Infecté par MyWebSearch

Résolu
eucharistie -  
Bonjour,

Voila, cela fait 2 jours que je galère, je n'arrive pas a trouver un site qui puisse m'aider!

J'ai fait une analyse avec hijack this et j'ai télécharger zeb help process, qui m'annonce que je suis infecté par plusieurs "malware" mywebsearch.

S.V.P, aidez-moi je suis pas très douée en informatique et j'ai peur d'agraver les choses.

Merci bokou bokou.....
Configuration: Windows Vista Internet Explorer 7.0

37 réponses

Résumé de la discussion

Une infection détectée par HijackThis et des outils tiers, notamment MyWebSearch, vise un ordinateur Windows Vista avec Internet Explorer 7 et déclenche des alertes et des ralentissements. Des solutions évoquées incluent des nettoyages, la désinstallation de programmes indésirables, puis des scans avec MalwareBytes et CCleaner en mode normal puis sans échec pour supprimer les composants malveillants. D'autres conseils préconisent des mises à jour régulières, la vérification des extensions et ActiveX, l'utilisation de Firefox en complément d'IE pour la sécurité, et l'élimination des failles Java et Flash. En complément, l'usage d'un outil de suppression comme MalwareBytes et la génération d'un rapport facilitent le suivi des infections, tandis que la création d'un point de restauration offre une sécurité supplémentaire.

Bobot (l’IA à votre service)
  1. eucharistie Auteur
    Désolée si je met du temps, j'ai de plus en plus de mal a me connecté, dès que je clic sur quelque chose, j'ai un message d'alerte qui s'affiche.

    ========== PROCESSES ==========
    Process explorer.exe killed successfully.
    ========== FILES ==========
    Folder move failed. C:\Program Files\MyWebSearch\bar\1.bin scheduled to be moved on reboot.
    Folder move failed. C:\Program Files\MyWebSearch\bar scheduled to be moved on reboot.
    Folder move failed. C:\Program Files\MyWebSearch scheduled to be moved on reboot.
    ========== REGISTRY ==========
    Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{00A6FAF6-072E-44cf-8957-5838F569A31D} not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00A6FAF6-072E-44cf-8957-5838F569A31D}\ not found.
    ========== COMMANDS ==========
    User's Temp folder emptied.
    User's Internet Explorer cache folder emptied.
    Windows Temp folder emptied.
    Temp folders emptied.
    Explorer started successfully

    OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 05262009_100403
    1. V-X
      Salut,

      ▶ Télécharge random's system information tool (RSIT) et enregistre le sur ton bureau.

      ▶ Double clique sur RSIT.exe pour lancer l'outil.

      ▶ Clique sur ' continue ' à l'écran Disclaimer.

      ▶ Si l'outil HIjackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera et tu devras accepter la licence.

      ▶ Une fois le scan fini , 2 rapports vont apparaitre. Poste le contenu des 2 rapports séparément.
      ( log.txt & info.txt )

      (CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

      Si un rapport ne passe pas faire une alerte à la conciergerie avec le /!\ jaune.
      1. eucharistie Auteur
        Salut,
        ok je vais faire sa et je te le poste aprés, merci d'avoir répondu si vite ^^
        1. eucharistie Auteur
          voici le log txt :
          Logfile of random's system information tool 1.06 (written by random/random)
          Run by francois at 2009-05-26 07:21:05
          Microsoft® Windows Vista™ Édition Familiale Premium Service Pack 1
          System drive C: has 4 GB (13%) free of 30 GB
          Total RAM: 3063 MB (59% free)

          Logfile of Trend Micro HijackThis v2.0.2
          Scan saved at 07:21:24, on 26/05/2009
          Platform: Windows Vista SP1 (WinNT 6.00.1905)
          MSIE: Internet Explorer v7.00 (7.00.6001.18226)
          Boot mode: Normal

          Running processes:
          C:\Windows\system32\Dwm.exe
          C:\Windows\system32\taskeng.exe
          C:\Windows\RtHDVCpl.exe
          C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
          C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
          C:\Windows\System32\hkcmd.exe
          C:\Windows\System32\igfxpers.exe
          C:\Program Files\Lenovo\EnergyCut\utilty.exe
          C:\Program Files\Lenovo\EnergyCut\EnergyCut.exe
          C:\Program Files\Common Files\Symantec Shared\ccApp.exe
          C:\Program Files\Lenovo\ShuttleCenter\PCMService.exe
          C:\Program Files\Lenovo\VeriFace\PManage.exe
          C:\Program Files\Lenovo\VeriFace\RTimeLock.exe
          C:\Program Files\MyWebSearch\bar\1.bin\M3SRCHMN.EXE
          C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
          C:\Program Files\Windows Sidebar\sidebar.exe
          C:\Windows\ehome\ehtray.exe
          C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
          C:\Windows\system32\igfxsrvc.exe
          C:\Windows\ehome\ehmsas.exe
          C:\Windows\explorer.exe
          C:\Program Files\Internet Explorer\ieuser.exe
          C:\Program Files\Google\Google Toolbar\GoogleToolbarUser.exe
          C:\Program Files\Internet Explorer\iexplore.exe
          C:\Program Files\ZebHelpProcess\ZHP2.exe
          C:\Windows\system32\Macromed\Flash\FlashUtil10a.exe
          C:\Windows\system32\SearchFilterHost.exe
          C:\Users\francois\Desktop\RSIT.exe
          C:\Users\francois\Desktop\francois.exe

          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
          R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
          R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
          R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
          R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
          R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL
          O1 - Hosts: ::1 localhost
          O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL
          O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
          O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
          O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
          O2 - BHO: (no name) - {2E59498D-7E44-4452-9044-0973B080B9E8} - C:\Windows\System32\winexplorer.dll
          O2 - BHO: Windows Live Call HoverToCall class - {7E853D72-626A-48EC-A868-BA8D5E23E045} - C:\Program Files\Windows Live\Messenger\HTC.DLL
          O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
          O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
          O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
          O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
          O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
          O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
          O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
          O3 - Toolbar: My Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
          O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
          O4 - HKLM\..\Run: [Unattend0000000001{7CE4F652-9E84-4617-9F54-DC8891DFB725}] C:\Windows\test.bat
          O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
          O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
          O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
          O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
          O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
          O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
          O4 - HKLM\..\Run: [EnergyCut_Utility] C:\Program Files\Lenovo\EnergyCut\utilty.exe
          O4 - HKLM\..\Run: [EnergyCut] C:\Program Files\Lenovo\EnergyCut\EnergyCut.exe
          O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
          O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Lenovo\ShuttleCenter\PCMService.exe"
          O4 - HKLM\..\Run: [VeriFacePassManager] C:\Program Files\Lenovo\VeriFace\PManage.exe
          O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
          O4 - HKLM\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALuNotify.exe
          O4 - HKLM\..\Run: [VeriFaceTimeLock] C:\Program Files\Lenovo\VeriFace\RTimeLock.exe
          O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
          O4 - HKLM\..\Run: [MyWebSearch Plugin] rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\M3PLUGIN.DLL,UPF
          O4 - HKLM\..\Run: [My Web Search Bar Search Scope Monitor] "C:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe" /m=2 /w /h
          O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
          O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
          O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
          O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
          O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
          O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
          O4 - HKCU\..\Run: [Speech Recognition] "C:\Windows\Speech\Common\sapisvr.exe" -SpeechUX -Startup
          O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
          O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
          O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
          O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZJxdm301YYGB
          O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
          O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
          O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
          O9 - Extra button: Password Administration Box - {A26ABCF0-1C8F-46e7-A67C-0489DC21B9CC} - C:\Program Files\Lenovo\VeriFace\OpenWnd.exe
          O9 - Extra 'Tools' menuitem: Password Administration Box - {A26ABCF0-1C8F-46e7-A67C-0489DC21B9CC} - C:\Program Files\Lenovo\VeriFace\OpenWnd.exe
          O13 - Gopher Prefix:
          O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei-4/ZwinkyInitialSetup1.0.1.1.cab
          O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
          O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ATK Hotkey\ASLDRSrv.exe
          O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
          O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
          O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Lenovo\ShuttleCenter\Kernel\TV\CLCapSvc.exe
          O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Lenovo\ShuttleCenter\Kernel\TV\CLSched.exe
          O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
          O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
          O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
          O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe
          O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
          O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
          O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
          O23 - Service: My Web Search Service (MyWebSearchService) - MyWebSearch.com - C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwssvc.exe
          O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
          O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
          O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
          O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
          2. eucharistie Auteur
            et le info txt :

