Pb svchost.exe rapport hijackthis
aymeric
-
sherred Messages postés 8605 Statut Membre -
sherred Messages postés 8605 Statut Membre -
Bonjour,
Alors voila mon probleme.
Actuellement je suis obliger de passé par le mode sans echec pour avoir accés a internet et tout types de logiciels.
Sinon quand je suis en mode normal j'ai une petite fenetre qui apparait où c'est écrit svchost.exe la memoire de ne peut etre read avec un numero qui est "0x755cd383" puis 0x00000060.
J'ai fait passé un scan malwarebytes en mode sans echec et hijackthis donc voila ce que j'ai comme rapport:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:57:48, on 21/04/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Safe mode with network support
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\denis\Bureau\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - (no file)
R3 - URLSearchHook: (no name) - {EEE6C35D-6118-11DC-9C72-001320C79847} - (no file)
O2 - BHO: (no name) - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: (no name) - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - (no file)
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\SweetIM\Messenger\SweetIM.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] ~"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Notification de cadeaux MSN.lnk = C:\Documents and Settings\denis\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} (Creative Software AutoUpdate) - http://www.creative.com/softwareupdate/su/ocx/15101/CTSUEng.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupdate/su/ocx/15102/CTPID.cab
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Fichiers communs\SureThing Shared\stllssvr.exe
Alors voila mon probleme.
Actuellement je suis obliger de passé par le mode sans echec pour avoir accés a internet et tout types de logiciels.
Sinon quand je suis en mode normal j'ai une petite fenetre qui apparait où c'est écrit svchost.exe la memoire de ne peut etre read avec un numero qui est "0x755cd383" puis 0x00000060.
J'ai fait passé un scan malwarebytes en mode sans echec et hijackthis donc voila ce que j'ai comme rapport:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:57:48, on 21/04/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Safe mode with network support
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\denis\Bureau\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - (no file)
R3 - URLSearchHook: (no name) - {EEE6C35D-6118-11DC-9C72-001320C79847} - (no file)
O2 - BHO: (no name) - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: (no name) - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - (no file)
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\SweetIM\Messenger\SweetIM.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] ~"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Notification de cadeaux MSN.lnk = C:\Documents and Settings\denis\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} (Creative Software AutoUpdate) - http://www.creative.com/softwareupdate/su/ocx/15101/CTSUEng.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupdate/su/ocx/15102/CTPID.cab
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Fichiers communs\SureThing Shared\stllssvr.exe
A voir également:
- Pb svchost.exe rapport hijackthis
- Hijackthis - Télécharger - Antivirus & Antimalwares
- Svchost.exe c'est quoi - Guide
- Plan rapport de stage - Guide
- Rapport de crash windows - Guide
- Impression rapport de stage ✓ - Forum Word
6 réponses
Salut,
Télécharges AD-Remover ( de Cyrildu17 / C_XX ) sur ton bureau :
http://sd-1.archive-host.com/membres/up/16506160323759868/AD-R.exe
/!\ Déconnectes toi et fermes toutes applications en cours
● Double clique sur le programme d'installation , et installe le dans son emplacement par défaut. ( C:\Program files )
● Double clique sur l'icône Ad-remover située sur ton bureau
● Au menu principal choisi l'option "A"
● Postes le rapport qui apparait à la fin .
( le rapport est sauvegardé aussi sous C:\Ad-report(date).log )
(CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )
Télécharges AD-Remover ( de Cyrildu17 / C_XX ) sur ton bureau :
http://sd-1.archive-host.com/membres/up/16506160323759868/AD-R.exe
/!\ Déconnectes toi et fermes toutes applications en cours
● Double clique sur le programme d'installation , et installe le dans son emplacement par défaut. ( C:\Program files )
● Double clique sur l'icône Ad-remover située sur ton bureau
● Au menu principal choisi l'option "A"
● Postes le rapport qui apparait à la fin .
