Sujet Précédent Sujet Suivant

Hijackthis

Résolu
adela80 Messages postés 46 Statut Membre -  
adela80 Messages postés 46 Statut Membre -
Bonjour,
pouvez vous m'aider a analyser ce qui suit car je ne suis pas tres cale sur le sujet merci par avance voisci l'analyse :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:38:39, on 02/06/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SYSTEM32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\windows\system\hpsysdrv.exe
C:\Programfiler\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Programfiler\QuickTime\QTTask.exe
C:\Programfiler\Fellesfiler\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programfiler\iTunes\iTunesHelper.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Programfiler\Google\Google Desktop Search\GoogleDesktop.exe
C:\HP\KBD\KBD.EXE
C:\Programfiler\Telenor\Telenorhjelpen\Telenor.exe
C:\PROGRA~1\AVG\AVG8\avgfws8.exe
C:\Programfiler\Java\jre6\bin\jusched.exe
C:\Programfiler\Hp\HP Software Update\HPWuSchd2.exe
C:\Programfiler\SweetIM\Messenger\SweetIM.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Programfiler\Fellesfiler\Real\Update_OB\realsched.exe
C:\Programfiler\Java\jre6\bin\jqs.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Programfiler\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe
C:\Program Files\Real\SKL\alsvc.exe
C:\Programfiler\Windows Live\Messenger\msnmsgr.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Programfiler\AVG\AVG8\avgcsrvx.exe
C:\Programfiler\AVG\AVG8\avgcsrvx.exe
C:\Programfiler\Google\Google Desktop Search\GoogleDesktop.exe
C:\Programfiler\iPod\bin\iPodService.exe
C:\Programfiler\Yahoo!\Messenger\ymsgr_tray.exe
C:\Programfiler\Windows Live\Messenger\usnsvc.exe
C:\Program Files\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.yahoo.com/search/ie.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://home.sweetim.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programfiler\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: SweetIM ToolbarURLSearchHook Class - {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Programfiler\SweetIM\Toolbars\Internet Explorer\mgHelper.dll
F2 - REG:system.ini: UserInit=c:\windows\system32\userinit.exe
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programfiler\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programfiler\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Programfiler\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Programfiler\AVG\AVG8\avgssie.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: (no name) - {5f90c0e3-4c0a-4d54-a8ac-5afe6163a99e} - (no file)
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programfiler\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\Programfiler\AVG\AVG8\avgtoolbar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programfiler\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programfiler\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programfiler\Windows Live Toolbar\msntb.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Programfiler\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll (file missing)
O2 - BHO: Telenor Telenorhjelpen Plugin - {DB87CDE1-EF9C-44EB-A42F-6D0B3C72C516} - C:\Programfiler\Telenor\Telenorhjelpen\IEFixItNowPlugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programfiler\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programfiler\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SWEETIE - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Programfiler\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programfiler\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Starware Music UK Toolbar - {1962c5bc-e475-465b-823b-133e711bceb9} - (no file)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programfiler\Windows Live Toolbar\msntb.dll
O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programfiler\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programfiler\Google\Google Toolbar\GoogleToolbar.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\Programfiler\AVG\AVG8\avgtoolbar.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [Snarvei til egenskapsside for High Definition Audio] HDAShCut.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Programfiler\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [Creative WebCam Tray] C:\Programfiler\Creative\Shared Files\CAMTRAY.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programfiler\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [MsgCenterExe] "C:\Programfiler\Fellesfiler\Real\Update_OB\RealOneMessageCenter.exe" -osboot
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programfiler\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Programfiler\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Telenorhjelpen] "C:\Programfiler\Telenor\Telenorhjelpen\Telenor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programfiler\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Programfiler\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SweetIM] C:\Programfiler\SweetIM\Messenger\SweetIM.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Programfiler\Fellesfiler\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [MsnMsgr] ~"C:\Programfiler\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Messenger (Yahoo!)] ~"C:\Programfiler\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETTVERKSTJENESTE')
O4 - HKUS\S-1-5-18\..\Run: [msnmsgr] "C:\Programfiler\Windows Live\Messenger\msnmsgr.exe" /background (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [msnmsgr] "C:\Programfiler\Windows Live\Messenger\msnmsgr.exe" /background (User 'Default user')
O4 - Startup: Outil de détection de support Picture Motion Browser.lnk = C:\Programfiler\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe
O8 - Extra context menu item: &Search - ?p=ZKfox000
O8 - Extra context menu item: &Windows Live Search - res://C:\Programfiler\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programfiler\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programfiler\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Tilkoblingshjelp - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Tilkoblingshjelp - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} -
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Programfiler\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www3.snapfish.fr/SnapfishActivia.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {BA162249-F2C5-4851-8ADC-FC58CB424243} (Image Uploader Control) - http://copainsdavant.linternaute.com/html_include_bibliotheque/objimageuploader/5.0.15.0/ImageUploader5.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: fin - {5C472352-90D0-4214-BF20-8E4A2B82F980} - (no file)
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Programfiler\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FELLES~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/html - (no CLSID) - (no file)
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL,C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: arm32reg - C:\WINDOWS\
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Programfiler\Fellesfiler\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: AVG8 Firewall (avgfws8) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgfws8.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Programfiler\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programfiler\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Programfiler\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programfiler\Java\jre6\bin\jqs.exe
O23 - Service: Salsvc - Unknown owner - C:\Program Files\Real\SKL\alsvc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - c:\Programfiler\Fellesfiler\Symantec Shared\SNDSrvc.exe

33 réponses

  • 1
  • 2
Réponse 1 / 33
Utilisateur anonyme
 
Salut,

Comment supprimer correctement les produits SYMANTEC

• Télécharge Ad-remover sur ton bureau :

! Déconnecte toi et ferme toutes applications en cours !

• Double clique sur "Ad-R.exe" pour lancer l'installation et laisse les paramètres d'installation par défaut .

• Double-clique sur le raccourci Ad-remover qui est sur ton bureau pour lancer l'outil .

• Au menu principal choisis l'option "S" et tape sur [entrée] .

• Laisse travailler l'outil et ne touche à rien ...

--> Poste le rapport qui apparait à la fin .

( Le rapport est sauvegardé sous C:\Ad-report-scan-(date).log )

( CTRL+A Pour tout sélectionner , CTRL+C pour copier et CTRL+V pour coller )

Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.
0
Réponse 2 / 33
adela80 Messages postés 46 Statut Membre
 
voici le rapport de ad-remove:

