D448845F3EFD0F15A43
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\351716A953E21214898904032EAE2E81
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\397C771A7BCAC904697C3EC629ED33ED
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\427EA997C413D1D47907CBFC7B2DB432
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\4318DF19719275242801CBE292063A4C
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\45FC115D1FEAEF849A4E1610D6EC8BF0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\46A5861A389ADB844AF89E31BC9DF0A1
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\49B0E1A6FF50BBE4289E4E23DE6EA0C7
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\4CCCAC049F34D0540AAC13011398BEDB
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5C4389D0BFB302C479DE4178BD5D9EBA
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5D19F074C042AD34BAB463D4175A062E
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5D2B09BDEF4FE54418E6F3373CDBC7AC
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\61B65D3397A1FBF4CB1571B5E4F6B5B0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\68E8A05C60DD9254591DBD16C94EDDBF
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\697E782CF574CC34CBB9566440BA12BC
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\6AE27A8613CF7EA4782F2886F67295E5
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\7CE172051F585E04187BCB97570BFA74
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\86A901BA5265452499DCBF719C378EE3
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\88ABD1CD5C40EC84789A7F6EF86DAC5E
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\980289C22F80A7C4BB9323DC61255E4E
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\98CC8BF5A4A6E6C4ABF7051DDAB8B058
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\9A4B7EF3789F871419D9302583B20C15
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\A189D17A469616C4688D23E192996267
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\A6C53B0F76C44004A8F36716213017DB
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\B59F2D8189784CC46A4597F2842480B0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\BD746FB95FB8E5B45BF66BE54D5FD91F
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\CCF399FCD6D2D3F46BF02A1378654FC9
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D149C1355C98DE24E82CEFBD996FE06A
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D15DAF33C220F91468A1D7D57C31ACD7
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D3BA76A44C779424889063D5098ED2D6
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D6D0EB9FDBD90C04D92A7E729058F10D
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\DB59FDB786388EA4D897F3EE715683AC
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\DB8DAD19CFBCC2049A4477183787E8C5
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E1C820A74ED67374BA048B52CB3C3804
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E337925F629CF4C4FB08F3D9674DD839
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E4748F9A4181FCE46A23C13B517B9420
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\EC65F200D112357449C8B1BC3CFA03D0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\F327D0C73C0973644A21E8CC852267A0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\FA96423FE2B98E248A3B23548D1E22D9
.
C:\WINDOWS\Installer\2f84f513.msi
C:\WINDOWS\Installer\2f84f519.msi
C:\Program Files\SweetIM
C:\Program Files\SweetIM\Messenger
C:\Program Files\SweetIM\Toolbars
C:\Program Files\SweetIM\Messenger\resources
C:\Program Files\SweetIM\Messenger\resources\images
C:\Program Files\SweetIM\Toolbars\Internet Explorer
C:\Program Files\SweetIM\Toolbars\Internet Explorer\conf
C:\Program Files\SweetIM\Toolbars\Internet Explorer\resources
C:\Documents and Settings\All Users\Application Data\SweetIM
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger
C:\Documents and Settings\All Users\Application Data\SweetIM\Toolbars
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\logs
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\update
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\conf
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\conf\users
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\conf\users\karine-verdelet@hotmail.fr
C:\Documents and Settings\All Users\Application Data\SweetIM\Toolbars\Internet Explorer
C:\Documents and Settings\All Users\Application Data\SweetIM\Toolbars\Internet Explorer\cache

+-----------------| Other Adwares Found:

.
HKCR\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
HKLM\Software\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
.
C:\Program Files\Conduit
C:\Program Files\Conduit\Community Alerts
C:\Documents and Settings\jean thiebaut\Cookies\jean_thiebaut@atdmt[2].txt

+-----------------| Added Scan:

---- Mozilla FireFox Version [Unable to get version] ----

ProfilePath: rivxi91f.default
.
Prefs.js: Browser.Search.DefaultEngineName: "Google"
Prefs.js: Browser.Search.SelectedEngine: "Google"
Prefs.js: Browser.Search.DefaultUrl: "hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q="
.
.
.
.
.