( le rapport est sauvegardé aussi sous C:\Ad-report(date).log )
(CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )
ensuite
dans le menu DEMARRER
tu clic sur EXECUTER
et tu tappe "msconfig"
tu va dans l'onglé demarrage
et tu décoche tout vraiment tout
tu ne risque rien "ca n'efface rien"
tu redemarre le pc en mode normale
un fenetre va s'afficher tu la decoche et ok
dans le menu DEMARRER
tu clic sur EXECUTER
et tu tappe "msconfig"
tu va dans l'onglé demarrage
et tu décoche tout vraiment tout
tu ne risque rien "ca n'efface rien"
tu redemarre le pc en mode normale
un fenetre va s'afficher tu la decoche et ok
rapport ad remover
------- LOGFILE OF AD-REMOVER 1.1.3.2 | ONLY XP/VISTA -------
Updated by C_XX on 19/04/2009 at 22:00
Contact: AdRemover.contact@gmail.com
Website: http://pagesperso-orange.fr/FindyKill.Ad.Remover/
Start at: 11:31:52, 21/04/2009 | Boot mode: Safe Boot
Option: SCAN | Executed from: C:\Program Files\Ad-remover\Ad-remover.bat
Operating System: Microsoft® Windows XP™ Service Pack 3 (version 5.1.2600)
Computer Name: FAMILLE
Current User: denis - Administrator
Drive(s):
- C:\ (File System: NTFS)
- E:\ (File System: NTFS)
============ Known Adwares Found ============
.
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9D5BD211-422C-4164-9298-BB4186A30F31}
.
+-----------------| Eorezo Elements Found:
.
+-----------------| It's TV Elements Found:
.
+-----------------| Sweetim Elements Found:
HKCU\Software\SweetIM
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\Sweetim
HKCU\Software\Microsoft\Internet Explorer\UrlSearchHooks\\{EEE6C35D-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EEE6C35B-6118-11DC-9C72-001320C79847}
.
C:\Documents and Settings\denis\Application Data\Mozilla\Firefox\Profiles\w1jaq9pv.default\searchplugins\sweetim.xml
C:\Documents and Settings\denis\Application Data\Mozilla\Firefox\Profiles\w1jaq9pv.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}
C:\Documents and Settings\denis\Application Data\Mozilla\Firefox\Profiles\w1jaq9pv.default\SweetIMToolbarData
C:\Documents and Settings\denis\Cookies\denis@search.sweetim[1].txt
+-----------------| Added Scan:
---- Mozilla FireFox Version 3.0.8 ----
ProfilePath: w1jaq9pv.default (denis)
.
Prefs.js: Browser.Search.DefaultEngineName: "SweetIM Search"
Prefs.js: Browser.Search.DefaultEngineName: "Live Search"
Prefs.js: Browser.Search.SelectedEngine: "SweetIM Search"
Prefs.js: Browser.Search.SelectedEngine: "Live Search"
Prefs.js: Browser.Search.DefaultUrl: "hxxp://search.sweetim.com/search.asp?src=2&q="
Prefs.js: Browser.Search.DefaultUrl: "hxxp://search.live.com/results.aspx?FORM=IEFM1&q="
.
(Prefs.js) FOUND: user_pref("browser.search.defaultenginename", "SweetIM Search");
(Prefs.js) FOUND: user_pref("browser.search.defaulturl", "https://search.sweetim.com/search.asp?src=2&q=");
(Prefs.js) FOUND: user_pref("browser.search.selectedEngine", "SweetIM Search");
(Prefs.js) FOUND: user_pref("browser.startup.homepage", "https://home.sweetim.com/");
(Prefs.js) FOUND: user_pref("keyword.URL", "https://search.sweetim.com/search.asp?src=2&q=");
(Prefs.js) FOUND: user_pref("sweetim.toolbar.highlight.colors", "#FFFF00,#00FFE4,#5AFF00,#0087FF,#FFCC00,#FF00F0");
(Prefs.js) FOUND: user_pref("sweetim.toolbar.logger.ConsoleHandler.MinReportLevel", "7");
(Prefs.js) FOUND: user_pref("sweetim.toolbar.logger.FileHandler.FileName", "ff-toolbar.log");
(Prefs.js) FOUND: user_pref("sweetim.toolbar.logger.FileHandler.MaxFileSize", "200000");
(Prefs.js) FOUND: user_pref("sweetim.toolbar.logger.FileHandler.MinReportLevel", "7");
(Prefs.js) FOUND: user_pref("sweetim.toolbar.mode.debug", "false");