.
======= RAPPORT D'AD-REMOVER 1.1.4.5_B | UNIQUEMENT XP/VISTA =======
.
Mit à jour part C_XX le 01/06/2009 à 11:50 AM
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Lancé à: 18:11:43, 02/06/2009 | Mode Normal | Option: SCAN
Exécuté de: C:\Programfiler\Ad-remover\
Système d'exploitation: Microsoft® Windows XP™ Service Pack 3 Versjon 5.1.2600
Nom du PC: WAHREN31 | Utilisateur actuel: Compaq_Eier
.
Administrateur: Administrator
N'est pas administrateur: ASPNET
Administrateur: Compaq_Eier
N'est pas administrateur: Gjest *Desactive*
N'est pas administrateur: Hjelpeassistent *Desactive*
N'est pas administrateur: SUPPORT_388945a0 *Desactive*
N'est pas administrateur: SUPPORT_fddfa904 *Desactive*
.
============== ÉLÉMENT(S) TROUVÉ(S) ==============
.
.
HKCR\CLSID\{6E15D3C4-C6FC-4F02-B130-77CC5B1F09DB}
HKCR\CLSID\{6638A9DE-0745-4292-8A2E-AE530E7B9B3F}
HKCR\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}
HKCR\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064}
HKCR\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCR\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKCR\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}
HKCR\CLSID\{E03BAFDC-EB9D-4C35-A7A2-AB6C62FF0A68}
HKCR\CLSID\{E6375F37-E4D1-4F51-B651-4658C27AC5BF}
HKCR\Interface\{5663B370-F3C3-40D1-9C46-0E800AA4D0E8}
HKCR\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}
HKCR\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}
HKCR\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}
HKCR\KiweeIEToolbar.KiweeToolbar
HKCR\KiweeIEToolbar.KiweeToolbar.1
HKCR\KiweeIEToolbar.ToolbarInfo
HKCR\KiweeIEToolbar.ToolbarInfo.1
HKCR\MediaPlayer.GraphicsUtils
HKCR\MediaPlayer.GraphicsUtils.1
HKCR\MgMediaPlayer.GifAnimator
HKCR\MgMediaPlayer.GifAnimator.1
HKCR\SWEETIE.IEToolbar
HKCR\SWEETIE.IEToolbar.1
HKCR\SWEETIE.SWEETIE
HKCR\SWEETIE.SWEETIE.1
HKCR\SWEETIE.SWEETIE.3
HKCR\SweetIM_URLSearchHook.ToolbarURLSearchHook
HKCR\SweetIM_URLSearchHook.ToolbarURLSearchHook.1
HKCR\ToolBand.SWEETIE
HKCR\ToolBand.SWEETIE.1
HKCR\Toolbar3.SWEETIE
HKCR\Toolbar3.SWEETIE.1
HKCR\Typelib\{259EEB17-79AA-44DF-8410-8E55F82A902A}
HKCR\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}
HKCR\Typelib\{58906392-79C4-497C-ACC6-6942B59F1A08}
HKCR\Typelib\{C7403C30-3644-43D8-A82F-4BD84B9682D9}
HKCR\Typelib\{EEE6C35E-6118-11DC-9C72-001320C79847}
HKCR\Typelib\{EEE6C35F-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKCU\Software\SWEETIE
HKCU\Software\SweetIM
HKLM\Software\Classes\CLSID\{6E15D3C4-C6FC-4F02-B130-77CC5B1F09DB}
HKLM\Software\Classes\CLSID\{6638A9DE-0745-4292-8A2E-AE530E7B9B3F}
HKLM\Software\Classes\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}
HKLM\Software\Classes\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064}
HKLM\Software\Classes\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKLM\Software\Classes\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKLM\Software\Classes\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}
HKLM\Software\Classes\CLSID\{E03BAFDC-EB9D-4C35-A7A2-AB6C62FF0A68}
HKLM\Software\Classes\CLSID\{E6375F37-E4D1-4F51-B651-4658C27AC5BF}
HKLM\Software\Classes\Interface\{5663B370-F3C3-40D1-9C46-0E800AA4D0E8}
HKLM\Software\Classes\Interface\{A439801C-961D-452C-AB42-7848E9CBD289}
HKLM\Software\Classes\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}
HKLM\Software\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}
HKLM\Software\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}
HKLM\Software\Classes\Interface\{F4EBB1E2-21F3-4786-8CF4-16EC5925867F}
HKLM\Software\Classes\KiweeIEToolbar.KiweeToolbar
HKLM\Software\Classes\KiweeIEToolbar.KiweeToolbar.1
HKLM\Software\Classes\KiweeIEToolbar.ToolbarInfo
HKLM\Software\Classes\KiweeIEToolbar.ToolbarInfo.1
HKLM\Software\Classes\MediaPlayer.GraphicsUtils
HKLM\Software\Classes\MediaPlayer.GraphicsUtils.1
HKLM\Software\Classes\MgMediaPlayer.GifAnimator
HKLM\Software\Classes\MgMediaPlayer.GifAnimator.1
HKLM\Software\Classes\SWEETIE.IEToolbar
HKLM\Software\Classes\SWEETIE.IEToolbar.1
HKLM\Software\Classes\SWEETIE.SWEETIE
HKLM\Software\Classes\SWEETIE.SWEETIE.1
HKLM\Software\Classes\SWEETIE.SWEETIE.3
HKLM\Software\Classes\SweetIM_URLSearchHook.ToolbarURLSearchHook
HKLM\Software\Classes\SweetIM_URLSearchHook.ToolbarURLSearchHook.1
HKLM\Software\Classes\ToolBand.SWEETIE
HKLM\Software\Classes\ToolBand.SWEETIE.1
HKLM\Software\Classes\Toolbar3.SWEETIE
HKLM\Software\Classes\Toolbar3.SWEETIE.1
HKLM\Software\Classes\Typelib\{259EEB17-79AA-44DF-8410-8E55F82A902A}
HKLM\Software\Classes\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}
HKLM\Software\Classes\Typelib\{58906392-79C4-497C-ACC6-6942B59F1A08}
HKLM\Software\Classes\Typelib\{C7403C30-3644-43D8-A82F-4BD84B9682D9}
HKLM\Software\Classes\Typelib\{EEE6C35E-6118-11DC-9C72-001320C79847}
HKLM\Software\Classes\Typelib\{EEE6C35F-6118-11DC-9C72-001320C79847}
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59C7FC09-1C83-4648-B3E6-003D2BBC7481}
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68AF847F-6E91-45DD-9B68-D6A12C30E5D7}
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170B96C-28D4-4626-8358-27E6CAEEF907}
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D1A71FA0-FF48-48DD-9B6D-7A13A3E42127}
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DDB1968E-EAD6-40FD-8DAE-FF14757F60C7}
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F138D901-86F0-4383-99B6-9CDD406036DA}
HKLM\Software\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll
HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}
HKLM\Software\Microsoft\Multimedia\WMPlayer\Schemes\f3pss
HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{37B85A2B-692B-4205-9CAD-2626E4993404}
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{266C7330-C0F4-49E5-8F20-A56F9F822875}
HKLM\Software\SweetIM
HKU\S-1-5-18\Software\SWEETIE
HKU\S-1-5-21-1512001447-448286266-671845353-1008\Software\Binary Noise\mPlayer\kiwee_toolbar_installer.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\Sweetim
HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\\{EEE6C35D-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{BC4FFE41-DE9F-46FA-B455-AAD49B9F9938}
HKLM\Software\Microsoft\Internet Explorer\Toolbar\\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\07D5290CDBDAE4242926B8E6CA650501
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\08E33F7B61DEFF24BB9673ED7D467636
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\0E3D8A5B48622A445A7DF73FEFF32C3F
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\1AC67655DD68F8240B2860F2D511EBD8
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\34EDDB1BFB3A2D448845F3EFD0F15A43
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\351716A953E21214898904032EAE2E81
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\397C771A7BCAC904697C3EC629ED33ED
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\427EA997C413D1D47907CBFC7B2DB432
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\4318DF19719275242801CBE292063A4C
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\45FC115D1FEAEF849A4E1610D6EC8BF0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\46A5861A389ADB844AF89E31BC9DF0A1
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\49B0E1A6FF50BBE4289E4E23DE6EA0C7
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\4CCCAC049F34D0540AAC13011398BEDB
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5C4389D0BFB302C479DE4178BD5D9EBA
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5D19F074C042AD34BAB463D4175A062E
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5D2B09BDEF4FE54418E6F3373CDBC7AC
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\61B65D3397A1FBF4CB1571B5E4F6B5B0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\68E8A05C60DD9254591DBD16C94EDDBF
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\697E782CF574CC34CBB9566440BA12BC
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\6AE27A8613CF7EA4782F2886F67295E5
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\7CE172051F585E04187BCB97570BFA74
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\86A901BA5265452499DCBF719C378EE3
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\88ABD1CD5C40EC84789A7F6EF86DAC5E
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\980289C22F80A7C4BB9323DC61255E4E
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\98CC8BF5A4A6E6C4ABF7051DDAB8B058
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\9A4B7EF3789F871419D9302583B20C15
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\A189D17A469616C4688D23E192996267
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\A6C53B0F76C44004A8F36716213017DB
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\B59F2D8189784CC46A4597F2842480B0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\BD746FB95FB8E5B45BF66BE54D5FD91F
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\CCF399FCD6D2D3F46BF02A1378654FC9
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D149C1355C98DE24E82CEFBD996FE06A
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D15DAF33C220F91468A1D7D57C31ACD7
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D3BA76A44C779424889063D5098ED2D6
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D6D0EB9FDBD90C04D92A7E729058F10D
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\DB59FDB786388EA4D897F3EE715683AC
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\DB8DAD19CFBCC2049A4477183787E8C5
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E1C820A74ED67374BA048B52CB3C3804
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E337925F629CF4C4FB08F3D9674DD839
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E4748F9A4181FCE46A23C13B517B9420
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\EC65F200D112357449C8B1BC3CFA03D0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\F327D0C73C0973644A21E8CC852267A0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\FA96423FE2B98E248A3B23548D1E22D9
.
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM
C:\DOCUME~1\COMPAQ~1\PROGRA~1\Mozilla\Firefox\Profiles\ez13n66f.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}
C:\DOCUME~1\COMPAQ~1\PROGRA~1\Mozilla\Firefox\Profiles\ez13n66f.default\SweetIMToolbarData
C:\Programfiler\Macrogaming
C:\Programfiler\SweetIM
C:\DOCUME~1\COMPAQ~1\PROGRA~1\Mozilla\Firefox\Profiles\ez13n66f.default\searchplugins\sweetim.xml
C:\WINDOWS\Installer\5377d.msi
C:\WINDOWS\Installer\53783.msi
C:\Programfiler\Windows Live\Messenger\Riched20.dll
.
============== Scan additionnel ==============
.

* Mozilla FireFox Version 2.0 *

Nom du profil: ez13n66f.default (Compaq_Eier)
.
(Prefs.js) user_pref("browser.search.defaultenginename", "SweetIM Search");
(Prefs.js) user_pref("browser.search.selectedEngine", "Yahoo");
(Prefs.js) user_pref("browser.search.defaulturl", "hxxp://search.sweetim.com/search.asp?src=2&q=");
(Prefs.js) user_pref("browser.startup.homepage", "hxxp://www.yahoo.fr");
(Prefs.js) user_pref("browser.startup.homepage_override.mstone", "rv:1.8.1.6");
.
(prefs.js) TROUVÉ: user_pref("browser.search.defaultenginename", "SweetIM Search");
(prefs.js) TROUVÉ: user_pref("browser.search.defaulturl", "hxxp://search.sweetim.com/search.asp?src=2&q=");
(prefs.js) TROUVÉ: user_pref("sweetim.toolbar.highlight.colors", "#FFFF00,#00FFE4,#5AFF00,#0087FF,#FFCC00,#FF00F0");
(prefs.js) TROUVÉ: user_pref("sweetim.toolbar.logger.ConsoleHandler.MinReportLevel", "7");
(prefs.js) TROUVÉ: user_pref("sweetim.toolbar.logger.FileHandler.FileName", "ff-toolbar.log");
(prefs.js) TROUVÉ: user_pref("sweetim.toolbar.logger.FileHandler.MaxFileSize", "200000");
(prefs.js) TROUVÉ: user_pref("sweetim.toolbar.logger.FileHandler.MinReportLevel", "7");
(prefs.js) TROUVÉ: user_pref("sweetim.toolbar.mode.debug", "false");
(prefs.js) TROUVÉ: user_pref("sweetim.toolbar.previous.keyword.URL", "hxxp://fr.search.yahoo.com/search?ei=UTF-8&fr=ytff-&p=");
(prefs.js) TROUVÉ: user_pref("sweetim.toolbar.search.external", "<?xml version=\"1.0\"?><TOOLBAR><EXTERNAL_SEARCH engine=\"hxxp://*google.*\" param=\"q=\" /><EXTERNAL_SEARCH engine=\"hxxp://search.yahoo.com/*\" param=\"p=\" /><EXTERNAL_SEARCH engine=\"hxxp://search.sweetim.*\" param=\"q=\" /><EXTERNAL_SEARCH engine=\"hxxp://*.live.*/*\" param=\"q=\" /><EXTERNAL_SEARCH engine=\"hxxp://*youtube.com/\" param=\"search_query=\" /><EXTERNAL_SEARCH engine=\"hxxp://*.ebay.*/search/*\" param=\"satitle=\" /><EXTERNAL_SEARCH engine=\"hxxp://*.amazon.com/s/*\" param=\"field-keywords=\" /></TOOLBAR>");
(prefs.js) TROUVÉ: user_pref("sweetim.toolbar.search.history.capacity", "10");
(prefs.js) TROUVÉ: user_pref("sweetim.toolbar.simapp_id", "{E2885B2A-A03A-41eb-BA57-A54BC7A13AD8}");
(prefs.js) TROUVÉ: user_pref("sweetim.toolbar.urls.homepage", "hxxp://home.sweetim.com");
(prefs.js) TROUVÉ: user_pref("sweetim.toolbar.version", "1.0.0.8");
.

* Internet Explorer Version 6.0.2900.5512 *

[HKEY_CURRENT_USER\..\Internet Explorer\Main]

Search bar: hxxp://www.yahoo.com/search/ie.html
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://fr.yahoo.com/

[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://home.sweetim.com

[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

============== Suspect (Cracks, Serials ... ) ==============

.