---- Internet Explorer Version 7.0.5730.13 ----

+-[HKEY_CURRENT_USER\..\Internet Explorer\Main]

Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start page: hxxp://go.microsoft.com/fwlink/?LinkId=69157

+-[HKEY_USERS\S-1-5-21-4117893582-3251523194-220142345-1005\..\Internet Explorer\Main]

Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start page: hxxp://go.microsoft.com/fwlink/?LinkId=69157

+-[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

Default_Page_URL: hxxp://go.microsoft.com/fwlink/?LinkId=69157
Default_Search_URL: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Search Page: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Start page: hxxp://go.microsoft.com/fwlink/?LinkId=69157

+-[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

Tabs: hxxp://ieframe.dll/tabswelcome.htm

+---------------------------------------------------------------------------+

[~15062 Bytes] - "C:\Ad-Report-Scan-24.02.2009.log"
-

End at: 3:30:46 | 24/02/2009
.
+-----------------| E.O.F - 225 Lines
.
j'ai essayer de relancer avast, il n'est toujours pas valide
Messages postés
85925
Date d'inscription
dimanche 11 juillet 2010
Statut
Modérateur
Dernière intervention
30 octobre 2019
10 091
/!\ Déconnecte-toi et ferme toutes applications en cours /!\

● Double-clique sur AD-Remover pour le lancer : au menu principal, choisis l'option B.

● Coche A à l'écran de sélection :
http://sd-1.archive-host.com/membres/up/16506160323759868/Capturer-ADR.JPG

● Puis choisis S, le programme va travailler.

● Poste le rapport qui apparaît à la fin.

(Le rapport est sauvegardé aussi sous C:\Ad-report.log)

/!\ Si le Bureau ne réapparaît pas, presse Ctrl + Alt + Suppr, Onglet "Fichier", "Nouvelle tâche", tape explorer.exe et valide /!\
------- LOGFILE OF AD-REMOVER 1.1.1.4 | ONLY XP/VISTA -------

Updated by C_XX on 22/02/2009 at 21:00

*** LIMITED TO ***

Boonty/BoontyGames
Eorezo
Infected Poker Softwares
FunWebProduct/MyWay/MyWebSearch
It's TV
Sweetim
Other Adwares

******************

Start at: 3:50:44 | Mar 24/02/2009 | Boot mode: Normal Boot
Option: CLEAN | Executed from: C:\Program Files\Ad-remover\Ad-remover.bat
Operating System: Microsoft® Windows XP™ Service Pack 3 (version 5.1.2600)
Computer Name: NOM-2FF949DF057
Current User: jean thiebaut - Administrator
Drive(s):
- C:\ (File System: FAT32)
- D:\ (File System: NTFS)
- E:\ (File System: CDFS)
System Drive: C:\
Windows Directory: C:\WINDOWS\
System Directory: C:\WINDOWS\System32\

--- Running Processes: 59

(!) ---- IE start pages/Tabs reset

+--------------------| Boonty/Boonty Games Elements Deleted :

.
.

+-----------------| Eorezo Elements Deleted :

HKCR\CLSID\{64F56FC1-1272-44CD-BA6E-39723696E350}
HKCR\EoRezoBHO.EoBho
HKCR\EoRezoBHO.EoBho.1
HKCR\Interface\{B0D071A1-36B3-4757-A126-14C89C56013A}
HKCR\Typelib\{B4C656C9-F2E9-4E77-B3F4-443DF2BD778F}
HKCU\Software\EoRezo
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{64F56FC1-1272-44CD-BA6E-39723696E350}
HKLM\Software\EoRezo
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64F56FC1-1272-44CD-BA6E-39723696E350}
.
C:\Program Files\EoRezo
C:\Documents and Settings\jean thiebaut\Application Data\EoRezo

+-----------------| Infected Poker Softwares Elements Deleted :

.

+-----------------| FunWebProducts/MyWay/MyWebSearch/MyGlobalSearch Elements Deleted :

.
.

+-----------------| It's TV Elements Deleted :

.