            info.txt logfile of random's system information tool 1.06 2009-05-26 07:21:32

            ======Uninstall list======

            2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0015-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
            2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0016-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
            2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0018-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
            2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0019-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
            2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001A-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
            2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001B-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
            2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0401-0000-0000000FF1CE} /uninstall {5A2F65A4-808F-4A1E-973E-92E17824982D}
            2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0407-0000-0000000FF1CE} /uninstall {2AB528A5-BB1B-4EBE-8E51-AD0C4CD33CA9}
            2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {3EC77D26-799B-4CD8-914F-C1565E796173}
            2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {430971B1-C31E-45DA-81E0-72C095BAB72C}
            2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0413-0000-0000000FF1CE} /uninstall {B3F4DC34-7F60-4B7C-A79F-1C13012D99D4}
            2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {F7A31780-33C4-4E39-951A-5EC9B91D7BF1}
            2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {BEE75E01-DD3F-4D5F-B96C-609E6538D419}
            2007 Microsoft Office system-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PROHYBRIDR /dll OSETUP.DLL
            Acoustica Effects Pack-->C:\PROGRA~1\ACOUST~2\UNWISE.EXE C:\PROGRA~1\ACOUST~2\INSTALL.LOG
            Activation Assistant for the 2007 Microsoft Office suites-->"C:\ProgramData\{174892B1-CBE7-44F5-86FF-AB555EFD73A3}\Microsoft Office Activation Assistant.exe" REMOVE=TRUE MODIFY=FALSE
            Adobe Flash Player 10 ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
            Adobe Reader 9 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A90000000001}
            AppCore-->MsiExec.exe /I{EFB5B3B5-A280-4E25-BE1C-634EEFE32C1B}
            Assistant de connexion Windows Live-->MsiExec.exe /I{D3116CC7-24DC-4CA3-9CE1-23FED836E9F2}
            ATK Hotkey-->C:\Program Files\InstallShield Installation Information\{3912D529-02BC-4CA8-B5ED-0D0C20EB6003}\setup.exe -runfromtemp -l0x040c -removeonly
            Audacity 1.2.6-->"C:\Program Files\Audacity\unins000.exe"
            AV-->MsiExec.exe /I{F4DB525F-A986-4249-B98B-42A8066251CA}
            Blender (remove only)-->"C:\Blender\uninstall.exe"
            Broadcom Gigabit Integrated Controller-->MsiExec.exe /X{FC57FC53-104C-415C-98D7-B05E659461A9}
            ccCommon-->MsiExec.exe /I{3CCAD2EF-CFF2-4637-82AA-AABF370282D3}
            DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
            EasyCapture-->C:\Program Files\Lenovo\EasyCapture\Uninstall.exe
            EnergyCut-->C:\Program Files\InstallShield Installation Information\{6E127727-CE4B-40E4-9A7D-9D65CDE0A15C}\setup.exe -runfromtemp -l0x040c -removeonly
            Fichiers de prise en charge de l'installation de Microsoft SQL Server (Français)-->MsiExec.exe /X{3380F354-C5F7-4E71-8F51-EEE6C3F06C62}
            Galerie de photos Windows Live-->MsiExec.exe /X{A70FA218-6598-4AC9-813D-63597C5DD068}
            Google Toolbar for Internet Explorer-->"C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarManager_BDA1448D3D255554.exe" /uninstall
            Google Toolbar for Internet Explorer-->MsiExec.exe /I{18455581-E099-4BA8-BC6B-F34B2F06600C}
            GTA2-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2987EE84-C4EE-4FF5-8160-32DE00D6ABC6}\Setup.exe" -l0x9
            Guitar Pro 4 Demo-->MsiExec.exe /X{22C1B575-C746-46F2-80A3-EE9612AF5FAA}
            HijackThis 2.0.2-->"C:\Users\francois\Desktop\HijackThis.exe" /uninstall
            Intel(R) Graphics Media Accelerator Driver-->C:\Windows\system32\igxpun.exe -uninstall
            Internet Worm Protection-->MsiExec.exe /I{2908F0CB-C1D4-447F-97A2-CFC135C9F8D4}
            K-Lite Mega Codec Pack 4.3.4-->"C:\Program Files\K-Lite Codec Pack\unins000.exe"
            Lenovo Easy Camera-->C:\Program Files\InstallShield Installation Information\{4BB1DCED-84D3-47F9-B718-5947E904593E}\SETUP.exe -runfromtemp -l0x040c -removeonly
            lenovo scrnsave-->C:\PROGRA~1\Lenovo\SCREEN~1\UNWISE.EXE C:\PROGRA~1\Lenovo\SCREEN~1\INSTALL.LOG
            LiveUpdate 3.2 (Symantec Corporation)-->"C:\Program Files\Symantec\LiveUpdate\LSETUP.EXE" /U
            LiveUpdate Notice (Symantec Corporation)-->MsiExec.exe /X{DBA4DB9D-EE51-4944-A419-98AB1F1249C8}
            Logiciel Intel(R) PROSet/Wireless-->C:\Windows\Installer\iProInst.exe
            mCore-->MsiExec.exe /I{F5D7FAB5-A1FD-4DD3-983E-4155B09D7102}
            mDriver-->MsiExec.exe /I{A0F925BF-5C55-44C2-A4E7-5A4C59791C29}
            mHelp-->MsiExec.exe /I{8C6BB412-D3A8-4AAE-A01B-35B681789D68}
            Microsoft Office 2003 Web Components-->MsiExec.exe /I{90A4040C-6000-11D3-8CFE-0150048383C9}
            Microsoft Office 2007 Primary Interop Assemblies-->MsiExec.exe /X{50120000-1105-0000-0000-0000000FF1CE}
            Microsoft Office Access MUI (French) 2007-->MsiExec.exe /X{90120000-0015-040C-0000-0000000FF1CE}
            Microsoft Office Excel MUI (French) 2007-->MsiExec.exe /X{90120000-0016-040C-0000-0000000FF1CE}
            Microsoft Office Language Pack 2007 Service Pack 1 (SP1)-->msiexec /package {90120000-006E-040C-0000-0000000FF1CE} /uninstall {EC50B538-CBE1-42E6-B7FE-87AA540AADFB}
            Microsoft Office Outlook MUI (French) 2007-->MsiExec.exe /X{90120000-001A-040C-0000-0000000FF1CE}
            Microsoft Office PowerPoint MUI (French) 2007-->MsiExec.exe /X{90120000-0018-040C-0000-0000000FF1CE}
            Microsoft Office Professional Hybrid 2007-->MsiExec.exe /X{91120000-0031-0000-0000-0000000FF1CE}
            Microsoft Office Proof (Arabic) 2007-->MsiExec.exe /X{90120000-001F-0401-0000-0000000FF1CE}
            Microsoft Office Proof (Dutch) 2007-->MsiExec.exe /X{90120000-001F-0413-0000-0000000FF1CE}
            Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
            Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
            Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
            Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
            Microsoft Office Proofing (French) 2007-->MsiExec.exe /X{90120000-002C-040C-0000-0000000FF1CE}
            Microsoft Office Publisher MUI (French) 2007-->MsiExec.exe /X{90120000-0019-040C-0000-0000000FF1CE}
            Microsoft Office Shared MUI (French) 2007-->MsiExec.exe /X{90120000-006E-040C-0000-0000000FF1CE}
            Microsoft Office Small Business Connectivity Components-->MsiExec.exe /X{A939D341-5A04-4E0A-BB55-3E65B386432D}
            Microsoft Office Word MUI (French) 2007-->MsiExec.exe /X{90120000-001B-040C-0000-0000000FF1CE}
            Microsoft SQL Server 2005 Compact Edition [ENU]-->MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
            Microsoft SQL Server Native Client-->MsiExec.exe /I{1F24E48F-7692-4E89-8784-68DD4D2712A0}
            Microsoft SQL Server VSS Writer-->MsiExec.exe /I{A30179B7-997A-4D47-AA43-57AE59A9C78B}
            Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
            Mise à jour Microsoft Office Excel 2007 Help (KB963678)-->msiexec /package {90120000-0016-040C-0000-0000000FF1CE} /uninstall {B761869A-B85C-40E2-994C-A1CE78AC8F2C}
            Mise à jour Microsoft Office Powerpoint 2007 Help (KB963669)-->msiexec /package {90120000-0018-040C-0000-0000000FF1CE} /uninstall {C3DCA38E-005E-41BA-A52A-7C3429F351C3}
            Mise à jour Microsoft Office Word 2007 Help (KB963665)-->msiexec /package {90120000-001B-040C-0000-0000000FF1CE} /uninstall {81536A04-DBFB-4DB3-978F-0F284590C223}
            mMHouse-->MsiExec.exe /I{F0BFC7EF-9CF8-44EE-91B0-158884CD87C5}
            Motorola SM56 Speakerphone Modem-->rundll32.exe sm56co6a.dll,SM56UnInstaller
            mPfMgr-->MsiExec.exe /I{8B928BA1-EDEC-4227-A2DA-DD83026C36F5}
            MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
            MSXML 4.0 SP2 (KB941833)-->MsiExec.exe /I{C523D256-313D-4866-B36A-F3DE528246EF}
            MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
            My Web Search (Zwinky)-->rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsbar.dll,O
            Norton AntiVirus (Symantec Corporation)-->"C:\Program Files\Common Files\Symantec Shared\SymSetup\{830D8CBD-C668-49e2-A969-C2C2106332E0}_14_2_0_29\{830D8CBD-C668-49e2-A969-C2C2106332E0}.exe" /X
            Norton AntiVirus Help-->MsiExec.exe /I{34EEB1F5-E939-40A1-A6BA-957282A4B2C8}
            Norton AntiVirus Parent MSI-->MsiExec.exe /I{E5EE9939-259F-4DE2-8023-5C49E16A4F43}
            Norton AntiVirus SYMLT MSI-->MsiExec.exe /I{D1FF75E7-DD42-4CFD-B052-20B3FFF4EDB8}
            Norton AntiVirus-->MsiExec.exe /X{830D8CBD-C668-49e2-A969-C2C2106332E0}
            Norton Protection Center-->MsiExec.exe /I{9A129ABC-A53A-4209-A21E-D5DEDFB7CCA8}
            Power2Go 5.0-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{40BF1E83-20EB-11D8-97C5-0009C5020658}\Setup.exe" -uninstall
            Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -l0x40c -removeonly
            Security Update for 2007 Microsoft Office System (KB951550)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {B243E9A5-ED77-4F1B-B338-2486FD82DC85}
            Security Update for 2007 Microsoft Office System (KB951944)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {797AE457-BA17-4BBC-B501-25FB3A0103C7}
            Security Update for 2007 Microsoft Office System (KB960003)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {F04F8702-18D0-458D-921E-146FB7CD38CF}
            Security Update for Microsoft Office Excel 2007 (KB959997)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {9EAC3AEC-5C81-4856-A05B-DE9DC236D740}
            Security Update for Microsoft Office PowerPoint 2007 (KB957789)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {7559E742-FF9F-4FAE-B279-008ED296CB4D}
            Security Update for Microsoft Office Publisher 2007 (KB950114)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {F9C3CDBA-1F00-4D4D-959D-75C9D3ACDD85}
            Security Update for Microsoft Office system 2007 (KB954326)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {5F7F6FFF-395D-480E-8450-64F385D82C5F}
            Security Update for Microsoft Office system 2007 (KB956828)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {885E081B-72BD-4E76-8E98-30B4BE468FAC}
            Security Update for Microsoft Office Word 2007 (KB956358)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {4551666D-0FD6-4C69-8A81-1C6F2E64517C}
            Shuttle Center II-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2637C347-9DAD-11D6-9EA2-00055D0CA761}\Setup.exe" -uninstall
            SPBBC 32bit-->MsiExec.exe /I{77772678-817F-4401-9301-ED1D01A8DA56}
            Symantec-->MsiExec.exe /I{228F6876-A313-40A3-91C0-C3CBE6997D09}
            Synaptics Pointing Device Driver-->rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall
            Update for 2007 Microsoft Office System (KB967642)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {C444285D-5E4F-48A4-91DD-47AAAA68E92D}
            Update for Microsoft Office Outlook 2007 (KB952142)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {4AD3A076-427C-491F-A5B7-7D1DE788A756}
            Update for Microsoft Office Outlook 2007 Help (KB957246)-->msiexec /package {90120000-001A-040C-0000-0000000FF1CE} /uninstall {80E46078-C1C5-4AE8-8744-3EAFC812E118}
            Update for Outlook 2007 Junk Email Filter (kb968503)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {5DD98950-4D10-4B79-8BF6-59726705207D}
            VC80CRTRedist - 8.0.50727.762-->MsiExec.exe /I{767CC44C-9BBC-438D-BAD3-FD4595DD148B}
            VeriFace-->C:\Program Files\Lenovo\VeriFace\Uninstall.exe
            Windows Live installer-->MsiExec.exe /X{FD44E544-E7D0-4DBA-9FA0-8AE1A1300390}
            Windows Live Messenger-->MsiExec.exe /X{BADF6744-3787-48F6-B8C9-4C4995401D65}
            Windows Live Toolbar-->"C:\Program Files\Windows Live Toolbar\UnInstall.exe" {E8A81E1F-665E-4F81-B04D-B6D164A8F360}
            Windows Live Toolbar-->MsiExec.exe /X{E8A81E1F-665E-4F81-B04D-B6D164A8F360}
            WinFlash-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B39AA98E-C966-46C9-ACA2-D2586E300988}\Setup.exe" -l0x9
            WinRAR archiver-->C:\Program Files\WinRAR\uninstall.exe
            ZebHelpProcess 2.33.12-->"C:\Program Files\ZebHelpProcess\unins000.exe"

            ======Security center information======

            AV: Norton AntiVirus (disabled) (outdated)
            FW: Norton AntiVirus
            AS: Windows Defender
            AS: Norton AntiVirus (outdated)

            ======System event log======

            Computer Name: PC-de-francois
            Event Code: 4
            Message: Error loading virus definitions.
            Record Number: 60910
            Source Name: SRTSP
            Time Written: 20090525163920.658652-000
            Event Type: Erreur
            User:

            Computer Name: PC-de-francois
            Event Code: 5
            Message: Error loading Symantec real time Anti-Virus driver.
            Record Number: 60911
            Source Name: SRTSP
            Time Written: 20090525163920.658652-000
            Event Type: Erreur
            User:

            Computer Name: PC-de-francois
            Event Code: 15016
            Message: Impossible d’initialiser le package de sécurité Kerberos pour l’authentification côté serveur. Le champ de données contient le numéro de l’erreur.
            Record Number: 60914
            Source Name: Microsoft-Windows-HttpEvent
            Time Written: 20090525163955.862852-000
            Event Type: Erreur
            User:

            Computer Name: PC-de-francois
            Event Code: 7034
            Message: Le service Enregistreur VSS SQL Server s'est terminé de façon inattendue pour la 1ème fois.
            Record Number: 60991
            Source Name: Service Control Manager
            Time Written: 20090525164108.000000-000
            Event Type: Erreur
            User:

            Computer Name: PC-de-francois
            Event Code: 7026
            Message: Le pilote de démarrage système ou d'amorçage suivant n'a pas pu se charger :
            SRTSP
            Record Number: 60994
            Source Name: Service Control Manager
            Time Written: 20090525164108.000000-000
            Event Type: Erreur
            User:

            =====Application event log=====

            Computer Name: PC-de-francois
            Event Code: 1000
            Message: Application défaillante iexplore.exe, version 7.0.6001.18226, horodatage 0x49ac95d6, module défaillant kernel32.dll, version 6.0.6001.18215, horodatage 0x49953395, code d’exception 0x0eedfade, décalage d’erreur 0x000442eb, ID du processus 0x4dc, heure de début de l’application 0x01c9ddb9a609419b.
            Record Number: 17499
            Source Name: Application Error
            Time Written: 20090526042714.000000-000
            Event Type: Erreur
            User:

            Computer Name: PC-de-francois
            Event Code: 1000
            Message: Application défaillante iexplore.exe, version 7.0.6001.18226, horodatage 0x49ac95d6, module défaillant kernel32.dll, version 6.0.6001.18215, horodatage 0x49953395, code d’exception 0x0eedfade, décalage d’erreur 0x000442eb, ID du processus 0x1908, heure de début de l’application 0x01c9ddb9fcf5647b.
            Record Number: 17500
            Source Name: Application Error
            Time Written: 20090526042852.000000-000
            Event Type: Erreur
            User:

            Computer Name: PC-de-francois
            Event Code: 1000
            Message: Application défaillante iexplore.exe, version 7.0.6001.18226, horodatage 0x49ac95d6, module défaillant kernel32.dll, version 6.0.6001.18215, horodatage 0x49953395, code d’exception 0x0eedfade, décalage d’erreur 0x000442eb, ID du processus 0xe0c, heure de début de l’application 0x01c9ddba7d49523b.
            Record Number: 17501
            Source Name: Application Error
            Time Written: 20090526045411.000000-000
            Event Type: Erreur
            User:

            Computer Name: PC-de-francois
            Event Code: 1000
            Message: Application défaillante iexplore.exe, version 7.0.6001.18226, horodatage 0x49ac95d6, module défaillant kernel32.dll, version 6.0.6001.18215, horodatage 0x49953395, code d’exception 0x0eedfade, décalage d’erreur 0x000442eb, ID du processus 0x1a38, heure de début de l’application 0x01c9ddbcdc49af8b.
            Record Number: 17502
            Source Name: Application Error
            Time Written: 20090526045425.000000-000
            Event Type: Erreur
            User:

            Computer Name: PC-de-francois
            Event Code: 1000
            Message: Application défaillante iexplore.exe, version 7.0.6001.18226, horodatage 0x49ac95d6, module défaillant kernel32.dll, version 6.0.6001.18215, horodatage 0x49953395, code d’exception 0x0eedfade, décalage d’erreur 0x000442eb, ID du processus 0x1e58, heure de début de l’application 0x01c9ddc1e3c25e1b.
            Record Number: 17505
            Source Name: Application Error
            Time Written: 20090526060545.000000-000
            Event Type: Erreur
            User:

            =====Security event log=====

            Computer Name: PC-de-francois
            Event Code: 4634
            Message: Fermeture de session d’un compte.

            Sujet :
            ID de sécurité : S-1-5-7
            Nom du compte : ANONYMOUS LOGON
            Domaine du compte : AUTORITE NT
            ID du compte : 0x170aff54

            Type d’ouverture de session : 3

            Cet événement est généré lorsqu’une session ouverte est supprimée. Il peut être associé à un événement d’ouverture de session en utilisant la valeur ID d’ouverture de session. Les ID d’ouverture de session ne sont uniques qu’entre les redémarrages sur un même ordinateur.
            Record Number: 24552
            Source Name: Microsoft-Windows-Security-Auditing
            Time Written: 20090311073508.741000-000
            Event Type: Succès de l'audit
            User:

            Computer Name: PC-de-francois
            Event Code: 4634
            Message: Fermeture de session d’un compte.

            Sujet :
            ID de sécurité : S-1-5-7
            Nom du compte : ANONYMOUS LOGON
            Domaine du compte : AUTORITE NT
            ID du compte : 0x170b0544

            Type d’ouverture de session : 3

            Cet événement est généré lorsqu’une session ouverte est supprimée. Il peut être associé à un événement d’ouverture de session en utilisant la valeur ID d’ouverture de session. Les ID d’ouverture de session ne sont uniques qu’entre les redémarrages sur un même ordinateur.
            Record Number: 24553
            Source Name: Microsoft-Windows-Security-Auditing
            Time Written: 20090311073508.869000-000
            Event Type: Succès de l'audit
            User:

            Computer Name: PC-de-francois
            Event Code: 4624
            Message: L’ouverture de session d’un compte s’est correctement déroulée.

            Sujet :
            ID de sécurité : S-1-0-0
            Nom du compte : -
            Domaine du compte : -
            ID d’ouverture de session : 0x0

            Type d’ouverture de session : 3

            Nouvelle ouverture de session :
            ID de sécurité : S-1-5-7
            Nom du compte : ANONYMOUS LOGON
            Domaine du compte : AUTORITE NT
            ID d’ouverture de session : 0x17104d5b
            GUID d’ouverture de session : {00000000-0000-0000-0000-000000000000}

            Informations sur le processus :
            ID du processus : 0x0
            Nom du processus : -

            Informations sur le réseau :
            Nom de la station de travail : ROBERT-PC
            Adresse du réseau source : 192.168.0.199
            Port source : 49204

            Informations détaillées sur l’authentification :
            Processus d’ouverture de session : NtLmSsp
            Package d’authentification : NTLM
            Services en transit : -
            Nom du package (NTLM uniquement) : NTLM V1
            Longueur de la clé : 128

            Cet événement est généré lors de la création d’une ouverture de session. Il est généré sur l’ordinateur sur lequel l’ouverture de session a été effectuée.

            Le champ Objet indique le compte sur le système local qui a demandé l’ouverture de session. Il s’agit le plus souvent d’un service, comme le service Serveur, ou un processus local tel que Winlogon.exe ou Services.exe.

            Le champ Type d’ouverture de session indique le type d’ouverture de session qui s’est produit. Les types les plus courants sont 2 (interactif) et 3 (réseau).

            Le champ Nouvelle ouverture de session indique le compte pour lequel la nouvelle ouverture de session a été créée, par exemple, le compte qui s’est connecté.

            Les champs relatifs au réseau indiquent la provenance d’une demande d’ouverture de session à distance. Le nom de la station de travail n’étant pas toujours disponible, peut être laissé vide dans certains cas.

            Les champs relatifs aux informations d’authentification fournissent des détails sur cette demande d’ouverture de session spécifique.
            - Le GUID d’ouverture de session est un identificateur unique pouvant servir à associer cet événement à un événement KDC .
            - Les services en transit indiquent les services intermédiaires qui ont participé à cette demande d’ouverture de session.
            - Nom du package indique quel est le sous-protocole qui a été utilisé parmi les protocoles NTLM.
            - La longueur de la clé indique la longueur de la clé de session générée. Elle a la valeur 0 si aucune clé de session n’a été demandée.
            Record Number: 24554
            Source Name: Microsoft-Windows-Security-Auditing
            Time Written: 20090311074656.776000-000
            Event Type: Succès de l'audit
            User:

            Computer Name: PC-de-francois
            Event Code: 4624
            Message: L’ouverture de session d’un compte s’est correctement déroulée.

            Sujet :
            ID de sécurité : S-1-0-0
            Nom du compte : -
            Domaine du compte : -
            ID d’ouverture de session : 0x0

            Type d’ouverture de session : 3

            Nouvelle ouverture de session :
            ID de sécurité : S-1-5-7
            Nom du compte : ANONYMOUS LOGON
            Domaine du compte : AUTORITE NT
            ID d’ouverture de session : 0x17104d8f
            GUID d’ouverture de session : {00000000-0000-0000-0000-000000000000}

            Informations sur le processus :
            ID du processus : 0x0
            Nom du processus : -

            Informations sur le réseau :
            Nom de la station de travail : ROBERT-PC
            Adresse du réseau source : 192.168.0.199
            Port source : 49205

            Informations détaillées sur l’authentification :
            Processus d’ouverture de session : NtLmSsp
            Package d’authentification : NTLM
            Services en transit : -
            Nom du package (NTLM uniquement) : NTLM V1
            Longueur de la clé : 128

            Cet événement est généré lors de la création d’une ouverture de session. Il est généré sur l’ordinateur sur lequel l’ouverture de session a été effectuée.

            Le champ Objet indique le compte sur le système local qui a demandé l’ouverture de session. Il s’agit le plus souvent d’un service, comme le service Serveur, ou un processus local tel que Winlogon.exe ou Services.exe.

            Le champ Type d’ouverture de session indique le type d’ouverture de session qui s’est produit. Les types les plus courants sont 2 (interactif) et 3 (réseau).

            Le champ Nouvelle ouverture de session indique le compte pour lequel la nouvelle ouverture de session a été créée, par exemple, le compte qui s’est connecté.

            Les champs relatifs au réseau indiquent la provenance d’une demande d’ouverture de session à distance. Le nom de la station de travail n’étant pas toujours disponible, peut être laissé vide dans certains cas.

            Les champs relatifs aux informations d’authentification fournissent des détails sur cette demande d’ouverture de session spécifique.
            - Le GUID d’ouverture de session est un identificateur unique pouvant servir à associer cet événement à un événement KDC .
            - Les services en transit indiquent les services intermédiaires qui ont participé à cette demande d’ouverture de session.
            - Nom du package indique quel est le sous-protocole qui a été utilisé parmi les protocoles NTLM.
            - La longueur de la clé indique la longueur de la clé de session générée. Elle a la valeur 0 si aucune clé de session n’a été demandée.
            Record Number: 24555
            Source Name: Microsoft-Windows-Security-Auditing
            Time Written: 20090311074656.795000-000
            Event Type: Succès de l'audit
            User:

            Computer Name: PC-de-francois
            Event Code: 4634
            Message: Fermeture de session d’un compte.

            Sujet :
            ID de sécurité : S-1-5-7
            Nom du compte : ANONYMOUS LOGON
            Domaine du compte : AUTORITE NT
            ID du compte : 0x17104d5b

            Type d’ouverture de session : 3

            Cet événement est généré lorsqu’une session ouverte est supprimée. Il peut être associé à un événement d’ouverture de session en utilisant la valeur ID d’ouverture de session. Les ID d’ouverture de session ne sont uniques qu’entre les redémarrages sur un même ordinateur.
            Record Number: 24556
            Source Name: Microsoft-Windows-Security-Auditing
            Time Written: 20090311074707.240000-000
            Event Type: Succès de l'audit
            User:

            ======Environment variables======

            "ComSpec"=%SystemRoot%\system32\cmd.exe
            "FP_NO_HOST_CHECK"=NO
            "OS"=Windows_NT
            "Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem
            "PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
            "PROCESSOR_ARCHITECTURE"=x86
            "TEMP"=%SystemRoot%\TEMP
            "TMP"=%SystemRoot%\TEMP
            "USERNAME"=SYSTEM
            "windir"=%SystemRoot%
            "PROCESSOR_LEVEL"=6
            "PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 13, GenuineIntel
            "PROCESSOR_REVISION"=0f0d
            "NUMBER_OF_PROCESSORS"=2
            "configsetroot"=%SystemRoot%\ConfigSetRoot

            -----------------EOF-----------------
            1. V-X
              Re,

              ▶ Désactive le « contrôle des comptes utilisateurs = UAC »
              (tu le réactiveras après ta désinfection): Ne pas oublier !!
              Désactiver l'UAC est nécessaire pour pouvoir faire fonctionner certains programmes sous Vista.
              - Vas dans Démarrer puis panneau de configuration
              - Double Clique sur l'icône "Comptes d'utilisateurs"
              - Clique ensuite sur désactiver et valide.
              comment désactiver L'UAC

              ▶ Télécharge Ad-remover ( de C_XX ) sur ton bureau :

              ! Déconnecte toi et ferme toutes applications en cours !