+---------------------------------------------------------------------------+

16172 Octet(s) - C:\Ad-Report-SCAN.log

1 Fichier(s) - C:\Programfiler\Ad-remover\BACKUP
0 Fichier(s) - C:\Programfiler\Ad-remover\QUARANTINE

Fin à: 18:24:54 | 02/06/2009
.
============== E.O.F ==============
.
0
Réponse 3 / 33
Utilisateur anonyme
 
Re,

! Déconnecte toi et ferme toutes applications en cours !

▶ Double-clique sur le raccourci Ad-remover qui est sur ton bureau pour lancer l'outil .

▶ Au menu principal choisis l'option "L" et tape sur [entrée] .

▶ Laisse travailler l'outil et ne touche à rien ...

▶ Poste le rapport qui apparait à la fin , sur le forum ...

( Le rapport est sauvegardé aussi sous C:\Ad-report.log )
( CTRL+A Pour tout sélectionner , CTRL+C pour copier et CTRL+V pour coller )

Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.
0
Réponse 4 / 33
adela80 Messages postés 46 Statut Membre
 
.voici le clean

======= RAPPORT D'AD-REMOVER 1.1.4.5_B | UNIQUEMENT XP/VISTA =======
.
Mit à jour part C_XX le 01/06/2009 à 11:50 AM
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Lancé à: 18:36:58, 02/06/2009 | Mode Normal | Option: CLEAN
Exécuté de: C:\Programfiler\Ad-remover\
Système d'exploitation: Microsoft® Windows XP™ Service Pack 3 Versjon 5.1.2600
Nom du PC: WAHREN31 | Utilisateur actuel: Compaq_Eier
.
Administrateur: Administrator
N'est pas administrateur: ASPNET
Administrateur: Compaq_Eier
N'est pas administrateur: Gjest *Desactive*
N'est pas administrateur: Hjelpeassistent *Desactive*
N'est pas administrateur: SUPPORT_388945a0 *Desactive*
N'est pas administrateur: SUPPORT_fddfa904 *Desactive*
.
============== ÉLÉMENT(S) NEUTRALISÉ(S) ==============
.
.
HKCR\CLSID\{6E15D3C4-C6FC-4F02-B130-77CC5B1F09DB}
HKCR\CLSID\{6638A9DE-0745-4292-8A2E-AE530E7B9B3F}
HKCR\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}
HKCR\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064}
HKCR\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCR\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKCR\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}
HKCR\CLSID\{E03BAFDC-EB9D-4C35-A7A2-AB6C62FF0A68}
HKCR\CLSID\{E6375F37-E4D1-4F51-B651-4658C27AC5BF}
HKCR\Interface\{5663B370-F3C3-40D1-9C46-0E800AA4D0E8}
HKCR\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}
HKCR\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}
HKCR\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}
HKCR\KiweeIEToolbar.KiweeToolbar
HKCR\KiweeIEToolbar.KiweeToolbar.1
HKCR\KiweeIEToolbar.ToolbarInfo
HKCR\KiweeIEToolbar.ToolbarInfo.1
HKCR\MediaPlayer.GraphicsUtils
HKCR\MediaPlayer.GraphicsUtils.1
HKCR\MgMediaPlayer.GifAnimator
HKCR\MgMediaPlayer.GifAnimator.1
HKCR\SWEETIE.IEToolbar
HKCR\SWEETIE.IEToolbar.1
HKCR\SWEETIE.SWEETIE
HKCR\SWEETIE.SWEETIE.1
HKCR\SWEETIE.SWEETIE.3
HKCR\SweetIM_URLSearchHook.ToolbarURLSearchHook
HKCR\SweetIM_URLSearchHook.ToolbarURLSearchHook.1
HKCR\ToolBand.SWEETIE
HKCR\ToolBand.SWEETIE.1
HKCR\Toolbar3.SWEETIE
HKCR\Toolbar3.SWEETIE.1
HKCR\Typelib\{259EEB17-79AA-44DF-8410-8E55F82A902A}
HKCR\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}
HKCR\Typelib\{58906392-79C4-497C-ACC6-6942B59F1A08}
HKCR\Typelib\{C7403C30-3644-43D8-A82F-4BD84B9682D9}
HKCR\Typelib\{EEE6C35E-6118-11DC-9C72-001320C79847}
HKCR\Typelib\{EEE6C35F-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKCU\Software\SWEETIE
HKCU\Software\SweetIM
HKLM\Software\Classes\Interface\{A439801C-961D-452C-AB42-7848E9CBD289}
HKLM\Software\Classes\Interface\{F4EBB1E2-21F3-4786-8CF4-16EC5925867F}
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59C7FC09-1C83-4648-B3E6-003D2BBC7481}
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68AF847F-6E91-45DD-9B68-D6A12C30E5D7}
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170B96C-28D4-4626-8358-27E6CAEEF907}
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D1A71FA0-FF48-48DD-9B6D-7A13A3E42127}
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DDB1968E-EAD6-40FD-8DAE-FF14757F60C7}
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F138D901-86F0-4383-99B6-9CDD406036DA}
HKLM\Software\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll
HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}
HKLM\Software\Microsoft\Multimedia\WMPlayer\Schemes\f3pss
HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{37B85A2B-692B-4205-9CAD-2626E4993404}
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{266C7330-C0F4-49E5-8F20-A56F9F822875}
HKLM\Software\SweetIM
HKU\S-1-5-18\Software\SWEETIE
HKU\S-1-5-21-1512001447-448286266-671845353-1008\Software\Binary Noise\mPlayer\kiwee_toolbar_installer.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\Sweetim
HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\\{EEE6C35D-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{BC4FFE41-DE9F-46FA-B455-AAD49B9F9938}
HKLM\Software\Microsoft\Internet Explorer\Toolbar\\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\07D5290CDBDAE4242926B8E6CA650501
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\08E33F7B61DEFF24BB9673ED7D467636
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\0E3D8A5B48622A445A7DF73FEFF32C3F
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\1AC67655DD68F8240B2860F2D511EBD8
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\34EDDB1BFB3A2D448845F3EFD0F15A43
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\351716A953E21214898904032EAE2E81
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\397C771A7BCAC904697C3EC629ED33ED
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\427EA997C413D1D47907CBFC7B2DB432
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\4318DF19719275242801CBE292063A4C
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\45FC115D1FEAEF849A4E1610D6EC8BF0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\46A5861A389ADB844AF89E31BC9DF0A1
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\49B0E1A6FF50BBE4289E4E23DE6EA0C7
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\4CCCAC049F34D0540AAC13011398BEDB
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5C4389D0BFB302C479DE4178BD5D9EBA
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5D19F074C042AD34BAB463D4175A062E
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5D2B09BDEF4FE54418E6F3373CDBC7AC
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\61B65D3397A1FBF4CB1571B5E4F6B5B0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\68E8A05C60DD9254591DBD16C94EDDBF
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\697E782CF574CC34CBB9566440BA12BC
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\6AE27A8613CF7EA4782F2886F67295E5
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\7CE172051F585E04187BCB97570BFA74
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\86A901BA5265452499DCBF719C378EE3
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\88ABD1CD5C40EC84789A7F6EF86DAC5E
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\980289C22F80A7C4BB9323DC61255E4E
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\98CC8BF5A4A6E6C4ABF7051DDAB8B058
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\9A4B7EF3789F871419D9302583B20C15
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\A189D17A469616C4688D23E192996267
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\A6C53B0F76C44004A8F36716213017DB
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\B59F2D8189784CC46A4597F2842480B0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\BD746FB95FB8E5B45BF66BE54D5FD91F
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\CCF399FCD6D2D3F46BF02A1378654FC9
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D149C1355C98DE24E82CEFBD996FE06A
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D15DAF33C220F91468A1D7D57C31ACD7
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D3BA76A44C779424889063D5098ED2D6
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D6D0EB9FDBD90C04D92A7E729058F10D
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\DB59FDB786388EA4D897F3EE715683AC
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\DB8DAD19CFBCC2049A4477183787E8C5
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E1C820A74ED67374BA048B52CB3C3804
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E337925F629CF4C4FB08F3D9674DD839
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E4748F9A4181FCE46A23C13B517B9420
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\EC65F200D112357449C8B1BC3CFA03D0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\F327D0C73C0973644A21E8CC852267A0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\FA96423FE2B98E248A3B23548D1E22D9
.
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Toolbars
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\logs
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\update
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\adapter.xml
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\autoupdate.xml
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\logger.xml
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\messages.xml
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\sweetim.xml
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\sweetimapp.xml
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\adela80@hotmail.fr
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\beverly.scott@hotmail.com
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\bezon_guendouz@hotmail.com
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\eiwute@hotmail.com
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\gamazz@hotmail.com
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\jackmove179@hotmail.com
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\lotfi.merad-boudia@hotmail.fr
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\main_user_config.xml
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\marie-antoinette01@hotmail.fr
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\mousfatima@hotmail.fr
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\mousnadir@hotmail.fr
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\nino31_norw@hotmail.com
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\oLdsChooL@oldschool.com
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\scofiane@hotmail.com
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\wallace_free@hotmail.com
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\yacin_bergen@hotmail.com
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\adela80@hotmail.fr\content_update_notification.xml
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\adela80@hotmail.fr\emoticons_shortcut.xml
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\adela80@hotmail.fr\lastuse_Emoticons.xml
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\adela80@hotmail.fr\lastuse_SpecialFX.xml
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\adela80@hotmail.fr\lastuse_Winks.xml
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\adela80@hotmail.fr\user_config.xml
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\beverly.scott@hotmail.com\content_update_notification.xml
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\beverly.scott@hotmail.com\emoticons_shortcut.xml
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\beverly.scott@hotmail.com\user_config.xml
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\bezon_guendouz@hotmail.com\emoticons_shortcut.xml
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\bezon_guendouz@hotmail.com\user_config.xml
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\eiwute@hotmail.com\emoticons_shortcut.xml
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\eiwute@hotmail.com\user_config.xml
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\gamazz@hotmail.com\emoticons_shortcut.xml
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\gamazz@hotmail.com\user_config.xml
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\jackmove179@hotmail.com\emoticons_shortcut.xml
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\jackmove179@hotmail.com\user_config.xml
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\lotfi.merad-boudia@hotmail.fr\emoticons_shortcut.xml
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\lotfi.merad-boudia@hotmail.fr\user_config.xml
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\marie-antoinette01@hotmail.fr\emoticons_shortcut.xml
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\marie-antoinette01@hotmail.fr\user_config.xml
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\mousfatima@hotmail.fr\emoticons_shortcut.xml
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\mousfatima@hotmail.fr\user_config.xml
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\mousnadir@hotmail.fr\emoticons_shortcut.xml
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\mousnadir@hotmail.fr\user_config.xml
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\nino31_norw@hotmail.com\content_update_notification.xml
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\nino31_norw@hotmail.com\emoticons_shortcut.xml
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\nino31_norw@hotmail.com\lastuse_Emoticons.xml
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\nino31_norw@hotmail.com\lastuse_SoundFX.xml
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\nino31_norw@hotmail.com\lastuse_Winks.xml
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\nino31_norw@hotmail.com\user_config.xml
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\oLdsChooL@oldschool.com\emoticons_shortcut.xml
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\oLdsChooL@oldschool.com\user_config.xml
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\scofiane@hotmail.com\emoticons_shortcut.xml
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\scofiane@hotmail.com\user_config.xml
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\wallace_free@hotmail.com\emoticons_shortcut.xml
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\wallace_free@hotmail.com\user_config.xml
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\yacin_bergen@hotmail.com\emoticons_shortcut.xml
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\yacin_bergen@hotmail.com\lastuse_Audibles.xml
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\yacin_bergen@hotmail.com\lastuse_Emoticons.xml
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\yacin_bergen@hotmail.com\lastuse_Winks.xml
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\conf\users\yacin_bergen@hotmail.com\user_config.xml
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000100AA.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000100AB.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000100AC.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000100AD.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000100AE.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000100B0.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000100B2.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000100B3.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000100B5.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000100B6.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000100B9.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000100BD.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000100BE.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000100C0.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000100C6.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000100C8.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000100C9.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000100CB.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000100CC.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000100CD.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000100CF.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000100D0.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000100D1.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000100D2.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000100D3.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000100D9.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000100E8.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000100F9.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000100FA.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000100FD.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000100FE.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000100FF.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00010100.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00010104.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00010108.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\0001010F.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00010110.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00010111.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00010118.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00010119.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\0001011E.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00010121.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00010123.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00010124.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00010814.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00010818.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\0001081A.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\0001081B.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00010829.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00010840.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00010841.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00010842.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00010844.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00010846.