(Prefs.js) FOUND: user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "Live Search");
(Prefs.js) FOUND: user_pref("sweetim.toolbar.previous.browser.search.defaulturl", "https://www.bing.com/?scope=web&mkt=fr-FR&FORM=IEFM1");
(Prefs.js) FOUND: user_pref("sweetim.toolbar.previous.browser.search.selectedEngine", "Live Search");
(Prefs.js) FOUND: user_pref("sweetim.toolbar.previous.browser.startup.homepage", "https://www.google.fr/?gws_rd=ssl");
(Prefs.js) FOUND: user_pref("sweetim.toolbar.previous.keyword.URL", "https://www.bing.com/?scope=web&mkt=fr-FR&FORM=MICWU0");
(Prefs.js) FOUND: user_pref("sweetim.toolbar.search.external", "<?xml version=\"1.0\"?><TOOLBAR><EXTERNAL_SEARCH engine=\"http://*google.*\" param=\"q=\" /><EXTERNAL_SEARCH engine=\"https://search.yahoo.com/*\" param=\"p=\" /><EXTERNAL_SEARCH engine=\"http://search.sweetim.*\" param=\"q=\" /><EXTERNAL_SEARCH engine=\"http://*.live.*/*\" param=\"q=\" /><EXTERNAL_SEARCH engine=\"http://*youtube.com/\" param=\"search_query=\" /><EXTERNAL_SEARCH engine=\"http://*.ebay.*/search/*\" param=\"satitle=\" /><EXTERNAL_SEARCH engine=\"http://*.amazon.com/s/*\" param=\"field-keywords=\" /></TOOLBAR>");
(Prefs.js) FOUND: user_pref("sweetim.toolbar.search.history.capacity", "10");
(Prefs.js) FOUND: user_pref("sweetim.toolbar.simapp_id", "{C1C752F0-A858-4FF6-A9A5-A7CF915DF2FE}");
(Prefs.js) FOUND: user_pref("sweetim.toolbar.urls.homepage", "https://home.sweetim.com/");
(Prefs.js) FOUND: user_pref("sweetim.toolbar.version", "1.0.0.8");
.
.
.
.
---- Internet Explorer Version 7.0.5730.13 ----
[HKEY_CURRENT_USER\..\Internet Explorer\Main]
Search bar: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start page: hxxp://google.fr/
[HKEY_USERS\S-1-5-21-1993962763-963894560-725345543-1003\..\Internet Explorer\Main]
Search bar: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start page: hxxp://google.fr/
[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://search.msn.com/spbasic.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start page: hxxp://fr.msn.com/
[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]
Tabs: hxxp://ieframe.dll/tabswelcome.htm
+---------------------------------------------------------------------------+
9395 Byte(s) - C:\Ad-Report-Clean-21.04.2009.log
10100 Byte(s) - C:\Ad-Report-Scan-20.04.2009.log
6047 Byte(s) - C:\Ad-Report-Scan-21.04.2009.log
0 File(s) - C:\Program Files\Ad-remover\TOOLS\BACKUP
2 File(s) - C:\Program Files\Ad-remover\TOOLS\QUARANTINE
End at: 11:39:04 | 21/04/2009
.
+-----------------| E.O.F
.
------- LOGFILE OF AD-REMOVER 1.1.3.2 | ONLY XP/VISTA -------
Updated by C_XX on 19/04/2009 at 22:00
Contact: AdRemover.contact@gmail.com
Website: http://pagesperso-orange.fr/FindyKill.Ad.Remover/
Start at: 11:31:52, 21/04/2009 | Boot mode: Safe Boot
Option: SCAN | Executed from: C:\Program Files\Ad-remover\Ad-remover.bat
Operating System: Microsoft® Windows XP™ Service Pack 3 (version 5.1.2600)
Computer Name: FAMILLE
Current User: denis - Administrator
Drive(s):
- C:\ (File System: NTFS)
- E:\ (File System: NTFS)
============ Known Adwares Found ============
.
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9D5BD211-422C-4164-9298-BB4186A30F31}
.
+-----------------| Eorezo Elements Found:
.
+-----------------| It's TV Elements Found:
.
+-----------------| Sweetim Elements Found:
HKCU\Software\SweetIM
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\Sweetim
HKCU\Software\Microsoft\Internet Explorer\UrlSearchHooks\\{EEE6C35D-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EEE6C35B-6118-11DC-9C72-001320C79847}
.