              ▶ Double clique sur "Ad-R.exe" pour lancer l'installation et laisse les paramètres d'installation par défaut .

              ▶ Double-clique sur le raccourci Ad-remover qui est sur ton bureau pour lancer l'outil .

              ▶ Au menu principal choisis l'option "L" et tape sur [entrée] .

              ▶ Laisse travailler l'outil et ne touche à rien ...

              ▶ Poste le rapport qui apparait à la fin , sur le forum ...

              ( Le rapport est sauvegardé aussi sous C:\Ad-report.log )
              ( CTRL+A Pour tout sélectionner , CTRL+C pour copier et CTRL+V pour coller )

              Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
              Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
              Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.
              1. eucharistie Auteur
                bon, sa a mis du temps, mais sa y est!

                ------ RAPPORT D'AD-REMOVER 1.1.4.3 | UNIQUEMENT XP/VISTA -------

                Mit à jour part C_XX le 24/05/2009 à 15:20
                Contact: AdRemover.contact@gmail.com
                Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html

                Lancé à: 7:53:48, 26/05/2009 | Mode Normal
                Exécuté de: C:\Program Files\Ad-remover\
                Système d'exploitation: Microsoft® Windows Vista™ Home Premium Service Pack 1 v6.0.6001
                Nom du PC: PC-DE-FRANCOIS
                Utilisateur actuel: francois - Administrator

                .
                ============== ÉLÉMENT(S) NEUTRALISÉ(S) ==============
                .
                Service: "MyWebSearchService"
                .
                HKCR\FunWebProducts.DataControl
                HKCR\FunWebProducts.DataControl.1
                HKCR\FunWebProducts.HistoryKillerScheduler
                HKCR\FunWebProducts.HistoryKillerScheduler.1
                HKCR\FunWebProducts.HistorySwatterControlBar
                HKCR\FunWebProducts.HistorySwatterControlBar.1
                HKCR\FunWebProducts.HTMLMenu
                HKCR\FunWebProducts.HTMLMenu.1
                HKCR\FunWebProducts.HTMLMenu.2
                HKCR\FunWebProducts.IECookiesManager
                HKCR\FunWebProducts.IECookiesManager.1
                HKCR\FunWebProducts.KillerObjManager
                HKCR\FunWebProducts.KillerObjManager.1
                HKCR\FunWebProducts.PopSwatterBarButton
                HKCR\FunWebProducts.PopSwatterBarButton.1
                HKCR\FunWebProducts.PopSwatterSettingsControl
                HKCR\FunWebProducts.PopSwatterSettingsControl.1
                HKCR\MyWebSearch.ChatSessionPlugin
                HKCR\MyWebSearch.ChatSessionPlugin.1
                HKCR\MyWebSearch.HTMLPanel
                HKCR\MyWebSearch.HTMLPanel.1
                HKCR\MyWebSearch.OutlookAddin
                HKCR\MyWebSearch.OutlookAddin.1
                HKCR\MyWebSearch.PseudoTransparentPlugin
                HKCR\MyWebSearch.PseudoTransparentPlugin.1
                HKCR\MyWebSearchToolBar.SettingsPlugin
                HKCR\MyWebSearchToolBar.SettingsPlugin.1
                HKCR\MyWebSearchToolBar.ToolbarPlugin
                HKCR\MyWebSearchToolBar.ToolbarPlugin.1
                HKCR\screensavercontrol.screensaverinstaller
                HKCR\screensavercontrol.screensaverinstaller.1
                HKCU\Software\AppDataLow\Software\MyWebSearch
                HKCU\Software\FunWebProducts
                HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0}
                HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF1-072E-44CF-8957-5838F569A31D}
                HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
                HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
                HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EAB-A523-4961-B6BB-170DE4475CCA}
                HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB}
                HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8}
                HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C}
                HKCU\Software\MyWebSearch
                HKLM\Software\FocusInteractive
                HKLM\Software\Fun Web Products
                HKLM\Software\FunWebProducts
                HKLM\Software\Microsoft\Code Store Database\Distribution Units\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB}
                HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59C7FC09-1C83-4648-B3E6-003D2BBC7481}
                HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68AF847F-6E91-45DD-9B68-D6A12C30E5D7}
                HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170B96C-28D4-4626-8358-27E6CAEEF907}
                HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D1A71FA0-FF48-48DD-9B6D-7A13A3E42127}
                HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DDB1968E-EAD6-40FD-8DAE-FF14757F60C7}
                HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F138D901-86F0-4383-99B6-9CDD406036DA}
                HKLM\Software\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll
                HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0}
                HKLM\Software\Microsoft\Multimedia\WMPlayer\Schemes\f3pss
                HKLM\Software\Microsoft\Office\Outlook\Addins\MyWebSearch.OutlookAddin
                HKLM\Software\Microsoft\Office\Word\Addins\MyWebSearch.OutlookAddin
                HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{07B18EAB-A523-4961-B6BB-170DE4475CCA}
                HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{25560540-9571-4D7B-9389-0F166788785A}
                HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8}
                HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3E720452-B472-4954-B7AA-33069EB53906}
                HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C}
                HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7473d294-b7bb-4f24-ae82-7e2ce94bb6a9}
                HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{98D9753D-D73B-42D5-8C85-4469CDA897AB}
                HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9FF05104-B030-46FC-94B8-81276E4E27DF}
                HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{E79DFBCA-5697-4FBD-94E5-5B2A9C7C1612}
                HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\MyWebSearch bar Uninstall
                HKLM\Software\MyWebSearch
                HKLM\SYSTEM\ControlSet002\Services\MyWebSearchService
                HKU\S-1-5-21-660324954-2617743974-2655421058-1004\Software\Appdatalow\Software\Fun Web Products
                HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform\\FunWebProducts
                HKLM\Software\Microsoft\Windows Media\Wmsdk\Sources\\F3PopularScreenSavers
                HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\MyWebSearch Email Plugin
                HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\My Web Search Bar Search Scope Monitor
                HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\MyWebSearch Email Plugin
                HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\MyWebSearch Plugin
                HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\\{00A6FAF6-072E-44CF-8957-5838F569A31D}
                HKLM\Software\Microsoft\Internet Explorer\Toolbar\\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
                HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
                HKLM\Software\Classes\CLSID\{00A6FAF1-072E-44cf-8957-5838F569A31D}
                HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00A6FAF1-072E-44cf-8957-5838F569A31D}
                HKLM\Software\Classes\CLSID\{00A6FAF6-072E-44cf-8957-5838F569A31D}
                HKLM\Software\Classes\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
                HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
                HKLM\Software\Classes\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
                HKLM\Software\Classes\CLSID\{07B18EAB-A523-4961-B6BB-170DE4475CCA}
                HKLM\Software\Classes\CLSID\{0F8ECF4F-3646-4C3A-8881-8E138FFCAF70}
                HKLM\Software\Classes\CLSID\{25560540-9571-4D7B-9389-0F166788785A}
                HKLM\Software\Classes\CLSID\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8}
                HKLM\Software\Classes\CLSID\{3E720452-B472-4954-B7AA-33069EB53906}
                HKLM\Software\Classes\CLSID\{53CED2D0-5E9A-4761-9005-648404E6F7E5}
                HKLM\Software\Classes\CLSID\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C}
                HKLM\Software\Classes\CLSID\{7473D292-B7BB-4f24-AE82-7E2CE94BB6A9}
                HKLM\Software\Classes\CLSID\{7473D294-B7BB-4f24-AE82-7E2CE94BB6A9}
                HKLM\Software\Classes\CLSID\{7473D296-B7BB-4f24-AE82-7E2CE94BB6A9}
                HKLM\Software\Classes\CLSID\{84DA4FDF-A1CF-4195-8688-3E961F505983}
                HKLM\Software\Classes\CLSID\{8E6F1832-9607-4440-8530-13BE7C4B1D14}
                HKLM\Software\Classes\CLSID\{938AA51A-996C-4884-98CE-80DD16A5C9DA}
                HKLM\Software\Classes\CLSID\{98D9753D-D73B-42D5-8C85-4469CDA897AB}
                HKLM\Software\Classes\CLSID\{9FF05104-B030-46FC-94B8-81276E4E27DF}
                HKLM\Software\Classes\CLSID\{A9571378-68A1-443d-B082-284F960C6D17}
                HKLM\Software\Classes\CLSID\{ADB01E81-3C79-4272-A0F1-7B2BE7A782DC}
                HKLM\Software\Classes\CLSID\{B813095C-81C0-4E40-AA14-67520372B987}
                HKLM\Software\Classes\CLSID\{C9D7BE3E-141A-4C85-8CD6-32461F3DF2C7}
                HKLM\Software\Classes\CLSID\{CFF4CE82-3AA2-451F-9B77-7165605FB835}
                HKLM\Software\Classes\CLSID\{D9FFFB27-D62A-4D64-8CEC-1FF006528805}
                HKLM\Software\Classes\CLSID\{E79DFBCA-5697-4fbd-94E5-5B2A9C7C1612}
                .
                C:\Users\francois\Appdata\LocalLow\FunWebProducts\Data
                C:\Users\francois\Appdata\LocalLow\FunWebProducts\Installr
                C:\Users\francois\Appdata\LocalLow\FunWebProducts\PopSwatr
                C:\Users\francois\Appdata\LocalLow\FunWebProducts\Shared
                C:\Users\francois\Appdata\LocalLow\FunWebProducts\Data\avatar.dat
                C:\Users\francois\Appdata\LocalLow\FunWebProducts\Data\zbucks.dat
                C:\Users\francois\Appdata\LocalLow\FunWebProducts\Installr\Cache
                C:\Users\francois\Appdata\LocalLow\FunWebProducts\Installr\Cache\00191BCA.exe
                C:\Users\francois\Appdata\LocalLow\FunWebProducts\Installr\Cache\files.ini
                C:\Users\francois\Appdata\LocalLow\FunWebProducts\PopSwatr\History
                C:\Users\francois\Appdata\LocalLow\FunWebProducts\PopSwatr\History\allowed
                C:\Users\francois\Appdata\LocalLow\FunWebProducts\PopSwatr\History\notallow
                C:\Users\francois\Appdata\LocalLow\FunWebProducts\Shared\Cache
                C:\Users\francois\Appdata\LocalLow\FunWebProducts\Shared\Cache\CursorManiaBtn.html
                C:\Users\francois\Appdata\LocalLow\FunWebProducts\Shared\Cache\MyFunCardsIMBtn.html
                C:\Users\francois\Appdata\LocalLow\FunWebProducts\Shared\Cache\SmileyCentralBtn.html
                C:\Users\francois\Appdata\LocalLow\FunWebProducts\Shared\Cache\WebfettiBtn.html
                C:\Users\francois\Appdata\LocalLow\FunWebProducts
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Cache
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\History
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Settings
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\avatar.htm
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\bgfadel.gif
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\bgfader.gif
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\common-x.css
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\common.css
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\cornerbl.gif
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\cornerbr.gif
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\ext_def.gif
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\ext_roll.gif
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\include.js
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\index.htm
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\loader.htm
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\loading.gif
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\logo.gif
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\max_def.gif
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\max_roll.gif
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\min_def.gif
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\min_roll.gif
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\noflash.htm
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\res_def.gif
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\res_roll.gif
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\spacer.gif
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\spacer.swf
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\topgrad.gif
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\window.ico
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Cache\001BC60C
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Cache\001BC966.bin
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Cache\001BCBC7.bin
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Cache\001BCF5F.bin
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Cache\001BD181.bin
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Cache\001BD3A3.bin
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Cache\001BDB70
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Cache\003E977F.bin
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Cache\003E9924.bin
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Cache\003E9AD9.bin
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Cache\003E9C6E.bin
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Cache\0132D3A9
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Cache\files.ini
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\History\search3
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON\ask_logo.gif
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON\autoup.gif
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON\autoup.htm
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON\center.htm
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON\index.htm
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON\mid_dots.gif
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON\mws_logo.gif
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON\protect.htm
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON\shocked.gif
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON\stop.gif
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON\systray.htm
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON\systrayp.htm
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON\tp_grad.gif
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON\warn.gif
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Settings\prevcfg2.htm
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Settings\setting2.htm
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Settings\setting2.htm.bak
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Settings\settings.dat
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Settings\settings.dat.bak
                C:\Users\francois\Appdata\LocalLow\MyWebSearch
                C:\Program Files\FunWebProducts\ScreenSaver
                C:\Program Files\FunWebProducts\ScreenSaver\Images
                C:\Program Files\FunWebProducts
                /!\ NON SUPPRIMÉ: C:\Program Files\MyWebSearch\bar
                /!\ NON SUPPRIMÉ: C:\Program Files\MyWebSearch\bar\1.bin
                C:\Program Files\MyWebSearch\bar\Avatar
                C:\Program Files\MyWebSearch\bar\Game
                C:\Program Files\MyWebSearch\bar\History
                C:\Program Files\MyWebSearch\bar\icons
                C:\Program Files\MyWebSearch\bar\Message
                C:\Program Files\MyWebSearch\bar\Notifier
                C:\Program Files\MyWebSearch\bar\Settings
                C:\Program Files\MyWebSearch\bar\1.bin\F3BKGERR.JPG
                C:\Program Files\MyWebSearch\bar\1.bin\F3CJPEG.DLL
                C:\Program Files\MyWebSearch\bar\1.bin\F3DTACTL.DLL
                C:\Program Files\MyWebSearch\bar\1.bin\F3HISTSW.DLL
                /!\ NON SUPPRIMÉ: C:\Program Files\MyWebSearch\bar\1.bin\F3HKSTUB.DLL
                C:\Program Files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL
                C:\Program Files\MyWebSearch\bar\1.bin\F3HTTPCT.DLL
                C:\Program Files\MyWebSearch\bar\1.bin\F3POPSWT.DLL
                C:\Program Files\MyWebSearch\bar\1.bin\F3PSSAVR.SCR
                C:\Program Files\MyWebSearch\bar\1.bin\F3REGHK.DLL
                C:\Program Files\MyWebSearch\bar\1.bin\F3REPROX.DLL
                C:\Program Files\MyWebSearch\bar\1.bin\F3RESTUB.DLL
                C:\Program Files\MyWebSearch\bar\1.bin\F3SCHMON.EXE
                C:\Program Files\MyWebSearch\bar\1.bin\F3SCRCTR.DLL
                C:\Program Files\MyWebSearch\bar\1.bin\F3SPACER.WMV
                C:\Program Files\MyWebSearch\bar\1.bin\F3WALLPP.DAT
                C:\Program Files\MyWebSearch\bar\1.bin\F3WPHOOK.DLL
                C:\Program Files\MyWebSearch\bar\1.bin\FWPBUDDY.PNG
                C:\Program Files\MyWebSearch\bar\1.bin\M3FFXTBR.JAR
                C:\Program Files\MyWebSearch\bar\1.bin\M3FFXTBR.MANIFEST
                C:\Program Files\MyWebSearch\bar\1.bin\M3HIGHIN.EXE
                C:\Program Files\MyWebSearch\bar\1.bin\M3HTML.DLL
                C:\Program Files\MyWebSearch\bar\1.bin\M3IDLE.DLL
                C:\Program Files\MyWebSearch\bar\1.bin\M3IMPIPE.EXE
                C:\Program Files\MyWebSearch\bar\1.bin\M3MEDINT.EXE
                C:\Program Files\MyWebSearch\bar\1.bin\M3MSG.DLL
                C:\Program Files\MyWebSearch\bar\1.bin\M3NTSTBR.JAR
                C:\Program Files\MyWebSearch\bar\1.bin\M3NTSTBR.MANIFEST
                C:\Program Files\MyWebSearch\bar\1.bin\M3OUTLCN.DLL
                C:\Program Files\MyWebSearch\bar\1.bin\M3PLUGIN.DLL
                C:\Program Files\MyWebSearch\bar\1.bin\M3SKIN.DLL
                C:\Program Files\MyWebSearch\bar\1.bin\M3SKPLAY.EXE
                C:\Program Files\MyWebSearch\bar\1.bin\M3SLSRCH.EXE
                C:\Program Files\MyWebSearch\bar\1.bin\M3SRCHMN.EXE
                C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
                C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
                C:\Program Files\MyWebSearch\bar\1.bin\MWSOEPLG.DLL
                /!\ NON SUPPRIMÉ: C:\Program Files\MyWebSearch\bar\1.bin\MWSOESTB.DLL
                /!\ NON SUPPRIMÉ: C:\Program Files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL
                C:\Program Files\MyWebSearch\bar\1.bin\MWSSVC.EXE
                C:\Program Files\MyWebSearch\bar\1.bin\NPMYWEBS.DLL
                C:\Program Files\MyWebSearch\bar\Avatar\COMMON.F3S
                C:\Program Files\MyWebSearch\bar\Game\CHECKERS.F3S
                C:\Program Files\MyWebSearch\bar\Game\CHESS.F3S
                C:\Program Files\MyWebSearch\bar\Game\REVERSI.F3S
                C:\Program Files\MyWebSearch\bar\icons\CM.ICO
                C:\Program Files\MyWebSearch\bar\icons\MFC.ICO
                C:\Program Files\MyWebSearch\bar\icons\PSS.ICO
                C:\Program Files\MyWebSearch\bar\icons\SMILEY.ICO
                C:\Program Files\MyWebSearch\bar\icons\WB.ICO
                C:\Program Files\MyWebSearch\bar\icons\ZWINKY.ICO
                C:\Program Files\MyWebSearch\bar\Message\COMMON.F3S
                C:\Program Files\MyWebSearch\bar\Notifier\COMMON.F3S
                C:\Program Files\MyWebSearch\bar\Notifier\DOG.F3S
                C:\Program Files\MyWebSearch\bar\Notifier\FISH.F3S
                C:\Program Files\MyWebSearch\bar\Notifier\KUNGFU.F3S
                C:\Program Files\MyWebSearch\bar\Notifier\LIFEGARD.F3S
                C:\Program Files\MyWebSearch\bar\Notifier\MAID.F3S
                C:\Program Files\MyWebSearch\bar\Notifier\MAILBOX.F3S
                C:\Program Files\MyWebSearch\bar\Notifier\OPERA.F3S
                C:\Program Files\MyWebSearch\bar\Notifier\ROBOT.F3S
                C:\Program Files\MyWebSearch\bar\Notifier\SEDUCT.F3S
                C:\Program Files\MyWebSearch\bar\Notifier\SURFER.F3S
                C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat
                /!\ NON SUPPRIMÉ: C:\Program Files\MyWebSearch
                C:\Windows\System32\f3PSSavr.scr
                C:\Program Files\Windows Live\Messenger\riched20.dll
                C:\Program Files\Windows Live\Messenger\msimg32.dll