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\0001084A.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\0001084B.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00010850.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00010859.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00010861.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00010889.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\0001088D.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00010890.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00010893.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00010894.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00010895.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00010897.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00010898.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\0001089B.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\0001089C.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\0001089D.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000108A0.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000108A4.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000108A8.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000108A9.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000108AA.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000108AB.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000108AE.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000108B1.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000108B5.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000108B6.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000108B7.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000108B8.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000108BC.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000108C2.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000108C5.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000108CB.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000108CC.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000108CD.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000108DF.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00010911.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00010923.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00010949.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00010958.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00010970.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00020058.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00020059.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\0002005C.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00020066.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00020067.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00020069.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\0002006A.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\0002006B.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\0002006C.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\0002006D.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\0002006E.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00020071.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00020073.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00020074.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00020075.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00020076.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00020077.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00020079.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\0002007B.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\0002007C.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\0002007D.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00020087.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\0002008A.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00020092.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00020093.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00020096.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\0002009C.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\0002009D.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\0002009F.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000200A9.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000200AC.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000200AE.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000200AF.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000200B1.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000200B8.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000200B9.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000200BA.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000200BB.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000200C0.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000200C6.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000200CA.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000200CD.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000200D4.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000200D8.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000200E2.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000200EC.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000200ED.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000200EE.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00020112.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00020118.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\0002013F.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\0002014E.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00020185.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00020192.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00020193.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\0002019D.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000201AF.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00020210.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00020236.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000202C4.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000202E6.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00020309.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00030001.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00030005.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00030007.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00030009.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\0003000B.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\0003000F.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00030011.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00030019.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\0003001B.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\0003001D.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00030023.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00030027.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\0003006F.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\0003009A.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000300CD.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00040012.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00040014.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00040015.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00040021.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00040022.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00040024.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00040026.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00040027.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00040028.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00040029.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\0004002A.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\0004002B.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\0004002F.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00040032.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00040035.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00040036.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00040039.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\0004003A.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00040041.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00040042.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00040043.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00040044.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\0004005A.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00040068.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\0004007A.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\0004007B.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000400A2.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000400A3.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000400CC.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000400CE.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000400E7.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000400E8.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000400E9.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00040148.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00050001.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00050002.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00050004.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00050005.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00050007.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00060002.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\0006002F.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\0006003C.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00080014.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00080017.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\0008001A.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\00080020.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\000800C4.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\01050001.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\01050002.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\02050002.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\data\contentdb\cache_indx.dat
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Messenger\update\lastversioninfo.xml
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Toolbars\Internet Explorer
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Toolbars\Internet Explorer\cache
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Toolbars\Internet Explorer\cache\0d922024f43d83ed230c4d61cce3a239.games1.bmp
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Toolbars\Internet Explorer\cache\11f36d4363b8e493b9e3a17b45c2612b.free_games.bmp
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Toolbars\Internet Explorer\cache\7ecfc800b3946bda26c32bca50a3f4eb.games.bmp
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Toolbars\Internet Explorer\cache\9af18640b8436a17ad76b7c578736544.wink.bmp
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Toolbars\Internet Explorer\cache\a58d003368a47b8a816a12537acccce1.winkhover.bmp
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM\Toolbars\Internet Explorer\cache\f64a71f602d078aa84829e36b8992194.toolbar31.xml
C:\DOCUME~1\ALLUSE~1\PROGRA~1\SweetIM
C:\DOCUME~1\COMPAQ~1\PROGRA~1\Mozilla\Firefox\Profiles\ez13n66f.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome
C:\DOCUME~1\COMPAQ~1\PROGRA~1\Mozilla\Firefox\Profiles\ez13n66f.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome.manifest
C:\DOCUME~1\COMPAQ~1\PROGRA~1\Mozilla\Firefox\Profiles\ez13n66f.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\components
C:\DOCUME~1\COMPAQ~1\PROGRA~1\Mozilla\Firefox\Profiles\ez13n66f.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\install.rdf
C:\DOCUME~1\COMPAQ~1\PROGRA~1\Mozilla\Firefox\Profiles\ez13n66f.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\META-INF
C:\DOCUME~1\COMPAQ~1\PROGRA~1\Mozilla\Firefox\Profiles\ez13n66f.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\chrome\sweetim-toolbar.jar
C:\DOCUME~1\COMPAQ~1\PROGRA~1\Mozilla\Firefox\Profiles\ez13n66f.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\components\SIMAutoCompleteSearch.js
C:\DOCUME~1\COMPAQ~1\PROGRA~1\Mozilla\Firefox\Profiles\ez13n66f.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\META-INF\manifest.mf
C:\DOCUME~1\COMPAQ~1\PROGRA~1\Mozilla\Firefox\Profiles\ez13n66f.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\META-INF\zigbert.rsa
C:\DOCUME~1\COMPAQ~1\PROGRA~1\Mozilla\Firefox\Profiles\ez13n66f.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}\META-INF\zigbert.sf
C:\DOCUME~1\COMPAQ~1\PROGRA~1\Mozilla\Firefox\Profiles\ez13n66f.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}
C:\DOCUME~1\COMPAQ~1\PROGRA~1\Mozilla\Firefox\Profiles\ez13n66f.default\SweetIMToolbarData\logs
C:\DOCUME~1\COMPAQ~1\PROGRA~1\Mozilla\Firefox\Profiles\ez13n66f.default\SweetIMToolbarData
C:\Programfiler\Macrogaming\SweetIM
C:\Programfiler\Macrogaming\SweetIM\conf
C:\Programfiler\Macrogaming\SweetIM\resources
C:\Programfiler\Macrogaming\SweetIM\update
C:\Programfiler\Macrogaming\SweetIM\resources\images
C:\Programfiler\Macrogaming\SweetIM\resources\images\Thumbs.db
C:\Programfiler\Macrogaming\SweetIM\update\sweetimsetup.exe
C:\Programfiler\Macrogaming
C:\Programfiler\SweetIM\Messenger
C:\Programfiler\SweetIM\Toolbars
C:\Programfiler\SweetIM\Messenger\default.xml
C:\Programfiler\SweetIM\Messenger\mgAdaptersProxy.dll
C:\Programfiler\SweetIM\Messenger\mgAIMAuto.dll
C:\Programfiler\SweetIM\Messenger\mgAIMMessengerAdapter.dll
C:\Programfiler\SweetIM\Messenger\mgArchive.dll
C:\Programfiler\SweetIM\Messenger\mgcommon.dll
C:\Programfiler\SweetIM\Messenger\mgcommunication.dll
C:\Programfiler\SweetIM\Messenger\mgconfig.dll
C:\Programfiler\SweetIM\Messenger\mgFlashPlayer.dll
C:\Programfiler\SweetIM\Messenger\mghooking.dll
C:\Programfiler\SweetIM\Messenger\mgICQAuto.dll
C:\Programfiler\SweetIM\Messenger\mgICQMessengerAdapter.dll
C:\Programfiler\SweetIM\Messenger\mgIEPlayer.dll
C:\Programfiler\SweetIM\Messenger\mglogger.dll
C:\Programfiler\SweetIM\Messenger\mgMediaPlayer.dll
C:\Programfiler\SweetIM\Messenger\mgMsnAuto.dll
C:\Programfiler\SweetIM\Messenger\mgMsnMessengerAdapter.dll
C:\Programfiler\SweetIM\Messenger\mgsimcommon.dll
C:\Programfiler\SweetIM\Messenger\mgSweetIM.dll
C:\Programfiler\SweetIM\Messenger\mgUpdateSupport.dll
C:\Programfiler\SweetIM\Messenger\mgxml_wrapper.dll
C:\Programfiler\SweetIM\Messenger\mgYahooAuto.dll
C:\Programfiler\SweetIM\Messenger\mgYahooMessengerAdapter.dll
C:\Programfiler\SweetIM\Messenger\msvcp71.dll
C:\Programfiler\SweetIM\Messenger\msvcr71.dll
C:\Programfiler\SweetIM\Messenger\resources
C:\Programfiler\SweetIM\Messenger\SweetIM.exe
C:\Programfiler\SweetIM\Messenger\resources\images
C:\Programfiler\SweetIM\Messenger\resources\images\AudibleButton.png
C:\Programfiler\SweetIM\Messenger\resources\images\DisplayPicturesButton.png
C:\Programfiler\SweetIM\Messenger\resources\images\EmoticonButton.png
C:\Programfiler\SweetIM\Messenger\resources\images\NudgeButton.png
C:\Programfiler\SweetIM\Messenger\resources\images\SoundFxButton.png
C:\Programfiler\SweetIM\Messenger\resources\images\WinksButton.png
C:\Programfiler\SweetIM\Toolbars\Internet Explorer
C:\Programfiler\SweetIM\Toolbars\Internet Explorer\ClearHist.exe
C:\Programfiler\SweetIM\Toolbars\Internet Explorer\conf
C:\Programfiler\SweetIM\Toolbars\Internet Explorer\default.xml
C:\Programfiler\SweetIM\Toolbars\Internet Explorer\mgcommon.dll
C:\Programfiler\SweetIM\Toolbars\Internet Explorer\mgconfig.dll
C:\Programfiler\SweetIM\Toolbars\Internet Explorer\mgHelper.dll
C:\Programfiler\SweetIM\Toolbars\Internet Explorer\mglogger.dll
C:\Programfiler\SweetIM\Toolbars\Internet Explorer\mgsimcommon.dll
C:\Programfiler\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
C:\Programfiler\SweetIM\Toolbars\Internet Explorer\mgxml_wrapper.dll
C:\Programfiler\SweetIM\Toolbars\Internet Explorer\msvcp71.dll
C:\Programfiler\SweetIM\Toolbars\Internet Explorer\msvcr71.dll
C:\Programfiler\SweetIM\Toolbars\Internet Explorer\resources
C:\Programfiler\SweetIM\Toolbars\Internet Explorer\conf\logger.xml
C:\Programfiler\SweetIM\Toolbars\Internet Explorer\resources\affid.dat
C:\Programfiler\SweetIM\Toolbars\Internet Explorer\resources\basis.xml
C:\Programfiler\SweetIM\Toolbars\Internet Explorer\resources\Bookmarks_23x18.bmp
C:\Programfiler\SweetIM\Toolbars\Internet Explorer\resources\Email_23x18.bmp
C:\Programfiler\SweetIM\Toolbars\Internet Explorer\resources\Games_23x18.bmp
C:\Programfiler\SweetIM\Toolbars\Internet Explorer\resources\Greetingcards_23x18.bmp
C:\Programfiler\SweetIM\Toolbars\Internet Explorer\resources\Logo.bmp
C:\Programfiler\SweetIM\Toolbars\Internet Explorer\resources\Mobile_23x18.bmp
C:\Programfiler\SweetIM\Toolbars\Internet Explorer\resources\Music_23x18.bmp
C:\Programfiler\SweetIM\Toolbars\Internet Explorer\resources\News_23x18.bmp
C:\Programfiler\SweetIM\Toolbars\Internet Explorer\resources\Shoping_23x18.bmp
C:\Programfiler\SweetIM\Toolbars\Internet Explorer\resources\SmileySmile.bmp
C:\Programfiler\SweetIM\Toolbars\Internet Explorer\resources\SmileyWink.bmp
C:\Programfiler\SweetIM\Toolbars\Internet Explorer\resources\sweetimicons.bmp
C:\Programfiler\SweetIM\Toolbars\Internet Explorer\resources\toolbar.xml
C:\Programfiler\SweetIM\Toolbars\Internet Explorer\resources\version.txt
C:\Programfiler\SweetIM
C:\DOCUME~1\COMPAQ~1\PROGRA~1\Mozilla\Firefox\Profiles\ez13n66f.default\searchplugins\sweetim.xml
C:\WINDOWS\Installer\5377d.msi
C:\WINDOWS\Installer\53783.msi
C:\Programfiler\Windows Live\Messenger\riched20.dll