C:\Documents and Settings\denis\Application Data\Mozilla\Firefox\Profiles\w1jaq9pv.default\searchplugins\sweetim.xml
C:\Documents and Settings\denis\Application Data\Mozilla\Firefox\Profiles\w1jaq9pv.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}
C:\Documents and Settings\denis\Application Data\Mozilla\Firefox\Profiles\w1jaq9pv.default\SweetIMToolbarData
C:\Documents and Settings\denis\Cookies\denis@search.sweetim[1].txt
+-----------------| Added Scan:
---- Mozilla FireFox Version 3.0.8 ----
ProfilePath: w1jaq9pv.default (denis)
.
Prefs.js: Browser.Search.DefaultEngineName: "SweetIM Search"
Prefs.js: Browser.Search.DefaultEngineName: "Live Search"
Prefs.js: Browser.Search.SelectedEngine: "SweetIM Search"
Prefs.js: Browser.Search.SelectedEngine: "Live Search"
Prefs.js: Browser.Search.DefaultUrl: "hxxp://search.sweetim.com/search.asp?src=2&q="
Prefs.js: Browser.Search.DefaultUrl: "hxxp://search.live.com/results.aspx?FORM=IEFM1&q="
.
(Prefs.js) FOUND: user_pref("browser.search.defaultenginename", "SweetIM Search");
(Prefs.js) FOUND: user_pref("browser.search.defaulturl", "https://search.sweetim.com/search.asp?src=2&q=");
(Prefs.js) FOUND: user_pref("browser.search.selectedEngine", "SweetIM Search");
(Prefs.js) FOUND: user_pref("browser.startup.homepage", "https://home.sweetim.com/");
(Prefs.js) FOUND: user_pref("keyword.URL", "https://search.sweetim.com/search.asp?src=2&q=");
(Prefs.js) FOUND: user_pref("sweetim.toolbar.highlight.colors", "#FFFF00,#00FFE4,#5AFF00,#0087FF,#FFCC00,#FF00F0");
(Prefs.js) FOUND: user_pref("sweetim.toolbar.logger.ConsoleHandler.MinReportLevel", "7");
(Prefs.js) FOUND: user_pref("sweetim.toolbar.logger.FileHandler.FileName", "ff-toolbar.log");
(Prefs.js) FOUND: user_pref("sweetim.toolbar.logger.FileHandler.MaxFileSize", "200000");
(Prefs.js) FOUND: user_pref("sweetim.toolbar.logger.FileHandler.MinReportLevel", "7");
(Prefs.js) FOUND: user_pref("sweetim.toolbar.mode.debug", "false");
(Prefs.js) FOUND: user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "Live Search");
(Prefs.js) FOUND: user_pref("sweetim.toolbar.previous.browser.search.defaulturl", "https://www.bing.com/?scope=web&mkt=fr-FR&FORM=IEFM1");
(Prefs.js) FOUND: user_pref("sweetim.toolbar.previous.browser.search.selectedEngine", "Live Search");
(Prefs.js) FOUND: user_pref("sweetim.toolbar.previous.browser.startup.homepage", "https://www.google.fr/?gws_rd=ssl");
(Prefs.js) FOUND: user_pref("sweetim.toolbar.previous.keyword.URL", "https://www.bing.com/?scope=web&mkt=fr-FR&FORM=MICWU0");
(Prefs.js) FOUND: user_pref("sweetim.toolbar.search.external", "<?xml version=\"1.0\"?><TOOLBAR><EXTERNAL_SEARCH engine=\"http://*google.*\" param=\"q=\" /><EXTERNAL_SEARCH engine=\"https://search.yahoo.com/*\" param=\"p=\" /><EXTERNAL_SEARCH engine=\"http://search.sweetim.*\" param=\"q=\" /><EXTERNAL_SEARCH engine=\"http://*.live.*/*\" param=\"q=\" /><EXTERNAL_SEARCH engine=\"http://*youtube.com/\" param=\"search_query=\" /><EXTERNAL_SEARCH engine=\"http://*.ebay.*/search/*\" param=\"satitle=\" /><EXTERNAL_SEARCH engine=\"http://*.amazon.com/s/*\" param=\"field-keywords=\" /></TOOLBAR>");
(Prefs.js) FOUND: user_pref("sweetim.toolbar.search.history.capacity", "10");
(Prefs.js) FOUND: user_pref("sweetim.toolbar.simapp_id", "{C1C752F0-A858-4FF6-A9A5-A7CF915DF2FE}");
(Prefs.js) FOUND: user_pref("sweetim.toolbar.urls.homepage", "https://home.sweetim.com/");
(Prefs.js) FOUND: user_pref("sweetim.toolbar.version", "1.0.0.8");
.