                (!) -- Fichiers temporaires supprimés.

                .
                +-----------------| Scan additionnel:
                .
                .
                .

                ---- Internet Explorer Version 7.0.6001.18000 ----

                [HKEY_CURRENT_USER\..\Internet Explorer\Main]

                Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
                Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
                Search Page: hxxp://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR
                Start Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

                [HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

                Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
                Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                Search bar: hxxp://search.msn.com/spbasic.htm
                Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                Start Page: hxxp://fr.msn.com/

                [HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

                Tabs: res://ieframe.dll/tabswelcome.htm

                =========== Suspect (Cracks, Serials ... ) ==========

                .

                +---------------------------------------------------------------------------+

                19555 Octet(s) - C:\Ad-Report-26.05.2009.log

                19 Fichier(s) - C:\Program Files\Ad-remover\BACKUP
                11 Fichier(s) - C:\Program Files\Ad-remover\QUARANTINE

                Fin à: 8:25:21 | 26/05/2009
                .
                +-----------------| E.O.F
                .
                1. eucharistie Auteur
                  ------ RAPPORT D'AD-REMOVER 1.1.4.3 | UNIQUEMENT XP/VISTA -------

                  Mit à jour part C_XX le 24/05/2009 à 15:20
                  Contact: AdRemover.contact@gmail.com
                  Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html

                  Lancé à: 7:53:48, 26/05/2009 | Mode Normal
                  Exécuté de: C:\Program Files\Ad-remover\
                  Système d'exploitation: Microsoft® Windows Vista™ Home Premium Service Pack 1 v6.0.6001
                  Nom du PC: PC-DE-FRANCOIS
                  Utilisateur actuel: francois - Administrator

