Rapports à analyser

dlpworld -
fix200 Messages postés 3365 Statut Contributeur sécurité - 16 mai 2009 à 10:39

Bonjour,

J'ai 2 ordinateurs de même configuration qui, a quelques jours d'intervalles, n'ont plus de connexion Internet disponible. Lorsque je ping un site, j'obtiens bien un retour et mes machines peuvent bien accéder au réseau situé à mon travail. Je suppose une infection mais je n'arrive pas à déterminer de quel virus il pourrait s'agir. J'ai aussi passé mes 2 machines à Malwarebytes' Anti-Malware, sans résultat. Je vous communique les rapports HijackThis effectués sur chaque machine. Merci d'avance pour votre aide.

Machine 1
-------------------------------------------------------------------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:23:26, on 13/05/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\NavNT\vptray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\PROGRA~1\CONTRO~1\bin\optgui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.yahoo.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: SweetIM ToolbarURLSearchHook Class - {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SWEETIE - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [OPTENET_GUI] C:\PROGRA~1\CONTRO~1\bin\optgui.exe
O4 - HKCU\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://c:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {05D96F71-87C6-11D3-9BE4-00902742D6E0} (QuickPlace Class) - http://quickplace.creteil.iufm.fr/qp2.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.mypix.com/fr/fr/importer/ImageUploader4.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = mediatheque-plessis.local
O17 - HKLM\Software\..\Telephony: DomainName = mediatheque-plessis.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = mediatheque-plessis.local
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: Orange Contrôle Parental (OPTENET_FILTER) - Orange - C:\Program Files\Controle Parental\bin\optproxy.exe

-------------------------------------------------------------------------

Machine 2
-------------------------------------------------------------------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:25:35, on 13/05/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\NavNT\vptray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\PROGRA~1\CONTRO~1\bin\optgui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\SoftwareDistribution\Download\b0927adfcd48ce89dff49e60229e9f94\update\update.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,System,
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Cyberlux7] C:\PROGRA~1\DATA-C~1\CYBERL~1\CyberluxClient.exe
O4 - HKLM\..\Run: [OPTENET_GUI] C:\PROGRA~1\CONTRO~1\bin\optgui.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://c:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = mediatheque-plessis.local
O17 - HKLM\Software\..\Telephony: DomainName = mediatheque-plessis.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = mediatheque-plessis.local
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: Orange Contrôle Parental (OPTENET_FILTER) - Orange - C:\Program Files\Controle Parental\bin\optproxy.exe
-------------------------------------------------------------------------

Configuration: Windows XP
Firefox 3.0.10

Afficher la suite

A voir également:

Rapports à analyser
Analyser et reparer un disque dur externe - Guide
Comment analyser une clé usb - Guide
Image analyser - Télécharger - Photo & Graphisme
Analyser performance pc - Guide
Analyser disque dur - Télécharger - Informations & Diagnostic

4 réponses

Réponse 1 / 4
arthurg95 Messages postés 2440 Date d'inscription Statut Membre Dernière intervention 343

J'ai pas regardé ton rapport, je n'ai pas le temps, mais essaye de démarrer en mode sans echec avec prise en charge réseau et d'aller sur internet voir si ça marche.
0
1. dlpworld
  
  J'ai oublié de préciser que j'avais tenté cette solution, sans résultat non plus...
  
  0
Réponse 2 / 4
arthurg95 Messages postés 2440 Date d'inscription Statut Membre Dernière intervention 343

As-tu essayé un autre naviguateur, comme firefox ou opéra ?
0
1. dlpworld
  
  Oui, j'ai essayé Firefox et IE8
  
  0
Réponse 3 / 4
fix200 Messages postés 3365 Statut Contributeur sécurité 158

La machine 1 il y a une infection, (pas grave)

Le machine 2 il y a un fichier infecté .

Pour la machine 1:

Transmet ce programe depuis un autre PC connecté a internet

▶ Télécharge Ad-Remover de C_XX sur ton bureau :

tutoriel installation

tutoriel recherche

/!\ Ne fait pas le nettoyage tout de suite /!\

▶ Double clique sur le programme d'installation , et installe le dans son emplacement par défaut. ( le bureau )

▶ Ouvre le dossier Ad-remover présent sur ton bureau

▶ Double clique sur Ad-remover.bat.