.
.
.
---- Internet Explorer Version 7.0.5730.13 ----
[HKEY_CURRENT_USER\..\Internet Explorer\Main]
Search bar: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start page: hxxp://google.fr/
[HKEY_USERS\S-1-5-21-1993962763-963894560-725345543-1003\..\Internet Explorer\Main]
Search bar: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start page: hxxp://google.fr/
[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://search.msn.com/spbasic.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start page: hxxp://fr.msn.com/
[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]
Tabs: hxxp://ieframe.dll/tabswelcome.htm
+---------------------------------------------------------------------------+
9395 Byte(s) - C:\Ad-Report-Clean-21.04.2009.log
10100 Byte(s) - C:\Ad-Report-Scan-20.04.2009.log
6047 Byte(s) - C:\Ad-Report-Scan-21.04.2009.log
0 File(s) - C:\Program Files\Ad-remover\TOOLS\BACKUP
2 File(s) - C:\Program Files\Ad-remover\TOOLS\QUARANTINE
End at: 11:39:04 | 21/04/2009
.
+-----------------| E.O.F
.
Déconnectes toi et fermes toutes applications en cours !
* Relances "Ad-remover" : au menu principal choisi l'option "B" . clean
puis
A supprimer tout
--> le programme va travailler ...
* Postes le rapport qui apparait à la fin + un nouvel Hijackthis pour analyse ...
( le rapport est sauvegardé aussi sous C:\Ad-report.log )
/!\ Si le Bureau ne réapparait pas presse Ctrl + Alt + Suppr , Onglet "Fichier" , "Nouvelle tâche" , tapes explorer.exe et valides) /!\
* Relances "Ad-remover" : au menu principal choisi l'option "B" . clean
puis
A supprimer tout
--> le programme va travailler ...
* Postes le rapport qui apparait à la fin + un nouvel Hijackthis pour analyse ...
( le rapport est sauvegardé aussi sous C:\Ad-report.log )
/!\ Si le Bureau ne réapparait pas presse Ctrl + Alt + Suppr , Onglet "Fichier" , "Nouvelle tâche" , tapes explorer.exe et valides) /!\
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
------- LOGFILE OF AD-REMOVER 1.1.3.2 | ONLY XP/VISTA -------
Updated by C_XX on 19/04/2009 at 22:00
Contact: AdRemover.contact@gmail.com
Website: http://pagesperso-orange.fr/FindyKill.Ad.Remover/
**** LIMITED TO ****
Known Adwares
Eorezo
It's TV
Sweetim
********************
Start at: 12:01:01, 21/04/2009 | Boot mode: Normal Boot
Option: CLEAN | Executed from: C:\Program Files\Ad-remover\Ad-remover.bat
Operating System: Microsoft® Windows XP™ Service Pack 3 (version 5.1.2600)
Computer Name: FAMILLE
Current User: denis - Administrator
Drive(s):
- C:\ (File System: NTFS)
- E:\ (File System: NTFS)
(!) ---- IE start pages/Tabs reset
============ Known Adwares Deleted ============
.
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9D5BD211-422C-4164-9298-BB4186A30F31}
.
+-----------------| Eorezo Elements Deleted :
.
+-----------------| It's TV Elements Deleted :
.
+-----------------| Sweetim Elements Deleted :
HKCU\Software\Microsoft\Internet Explorer\UrlSearchHooks\\{EEE6C35D-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCU\Software\SweetIM
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKLM\Software\Microsoft\Shared Tools\MSConfig\startupreg\SweetIM
.