                  .
                  ============== ÉLÉMENT(S) NEUTRALISÉ(S) ==============
                  .
                  Service: "MyWebSearchService"
                  .
                  HKCR\FunWebProducts.DataControl
                  HKCR\FunWebProducts.DataControl.1
                  HKCR\FunWebProducts.HistoryKillerScheduler
                  HKCR\FunWebProducts.HistoryKillerScheduler.1
                  HKCR\FunWebProducts.HistorySwatterControlBar
                  HKCR\FunWebProducts.HistorySwatterControlBar.1
                  HKCR\FunWebProducts.HTMLMenu
                  HKCR\FunWebProducts.HTMLMenu.1
                  HKCR\FunWebProducts.HTMLMenu.2
                  HKCR\FunWebProducts.IECookiesManager
                  HKCR\FunWebProducts.IECookiesManager.1
                  HKCR\FunWebProducts.KillerObjManager
                  HKCR\FunWebProducts.KillerObjManager.1
                  HKCR\FunWebProducts.PopSwatterBarButton
                  HKCR\FunWebProducts.PopSwatterBarButton.1
                  HKCR\FunWebProducts.PopSwatterSettingsControl
                  HKCR\FunWebProducts.PopSwatterSettingsControl.1
                  HKCR\MyWebSearch.ChatSessionPlugin
                  HKCR\MyWebSearch.ChatSessionPlugin.1
                  HKCR\MyWebSearch.HTMLPanel
                  HKCR\MyWebSearch.HTMLPanel.1
                  HKCR\MyWebSearch.OutlookAddin
                  HKCR\MyWebSearch.OutlookAddin.1
                  HKCR\MyWebSearch.PseudoTransparentPlugin
                  HKCR\MyWebSearch.PseudoTransparentPlugin.1
                  HKCR\MyWebSearchToolBar.SettingsPlugin
                  HKCR\MyWebSearchToolBar.SettingsPlugin.1
                  HKCR\MyWebSearchToolBar.ToolbarPlugin
                  HKCR\MyWebSearchToolBar.ToolbarPlugin.1
                  HKCR\screensavercontrol.screensaverinstaller
                  HKCR\screensavercontrol.screensaverinstaller.1
                  HKCU\Software\AppDataLow\Software\MyWebSearch
                  HKCU\Software\FunWebProducts
                  HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0}
                  HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF1-072E-44CF-8957-5838F569A31D}
                  HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
                  HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
                  HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EAB-A523-4961-B6BB-170DE4475CCA}
                  HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB}
                  HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8}
                  HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C}
                  HKCU\Software\MyWebSearch
                  HKLM\Software\FocusInteractive
                  HKLM\Software\Fun Web Products
                  HKLM\Software\FunWebProducts
                  HKLM\Software\Microsoft\Code Store Database\Distribution Units\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB}
                  HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59C7FC09-1C83-4648-B3E6-003D2BBC7481}
                  HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68AF847F-6E91-45DD-9B68-D6A12C30E5D7}
                  HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170B96C-28D4-4626-8358-27E6CAEEF907}
                  HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D1A71FA0-FF48-48DD-9B6D-7A13A3E42127}
                  HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DDB1968E-EAD6-40FD-8DAE-FF14757F60C7}
                  HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F138D901-86F0-4383-99B6-9CDD406036DA}
                  HKLM\Software\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll
                  HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0}
                  HKLM\Software\Microsoft\Multimedia\WMPlayer\Schemes\f3pss
                  HKLM\Software\Microsoft\Office\Outlook\Addins\MyWebSearch.OutlookAddin
                  HKLM\Software\Microsoft\Office\Word\Addins\MyWebSearch.OutlookAddin
                  HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{07B18EAB-A523-4961-B6BB-170DE4475CCA}
                  HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{25560540-9571-4D7B-9389-0F166788785A}
                  HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8}
                  HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3E720452-B472-4954-B7AA-33069EB53906}
                  HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C}
                  HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7473d294-b7bb-4f24-ae82-7e2ce94bb6a9}
                  HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{98D9753D-D73B-42D5-8C85-4469CDA897AB}
                  HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9FF05104-B030-46FC-94B8-81276E4E27DF}
                  HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{E79DFBCA-5697-4FBD-94E5-5B2A9C7C1612}
                  HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\MyWebSearch bar Uninstall
                  HKLM\Software\MyWebSearch
                  HKLM\SYSTEM\ControlSet002\Services\MyWebSearchService
                  HKU\S-1-5-21-660324954-2617743974-2655421058-1004\Software\Appdatalow\Software\Fun Web Products
                  HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform\\FunWebProducts
                  HKLM\Software\Microsoft\Windows Media\Wmsdk\Sources\\F3PopularScreenSavers
                  HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\MyWebSearch Email Plugin
                  HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\My Web Search Bar Search Scope Monitor
                  HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\MyWebSearch Email Plugin
                  HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\MyWebSearch Plugin
                  HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\\{00A6FAF6-072E-44CF-8957-5838F569A31D}
                  HKLM\Software\Microsoft\Internet Explorer\Toolbar\\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
                  HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
                  HKLM\Software\Classes\CLSID\{00A6FAF1-072E-44cf-8957-5838F569A31D}
                  HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00A6FAF1-072E-44cf-8957-5838F569A31D}
                  HKLM\Software\Classes\CLSID\{00A6FAF6-072E-44cf-8957-5838F569A31D}
                  HKLM\Software\Classes\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
                  HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
                  HKLM\Software\Classes\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
                  HKLM\Software\Classes\CLSID\{07B18EAB-A523-4961-B6BB-170DE4475CCA}
                  HKLM\Software\Classes\CLSID\{0F8ECF4F-3646-4C3A-8881-8E138FFCAF70}
                  HKLM\Software\Classes\CLSID\{25560540-9571-4D7B-9389-0F166788785A}
                  HKLM\Software\Classes\CLSID\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8}
                  HKLM\Software\Classes\CLSID\{3E720452-B472-4954-B7AA-33069EB53906}
                  HKLM\Software\Classes\CLSID\{53CED2D0-5E9A-4761-9005-648404E6F7E5}
                  HKLM\Software\Classes\CLSID\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C}
                  HKLM\Software\Classes\CLSID\{7473D292-B7BB-4f24-AE82-7E2CE94BB6A9}
                  HKLM\Software\Classes\CLSID\{7473D294-B7BB-4f24-AE82-7E2CE94BB6A9}
                  HKLM\Software\Classes\CLSID\{7473D296-B7BB-4f24-AE82-7E2CE94BB6A9}
                  HKLM\Software\Classes\CLSID\{84DA4FDF-A1CF-4195-8688-3E961F505983}
                  HKLM\Software\Classes\CLSID\{8E6F1832-9607-4440-8530-13BE7C4B1D14}
                  HKLM\Software\Classes\CLSID\{938AA51A-996C-4884-98CE-80DD16A5C9DA}
                  HKLM\Software\Classes\CLSID\{98D9753D-D73B-42D5-8C85-4469CDA897AB}
                  HKLM\Software\Classes\CLSID\{9FF05104-B030-46FC-94B8-81276E4E27DF}
                  HKLM\Software\Classes\CLSID\{A9571378-68A1-443d-B082-284F960C6D17}
                  HKLM\Software\Classes\CLSID\{ADB01E81-3C79-4272-A0F1-7B2BE7A782DC}
                  HKLM\Software\Classes\CLSID\{B813095C-81C0-4E40-AA14-67520372B987}
                  HKLM\Software\Classes\CLSID\{C9D7BE3E-141A-4C85-8CD6-32461F3DF2C7}
                  HKLM\Software\Classes\CLSID\{CFF4CE82-3AA2-451F-9B77-7165605FB835}
                  HKLM\Software\Classes\CLSID\{D9FFFB27-D62A-4D64-8CEC-1FF006528805}
                  HKLM\Software\Classes\CLSID\{E79DFBCA-5697-4fbd-94E5-5B2A9C7C1612}
                  .
                  C:\Users\francois\Appdata\LocalLow\FunWebProducts\Data
                  C:\Users\francois\Appdata\LocalLow\FunWebProducts\Installr
                  C:\Users\francois\Appdata\LocalLow\FunWebProducts\PopSwatr
                  C:\Users\francois\Appdata\LocalLow\FunWebProducts\Shared
                  C:\Users\francois\Appdata\LocalLow\FunWebProducts\Data\avatar.dat
                  C:\Users\francois\Appdata\LocalLow\FunWebProducts\Data\zbucks.dat
                  C:\Users\francois\Appdata\LocalLow\FunWebProducts\Installr\Cache
                  C:\Users\francois\Appdata\LocalLow\FunWebProducts\Installr\Cache\00191BCA.exe
                  C:\Users\francois\Appdata\LocalLow\FunWebProducts\Installr\Cache\files.ini
                  C:\Users\francois\Appdata\LocalLow\FunWebProducts\PopSwatr\History
                  C:\Users\francois\Appdata\LocalLow\FunWebProducts\PopSwatr\History\allowed
                  C:\Users\francois\Appdata\LocalLow\FunWebProducts\PopSwatr\History\notallow
                  C:\Users\francois\Appdata\LocalLow\FunWebProducts\Shared\Cache
                  C:\Users\francois\Appdata\LocalLow\FunWebProducts\Shared\Cache\CursorManiaBtn.html
                  C:\Users\francois\Appdata\LocalLow\FunWebProducts\Shared\Cache\MyFunCardsIMBtn.html
                  C:\Users\francois\Appdata\LocalLow\FunWebProducts\Shared\Cache\SmileyCentralBtn.html
                  C:\Users\francois\Appdata\LocalLow\FunWebProducts\Shared\Cache\WebfettiBtn.html
                  C:\Users\francois\Appdata\LocalLow\FunWebProducts
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Cache
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\History
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Settings
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\avatar.htm
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\bgfadel.gif
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\bgfader.gif
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\common-x.css
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\common.css
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\cornerbl.gif
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\cornerbr.gif
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\ext_def.gif
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\ext_roll.gif
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\include.js
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\index.htm
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\loader.htm
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\loading.gif
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\logo.gif
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\max_def.gif
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\max_roll.gif
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\min_def.gif
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\min_roll.gif
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\noflash.htm
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\res_def.gif
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\res_roll.gif
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\spacer.gif
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\spacer.swf
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\topgrad.gif
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\window.ico
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Cache\001BC60C
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Cache\001BC966.bin
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Cache\001BCBC7.bin
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Cache\001BCF5F.bin
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Cache\001BD181.bin
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Cache\001BD3A3.bin
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Cache\001BDB70
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Cache\003E977F.bin
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Cache\003E9924.bin
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Cache\003E9AD9.bin
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Cache\003E9C6E.bin
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Cache\0132D3A9
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Cache\files.ini
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\History\search3
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON\ask_logo.gif
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON\autoup.gif
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON\autoup.htm
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON\center.htm
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON\index.htm
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON\mid_dots.gif
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON\mws_logo.gif
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON\protect.htm
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON\shocked.gif
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON\stop.gif
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON\systray.htm
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON\systrayp.htm
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON\tp_grad.gif
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON\warn.gif
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Settings\prevcfg2.htm
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Settings\setting2.htm
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Settings\setting2.htm.bak
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Settings\settings.dat
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Settings\settings.dat.bak
                  C:\Users\francois\Appdata\LocalLow\MyWebSearch
                  C:\Program Files\FunWebProducts\ScreenSaver
                  C:\Program Files\FunWebProducts\ScreenSaver\Images
                  C:\Program Files\FunWebProducts
                  /!\ NON SUPPRIMÉ: C:\Program Files\MyWebSearch\bar
                  /!\ NON SUPPRIMÉ: C:\Program Files\MyWebSearch\bar\1.bin
                  C:\Program Files\MyWebSearch\bar\Avatar
                  C:\Program Files\MyWebSearch\bar\Game
                  C:\Program Files\MyWebSearch\bar\History
                  C:\Program Files\MyWebSearch\bar\icons
                  C:\Program Files\MyWebSearch\bar\Message
                  C:\Program Files\MyWebSearch\bar\Notifier
                  C:\Program Files\MyWebSearch\bar\Settings
                  C:\Program Files\MyWebSearch\bar\1.bin\F3BKGERR.JPG
                  C:\Program Files\MyWebSearch\bar\1.bin\F3CJPEG.DLL
                  C:\Program Files\MyWebSearch\bar\1.bin\F3DTACTL.DLL
                  C:\Program Files\MyWebSearch\bar\1.bin\F3HISTSW.DLL
                  /!\ NON SUPPRIMÉ: C:\Program Files\MyWebSearch\bar\1.bin\F3HKSTUB.DLL
                  C:\Program Files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL
                  C:\Program Files\MyWebSearch\bar\1.bin\F3HTTPCT.DLL
                  C:\Program Files\MyWebSearch\bar\1.bin\F3POPSWT.DLL
                  C:\Program Files\MyWebSearch\bar\1.bin\F3PSSAVR.SCR
                  C:\Program Files\MyWebSearch\bar\1.bin\F3REGHK.DLL
                  C:\Program Files\MyWebSearch\bar\1.bin\F3REPROX.DLL
                  C:\Program Files\MyWebSearch\bar\1.bin\F3RESTUB.DLL
                  C:\Program Files\MyWebSearch\bar\1.bin\F3SCHMON.EXE
                  C:\Program Files\MyWebSearch\bar\1.bin\F3SCRCTR.DLL
                  C:\Program Files\MyWebSearch\bar\1.bin\F3SPACER.WMV
                  C:\Program Files\MyWebSearch\bar\1.bin\F3WALLPP.DAT
                  C:\Program Files\MyWebSearch\bar\1.bin\F3WPHOOK.DLL
                  C:\Program Files\MyWebSearch\bar\1.bin\FWPBUDDY.PNG
                  C:\Program Files\MyWebSearch\bar\1.bin\M3FFXTBR.JAR
                  C:\Program Files\MyWebSearch\bar\1.bin\M3FFXTBR.MANIFEST
                  C:\Program Files\MyWebSearch\bar\1.bin\M3HIGHIN.EXE
                  C:\Program Files\MyWebSearch\bar\1.bin\M3HTML.DLL
                  C:\Program Files\MyWebSearch\bar\1.bin\M3IDLE.DLL
                  C:\Program Files\MyWebSearch\bar\1.bin\M3IMPIPE.EXE
                  C:\Program Files\MyWebSearch\bar\1.bin\M3MEDINT.EXE
                  C:\Program Files\MyWebSearch\bar\1.bin\M3MSG.DLL
                  C:\Program Files\MyWebSearch\bar\1.bin\M3NTSTBR.JAR
                  C:\Program Files\MyWebSearch\bar\1.bin\M3NTSTBR.MANIFEST
                  C:\Program Files\MyWebSearch\bar\1.bin\M3OUTLCN.DLL
                  C:\Program Files\MyWebSearch\bar\1.bin\M3PLUGIN.DLL
                  C:\Program Files\MyWebSearch\bar\1.bin\M3SKIN.DLL
                  C:\Program Files\MyWebSearch\bar\1.bin\M3SKPLAY.EXE
                  C:\Program Files\MyWebSearch\bar\1.bin\M3SLSRCH.EXE
                  C:\Program Files\MyWebSearch\bar\1.bin\M3SRCHMN.EXE
                  C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
                  C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
                  C:\Program Files\MyWebSearch\bar\1.bin\MWSOEPLG.DLL
                  /!\ NON SUPPRIMÉ: C:\Program Files\MyWebSearch\bar\1.bin\MWSOESTB.DLL
                  /!\ NON SUPPRIMÉ: C:\Program Files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL
                  C:\Program Files\MyWebSearch\bar\1.bin\MWSSVC.EXE
                  C:\Program Files\MyWebSearch\bar\1.bin\NPMYWEBS.DLL
                  C:\Program Files\MyWebSearch\bar\Avatar\COMMON.F3S
                  C:\Program Files\MyWebSearch\bar\Game\CHECKERS.F3S
                  C:\Program Files\MyWebSearch\bar\Game\CHESS.F3S
                  C:\Program Files\MyWebSearch\bar\Game\REVERSI.F3S
                  C:\Program Files\MyWebSearch\bar\icons\CM.ICO
                  C:\Program Files\MyWebSearch\bar\icons\MFC.ICO
                  C:\Program Files\MyWebSearch\bar\icons\PSS.ICO
                  C:\Program Files\MyWebSearch\bar\icons\SMILEY.ICO
                  C:\Program Files\MyWebSearch\bar\icons\WB.ICO
                  C:\Program Files\MyWebSearch\bar\icons\ZWINKY.ICO
                  C:\Program Files\MyWebSearch\bar\Message\COMMON.F3S
                  C:\Program Files\MyWebSearch\bar\Notifier\COMMON.F3S
                  C:\Program Files\MyWebSearch\bar\Notifier\DOG.F3S
                  C:\Program Files\MyWebSearch\bar\Notifier\FISH.F3S
                  C:\Program Files\MyWebSearch\bar\Notifier\KUNGFU.F3S
                  C:\Program Files\MyWebSearch\bar\Notifier\LIFEGARD.F3S
                  C:\Program Files\MyWebSearch\bar\Notifier\MAID.F3S
                  C:\Program Files\MyWebSearch\bar\Notifier\MAILBOX.F3S
                  C:\Program Files\MyWebSearch\bar\Notifier\OPERA.F3S
                  C:\Program Files\MyWebSearch\bar\Notifier\ROBOT.F3S
                  C:\Program Files\MyWebSearch\bar\Notifier\SEDUCT.F3S
                  C:\Program Files\MyWebSearch\bar\Notifier\SURFER.F3S
                  C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat
                  /!\ NON SUPPRIMÉ: C:\Program Files\MyWebSearch
                  C:\Windows\System32\f3PSSavr.scr
                  C:\Program Files\Windows Live\Messenger\riched20.dll
                  C:\Program Files\Windows Live\Messenger\msimg32.dll