+-----------------| Sweetim Elements Deleted :

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\Sweetim
HKCU\Software\Microsoft\Internet Explorer\UrlSearchHooks\\{EEE6C35D-6118-11DC-9C72-001320C79847}
HKLM\Software\Microsoft\Internet Explorer\Toolbar\\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCR\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}
HKCR\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064}
HKCR\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCR\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKCR\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}
HKCR\Interface\{A439801C-961D-452C-AB42-7848E9CBD289}
HKCR\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}
HKCR\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}
HKCR\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}
HKCR\Interface\{F4EBB1E2-21F3-4786-8CF4-16EC5925867F}
HKCR\MediaPlayer.GraphicsUtils
HKCR\MediaPlayer.GraphicsUtils.1
HKCR\MgMediaPlayer.GifAnimator
HKCR\MgMediaPlayer.GifAnimator.1
HKCR\SWEETIE.IEToolbar
HKCR\SWEETIE.IEToolbar.1
HKCR\SWEETIE.SWEETIE
HKCR\SWEETIE.SWEETIE.3
HKCR\SweetIM_URLSearchHook.ToolbarURLSearchHook
HKCR\SweetIM_URLSearchHook.ToolbarURLSearchHook.1
HKCR\Toolbar3.SWEETIE
HKCR\Toolbar3.SWEETIE.1
HKCR\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}
HKCR\Typelib\{EEE6C35E-6118-11DC-9C72-001320C79847}
HKCR\Typelib\{EEE6C35F-6118-11DC-9C72-001320C79847}
HKCU\Software\SweetIM
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKLM\Software\Microsoft\ESENT\Process\SweetIM
HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{266C7330-C0F4-49E5-8F20-A56F9F822875}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKLM\Software\SweetIM
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\07D5290CDBDAE4242926B8E6CA650501
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\08E33F7B61DEFF24BB9673ED7D467636
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\0E3D8A5B48622A445A7DF73FEFF32C3F
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\1AC67655DD68F8240B2860F2D511EBD8
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\34EDDB1BFB3A2D448845F3EFD0F15A43
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\351716A953E21214898904032EAE2E81
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\397C771A7BCAC904697C3EC629ED33ED
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\427EA997C413D1D47907CBFC7B2DB432
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\4318DF19719275242801CBE292063A4C
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\45FC115D1FEAEF849A4E1610D6EC8BF0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\46A5861A389ADB844AF89E31BC9DF0A1
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\49B0E1A6FF50BBE4289E4E23DE6EA0C7
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\4CCCAC049F34D0540AAC13011398BEDB
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5C4389D0BFB302C479DE4178BD5D9EBA
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5D19F074C042AD34BAB463D4175A062E
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5D2B09BDEF4FE54418E6F3373CDBC7AC
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\61B65D3397A1FBF4CB1571B5E4F6B5B0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\68E8A05C60DD9254591DBD16C94EDDBF
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\697E782CF574CC34CBB9566440BA12BC
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\6AE27A8613CF7EA4782F2886F67295E5
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\7CE172051F585E04187BCB97570BFA74
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\86A901BA5265452499DCBF719C378EE3
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\88ABD1CD5C40EC84789A7F6EF86DAC5E
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\980289C22F80A7C4BB9323DC61255E4E
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\98CC8BF5A4A6E6C4ABF7051DDAB8B058
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\9A4B7EF3789F871419D9302583B20C15
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\A189D17A469616C4688D23E192996267
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\A6C53B0F76C44004A8F36716213017DB
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\B59F2D8189784CC46A4597F2842480B0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\BD746FB95FB8E5B45BF66BE54D5FD91F
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\CCF399FCD6D2D3F46BF02A1378654FC9
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D149C1355C98DE24E82CEFBD996FE06A
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D15DAF33C220F91468A1D7D57C31ACD7
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D3BA76A44C779424889063D5098ED2D6
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D6D0EB9FDBD90C04D92A7E729058F10D
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\DB59FDB786388EA4D897F3EE715683AC
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\DB8DAD19CFBCC2049A4477183787E8C5
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E1C820A74ED67374BA048B52CB3C3804
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E337925F629CF4C4FB08F3D9674DD839
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E4748F9A4181FCE46A23C13B517B9420
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\EC65F200D112357449C8B1BC3CFA03D0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\F327D0C73C0973644A21E8CC852267A0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\FA96423FE2B98E248A3B23548D1E22D9
.
C:\WINDOWS\Installer\2f84f513.msi
C:\WINDOWS\Installer\2f84f519.msi
C:\Program Files\SweetIM
C:\Documents and Settings\All Users\Application Data\SweetIM

+-----------------| Other Adwares Deleted:

.
HKCR\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
.
C:\Program Files\Conduit
C:\Documents and Settings\jean thiebaut\Cookies\jean_thiebaut@atdmt[2].txt

(!) ---- Temp files deleted.
(!) ---- Recycle bin emptied in all drives.