C:\Documents and Settings\denis\Application Data\Mozilla\Firefox\Profiles\w1jaq9pv.default\searchplugins\sweetim.xml
C:\Documents and Settings\denis\Application Data\Mozilla\Firefox\Profiles\w1jaq9pv.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}
C:\Documents and Settings\denis\Application Data\Mozilla\Firefox\Profiles\w1jaq9pv.default\SweetIMToolbarData
C:\Documents and Settings\denis\Cookies\denis@search.sweetim[1].txt
(!) ---- Temp files deleted.
(!) ---- Recycle bin emptied in all drives.
+-----------------| Added Scan :
---- Mozilla FireFox Version 3.0.8 ----
ProfilePath: w1jaq9pv.default (denis)
.
Prefs.js: Browser.Search.DefaultEngineName: "SweetIM Search"
Prefs.js: Browser.Search.DefaultEngineName: "Live Search"
Prefs.js: Browser.Search.SelectedEngine: "SweetIM Search"
Prefs.js: Browser.Search.SelectedEngine: "Live Search"
Prefs.js: Browser.Search.DefaultUrl: "hxxp://search.sweetim.com/search.asp?src=2&q="
Prefs.js: Browser.Search.DefaultUrl: "hxxp://search.live.com/results.aspx?FORM=IEFM1&q="
.
(Prefs.js) REMOVED: user_pref("browser.search.defaultenginename", "SweetIM Search");
(Prefs.js) REMOVED: user_pref("browser.search.defaulturl", "https://search.sweetim.com/search.asp?src=2&q=");
(Prefs.js) REMOVED: user_pref("browser.search.selectedEngine", "SweetIM Search");
(Prefs.js) REMOVED: user_pref("browser.startup.homepage", "https://home.sweetim.com/");
(Prefs.js) REMOVED: user_pref("keyword.URL", "https://search.sweetim.com/search.asp?src=2&q=");
(Prefs.js) REMOVED: user_pref("sweetim.toolbar.highlight.colors", "#FFFF00,#00FFE4,#5AFF00,#0087FF,#FFCC00,#FF00F0");
(Prefs.js) REMOVED: user_pref("sweetim.toolbar.logger.ConsoleHandler.MinReportLevel", "7");
(Prefs.js) REMOVED: user_pref("sweetim.toolbar.logger.FileHandler.FileName", "ff-toolbar.log");
(Prefs.js) REMOVED: user_pref("sweetim.toolbar.logger.FileHandler.MaxFileSize", "200000");
(Prefs.js) REMOVED: user_pref("sweetim.toolbar.logger.FileHandler.MinReportLevel", "7");
(Prefs.js) REMOVED: user_pref("sweetim.toolbar.mode.debug", "false");
(Prefs.js) REMOVED: user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "Live Search");
(Prefs.js) REMOVED: user_pref("sweetim.toolbar.previous.browser.search.defaulturl", "https://www.bing.com/?scope=web&mkt=fr-FR&FORM=IEFM1");
(Prefs.js) REMOVED: user_pref("sweetim.toolbar.previous.browser.search.selectedEngine", "Live Search");
(Prefs.js) REMOVED: user_pref("sweetim.toolbar.previous.browser.startup.homepage", "https://www.google.fr/?gws_rd=ssl");
(Prefs.js) REMOVED: user_pref("sweetim.toolbar.previous.keyword.URL", "https://www.bing.com/?scope=web&mkt=fr-FR&FORM=MICWU0");
(Prefs.js) REMOVED: user_pref("sweetim.toolbar.search.external", "<?xml version=\"1.0\"?><TOOLBAR><EXTERNAL_SEARCH engine=\"http://*google.*\" param=\"q=\" /><EXTERNAL_SEARCH engine=\"https://search.yahoo.com/*\" param=\"p=\" /><EXTERNAL_SEARCH engine=\"http://search.sweetim.*\" param=\"q=\" /><EXTERNAL_SEARCH engine=\"http://*.live.*/*\" param=\"q=\" /><EXTERNAL_SEARCH engine=\"http://*youtube.com/\" param=\"search_query=\" /><EXTERNAL_SEARCH engine=\"http://*.ebay.*/search/*\" param=\"satitle=\" /><EXTERNAL_SEARCH engine=\"http://*.amazon.com/s/*\" param=\"field-keywords=\" /></TOOLBAR>");
(Prefs.js) REMOVED: user_pref("sweetim.toolbar.search.history.capacity", "10");
(Prefs.js) REMOVED: user_pref("sweetim.toolbar.simapp_id", "{C1C752F0-A858-4FF6-A9A5-A7CF915DF2FE}");
(Prefs.js) REMOVED: user_pref("sweetim.toolbar.urls.homepage", "https://home.sweetim.com/");
(Prefs.js) REMOVED: user_pref("sweetim.toolbar.version", "1.0.0.8");
.