                  (!) -- Fichiers temporaires supprimés.

                  .
                  +-----------------| Scan additionnel:
                  .
                  .
                  .

                  ---- Internet Explorer Version 7.0.6001.18000 ----

                  [HKEY_CURRENT_USER\..\Internet Explorer\Main]

                  Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
                  Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                  Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
                  Search Page: hxxp://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR
                  Start Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

                  [HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

                  Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
                  Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                  Search bar: hxxp://search.msn.com/spbasic.htm
                  Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                  Start Page: hxxp://fr.msn.com/

                  [HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

                  Tabs: res://ieframe.dll/tabswelcome.htm

                  =========== Suspect (Cracks, Serials ... ) ==========

                  .

                  +---------------------------------------------------------------------------+

                  19555 Octet(s) - C:\Ad-Report-26.05.2009.log

                  19 Fichier(s) - C:\Program Files\Ad-remover\BACKUP
                  11 Fichier(s) - C:\Program Files\Ad-remover\QUARANTINE

                  Fin à: 8:25:21 | 26/05/2009
                  .
                  +-----------------| E.O.F
                  .
                  3. eucharistie Auteur
                    voila, et excuse moi, merci de me consacré du temps!

                    Logfile of random's system information tool 1.06 (written by random/random)
                    Run by francois at 2009-05-26 08:35:26
                    Microsoft® Windows Vista™ Édition Familiale Premium Service Pack 1
                    System drive C: has 5 GB (16%) free of 30 GB
                    Total RAM: 3063 MB (59% free)

                    Logfile of Trend Micro HijackThis v2.0.2
                    Scan saved at 08:35:36, on 26/05/2009
                    Platform: Windows Vista SP1 (WinNT 6.00.1905)
                    MSIE: Internet Explorer v7.00 (7.00.6001.18226)
                    Boot mode: Normal

                    Running processes:
                    C:\Windows\system32\Dwm.exe
                    C:\Windows\system32\taskeng.exe
                    C:\Windows\RtHDVCpl.exe
                    C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
                    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
                    C:\Windows\System32\hkcmd.exe
                    C:\Windows\System32\igfxpers.exe
                    C:\Program Files\Lenovo\EnergyCut\utilty.exe
                    C:\Program Files\Lenovo\EnergyCut\EnergyCut.exe
                    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
                    C:\Program Files\Lenovo\ShuttleCenter\PCMService.exe
                    C:\Program Files\Lenovo\VeriFace\PManage.exe
                    C:\Program Files\Lenovo\VeriFace\RTimeLock.exe
                    C:\Program Files\Windows Sidebar\sidebar.exe
                    C:\Windows\ehome\ehtray.exe
                    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                    C:\Windows\system32\igfxsrvc.exe
                    C:\Windows\ehome\ehmsas.exe
                    C:\Windows\explorer.exe
                    C:\Windows\system32\conime.exe
                    C:\Program Files\Internet Explorer\ieuser.exe
                    C:\Program Files\Internet Explorer\iexplore.exe
                    C:\Program Files\Google\Google Toolbar\GoogleToolbarUser.exe
                    C:\Users\francois\Desktop\RSIT.exe
                    C:\Users\francois\Desktop\francois.exe

                    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
                    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
                    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
                    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
                    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
                    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
                    R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)
                    O1 - Hosts: ::1 localhost
                    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
                    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
                    O2 - BHO: (no name) - {2E59498D-7E44-4452-9044-0973B080B9E8} - C:\Windows\System32\winexplorer.dll
                    O2 - BHO: Windows Live Call HoverToCall class - {7E853D72-626A-48EC-A868-BA8D5E23E045} - C:\Program Files\Windows Live\Messenger\HTC.DLL
                    O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
                    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
                    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                    O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
                    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                    O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
                    O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
                    O4 - HKLM\..\Run: [Unattend0000000001{7CE4F652-9E84-4617-9F54-DC8891DFB725}] C:\Windows\test.bat
                    O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
                    O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
                    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
                    O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
                    O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
                    O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
                    O4 - HKLM\..\Run: [EnergyCut_Utility] C:\Program Files\Lenovo\EnergyCut\utilty.exe
                    O4 - HKLM\..\Run: [EnergyCut] C:\Program Files\Lenovo\EnergyCut\EnergyCut.exe
                    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
                    O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Lenovo\ShuttleCenter\PCMService.exe"
                    O4 - HKLM\..\Run: [VeriFacePassManager] C:\Program Files\Lenovo\VeriFace\PManage.exe
                    O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
                    O4 - HKLM\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALuNotify.exe
                    O4 - HKLM\..\Run: [VeriFaceTimeLock] C:\Program Files\Lenovo\VeriFace\RTimeLock.exe
                    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
                    O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
                    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
                    O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
                    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                    O4 - HKCU\..\Run: [Speech Recognition] "C:\Windows\Speech\Common\sapisvr.exe" -SpeechUX -Startup
                    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
                    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
                    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
                    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
                    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
                    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
                    O9 - Extra button: Password Administration Box - {A26ABCF0-1C8F-46e7-A67C-0489DC21B9CC} - C:\Program Files\Lenovo\VeriFace\OpenWnd.exe
                    O9 - Extra 'Tools' menuitem: Password Administration Box - {A26ABCF0-1C8F-46e7-A67C-0489DC21B9CC} - C:\Program Files\Lenovo\VeriFace\OpenWnd.exe
                    O13 - Gopher Prefix:
                    O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
                    O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ATK Hotkey\ASLDRSrv.exe
                    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
                    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
                    O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Lenovo\ShuttleCenter\Kernel\TV\CLCapSvc.exe
                    O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Lenovo\ShuttleCenter\Kernel\TV\CLSched.exe
                    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
                    O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
                    O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                    O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe
                    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
                    O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
                    O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
                    O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
                    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
                    O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
                    O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
                    1. V-X
                      Re,

                      Télécharge Toolbar-S&D (Team IDN) sur ton Bureau

                      !! Déconnectes toi et fermes toute tes applications en cours le temps de la manipe !!

                      ▶ Double-cliques sur l'.exe pour lancer l'installe et laisses toi guider ...

                      ▶ Une fois fait, cliques sur le raccourci créé sur ton bureau pour lancer l'outil .

                      ▶ Choisis l'option 1 ( "recherche") et tapes "entrée" .

                      ▶Une fois le scan finit , un rapport va apparaître, copie/colles l'intégralité
                      de son contenu dans ta prochaine réponse ...

                      ( le rapport est en outre sauvegardé ici -> C:\TB.txt )

                      Tutoriel Toolbard-S&D

                      Si un rapport ne passe pas faire une alerte à la conciergerie avec le /!\ jaune.
                      1. eucharistie Auteur
                        ----------\\ ToolBar S&D 1.2.8 XP/Vista

                        Microsoft® Windows Vista™ Édition Familiale Premium ( v6.0.6001 ) Service Pack 1
                        X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) Dual CPU T2390 @ 1.86GHz )
                        BIOS : Default System BIOS
                        USER : francois ( Administrator )
                        BOOT : Normal boot
                        Antivirus : Norton AntiVirus 2007 (Not Activated)
                        Firewall : Norton AntiVirus 2007 (Activated)
                        C:\ (Local Disk) - NTFS - Total:29 Go (Free:4 Go)
                        D:\ (Local Disk) - NTFS - Total:186 Go (Free:186 Go)
                        E:\ (CD or DVD)

                        "C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
                        Option : [1] ( 26/05/2009| 8:57 )

                        [ UAC => 1 ]

                        -----------\\ Recherche de Fichiers / Dossiers ...

                        C:\Program Files\MyWebSearch
                        C:\Program Files\MyWebSearch\bar
                        C:\Program Files\MyWebSearch\bar\1.bin
                        C:\Program Files\MyWebSearch\bar\1.bin\F3HKSTUB.DLL
                        C:\Program Files\MyWebSearch\bar\1.bin\MWSOESTB.DLL
                        C:\Program Files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL

                        -----------\\ [..\Internet Explorer\Main]

                        [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
                        "Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
                        "Local Page"="C:\\Windows\\system32\\blank.htm"
                        "Search Page"="https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC"
                        "Search Bar"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
                        "Default_search_url"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
                        "Default_page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"

                        [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
                        "Start Page"="https://www.msn.com/fr-fr"
                        "Default_Page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
                        "Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
                        "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
                        "Search bar"="http://www.bing.com/spresults.aspx"

                        --------------------\\ Recherche d'autres infections

                        Aucune autre infection trouvée !

                        [ UAC => 1 ]

                        1 - "C:\ToolBar SD\TB_1.txt" - 26/05/2009| 8:57 - Option : [1]

                        -----------\\ Fin du rapport a 8:57:46,73
                        1. V-X
                          Re,

                          Fais ceci maintenant :

                          ▶ Nettoyage avec ToolBar S&D :

                          !! Déconnectes toi et fermes toute tes applications en cours le temps de la manipe !!