▶ Au menu principal choisi l'option "A"

▶ Poste le rapport qui apparait à la fin.

( le rapport est sauvegardé aussi sous C:\Ad-report.log )

(CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

Note :

Process.exe est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.

@+
0
1. dlpworld
  
  OK alors sur la machine 1, j'ai fais la démarche indiquée. Dois-je faire la même chose sur la machine 2. En tout cas, voici le rapport issu de la machine 1 :
  
  --------------------------------------------------------------------------------------
  ------ LOGFILE OF AD-REMOVER 1.1.3.7 | ONLY XP/VISTA -------
  
  Updated by C_XX on 11/05/2009 at 16:00
  Contact: AdRemover.contact@gmail.com
  Website: http://pagesperso-orange.fr/NosTools/ad_remover.html
  
  Start at: 16:35:04, 13/05/2009 | Boot mode: Normal Boot
  Option: Scan | Executed from: C:\Program Files\Ad-remover\
  Operating System: Microsoft® Windows XP™ Service Pack 3 (version 5.1.2600)
  Computer Name: PST_INTERNET_2
  Current User: cyberlux - Administrator
  Drive(s):
  - B:\ (File System: FAT)
  - C:\ (File System: NTFS)
  - E:\ (File System: FAT)
  
  (!) ---- C:\Documents and Settings\Administrateur\Ntuser.dat Loaded as: 'HKU\Administrateur'
  (!) ---- C:\Documents and Settings\Administrateur.MEDIATHEQUE\Ntuser.dat Loaded as: 'HKU\Administrateur.MEDIATHEQUE'
  (!) ---- C:\Documents and Settings\passman\Ntuser.dat Loaded as: 'HKU\passman'
  
  ============ Known Adwares Found ============
  
  .
  .
  
  +-----------------| Eorezo Elements Found:
  
  .
  
  +-----------------| It's TV Elements Found:
  
  .
  
  +-----------------| Sweetim Elements Found:
  