(!) -- Fichiers temporaires supprimés.

.
============== Scan additionnel ==============
.

* Mozilla FireFox Version 2.0 *

Nom du profil: ez13n66f.default (Compaq_Eier)
.
(Prefs.js) user_pref("browser.search.defaultenginename", "SweetIM Search");
(Prefs.js) user_pref("browser.search.selectedEngine", "Yahoo");
(Prefs.js) user_pref("browser.search.defaulturl", "hxxp://search.sweetim.com/search.asp?src=2&q=");
(Prefs.js) user_pref("browser.startup.homepage", "hxxp://www.yahoo.fr");
(Prefs.js) user_pref("browser.startup.homepage_override.mstone", "rv:1.8.1.6");
.
(prefs.js) EFFACÉ: user_pref("browser.search.defaultenginename", "SweetIM Search");
(prefs.js) EFFACÉ: user_pref("browser.search.defaulturl", "hxxp://search.sweetim.com/search.asp?src=2&q=");
(prefs.js) EFFACÉ: user_pref("sweetim.toolbar.highlight.colors", "#FFFF00,#00FFE4,#5AFF00,#0087FF,#FFCC00,#FF00F0");
(prefs.js) EFFACÉ: user_pref("sweetim.toolbar.logger.ConsoleHandler.MinReportLevel", "7");
(prefs.js) EFFACÉ: user_pref("sweetim.toolbar.logger.FileHandler.FileName", "ff-toolbar.log");
(prefs.js) EFFACÉ: user_pref("sweetim.toolbar.logger.FileHandler.MaxFileSize", "200000");
(prefs.js) EFFACÉ: user_pref("sweetim.toolbar.logger.FileHandler.MinReportLevel", "7");
(prefs.js) EFFACÉ: user_pref("sweetim.toolbar.mode.debug", "false");
(prefs.js) EFFACÉ: user_pref("sweetim.toolbar.previous.keyword.URL", "hxxp://fr.search.yahoo.com/search?ei=UTF-8&fr=ytff-&p=");
(prefs.js) EFFACÉ: user_pref("sweetim.toolbar.search.external", "<?xml version=\"1.0\"?><TOOLBAR><EXTERNAL_SEARCH engine=\"hxxp://*google.*\" param=\"q=\" /><EXTERNAL_SEARCH engine=\"hxxp://search.yahoo.com/*\" param=\"p=\" /><EXTERNAL_SEARCH engine=\"hxxp://search.sweetim.*\" param=\"q=\" /><EXTERNAL_SEARCH engine=\"hxxp://*.live.*/*\" param=\"q=\" /><EXTERNAL_SEARCH engine=\"hxxp://*youtube.com/\" param=\"search_query=\" /><EXTERNAL_SEARCH engine=\"hxxp://*.ebay.*/search/*\" param=\"satitle=\" /><EXTERNAL_SEARCH engine=\"hxxp://*.amazon.com/s/*\" param=\"field-keywords=\" /></TOOLBAR>");
(prefs.js) EFFACÉ: user_pref("sweetim.toolbar.search.history.capacity", "10");
(prefs.js) EFFACÉ: user_pref("sweetim.toolbar.simapp_id", "{E2885B2A-A03A-41eb-BA57-A54BC7A13AD8}");
(prefs.js) EFFACÉ: user_pref("sweetim.toolbar.urls.homepage", "hxxp://home.sweetim.com");
(prefs.js) EFFACÉ: user_pref("sweetim.toolbar.version", "1.0.0.8");
.

* Internet Explorer Version 6.0.2900.5512 *

[HKEY_CURRENT_USER\..\Internet Explorer\Main]

Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://search.msn.com/spbasic.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://fr.msn.com/

[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

Tabs: res://ieframe.dll/tabswelcome.htm

============== Suspect (Cracks, Serials ... ) ==============

.

+---------------------------------------------------------------------------+

45091 Octet(s) - C:\Ad-Report-CLEAN.log
16393 Octet(s) - C:\Ad-Report-SCAN.log

18 Fichier(s) - C:\Programfiler\Ad-remover\BACKUP
37 Fichier(s) - C:\Programfiler\Ad-remover\QUARANTINE

Fin à: 18:50:30 | 02/06/2009
.
============== E.O.F ==============
.
0

Vous n’avez pas trouvé la réponse que vous recherchez ?

Posez votre question
Réponse 5 / 33
Utilisateur anonyme
 
Re,

Désinstalle Ad-Remover.

▶ Télécharge random's system information tool (RSIT) et enregistre le sur ton bureau.

▶ Double clique sur RSIT.exe pour lancer l'outil.

▶ Clique sur ' continue ' à l'écran Disclaimer.

▶ Si l'outil HIjackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera et tu devras accepter la licence.

▶ Une fois le scan fini , 2 rapports vont apparaitre. Poste le contenu des 2 rapports séparément.
( log.txt & info.txt )

(CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

Si un rapport ne passe pas faire une alerte à la conciergerie avec le /!\ jaune.
0
Réponse 6 / 33
boxer44 Messages postés 5 Statut Membre
 
Nod32 il détécte les virus mais il demande a chaque fois (Alert) de les supprimer.
Voila:
c:\q9.cmd a variant of Win32/Pacex.Gen virus.
c:\2a.exe a variant of Win32/Pacex.Gen virus.=>Nod32 ne peux pas supprimer "2a.exe".

Vous pouvez m'aider si possible .
Merci d'avance.
0
Réponse 7 / 33
Utilisateur anonyme
 
Re,

@Boxer44 ;

Il serait préférable que tu fasse ton propre topic.