                          ▶Relances Toolbar-S&D en double-cliquant sur le raccourci.

                          ▶ Tapes sur l'option 2 ( "nettoyage" ) puis tapes sur "Entrée".

                          Note : Ne touches à rien lors de la suppression !!

                          ▶ Un rapport sera généré à la fin du processus : postes son contenu dans ta prochaine réponse

                          Si un rapport ne passe pas faire une alerte à la conciergerie avec le /!\ jaune.
                          1. eucharistie Auteur
                            -----------\\ ToolBar S&D 1.2.8 XP/Vista

                            Microsoft® Windows Vista™ Édition Familiale Premium ( v6.0.6001 ) Service Pack 1
                            X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) Dual CPU T2390 @ 1.86GHz )
                            BIOS : Default System BIOS
                            USER : francois ( Administrator )
                            BOOT : Normal boot
                            Antivirus : Norton AntiVirus 2007 (Not Activated)
                            Firewall : Norton AntiVirus 2007 (Activated)
                            C:\ (Local Disk) - NTFS - Total:29 Go (Free:4 Go)
                            D:\ (Local Disk) - NTFS - Total:186 Go (Free:186 Go)
                            E:\ (CD or DVD)

                            "C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
                            Option : [2] ( 26/05/2009| 9:09 )

                            [ UAC => 1 ]

                            -----------\\ SUPPRESSION

                            Echec ! - C:\Program Files\MyWebSearch\bar
                            Echec ! - C:\Program Files\MyWebSearch\bar\1.bin
                            Echec ! - C:\Program Files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL
                            Echec ! - C:\Program Files\MyWebSearch

                            -----------\\ DEUXIEME PASSAGE

                            Echec ! - C:\Program Files\MyWebSearch\bar
                            Echec ! - C:\Program Files\MyWebSearch\bar\1.bin
                            Echec ! - C:\Program Files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL
                            Echec ! - C:\Program Files\MyWebSearch

                            -----------\\ Recherche de Fichiers / Dossiers ...

                            C:\Program Files\MyWebSearch
                            C:\Program Files\MyWebSearch\bar
                            C:\Program Files\MyWebSearch\bar\1.bin
                            C:\Program Files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL

                            -----------\\ [..\Internet Explorer\Main]

                            [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
                            "Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
                            "Local Page"="C:\\Windows\\system32\\blank.htm"
                            "Search Page"="https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC"
                            "Search Bar"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
                            "Default_search_url"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
                            "Default_page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"

                            [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
                            "Start Page"="https://www.msn.com/fr-fr/"
                            "Default_Page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
                            "Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
                            "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
                            "Search bar"="http://www.bing.com/spresults.aspx"

                            --------------------\\ Recherche d'autres infections

                            Aucune autre infection trouvée !

                            [ UAC => 1 ]

                            1 - "C:\ToolBar SD\TB_1.txt" - 26/05/2009| 8:57 - Option : [1]
                            2 - "C:\ToolBar SD\TB_2.txt" - 26/05/2009| 9:10 - Option : [2]

                            -----------\\ Fin du rapport a 9:10:59,04
                            1. V-X
                              Re,

                              ---> Télécharge OTM (OldTimer) sur ton Bureau :
                              http://oldtimer.geekstogo.com/OTMoveIt3.exe

                              ---> Double-clique sur OTMoveIt3.exe afin de le lancer.

                              ---> Copie (Ctrl+C) le texte suivant en gras ci-dessous :

                              :processes
                              explorer.exe

                              :files
                              C:\Program Files\MyWebSearch
                              C:\Program Files\MyWebSearch\bar
                              C:\Program Files\MyWebSearch\bar\1.bin
                              C:\Program Files\MyWebSearch\bar\1.bin\F3HKSTUB.DLL
                              C:\Program Files\MyWebSearch\bar\1.bin\MWSOESTB.DLL
                              C:\Program Files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL

                              :commands
                              [emptytemp]
                              [start explorer]


                              ---> Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved.

                              ---> Clique maintenant sur le bouton MoveIt! puis ferme OTMoveIt3.

                              Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer.
                              Accepte en cliquant sur YES.

                              ---> Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\
                              Le nom du rapport correspond au moment de sa création : date_heure.log
                              1. eucharistie Auteur
                                ========== PROCESSES ==========
                                Process explorer.exe killed successfully.
                                ========== FILES ==========
                                Folder move failed. C:\Program Files\MyWebSearch\bar\1.bin scheduled to be moved on reboot.
                                Folder move failed. C:\Program Files\MyWebSearch\bar scheduled to be moved on reboot.
                                Folder move failed. C:\Program Files\MyWebSearch scheduled to be moved on reboot.
                                Folder move failed. C:\Program Files\MyWebSearch\bar\1.bin scheduled to be moved on reboot.
                                Folder move failed. C:\Program Files\MyWebSearch\bar scheduled to be moved on reboot.
                                Folder move failed. C:\Program Files\MyWebSearch\bar\1.bin scheduled to be moved on reboot.
                                File/Folder C:\Program Files\MyWebSearch\bar\1.bin\F3HKSTUB.DLL not found.
                                File/Folder C:\Program Files\MyWebSearch\bar\1.bin\MWSOESTB.DLL not found.
                                C:\Program Files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL unregistered successfully.
                                File move failed. C:\Program Files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL scheduled to be moved on reboot.
                                ========== COMMANDS ==========
                                User's Temp folder emptied.
                                User's Internet Explorer cache folder emptied.
                                Windows Temp folder emptied.
                                Temp folders emptied.
                                Explorer started successfully

                                OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 05262009_094041
                                2. eucharistie Auteur
                                  Logfile of random's system information tool 1.06 (written by random/random)
                                  Run by francois at 2009-05-26 09:54:20
                                  Microsoft® Windows Vista™ Édition Familiale Premium Service Pack 1
                                  System drive C: has 5 GB (15%) free of 30 GB
                                  Total RAM: 3063 MB (69% free)

                                  Logfile of Trend Micro HijackThis v2.0.2
                                  Scan saved at 09:54:35, on 26/05/2009
                                  Platform: Windows Vista SP1 (WinNT 6.00.1905)
                                  MSIE: Internet Explorer v7.00 (7.00.6001.18226)
                                  Boot mode: Normal

                                  Running processes:
                                  C:\Windows\system32\Dwm.exe
                                  C:\Windows\Explorer.EXE
                                  C:\Windows\system32\taskeng.exe
                                  C:\Windows\system32\taskeng.exe
                                  C:\Windows\RtHDVCpl.exe
                                  C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
                                  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
                                  C:\Windows\System32\hkcmd.exe
                                  C:\Windows\System32\igfxpers.exe
                                  C:\Program Files\Lenovo\EnergyCut\utilty.exe
                                  C:\Program Files\Lenovo\EnergyCut\EnergyCut.exe
                                  C:\Program Files\Common Files\Symantec Shared\ccApp.exe
                                  C:\Program Files\Lenovo\ShuttleCenter\PCMService.exe
                                  C:\Program Files\Lenovo\VeriFace\PManage.exe
                                  C:\Program Files\Lenovo\VeriFace\RTimeLock.exe
                                  C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe
                                  C:\Program Files\Windows Sidebar\sidebar.exe
                                  C:\Windows\ehome\ehtray.exe
                                  C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                                  C:\Windows\system32\igfxsrvc.exe
                                  C:\Windows\system32\wbem\unsecapp.exe
                                  C:\Windows\ehome\ehmsas.exe
                                  C:\Windows\system32\SearchFilterHost.exe
                                  C:\Users\francois\Desktop\RSIT.exe
                                  C:\Users\francois\Desktop\francois.exe

                                  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.microsoft.com/fwlink/?linkid=54896
                                  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR
                                  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
                                  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
                                  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR
                                  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
                                  R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)
                                  O1 - Hosts: ::1 localhost
                                  O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
                                  O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
                                  O2 - BHO: (no name) - {2E59498D-7E44-4452-9044-0973B080B9E8} - C:\Windows\System32\winexplorer.dll
                                  O2 - BHO: Windows Live Call HoverToCall class - {7E853D72-626A-48EC-A868-BA8D5E23E045} - C:\Program Files\Windows Live\Messenger\HTC.DLL
                                  O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                                  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
                                  O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
                                  O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                                  O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
                                  O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                                  O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
                                  O4 - HKLM\..\Run: [Unattend0000000001{7CE4F652-9E84-4617-9F54-DC8891DFB725}] C:\Windows\test.bat
                                  O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
                                  O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
                                  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
                                  O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
                                  O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
                                  O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
                                  O4 - HKLM\..\Run: [EnergyCut_Utility] C:\Program Files\Lenovo\EnergyCut\utilty.exe
                                  O4 - HKLM\..\Run: [EnergyCut] C:\Program Files\Lenovo\EnergyCut\EnergyCut.exe
                                  O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
                                  O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Lenovo\ShuttleCenter\PCMService.exe"
                                  O4 - HKLM\..\Run: [VeriFacePassManager] C:\Program Files\Lenovo\VeriFace\PManage.exe
                                  O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
                                  O4 - HKLM\..\Run: [VeriFaceTimeLock] C:\Program Files\Lenovo\VeriFace\RTimeLock.exe
                                  O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
                                  O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
                                  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
                                  O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
                                  O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                                  O4 - HKCU\..\Run: [Speech Recognition] "C:\Windows\Speech\Common\sapisvr.exe" -SpeechUX -Startup
                                  O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
                                  O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
                                  O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
                                  O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
                                  O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
                                  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
                                  O9 - Extra button: Password Administration Box - {A26ABCF0-1C8F-46e7-A67C-0489DC21B9CC} - C:\Program Files\Lenovo\VeriFace\OpenWnd.exe
                                  O9 - Extra 'Tools' menuitem: Password Administration Box - {A26ABCF0-1C8F-46e7-A67C-0489DC21B9CC} - C:\Program Files\Lenovo\VeriFace\OpenWnd.exe
                                  O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)
                                  O13 - Gopher Prefix:
                                  O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
                                  O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ATK Hotkey\ASLDRSrv.exe
                                  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
                                  O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
                                  O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Lenovo\ShuttleCenter\Kernel\TV\CLCapSvc.exe
                                  O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Lenovo\ShuttleCenter\Kernel\TV\CLSched.exe
                                  O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
                                  O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
                                  O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                                  O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe
                                  O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
                                  O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
                                  O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
                                  O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
                                  O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
                                  O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
                                  O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
                                  1. V-X
                                    Re,

                                    ---> Télécharge OTM (OldTimer) sur ton Bureau :
                                    http://oldtimer.geekstogo.com/OTMoveIt3.exe

                                    ---> Double-clique sur OTMoveIt3.exe afin de le lancer.

                                    ---> Copie (Ctrl+C) le texte suivant en gras ci-dessous :

                                    :processes
                                    explorer.exe

                                    :files
                                    C:\Program Files\MyWebSearch

                                    :Reg
                                    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks]
                                    "{00A6FAF6-072E-44cf-8957-5838F569A31D}"=-

                                    :commands
                                    [emptytemp]
                                    [start explorer]
                                    [reboot]


                                    ---> Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved.

                                    ---> Clique maintenant sur le bouton MoveIt! puis ferme OTMoveIt3.

                                    Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer.
                                    Accepte en cliquant sur YES.

                                    ---> Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\
                                    Le nom du rapport correspond au moment de sa création : date_heure.log
                                    • 1
                                    • 2

                                    Discussions similaires

                                    Infecte par un virus
                                    sapard

                                    3 réponses
                                    Mon ordinateur a été infecté par un virus ou
                                    henry4002

                                    6 réponses
                                    Supprimer Mywebsearch
                                    cram

                                    32 réponses
                                    infecté par InstantAccess
                                    mimi22

                                    22 réponses
                                    infecté par brontok
                                    yannick

                                    27 réponses