  HKCR\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}
  HKCR\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064}
  HKCR\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}
  HKCR\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847}
  HKCR\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}
  HKCR\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}
  HKCR\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}
  HKCR\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}
  HKCR\MediaPlayer.GraphicsUtils
  HKCR\MediaPlayer.GraphicsUtils.1
  HKCR\MgMediaPlayer.GifAnimator
  HKCR\MgMediaPlayer.GifAnimator.1
  HKCR\SWEETIE.IEToolbar
  HKCR\SWEETIE.IEToolbar.1
  HKCR\SWEETIE.SWEETIE
  HKCR\SWEETIE.SWEETIE.3
  HKCR\SweetIM_URLSearchHook.ToolbarURLSearchHook
  HKCR\SweetIM_URLSearchHook.ToolbarURLSearchHook.1
  HKCR\Toolbar3.SWEETIE
  HKCR\Toolbar3.SWEETIE.1
  HKCR\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}
  HKCR\Typelib\{EEE6C35E-6118-11DC-9C72-001320C79847}
  HKCR\Typelib\{EEE6C35F-6118-11DC-9C72-001320C79847}
  HKCU\Software\SweetIM
  HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}
  HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
  HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
  HKLM\Software\Classes\MediaPlayer.GraphicsUtils
  HKLM\Software\Classes\MediaPlayer.GraphicsUtils.1
  HKLM\Software\Classes\MgMediaPlayer.GifAnimator
  HKLM\Software\Classes\MgMediaPlayer.GifAnimator.1
  HKLM\Software\Classes\SWEETIE.IEToolbar
  HKLM\Software\Classes\SWEETIE.IEToolbar.1
  HKLM\Software\Classes\SWEETIE.SWEETIE
  HKLM\Software\Classes\SWEETIE.SWEETIE.3
  HKLM\Software\Classes\SweetIM_URLSearchHook.ToolbarURLSearchHook
  HKLM\Software\Classes\SweetIM_URLSearchHook.ToolbarURLSearchHook.1
  HKLM\Software\Classes\Toolbar3.SWEETIE
  HKLM\Software\Classes\Toolbar3.SWEETIE.1
  HKLM\Software\Classes\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}
  HKLM\Software\Classes\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}
  HKLM\Software\Classes\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}
  HKLM\Software\Classes\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}
  HKLM\Software\Classes\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064}
  HKLM\Software\Classes\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}
  HKLM\Software\Classes\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847}
  HKLM\Software\Classes\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}
  HKLM\Software\Classes\Interface\{A439801C-961D-452C-AB42-7848E9CBD289}
  HKLM\Software\Classes\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}
  HKLM\Software\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}
  HKLM\Software\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}
  HKLM\Software\Classes\Interface\{F4EBB1E2-21F3-4786-8CF4-16EC5925867F}
  HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}
  HKLM\Software\Microsoft\Shared Tools\MSConfig\startupreg\SweetIM
  HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe
  HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{266C7330-C0F4-49E5-8F20-A56F9F822875}
  HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}
  HKLM\Software\SweetIM
  HKCU\Software\Microsoft\Internet Explorer\UrlSearchHooks\\{EEE6C35D-6118-11DC-9C72-001320C79847}
  HKLM\Software\Microsoft\Internet Explorer\Toolbar\\{EEE6C35B-6118-11DC-9C72-001320C79847}
  HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EEE6C35B-6118-11DC-9C72-001320C79847}
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\07D5290CDBDAE4242926B8E6CA650501
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\08E33F7B61DEFF24BB9673ED7D467636
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\0E3D8A5B48622A445A7DF73FEFF32C3F
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\1AC67655DD68F8240B2860F2D511EBD8
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\34EDDB1BFB3A2D448845F3EFD0F15A43
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\351716A953E21214898904032EAE2E81
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\397C771A7BCAC904697C3EC629ED33ED
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\427EA997C413D1D47907CBFC7B2DB432
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\4318DF19719275242801CBE292063A4C
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\45FC115D1FEAEF849A4E1610D6EC8BF0
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\46A5861A389ADB844AF89E31BC9DF0A1
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\49B0E1A6FF50BBE4289E4E23DE6EA0C7
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\4CCCAC049F34D0540AAC13011398BEDB
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5C4389D0BFB302C479DE4178BD5D9EBA
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5D19F074C042AD34BAB463D4175A062E
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5D2B09BDEF4FE54418E6F3373CDBC7AC
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\61B65D3397A1FBF4CB1571B5E4F6B5B0
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\68E8A05C60DD9254591DBD16C94EDDBF
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\697E782CF574CC34CBB9566440BA12BC
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\6AE27A8613CF7EA4782F2886F67295E5
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\7CE172051F585E04187BCB97570BFA74
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\86A901BA5265452499DCBF719C378EE3
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\88ABD1CD5C40EC84789A7F6EF86DAC5E
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\980289C22F80A7C4BB9323DC61255E4E
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\98CC8BF5A4A6E6C4ABF7051DDAB8B058
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\9A4B7EF3789F871419D9302583B20C15
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\A189D17A469616C4688D23E192996267
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\A6C53B0F76C44004A8F36716213017DB
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\B59F2D8189784CC46A4597F2842480B0
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\BD746FB95FB8E5B45BF66BE54D5FD91F
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\CCF399FCD6D2D3F46BF02A1378654FC9
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D149C1355C98DE24E82CEFBD996FE06A
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D15DAF33C220F91468A1D7D57C31ACD7
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D3BA76A44C779424889063D5098ED2D6
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D6D0EB9FDBD90C04D92A7E729058F10D
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\DB59FDB786388EA4D897F3EE715683AC
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\DB8DAD19CFBCC2049A4477183787E8C5
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E1C820A74ED67374BA048B52CB3C3804
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E337925F629CF4C4FB08F3D9674DD839
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E4748F9A4181FCE46A23C13B517B9420
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\EC65F200D112357449C8B1BC3CFA03D0
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\F327D0C73C0973644A21E8CC852267A0
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\FA96423FE2B98E248A3B23548D1E22D9
  .
  C:\WINDOWS\Installer\520052.msi
  C:\WINDOWS\Installer\520058.msi
  C:\Program Files\SweetIM
  C:\Documents and Settings\cyberlux\Application Data\Mozilla\Firefox\Profiles\juij7qqu.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}
  C:\Documents and Settings\cyberlux\Application Data\Mozilla\Firefox\Profiles\juij7qqu.default\SweetIMToolbarData
  C:\Documents and Settings\All Users\Application Data\SweetIM
  C:\WINDOWS\Prefetch\SWEETIM.EXE-114201E6.pf
  