Comment faire sont propre topic sur CCM

Merci
0
Réponse 8 / 33
adela80 Messages postés 46 Statut Membre
 
ca c le log

Logfile of random's system information tool 1.06 (written by random/random)
Run by Compaq_Eier at 2009-06-02 18:58:47
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 14 GB (20%) free of 70 GB
Total RAM: 511 MB (28% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:59:20, on 02/06/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SYSTEM32\Ati2evxx.exe
C:\windows\system\hpsysdrv.exe
C:\Programfiler\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Programfiler\QuickTime\QTTask.exe
C:\Programfiler\Fellesfiler\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programfiler\iTunes\iTunesHelper.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Programfiler\Google\Google Desktop Search\GoogleDesktop.exe
C:\HP\KBD\KBD.EXE
C:\Programfiler\Telenor\Telenorhjelpen\Telenor.exe
C:\PROGRA~1\AVG\AVG8\avgfws8.exe
C:\Programfiler\Java\jre6\bin\jusched.exe
C:\Programfiler\Hp\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Programfiler\Fellesfiler\Real\Update_OB\realsched.exe
C:\Programfiler\Java\jre6\bin\jqs.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Programfiler\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe
C:\Program Files\Real\SKL\alsvc.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Programfiler\AVG\AVG8\avgcsrvx.exe
C:\Programfiler\AVG\AVG8\avgcsrvx.exe
C:\Programfiler\Google\Google Desktop Search\GoogleDesktop.exe
C:\Programfiler\iPod\bin\iPodService.exe
C:\Programfiler\Yahoo!\Messenger\ymsgr_tray.exe
C:\Programfiler\Windows Live\Messenger\usnsvc.exe
C:\Programfiler\AVG\AVG8\avgscanx.exe
C:\Programfiler\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Compaq_Eier\Skrivebord\RSIT.exe
C:\Program Files\Compaq_Eier.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programfiler\Yahoo!\Companion\Installs\cpn\yt.dll
F2 - REG:system.ini: UserInit=c:\windows\system32\userinit.exe
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programfiler\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programfiler\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Programfiler\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Programfiler\AVG\AVG8\avgssie.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: (no name) - {5f90c0e3-4c0a-4d54-a8ac-5afe6163a99e} - (no file)
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programfiler\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\Programfiler\AVG\AVG8\avgtoolbar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programfiler\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programfiler\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programfiler\Windows Live Toolbar\msntb.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Programfiler\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll (file missing)
O2 - BHO: Telenor Telenorhjelpen Plugin - {DB87CDE1-EF9C-44EB-A42F-6D0B3C72C516} - C:\Programfiler\Telenor\Telenorhjelpen\IEFixItNowPlugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programfiler\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programfiler\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programfiler\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Starware Music UK Toolbar - {1962c5bc-e475-465b-823b-133e711bceb9} - (no file)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programfiler\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programfiler\Google\Google Toolbar\GoogleToolbar.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\Programfiler\AVG\AVG8\avgtoolbar.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [Snarvei til egenskapsside for High Definition Audio] HDAShCut.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Programfiler\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [Creative WebCam Tray] C:\Programfiler\Creative\Shared Files\CAMTRAY.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programfiler\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [MsgCenterExe] "C:\Programfiler\Fellesfiler\Real\Update_OB\RealOneMessageCenter.exe" -osboot
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programfiler\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Programfiler\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Telenorhjelpen] "C:\Programfiler\Telenor\Telenorhjelpen\Telenor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programfiler\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Programfiler\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Programfiler\Fellesfiler\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [MsnMsgr] ~"C:\Programfiler\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Messenger (Yahoo!)] ~"C:\Programfiler\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETTVERKSTJENESTE')
O4 - HKUS\S-1-5-18\..\Run: [msnmsgr] "C:\Programfiler\Windows Live\Messenger\msnmsgr.exe" /background (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [msnmsgr] "C:\Programfiler\Windows Live\Messenger\msnmsgr.exe" /background (User 'Default user')
O4 - Startup: Outil de détection de support Picture Motion Browser.lnk = C:\Programfiler\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Programfiler\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programfiler\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programfiler\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Tilkoblingshjelp - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Tilkoblingshjelp - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} -
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Programfiler\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www3.snapfish.fr/SnapfishActivia.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {BA162249-F2C5-4851-8ADC-FC58CB424243} (Image Uploader Control) - http://copainsdavant.linternaute.com/html_include_bibliotheque/objimageuploader/5.0.15.0/ImageUploader5.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: fin - {5C472352-90D0-4214-BF20-8E4A2B82F980} - (no file)
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Programfiler\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FELLES~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/html - (no CLSID) - (no file)
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL,C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: arm32reg - C:\WINDOWS\
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Programfiler\Fellesfiler\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: AVG8 Firewall (avgfws8) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgfws8.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Programfiler\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programfiler\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Programfiler\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programfiler\Java\jre6\bin\jqs.exe
O23 - Service: Salsvc - Unknown owner - C:\Program Files\Real\SKL\alsvc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - c:\Programfiler\Fellesfiler\Symantec Shared\SNDSrvc.exe
0
Réponse 9 / 33
adela80 Messages postés 46 Statut Membre
 
voici le info,

info.txt logfile of random's system information tool 1.06 2009-06-02 18:59:25

======Uninstall list======

-->C:\Programfiler\Fellesfiler\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
-->C:\Programfiler\InstallShield Installation Information\{36C41D70-56F5-4E2B-81DA-6BEB7502D7A1}\setup.exe -runfromtemp -l0x040c -removeonly
-->C:\Programfiler\InstallShield Installation Information\{B2C4A8C4-AA20-425D-9FEE-C78039238C81}\setup.exe -runfromtemp -l0x040c -removeonly
-->C:\WINDOWS\system32\\MSIEXEC.EXE /x {1206EF92-2E83-4859-ACCB-2048C3CB7DA6}
-->RunDll32 C:\PROGRA~1\FELLES~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programfiler\InstallShield Installation Information\{363435F2-7426-11D8-9966-00A0C9663221}\setup.exe" -l0x40c
-->RunDll32 C:\PROGRA~1\FELLES~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programfiler\InstallShield Installation Information\{5CDDF96A-BC34-4D72-9ABA-E1FFF0C39977}\setup.exe" -l0x40c
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
AC3Filter (remove only)-->C:\Programfiler\AC3Filter\uninstall.exe
Adobe Flash Player ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Reader 7.0 - Norsk-->MsiExec.exe /I{AC76BA86-7AD7-1044-7B44-A70000000000}
Apple Mobile Device Support-->MsiExec.exe /I{A43B2A2F-1DB5-47F9-A608-F11A4835D7CB}
Apple Software Update-->MsiExec.exe /I{74EC78BC-B379-4E29-9006-8F161DCAABA6}
Archiveur WinRAR-->C:\Programfiler\WinRAR\uninstall.exe
ArcSoft PhotoImpression 5-->RunDll32 C:\PROGRA~1\FELLES~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programfiler\InstallShield Installation Information\{FC888095-A35E-4993-A9E0-366BF6F0CCE0}\SETUP.EXE" -l0x40c
ATI Control Panel-->RunDll32 C:\PROGRA~1\FELLES~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Programfiler\InstallShield Installation Information\{0BEDBD4E-2D34-47B5-9973-57E62B29307C}\setup.exe"
ATI Display Driver-->rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
AVG 8.5-->C:\Programfiler\AVG\AVG8\setup.exe /UNINSTALL
BearShare Media Bar-->rundll32 C:\PROGRA~1\BEARSH~1\MediaBar\1.bin\BearSMBr.dll,O
CCleaner (remove only)-->"C:\Programfiler\CCleaner\uninst.exe"
Creative WebCam Center-->RunDll32 C:\PROGRA~1\FELLES~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programfiler\InstallShield Installation Information\{363435F2-7426-11D8-9966-00A0C9663221}\setup.exe" -l0x40c /remove
Creative WebCam Live! Driver (1.01.01.0730)-->C:\WINDOWS\CtDrvIns.exe -uninstall -script Pd0630.uns -unsext NT -plugin P0630Pin.dll -pluginres P0630Pin.crl
CyberGestion-->RunDll32 C:\PROGRA~1\FELLES~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Programfiler\InstallShield Installation Information\{C964A549-C74A-11D3-B88A-00A0C9379093}\setup.exe"
Diskeeper Lite-->MsiExec.exe /I{F09FB343-2806-4F48-846D-705352D30334}
DivX Pro Codec Adware-->C:\WINDOWS\unvise32.exe C:\Programfiler\DivX\DivX Pro Codec Adware\UninstalDivXProCodecAdware.log
Enhanced Multimedia Keyboard Solution-->C:\HP\KBD\Install.exe /u
Extension de Windows Live Toolbar (Windows Live Toolbar)-->MsiExec.exe /X{0CA6047C-D28B-4295-834A-07C52BA20C2D}
Free Easy Burner V 3.8-->"C:\Program Files\graveur\Free Easy Burner\unins000.exe"
Google Desktop-->C:\Programfiler\Google\Google Desktop Search\GoogleDesktopSetup.exe -uninstall
Google Earth-->MsiExec.exe /I{407B9B5C-DAC5-4F44-A756-B57CAB4E6A8B}
Google Toolbar for Internet Explorer-->"C:\Programfiler\Google\Google Toolbar\Component\GoogleToolbarManager_0531C63A913CC9D1.exe" /uninstall
High Definition Audio - KB888111-->"C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe"
HijackThis 2.0.2-->"C:\Program Files\HijackThis.exe" /uninstall
Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
HP Update-->MsiExec.exe /X{FE57DE70-95DE-4B64-9266-84DA811053DB}
Huffyuv AVI lossless video codec (Remove Only)-->rundll.exe setupx.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\HUFFYUV.INF
Hurtigreparasjon for Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
Intel(R) PRO Network Connections Drivers-->Prounstl.exe
iTunes-->MsiExec.exe /I{9357AE3A-B2ED-4138-BB9B-0564352C3F0A}
J2SE Runtime Environment 5.0-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150000}
Java(TM) 6 Update 11-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216011FF}
Java(TM) 6 Update 5-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}
Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
LiveUpdate 2.6 (Symantec Corporation)-->C:\Programfiler\Symantec\LiveUpdate\LSETUP.EXE /U
Manuel d'utilisation de Creative WebCam Live! (Français)-->C:\WINDOWS\IsUn040c.exe -f"C:\Programfiler\Creative\Creative WebCam Live!\Manuel d'utilisation de Creative WebCam Live!\French\CTManual.isu"
MediaCoder 0.6.0-->C:\Program Files\MediaCoder\uninst.exe
Menus intelligents (Windows Live Toolbar)-->MsiExec.exe /X{0CC70FEF-5068-4CD5-B4DE-86FFD98EC929}
Microsoft .NET Framework 1.1 Hotfix (KB928366)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
Microsoft .NET Framework 1.1 Norwegian Language Pack-->MsiExec.exe /X{3EAC35F4-FF26-4123-9404-0B5B93DAB570}
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft SQL Server 2005 Compact Edition [ENU]-->MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Works-->MsiExec.exe /I{CA4A3A50-4821-4CD9-B678-B33513190A8D}
Mozilla Firefox (2.0)-->C:\Programfiler\Mozilla Firefox\uninstall\uninst.exe
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MUSICMATCH Jukebox-->C:\WINDOWS\IsUninst.exe -f"C:\Programfiler\MUSICMATCH\MUSICMATCH Jukebox\Uninst.isu" -cC:\PROGRA~1\MUSICM~1\MUSICM~1\unmatch.dll
neroxml-->MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
Oppdatering for Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
Oppdatering for Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Oppdatering for Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
Oppdatering for Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"
PS2-->C:\WINDOWS\system32\ps2.exe uninstall
QuickTime-->MsiExec.exe /I{95A890AA-B3B1-44B6-9C18-A8F7AB3EE7FC}
RealPlayer-->C:\Programfiler\Fellesfiler\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Sikkerhetsoppdatering for Windows Media Player (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Sikkerhetsoppdatering for Windows Media Player 10 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP10$\spuninst\spuninst.exe"
Sikkerhetsoppdatering for Windows XP (KB923561)-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe"
Sikkerhetsoppdatering for Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Sikkerhetsoppdatering for Windows XP (KB938464-v2)-->"C:\WINDOWS\$NtUninstallKB938464-v2$\spuninst\spuninst.exe"
Sikkerhetsoppdatering for Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Sikkerhetsoppdatering for Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Sikkerhetsoppdatering for Windows XP (KB950759)-->"C:\WINDOWS\$NtUninstallKB950759$\spuninst\spuninst.exe"
Sikkerhetsoppdatering for Windows XP (KB950760)-->"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
Sikkerhetsoppdatering for Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Sikkerhetsoppdatering for Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Sikkerhetsoppdatering for Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Sikkerhetsoppdatering for Windows XP (KB951376)-->"C:\WINDOWS\$NtUninstallKB951376$\spuninst\spuninst.exe"
Sikkerhetsoppdatering for Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Sikkerhetsoppdatering for Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Sikkerhetsoppdatering for Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Sikkerhetsoppdatering for Windows XP (KB952004)-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe"
Sikkerhetsoppdatering for Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Sikkerhetsoppdatering for Windows XP (KB953838)-->"C:\WINDOWS\$NtUninstallKB953838$\spuninst\spuninst.exe"
Sikkerhetsoppdatering for Windows XP (KB953839)-->"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"
Sikkerhetsoppdatering for Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
Sikkerhetsoppdatering for Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Sikkerhetsoppdatering for Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Sikkerhetsoppdatering for Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Sikkerhetsoppdatering for Windows XP (KB956390)-->"C:\WINDOWS\$NtUninstallKB956390$\spuninst\spuninst.exe"
Sikkerhetsoppdatering for Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
Sikkerhetsoppdatering for Windows XP (KB956572)-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe"
Sikkerhetsoppdatering for Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Sikkerhetsoppdatering for Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Sikkerhetsoppdatering for Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Sikkerhetsoppdatering for Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
Sikkerhetsoppdatering for Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Sikkerhetsoppdatering for Windows XP (KB958215)-->"C:\WINDOWS\$NtUninstallKB958215$\spuninst\spuninst.exe"
Sikkerhetsoppdatering for Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Sikkerhetsoppdatering for Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
Sikkerhetsoppdatering for Windows XP (KB958690)-->"C:\WINDOWS\$NtUninstallKB958690$\spuninst\spuninst.exe"
Sikkerhetsoppdatering for Windows XP (KB959426)-->"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe"
Sikkerhetsoppdatering for Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"
Sikkerhetsoppdatering for Windows XP (KB960714)-->"C:\WINDOWS\$NtUninstallKB960714$\spuninst\spuninst.exe"
Sikkerhetsoppdatering for Windows XP (KB960715)-->"C:\WINDOWS\$NtUninstallKB960715$\spuninst\spuninst.exe"
Sikkerhetsoppdatering for Windows XP (KB960803)-->"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe"
Sikkerhetsoppdatering for Windows XP (KB961373)-->"C:\WINDOWS\$NtUninstallKB961373$\spuninst\spuninst.exe"
Sikkerhetsoppdatering for Windows XP (KB963027)-->"C:\WINDOWS\$NtUninstallKB963027$\spuninst\spuninst.exe"
Skype™ 3.5-->MsiExec.exe /X{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}
Sonic UDF Reader-->MsiExec.exe /I{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}
Sony Picture Utility-->C:\Programfiler\InstallShield Installation Information\{D5068583-D569-468B-9755-5FBF5848F46F}\setup.exe -runfromtemp -l0x040c uninstall -removeonly
Surligneur (Windows Live Toolbar)-->MsiExec.exe /X{81B5F83F-2291-48B0-8375-36B63A9BF5B0}
SweetIM for Messenger 2.6-->MsiExec.exe /X{0EE593B1-07F7-49B4-8825-4EAAB3FA6266}
Telenorhjelpen-->C:\Programfiler\Telenor\Telenorhjelpen\uninst.exe -u -c
Windows Genuine Advantage Notifications-->"C:\WINDOWS\$NtUninstallWgaNotify$\spuninst\spuninst.exe"
Windows Imaging Component-->"C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
Windows Live Favorites pour Windows Live Toolbar-->MsiExec.exe /X{786C4AD1-DCBA-49A6-B0EF-B317A344BD66}
Windows Live installer-->MsiExec.exe /X{FD44E544-E7D0-4DBA-9FA0-8AE1A1300390}
Windows Live Mail-->MsiExec.exe /I{184E7118-0295-43C4-B72C-1D54AA75AAF7}
Windows Live Messenger-->MsiExec.exe /X{508CE775-4BA4-4748-82DF-FE28DA9F03B0}
Windows Live Photo Gallery-->MsiExec.exe /X{2D4F6BE3-6FEF-4FE9-9D01-1406B220D08C}
Windows Live Toolbar-->"C:\Programfiler\Windows Live Toolbar\UnInstall.exe" {0A8C97AD-DEED-4894-B446-3ABA95A77D0D}
Windows Live Toolbar-->MsiExec.exe /X{0A8C97AD-DEED-4894-B446-3ABA95A77D0D}
Windows Live Writer-->MsiExec.exe /X{9176251A-4CC1-4DDB-B343-B487195EB397}
Windows Media Format 11 runtime-->"C:\Programfiler\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Player Firefox Plugin-->MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}
Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
Yahoo! Extras-->C:\PROGRA~1\Yahoo!\Common\unyext.exe
Yahoo! Mail-->C:\WINDOWS\system32\regsvr32.exe /u /s C:\PROGRA~1\Yahoo!\Common\ymmapi.dll
Yahoo! Messenger-->C:\PROGRA~1\Yahoo!\MESSEN~1\UNWISE.EXE /U C:\PROGRA~1\Yahoo!\MESSEN~1\INSTALL.LOG
Yahoo! Toolbar-->C:\PROGRA~1\Yahoo!\Common\unyt.exe