.
.
.
---- Internet Explorer Version 7.0.5730.13 ----
[HKEY_CURRENT_USER\..\Internet Explorer\Main]
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
[HKEY_USERS\S-1-5-21-1993962763-963894560-725345543-1003\..\Internet Explorer\Main]
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://search.msn.com/spbasic.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start page: hxxp://fr.msn.com/
[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]
Tabs: hxxp://ieframe.dll/tabswelcome.htm
+---------------------------------------------------------------------------+
6615 Byte(s) - C:\Ad-Report-Clean-21.04.2009.log
10100 Byte(s) - C:\Ad-Report-Scan-20.04.2009.log
6276 Byte(s) - C:\Ad-Report-Scan-21.04.2009.log
2 File(s) - C:\Program Files\Ad-remover\TOOLS\BACKUP
4 File(s) - C:\Program Files\Ad-remover\TOOLS\QUARANTINE
End at: 12:11:55 | 21/04/2009
.
+-----------------| E.O.F
.
Updated by C_XX on 19/04/2009 at 22:00
Contact: AdRemover.contact@gmail.com
Website: http://pagesperso-orange.fr/FindyKill.Ad.Remover/
**** LIMITED TO ****
Known Adwares
Eorezo
It's TV
Sweetim
********************
Start at: 12:01:01, 21/04/2009 | Boot mode: Normal Boot
Option: CLEAN | Executed from: C:\Program Files\Ad-remover\Ad-remover.bat
Operating System: Microsoft® Windows XP™ Service Pack 3 (version 5.1.2600)
Computer Name: FAMILLE
Current User: denis - Administrator
Drive(s):
- C:\ (File System: NTFS)
- E:\ (File System: NTFS)
(!) ---- IE start pages/Tabs reset
============ Known Adwares Deleted ============
.
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9D5BD211-422C-4164-9298-BB4186A30F31}
.
+-----------------| Eorezo Elements Deleted :
.
+-----------------| It's TV Elements Deleted :
.
+-----------------| Sweetim Elements Deleted :
HKCU\Software\Microsoft\Internet Explorer\UrlSearchHooks\\{EEE6C35D-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCU\Software\SweetIM
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKLM\Software\Microsoft\Shared Tools\MSConfig\startupreg\SweetIM
.
C:\Documents and Settings\denis\Application Data\Mozilla\Firefox\Profiles\w1jaq9pv.default\searchplugins\sweetim.xml
C:\Documents and Settings\denis\Application Data\Mozilla\Firefox\Profiles\w1jaq9pv.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}
C:\Documents and Settings\denis\Application Data\Mozilla\Firefox\Profiles\w1jaq9pv.default\SweetIMToolbarData
C:\Documents and Settings\denis\Cookies\denis@search.sweetim[1].txt
(!) ---- Temp files deleted.
(!) ---- Recycle bin emptied in all drives.
+-----------------| Added Scan :
---- Mozilla FireFox Version 3.0.8 ----
ProfilePath: w1jaq9pv.default (denis)
.
Prefs.js: Browser.Search.DefaultEngineName: "SweetIM Search"
Prefs.js: Browser.Search.DefaultEngineName: "Live Search"
Prefs.js: Browser.Search.SelectedEngine: "SweetIM Search"
Prefs.js: Browser.Search.SelectedEngine: "Live Search"
Prefs.js: Browser.Search.DefaultUrl: "hxxp://search.sweetim.com/search.asp?src=2&q="
Prefs.js: Browser.Search.DefaultUrl: "hxxp://search.live.com/results.aspx?FORM=IEFM1&q="
.