  +-----------------| Added Scan:
  
  ---- Mozilla FireFox Version 3.0.1 ----
  
  ProfilePath: juij7qqu.default (cyberlux)
  .
  (Prefs.js) user_pref("browser.search.defaultenginename", "SweetIM Search");
  (Prefs.js) user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "chrome://browser-region/locale/region.properties");
  (Prefs.js) user_pref("browser.search.selectedEngine", "SweetIM Search");
  (Prefs.js) user_pref("browser.search.defaulturl", "hxxp://search.sweetim.com/search.asp?src=2&q=");
  (Prefs.js) user_pref("browser.startup.homepage", "hxxp://www.yahoo.fr");
  (Prefs.js) user_pref("browser.startup.homepage_override.mstone", "rv:1.9.0.1");
  (Prefs.js) user_pref("sweetim.toolbar.previous.browser.startup.homepage", "hxxp://www.yahoo.fr");
  .
  (Prefs.js) Found: user_pref("browser.search.defaultenginename", "SweetIM Search");
  (Prefs.js) Found: user_pref("browser.search.defaulturl", "hxxp://search.sweetim.com/search.asp?src=2&q=");
  (Prefs.js) Found: user_pref("browser.search.selectedEngine", "SweetIM Search");
  (Prefs.js) Found: user_pref("keyword.URL", "hxxp://search.sweetim.com/search.asp?src=2&q=");
  (Prefs.js) Found: user_pref("sweetim.toolbar.highlight.colors", "#FFFF00,#00FFE4,#5AFF00,#0087FF,#FFCC00,#FF00F0");
  (Prefs.js) Found: user_pref("sweetim.toolbar.logger.ConsoleHandler.MinReportLevel", "7");
  (Prefs.js) Found: user_pref("sweetim.toolbar.logger.FileHandler.FileName", "ff-toolbar.log");
  (Prefs.js) Found: user_pref("sweetim.toolbar.logger.FileHandler.MaxFileSize", "200000");
  (Prefs.js) Found: user_pref("sweetim.toolbar.logger.FileHandler.MinReportLevel", "7");
  (Prefs.js) Found: user_pref("sweetim.toolbar.mode.debug", "false");
  (Prefs.js) Found: user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "chrome://browser-region/locale/region.properties");
  (Prefs.js) Found: user_pref("sweetim.toolbar.previous.browser.startup.homepage", "hxxp://www.yahoo.fr");
  (Prefs.js) Found: user_pref("sweetim.toolbar.previous.keyword.URL", "chrome://browser-region/locale/region.properties");
  (Prefs.js) Found: user_pref("sweetim.toolbar.search.external", "<?xml version=\"1.0\"?><TOOLBAR><EXTERNAL_SEARCH engine=\"hxxp://*google.*\" param=\"q=\" /><EXTERNAL_SEARCH engine=\"hxxp://search.yahoo.com/*\" param=\"p=\" /><EXTERNAL_SEARCH engine=\"hxxp://search.sweetim.*\" param=\"q=\" /><EXTERNAL_SEARCH engine=\"hxxp://*.live.*/*\" param=\"q=\" /><EXTERNAL_SEARCH engine=\"hxxp://*youtube.com/\" param=\"search_query=\" /><EXTERNAL_SEARCH engine=\"hxxp://*.ebay.*/search/*\" param=\"satitle=\" /><EXTERNAL_SEARCH engine=\"hxxp://*.amazon.com/s/*\" param=\"field-keywords=\" /></TOOLBAR>");
  (Prefs.js) Found: user_pref("sweetim.toolbar.search.history", "notation%20claquette");
  (Prefs.js) Found: user_pref("sweetim.toolbar.search.history.capacity", "10");
  (Prefs.js) Found: user_pref("sweetim.toolbar.simapp_id", "{76E8FBF5-8D30-4027-8AE0-5C80A07EF04D}");
  (Prefs.js) Found: user_pref("sweetim.toolbar.urls.homepage", "hxxp://home.sweetim.com");
  (Prefs.js) Found: user_pref("sweetim.toolbar.version", "1.0.0.8");
  