======Hosts File======

127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com

======Security center information======

AV: AVG Anti-Virus plus Firewall
FW: AVG Firewall

======System event log======

Computer Name: WAHREN31
Event Code: 4226
Message: TCP/IP har nådd sikkerhetsbegrensningen for antall samtidige TCP-tilkoblingsforsøk.

Record Number: 18512
Source Name: Tcpip
Time Written: 20090512221654.000000+120
Event Type: warning
User:

Computer Name: WAHREN31
Event Code: 7023
Message: Tjenesten Computer Browser ble avbrutt med feilkode
Tjenesten er ikke installert.

Record Number: 18485
Source Name: Service Control Manager
Time Written: 20090512155839.000000+120
Event Type: error
User:

Computer Name: WAHREN31
Event Code: 7023
Message: Tjenesten Computer Browser ble avbrutt med feilkode
Tjenesten er ikke installert.

Record Number: 18454
Source Name: Service Control Manager
Time Written: 20090512070424.000000+120
Event Type: error
User:

Computer Name: WAHREN31
Event Code: 7023
Message: Tjenesten Computer Browser ble avbrutt med feilkode
Tjenesten er ikke installert.

Record Number: 18377
Source Name: Service Control Manager
Time Written: 20090512000339.000000+120
Event Type: error
User:

Computer Name: WAHREN31
Event Code: 7023
Message: Tjenesten Computer Browser ble avbrutt med feilkode
Tjenesten er ikke installert.

Record Number: 18347
Source Name: Service Control Manager
Time Written: 20090511204612.000000+120
Event Type: error
User:

=====Application event log=====

Computer Name: WAHREN31
Event Code: 1002
Message: Hengende program iexplore.exe, versjon 6.0.2900.5512, hengende modul hungapp, versjon 0.0.0.0, hengeadresse 0x00000000.

Record Number: 2114
Source Name: Application Hang
Time Written: 20090203003704.000000+060
Event Type: error
User:

Computer Name: WAHREN31
Event Code: 1002
Message: Hengende program iexplore.exe, versjon 6.0.2900.5512, hengende modul hungapp, versjon 0.0.0.0, hengeadresse 0x00000000.

Record Number: 2113
Source Name: Application Hang
Time Written: 20090203003701.000000+060
Event Type: error
User:

Computer Name: WAHREN31
Event Code: 1002
Message: Hengende program iexplore.exe, versjon 6.0.2900.5512, hengende modul hungapp, versjon 0.0.0.0, hengeadresse 0x00000000.

Record Number: 2112
Source Name: Application Hang
Time Written: 20090203003701.000000+060
Event Type: error
User:

Computer Name: WAHREN31
Event Code: 12001
Message: The Messenger Sharing USN Journal Reader service started successfully.

Record Number: 2104
Source Name: usnjsvc
Time Written: 20090202234435.000000+060
Event Type:
User:

Computer Name: WAHREN31
Event Code: 12001
Message: The Messenger Sharing USN Journal Reader service started successfully.

Record Number: 2081
Source Name: usnjsvc
Time Written: 20090202013508.000000+060
Event Type:
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SYSTEMROOT%\SYSTEM32;%SYSTEMROOT%;%SYSTEMROOT%\SYSTEM32\WBEM;C:\PYTHON22;C:\PROGRAMFILER\ATI TECHNOLOGIES\ATI CONTROL PANEL;C:\PROGRAMFILER\QUICKTIME\QTSYSTEM;C:\PROGRAM FILES
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 4 Stepping 1, GenuineIntel
"PROCESSOR_REVISION"=0401
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"CLASSPATH"=.;C:\Programfiler\Java\jre1.6.0_02\lib\ext\QTJava.zip
"QTJAVA"=C:\Programfiler\Java\jre1.6.0_02\lib\ext\QTJava.zip
"DiskeeperIcon"=C:\Program Files\

-----------------EOF-----------------
0
Réponse 10 / 33
Utilisateur anonyme
 
Re,

Télécharge Toolbar-S&D (Team IDN) sur ton Bureau

!! Déconnectes toi et fermes toute tes applications en cours le temps de la manipe !!

▶ Double-cliques sur l'.exe pour lancer l'installe et laisses toi guider ...

▶ Une fois fait, cliques sur le raccourci créé sur ton bureau pour lancer l'outil .

▶ Choisis l'option 1 ( "recherche") et tapes "entrée" .

▶Une fois le scan finit , un rapport va apparaître, copie/colles l'intégralité
de son contenu dans ta prochaine réponse ...

( le rapport est en outre sauvegardé ici -> C:\TB.txt )

Tutoriel Toolbard-S&D

Si un rapport ne passe pas faire une alerte à la conciergerie avec le /!\ jaune.
0
Réponse 11 / 33
adela80 Messages postés 46 Statut Membre
 
-----------\\ ToolBar S&D 1.2.8 XP/Vista

Microsoft Windows XP Home Edition ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : Intel(R) Celeron(R) CPU 2.80GHz )
BIOS : v3.06
USER : Compaq_Eier ( Administrator )
BOOT : Normal boot
Antivirus : AVG Anti-Virus plus Firewall 8.5 (Activated)
Firewall : AVG Firewall 8.5 (Activated)
C:\ (Local Disk) - NTFS - Total:68 Go (Free:13 Go)
D:\ (Local Disk) - FAT32 - Total:5 Go (Free:3 Go)
E:\ (CD or DVD)
F:\ (USB)
G:\ (USB)
H:\ (USB)
I:\ (USB)

"C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
Option : [1] ( 02/06/2009|19:09 )

-----------\\ Recherche de Fichiers / Dossiers ...