+-----------------| Added Scan :

---- Mozilla FireFox Version [Unable to get version] ----

ProfilePath: rivxi91f.default
.
Prefs.js: Browser.Search.DefaultEngineName: "Google"
Prefs.js: Browser.Search.SelectedEngine: "Google"
Prefs.js: Browser.Search.DefaultUrl: "hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q="
.
.
.
.
.

---- Internet Explorer Version 7.0.5730.13 ----

+-[HKEY_CURRENT_USER\..\Internet Explorer\Main]

Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

+-[HKEY_USERS\S-1-5-21-4117893582-3251523194-220142345-1005\..\Internet Explorer\Main]

Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

+-[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://search.msn.com/spbasic.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start page: hxxp://fr.msn.com/

+-[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

Tabs: hxxp://ieframe.dll/tabswelcome.htm

+---------------------------------------------------------------------------+

[~15196 Bytes] - "C:\Ad-Report-Scan-24.02.2009.log"
[~11503 Bytes] - "C:\Ad-Report-Clean-24.02.2009.log"
-
C:\Program Files\Ad-remover\TOOLS\BACKUP\24.02.2009 - Prefs.js

End at: 3:53:06 | 24/02/2009
.
+-----------------| E.O.F - 178 Lines
.
Messages postés
85925
Date d'inscription
dimanche 11 juillet 2010
Statut
Modérateur
Dernière intervention
30 octobre 2019
10 091
---> Désinstalle AD-Remover.

---> Réinstalle les applications qui ont été infectées (Antivirus...).

---> Télécharge Malwarebytes' Anti-Malware (MBAM) sur ton Bureau.
---> Double-clique sur le fichier téléchargé pour lancer le processus d'installation.
---> Dans l'onglet Mise à jour, clique sur le bouton Recherche de mise à jour : si le pare-feu demande l'autorisation à MBAM de se connecter à Internet, accepte.
---> Une fois la mise à jour terminée, rends-toi dans l'onglet Recherche.
---> Sélectionne Exécuter un examen rapide.
---> Clique sur Rechercher. L'analyse démarre.

A la fin de l'analyse, un message s'affiche :

L'examen s'est terminé normalement. Cliquez sur 'Afficher les résultats' pour afficher tous les objets trouvés.

---> Clique sur OK pour poursuivre. Si MBAM n'a rien trouvé, il te le dira aussi.
---> Ferme tes navigateurs.
Si des malwares ont été détectés, clique sur Afficher les résultats.
---> Sélectionne tout (ou laisse coché) et clique sur Supprimer la sélection, MBAM va détruire les fichiers et clés de registre infectés et en mettre une copie dans la quarantaine.
---> MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Copie-colle ce rapport dans ta prochaine réponse.
Messages postés
85925
Date d'inscription
dimanche 11 juillet 2010
Statut
Modérateur
Dernière intervention
30 octobre 2019
10 091
Bonne nuit ;)
bonne nuit à toi aussi, je vais etre fraiche pour bosser demain matin
mais mon ordi à l'air en forme grace à toi
mille mercis
je t'envoie les rapports
demain
Messages postés
19
Date d'inscription
lundi 23 février 2009
Statut
Membre
Dernière intervention
24 février 2009

hello
de retour sur le forum voici mon rapport d'hier soir
j'espère que je ne suis plus infestée
ce soir avast me détecte à trois reprise un cheval de troie, j'espère que ce n'est pas le retour du bagle
rapport
Malwarebytes' Anti-Malware 1.34
Version de la base de données: 1798
Windows 5.1.2600 Service Pack 3

24/02/2009 04:29:53
mbam-log-2009-02-24 (04-29-53).txt

Type de recherche: Examen rapide
Eléments examinés: 62523
Temps écoulé: 4 minute(s), 27 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)