  ---- Internet Explorer Version 8.0.6001.18702 ----
  
  [HKEY_CURRENT_USER\..\Internet Explorer\Main]
  
  Default_Page_URL: hxxp://go.microsoft.com/fwlink/?LinkId=69157
  Search Page: hxxp://www.google.com
  
  [HKEY_USERS\S-1-5-21-1060284298-261903793-682003330-1618\..\Internet Explorer\Main]
  
  Default_Page_URL: hxxp://go.microsoft.com/fwlink/?LinkId=69157
  Search Page: hxxp://www.google.com
  
  [HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]
  
  Default_Page_URL: hxxp://go.microsoft.com/fwlink/?LinkId=69157
  Default_Search_URL: hxxp://go.microsoft.com/fwlink/?LinkId=54896
  Search Page: hxxp://go.microsoft.com/fwlink/?LinkId=54896
  Start Page: hxxp://go.microsoft.com/fwlink/?LinkId=69157
  
  [HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]
  
  Tabs: hxxp://ieframe.dll/tabswelcome.htm
  
  =========== Suspicious ==========
  
  0
  1. fix200 Messages postés 3365 Statut Contributeur sécurité 158 > dlpworld
    
    Ne fait pas la même chose pour la machine 2.
    
    Pour la machine 1:
    
    ! Déconnecte toi et fermes toutes applications en cours !
    
    ● tutoriel nettoyage
    
    ● Relances "Ad-remover" : au menu principal choisi l'option "B" .
    
    ● Coche à l'écran de sélection :
    
    4. Suppression Sweetim
    
    ● Puis choisi "S" , le programme va travailler,
    
    ● Postes le rapport qui apparait à la fin.
    
    ( le rapport est sauvegardé aussi sous C:\Ad-report(date).log )
    
    (CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )
    
    /!\ Si le Bureau ne réapparait pas presse Ctrl + Alt + Suppr , Onglet "Fichier" , "Nouvelle tâche" , tapes explorer.exe et valides)
    **************************************************************
    Pour les deux machines:
    
    Télécharge Random's System Information Tool (RSIT) par random/random
    et sauvegarde-le sur ton Bureau.
    
    ● Double-clique sur RSIT.exe afin de lancer RSIT.
    
    ● Clique sur Continue à l'écran Disclaimer.
    
    ● Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera et tu devras accepter la licence.
    
    ● Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront.
    
    ● Poste le contenu de log.txt (qui sera affiché) ainsi que de info.txt (<<qui sera réduit dans la Barre des Tâches).
    
    Note : Les deux rapports sont également sauvegardés %systemroot%\rsit
    
    **************************************************************
    Tu peux reparer tes connexions en suivant cette astuce
    
    PS: Attends moi je reviens demain matin environ 8h30 - 9h00
    
    Bon courage.
    
    0
  2. dlpworld > fix200 Messages postés 3365 Statut Contributeur sécurité
    
    Je viens de faire ma démarche prescrite et voici le rapport. A noter qu'à l'issue de cette manip, Internet ne fonctionne pas encore.
    
    ------- LOGFILE OF AD-REMOVER 1.1.3.7 | ONLY XP/VISTA -------
    
    Updated by C_XX on 11/05/2009 at 16:00
    Contact: AdRemover.contact@gmail.com
    Website: http://pagesperso-orange.fr/NosTools/ad_remover.html
    
    **** LIMITED TO ****
    
    Known Adwares
    Eorezo
    It's TV
    Sweetim
    
    ********************
    
    Start at: 9:54:33, 14/05/2009 | Boot mode: Normal Boot
    Option: Clean | Executed from: C:\Program Files\Ad-remover\
    Operating System: Microsoft® Windows XP™ Service Pack 3 (version 5.1.2600)
    Computer Name: PST_INTERNET_2
    Current User: cyberlux - Administrator
    Drive(s):
    - C:\ (File System: NTFS)
    
    (!) ---- C:\Documents and Settings\Administrateur\Ntuser.dat Loaded as: 'HKU\Administrateur'
    (!) ---- C:\Documents and Settings\Administrateur.MEDIATHEQUE\Ntuser.dat Loaded as: 'HKU\Administrateur.MEDIATHEQUE'
    (!) ---- C:\Documents and Settings\passman\Ntuser.dat Loaded as: 'HKU\passman'
    
    (!) ---- IE start pages/Tabs reset
    
    ============ Known Adwares Deleted ============
    
    .
    .
    