(Prefs.js) REMOVED: user_pref("browser.search.defaultenginename", "SweetIM Search");
(Prefs.js) REMOVED: user_pref("browser.search.defaulturl", "https://search.sweetim.com/search.asp?src=2&q=");
(Prefs.js) REMOVED: user_pref("browser.search.selectedEngine", "SweetIM Search");
(Prefs.js) REMOVED: user_pref("browser.startup.homepage", "https://home.sweetim.com/");
(Prefs.js) REMOVED: user_pref("keyword.URL", "https://search.sweetim.com/search.asp?src=2&q=");
(Prefs.js) REMOVED: user_pref("sweetim.toolbar.highlight.colors", "#FFFF00,#00FFE4,#5AFF00,#0087FF,#FFCC00,#FF00F0");
(Prefs.js) REMOVED: user_pref("sweetim.toolbar.logger.ConsoleHandler.MinReportLevel", "7");
(Prefs.js) REMOVED: user_pref("sweetim.toolbar.logger.FileHandler.FileName", "ff-toolbar.log");
(Prefs.js) REMOVED: user_pref("sweetim.toolbar.logger.FileHandler.MaxFileSize", "200000");
(Prefs.js) REMOVED: user_pref("sweetim.toolbar.logger.FileHandler.MinReportLevel", "7");
(Prefs.js) REMOVED: user_pref("sweetim.toolbar.mode.debug", "false");
(Prefs.js) REMOVED: user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "Live Search");
(Prefs.js) REMOVED: user_pref("sweetim.toolbar.previous.browser.search.defaulturl", "https://www.bing.com/?scope=web&mkt=fr-FR&FORM=IEFM1");
(Prefs.js) REMOVED: user_pref("sweetim.toolbar.previous.browser.search.selectedEngine", "Live Search");
(Prefs.js) REMOVED: user_pref("sweetim.toolbar.previous.browser.startup.homepage", "https://www.google.fr/?gws_rd=ssl");
(Prefs.js) REMOVED: user_pref("sweetim.toolbar.previous.keyword.URL", "https://www.bing.com/?scope=web&mkt=fr-FR&FORM=MICWU0");
(Prefs.js) REMOVED: user_pref("sweetim.toolbar.search.external", "<?xml version=\"1.0\"?><TOOLBAR><EXTERNAL_SEARCH engine=\"http://*google.*\" param=\"q=\" /><EXTERNAL_SEARCH engine=\"https://search.yahoo.com/*\" param=\"p=\" /><EXTERNAL_SEARCH engine=\"http://search.sweetim.*\" param=\"q=\" /><EXTERNAL_SEARCH engine=\"http://*.live.*/*\" param=\"q=\" /><EXTERNAL_SEARCH engine=\"http://*youtube.com/\" param=\"search_query=\" /><EXTERNAL_SEARCH engine=\"http://*.ebay.*/search/*\" param=\"satitle=\" /><EXTERNAL_SEARCH engine=\"http://*.amazon.com/s/*\" param=\"field-keywords=\" /></TOOLBAR>");
(Prefs.js) REMOVED: user_pref("sweetim.toolbar.search.history.capacity", "10");
(Prefs.js) REMOVED: user_pref("sweetim.toolbar.simapp_id", "{C1C752F0-A858-4FF6-A9A5-A7CF915DF2FE}");
(Prefs.js) REMOVED: user_pref("sweetim.toolbar.urls.homepage", "https://home.sweetim.com/");
(Prefs.js) REMOVED: user_pref("sweetim.toolbar.version", "1.0.0.8");
.
.
.
.
---- Internet Explorer Version 7.0.5730.13 ----
[HKEY_CURRENT_USER\..\Internet Explorer\Main]
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
[HKEY_USERS\S-1-5-21-1993962763-963894560-725345543-1003\..\Internet Explorer\Main]
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://search.msn.com/spbasic.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start page: hxxp://fr.msn.com/
[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]
Tabs: hxxp://ieframe.dll/tabswelcome.htm
+---------------------------------------------------------------------------+
6615 Byte(s) - C:\Ad-Report-Clean-21.04.2009.log
10100 Byte(s) - C:\Ad-Report-Scan-20.04.2009.log
6276 Byte(s) - C:\Ad-Report-Scan-21.04.2009.log
2 File(s) - C:\Program Files\Ad-remover\TOOLS\BACKUP
4 File(s) - C:\Program Files\Ad-remover\TOOLS\QUARANTINE
End at: 12:11:55 | 21/04/2009
.
+-----------------| E.O.F
.