    +-----------------| Eorezo Elements Deleted :
    
    .
    
    +-----------------| It's TV Elements Deleted :
    
    .
    
    +-----------------| Sweetim Elements Deleted :
    
    HKCU\Software\Microsoft\Internet Explorer\UrlSearchHooks\\{EEE6C35D-6118-11DC-9C72-001320C79847}
    HKLM\Software\Microsoft\Internet Explorer\Toolbar\\{EEE6C35B-6118-11DC-9C72-001320C79847}
    HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EEE6C35B-6118-11DC-9C72-001320C79847}
    HKCR\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}
    HKCR\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064}
    HKCR\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}
    HKCR\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847}
    HKCR\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}
    HKCR\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}
    HKCR\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}
    HKCR\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}
    HKCR\MediaPlayer.GraphicsUtils
    HKCR\MediaPlayer.GraphicsUtils.1
    HKCR\MgMediaPlayer.GifAnimator
    HKCR\MgMediaPlayer.GifAnimator.1
    HKCR\SWEETIE.IEToolbar
    HKCR\SWEETIE.IEToolbar.1
    HKCR\SWEETIE.SWEETIE
    HKCR\SWEETIE.SWEETIE.3
    HKCR\SweetIM_URLSearchHook.ToolbarURLSearchHook
    HKCR\SweetIM_URLSearchHook.ToolbarURLSearchHook.1
    HKCR\Toolbar3.SWEETIE
    HKCR\Toolbar3.SWEETIE.1
    HKCR\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}
    HKCR\Typelib\{EEE6C35E-6118-11DC-9C72-001320C79847}
    HKCR\Typelib\{EEE6C35F-6118-11DC-9C72-001320C79847}
    HKCU\Software\SweetIM
    HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}
    HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
    HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
    HKLM\Software\Classes\Interface\{A439801C-961D-452C-AB42-7848E9CBD289}
    HKLM\Software\Classes\Interface\{F4EBB1E2-21F3-4786-8CF4-16EC5925867F}
    HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}
    HKLM\Software\Microsoft\Shared Tools\MSConfig\startupreg\SweetIM
    HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe
    HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{266C7330-C0F4-49E5-8F20-A56F9F822875}
    HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}
    HKLM\Software\SweetIM
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\07D5290CDBDAE4242926B8E6CA650501
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\08E33F7B61DEFF24BB9673ED7D467636
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\0E3D8A5B48622A445A7DF73FEFF32C3F
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\1AC67655DD68F8240B2860F2D511EBD8
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\34EDDB1BFB3A2D448845F3EFD0F15A43
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\351716A953E21214898904032EAE2E81
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\397C771A7BCAC904697C3EC629ED33ED
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\427EA997C413D1D47907CBFC7B2DB432
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\4318DF19719275242801CBE292063A4C
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\45FC115D1FEAEF849A4E1610D6EC8BF0
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\46A5861A389ADB844AF89E31BC9DF0A1
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\49B0E1A6FF50BBE4289E4E23DE6EA0C7
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\4CCCAC049F34D0540AAC13011398BEDB
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5C4389D0BFB302C479DE4178BD5D9EBA
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5D19F074C042AD34BAB463D4175A062E
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5D2B09BDEF4FE54418E6F3373CDBC7AC
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\61B65D3397A1FBF4CB1571B5E4F6B5B0
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\68E8A05C60DD9254591DBD16C94EDDBF
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\697E782CF574CC34CBB9566440BA12BC
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\6AE27A8613CF7EA4782F2886F67295E5
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\7CE172051F585E04187BCB97570BFA74
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\86A901BA5265452499DCBF719C378EE3
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\88ABD1CD5C40EC84789A7F6EF86DAC5E
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\980289C22F80A7C4BB9323DC61255E4E
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\98CC8BF5A4A6E6C4ABF7051DDAB8B058
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\9A4B7EF3789F871419D9302583B20C15
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\A189D17A469616C4688D23E192996267
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\A6C53B0F76C44004A8F36716213017DB
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\B59F2D8189784CC46A4597F2842480B0
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\BD746FB95FB8E5B45BF66BE54D5FD91F
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\CCF399FCD6D2D3F46BF02A1378654FC9
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D149C1355C98DE24E82CEFBD996FE06A
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D15DAF33C220F91468A1D7D57C31ACD7
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D3BA76A44C779424889063D5098ED2D6
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D6D0EB9FDBD90C04D92A7E729058F10D
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\DB59FDB786388EA4D897F3EE715683AC
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\DB8DAD19CFBCC2049A4477183787E8C5
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E1C820A74ED67374BA048B52CB3C3804
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E337925F629CF4C4FB08F3D9674DD839
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E4748F9A4181FCE46A23C13B517B9420
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\EC65F200D112357449C8B1BC3CFA03D0
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\F327D0C73C0973644A21E8CC852267A0
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\FA96423FE2B98E248A3B23548D1E22D9
    .
    C:\WINDOWS\Installer\520052.msi
    C:\WINDOWS\Installer\520058.msi
    C:\Program Files\SweetIM
    C:\Documents and Settings\cyberlux\Application Data\Mozilla\Firefox\Profiles\juij7qqu.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}
    C:\Documents and Settings\cyberlux\Application Data\Mozilla\Firefox\Profiles\juij7qqu.default\SweetIMToolbarData
    C:\Documents and Settings\All Users\Application Data\SweetIM
    
    (!) ---- Temp files deleted.
    (!) ---- Recycle bin emptied in all drives.
    
    +-----------------| Added Scan:
    
    ---- Mozilla FireFox Version 3.0.1 ----
    
    ProfilePath: juij7qqu.default (cyberlux)
    .
    (Prefs.js) user_pref("browser.search.defaultenginename", "SweetIM Search");
    (Prefs.js) user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "chrome://browser-region/locale/region.properties");
    (Prefs.js) user_pref("browser.search.selectedEngine", "SweetIM Search");
    (Prefs.js) user_pref("browser.search.defaulturl", "hxxp://search.sweetim.com/search.asp?src=2&q=");
    (Prefs.js) user_pref("browser.startup.homepage", "hxxp://www.yahoo.fr");
    (Prefs.js) user_pref("browser.startup.homepage_override.mstone", "rv:1.9.0.1");
    (Prefs.js) user_pref("sweetim.toolbar.previous.browser.startup.homepage", "hxxp://www.yahoo.fr");
    .
    (Prefs.js) Removed: user_pref("browser.search.defaultenginename", "SweetIM Search");
    (Prefs.js) Removed: user_pref("browser.search.defaulturl", "hxxp://search.sweetim.com/search.asp?src=2&q=");
    (Prefs.js) Removed: user_pref("browser.search.selectedEngine", "SweetIM Search");
    (Prefs.js) Removed: user_pref("keyword.URL", "hxxp://search.sweetim.com/search.asp?src=2&q=");
    (Prefs.js) Removed: user_pref("sweetim.toolbar.highlight.colors", "#FFFF00,#00FFE4,#5AFF00,#0087FF,#FFCC00,#FF00F0");
    (Prefs.js) Removed: user_pref("sweetim.toolbar.logger.ConsoleHandler.MinReportLevel", "7");
    (Prefs.js) Removed: user_pref("sweetim.toolbar.logger.FileHandler.FileName", "ff-toolbar.log");
    (Prefs.js) Removed: user_pref("sweetim.toolbar.logger.FileHandler.MaxFileSize", "200000");
    (Prefs.js) Removed: user_pref("sweetim.toolbar.logger.FileHandler.MinReportLevel", "7");
    (Prefs.js) Removed: user_pref("sweetim.toolbar.mode.debug", "false");
    (Prefs.js) Removed: user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "chrome://browser-region/locale/region.properties");
    (Prefs.js) Removed: user_pref("sweetim.toolbar.previous.browser.startup.homepage", "hxxp://www.yahoo.fr");
    (Prefs.js) Removed: user_pref("sweetim.toolbar.previous.keyword.URL", "chrome://browser-region/locale/region.properties");
    (Prefs.js) Removed: user_pref("sweetim.toolbar.search.external", "<?xml version=\"1.0\"?><TOOLBAR><EXTERNAL_SEARCH engine=\"hxxp://*google.*\" param=\"q=\" /><EXTERNAL_SEARCH engine=\"hxxp://search.yahoo.com/*\" param=\"p=\" /><EXTERNAL_SEARCH engine=\"hxxp://search.sweetim.*\" param=\"q=\" /><EXTERNAL_SEARCH engine=\"hxxp://*.live.*/*\" param=\"q=\" /><EXTERNAL_SEARCH engine=\"hxxp://*youtube.com/\" param=\"search_query=\" /><EXTERNAL_SEARCH engine=\"hxxp://*.ebay.*/search/*\" param=\"satitle=\" /><EXTERNAL_SEARCH engine=\"hxxp://*.amazon.com/s/*\" param=\"field-keywords=\" /></TOOLBAR>");
    (Prefs.js) Removed: user_pref("sweetim.toolbar.search.history", "notation%20claquette");
    (Prefs.js) Removed: user_pref("sweetim.toolbar.search.history.capacity", "10");
    (Prefs.js) Removed: user_pref("sweetim.toolbar.simapp_id", "{76E8FBF5-8D30-4027-8AE0-5C80A07EF04D}");
    (Prefs.js) Removed: user_pref("sweetim.toolbar.urls.homepage", "hxxp://home.sweetim.com");
    (Prefs.js) Removed: user_pref("sweetim.toolbar.version", "1.0.0.8");
    
    ---- Internet Explorer Version 8.0.6001.18702 ----
    
    [HKEY_CURRENT_USER\..\Internet Explorer\Main]
    
    Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
    Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
    Search Page: hxxp://www.google.com
    Start Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
    
    [HKEY_USERS\S-1-5-21-1060284298-261903793-682003330-1618\..\Internet Explorer\Main]
    
    Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
    Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
    Search Page: hxxp://www.google.com
    Start Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
    
    [HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]
    
    Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
    Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    Search bar: hxxp://search.msn.com/spbasic.htm
    Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    Start Page: hxxp://fr.msn.com/
    
    [HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]
    
    Tabs: hxxp://ieframe.dll/tabswelcome.htm
    
    =========== Suspicious ==========
    
    +---------------------------------------------------------------------------+
    
    13710 Byte(s) - C:\Ad-Report-Clean-14.05.2009.log
    14243 Byte(s) - C:\Ad-Report-Scan-13.05.2009.log
    
    18 File(s) - C:\Program Files\Ad-remover\BACKUP
    2 File(s) - C:\Program Files\Ad-remover\QUARANTINE
    
    End at: 10:05:36 | 14/05/2009
    .
    +-----------------| E.O.F
    .
    
    0
  3. fix200 Messages postés 3365 Statut Contributeur sécurité 158 > dlpworld
    
    As tu essayé Winsockfix?
    
    0
  4. dlpworld > fix200 Messages postés 3365 Statut Contributeur sécurité
    
    Essayé à l'instant, sans succès...
    
    0
Réponse 4 / 4
fix200 Messages postés 3365 Statut Contributeur sécurité 158

Peut tu me préciser ta connexion (ADSL, Box,routeur)?
0
1. dlpworld
  
  A ma connaissance, les ordinateurs sont connectés au réseau local via un switch et un modem adsl. Nous n'avons pas de box. Je précise aussi que j'ai d'autres ordinateurs sur ce réseau local et aucun problème à signaler avec.
  
  0
  1. fix200 Messages postés 3365 Statut Contributeur sécurité 158 > dlpworld
    
    Alors, essaye l'option "Réparer" = "Connexion au réseau local" ==> l'onglet "support" puis "réparer".
    
    0

Rapports à analyser

4 réponses

Discussions similaires

Newsletters