C:\WINDOWS\Fonts\acrsec.fon
C:\WINDOWS\Fonts\acrsecB.fon
C:\WINDOWS\Fonts\acrsecI.fon

-----------\\ Extensions

(Compaq_Eier) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar
(Compaq_Eier) - {34ea1c70-42cc-42c5-aa29-ec58b95a343e} => mybabylon
(Compaq_Eier) - {635abd67-4fe9-1b23-4f01-e679fa7484c1} => ytoolbar
(Compaq_Eier) - {D02B1E87-A8C6-433f-9B5C-2CEC4A072736} => signupshield

-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
"Search Bar"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Default_search_url"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Default_page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
"Window Title"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
"Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Start Page"="https://www.msn.com/fr-fr"
"Search bar"="http://www.bing.com/spresults.aspx"

--------------------\\ Recherche d'autres infections

--------------------\\ ROGUES ..

C:\DOCUME~1\ALLUSE~1\PROGRA~1\Starware368
C:\DOCUME~1\COMPAQ~1\PROGRA~1\Starware368
C:\DOCUME~1\LOCALS~1\PROGRA~1\Starware368
C:\PROGRA~1\AdwareFilterToolbar
C:\PROGRA~1\Starware368

1 - "C:\ToolBar SD\TB_1.txt" - 02/06/2009|19:10 - Option : [1]

-----------\\ Fin du rapport a 19:10:13,82
0
Réponse 12 / 33
Utilisateur anonyme
 
Re,

Fais ceci maintenant :

▶ Nettoyage avec ToolBar S&D :

!! Déconnectes toi et fermes toute tes applications en cours le temps de la manipe !!

▶Relances Toolbar-S&D en double-cliquant sur le raccourci.

▶ Tapes sur l'option 2 ( "nettoyage" ) puis tapes sur "Entrée".

Note : Ne touches à rien lors de la suppression !!

▶ Un rapport sera généré à la fin du processus : postes son contenu dans ta prochaine réponse

Si un rapport ne passe pas faire une alerte à la conciergerie avec le /!\ jaune.
0
Réponse 13 / 33
adela80 Messages postés 46 Statut Membre
 
-----------\\ ToolBar S&D 1.2.8 XP/Vista

Microsoft Windows XP Home Edition ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : Intel(R) Celeron(R) CPU 2.80GHz )
BIOS : v3.06
USER : Compaq_Eier ( Administrator )
BOOT : Normal boot
Antivirus : AVG Anti-Virus plus Firewall 8.5 (Activated)
Firewall : AVG Firewall 8.5 (Activated)
C:\ (Local Disk) - NTFS - Total:68 Go (Free:13 Go)
D:\ (Local Disk) - FAT32 - Total:5 Go (Free:3 Go)
E:\ (CD or DVD)
F:\ (USB)
G:\ (USB)
H:\ (USB)
I:\ (USB)

"C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
Option : [2] ( 02/06/2009|19:14 )

-----------\\ SUPPRESSION

Supprime! - C:\WINDOWS\Fonts\acrsec.fon
Supprime! - C:\WINDOWS\Fonts\acrsecB.fon
Supprime! - C:\WINDOWS\Fonts\acrsecI.fon

-----------\\ Recherche de Fichiers / Dossiers ...

-----------\\ Extensions

(Compaq_Eier) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar
(Compaq_Eier) - {34ea1c70-42cc-42c5-aa29-ec58b95a343e} => mybabylon
(Compaq_Eier) - {635abd67-4fe9-1b23-4f01-e679fa7484c1} => ytoolbar
(Compaq_Eier) - {D02B1E87-A8C6-433f-9B5C-2CEC4A072736} => signupshield

-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
"Search Bar"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Default_search_url"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Default_page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
"Window Title"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
"Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Start Page"="https://www.msn.com/fr-fr/"
"Search bar"="http://www.bing.com/spresults.aspx"

--------------------\\ Recherche d'autres infections

--------------------\\ ROGUES ..

C:\DOCUME~1\ALLUSE~1\PROGRA~1\Starware368
C:\DOCUME~1\COMPAQ~1\PROGRA~1\Starware368
C:\DOCUME~1\LOCALS~1\PROGRA~1\Starware368
C:\PROGRA~1\AdwareFilterToolbar
C:\PROGRA~1\Starware368

1 - "C:\ToolBar SD\TB_1.txt" - 02/06/2009|19:10 - Option : [1]
2 - "C:\ToolBar SD\TB_2.txt" - 02/06/2009|19:15 - Option : [2]

-----------\\ Fin du rapport a 19:15:44,42
0
Réponse 14 / 33
Utilisateur anonyme
 
Re,

▶ Télécharge et installe MalwareByte's Anti-Malware
Malwarebyte

▶ Mets le à jour

▶ Double clique sur le raccourci de MalwareByte's Anti-Malware qui est sur le bureau.

▶ Sélectionne Exécuter un examen COMPLET si ce n'est pas déjà fait

▶ clique sur Rechercher

▶ Une fois le scan terminé, une fenêtre s'ouvre, clique sur sur Ok

▶ Si MalwareByte's n'a rien détecté, clique sur Ok Un rapport va apparaître ferme-le.

▶ Si MalwareByte's a détecté des infections, clique sur Afficher les résultats ensuite sur Supprimer la sélection

▶ Enregistre le rapport sur ton Bureau comme cela il sera plus facile à retrouver, poste ensuite ce rapport.

Note : Si MalwareByte's a besoin de redémarrer pour terminer la suppression, accepte en cliquant sur Ok

Tutoriel pour MalwareByte's

Si un rapport ne passe pas faire une alerte à la conciergerie avec le /!\ jaune.
0
Réponse 15 / 33
adela80 Messages postés 46 Statut Membre
 
Malwarebytes' Anti-Malware 1.37
Version de la base de données: 2182
Windows 5.1.2600 Service Pack 3

02/06/2009 20:25:56
mbam-log-2009-06-02 (20-25-56).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 164993
Temps écoulé: 57 minute(s), 31 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 9
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 23
Fichier(s) infecté(s): 62

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\CLSID\{4d1c4e81-a32a-416b-bcdb-33b3ef3617d3} (Adware.Need2Find) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1962c5bc-e475-465b-823b-133e711bceb9} (Adware.Starware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{5f90c0e3-4c0a-4d54-a8ac-5afe6163a99e} (Adware.Starware) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{0ac49246-419b-4ee0-8917-8818daad6a4e} (Adware.180Solutions) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{99410cde-6f16-42ce-9d49-3807f78f0287} (Adware.180Solutions) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{f31a5d11-bf0b-4a4e-90af-274f2090aaa6} (Adware.180Solutions) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{e550dc77-ef3b-474f-b59c-b3e2aa1fa6a5} (Adware.Starware) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_RUNTIME2 (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_RUNTIME (Rootkit.Agent) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{37b85a29-692b-4205-9cad-2626e4993404} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
c:\programfiler\Starware368 (Adware.Starware) -> Quarantined and deleted successfully.
c:\programfiler\starware368\bin (Adware.Starware) -> Quarantined and deleted successfully.
c:\programfiler\starware368\icons (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\all users\programdata\Starware368 (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\all users\programdata\starware368\buttons (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\all users\programdata\starware368\contexts (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\all users\programdata\starware368\SimpleUpdate (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\compaq_eier\programdata\Starware368 (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\compaq_eier\programdata\starware368\Button_6 (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\compaq_eier\programdata\starware368\Button_7 (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\compaq_eier\programdata\starware368\Button_8 (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\compaq_eier\programdata\starware368\Download (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\compaq_eier\programdata\starware368\Lyrics (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\compaq_eier\programdata\starware368\Music_Search (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\compaq_eier\programdata\starware368\Radio_UK (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\localservice\programdata\Starware368 (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\localservice\programdata\starware368\Button_7 (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\localservice\programdata\starware368\Button_8 (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\All Users\Programdata\MPK (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\documents and settings\all users\programdata\MPK\1 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\documents and settings\all users\programdata\MPK\1 (Refog.Keylogger) -> Files: 3395 -> Quarantined and deleted successfully.
c:\documents and settings\all users\programdata\MPK\2 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\documents and settings\all users\programdata\MPK\REFOG Keylogger (Refog.Keylogger) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
c:\programfiler\ad-remover\quarantine\PROGRA~1\WINDOW~4\MESSEN~1\riched20.dll.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\system volume information\_restore{3cddf21c-93f9-4740-898c-6ebeaa821307}\RP1147\A0317235.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\aclx86.dll (Spyware.EliteKeylogger) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\font32.dll (Spyware.EliteKeylogger) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\kbdnex86.dll (Spyware.EliteKeylogger) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\olec32.dll (Spyware.EliteKeylogger) -> Quarantined and deleted successfully.
c:\programfiler\starware368\Starware368Config.xml (Adware.Starware) -> Quarantined and deleted successfully.
c:\programfiler\starware368\icons\star_16.ico (Adware.Starware) -> Quarantined and deleted successfully.
c:\programfiler\starware368\icons\Thumbs.db (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\all users\programdata\starware368\Tem7.tmp (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\all users\programdata\starware368\buttons\503_button_1b_def.bmp (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\all users\programdata\starware368\buttons\503_button_1b_over.bmp (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\all users\programdata\starware368\buttons\512_button_1b_def.bmp (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\all users\programdata\starware368\buttons\512_button_1b_over.bmp (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\all users\programdata\starware368\buttons\513_button_1b_def.bmp (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\all users\programdata\starware368\buttons\513_button_1b_over.bmp (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\all users\programdata\starware368\buttons\Button_60.bmp (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\all users\programdata\starware368\buttons\Button_70.bmp (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\all users\programdata\starware368\buttons\Button_80.bmp (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\all users\programdata\starware368\buttons\FindIt.bmp (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\all users\programdata\starware368\buttons\FindItHot.bmp (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\all users\programdata\starware368\buttons\findithotxp.png (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\all users\programdata\starware368\buttons\finditxp.png (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\all users\programdata\starware368\buttons\logo.bmp (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\all users\programdata\starware368\buttons\logoxp.bmp (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\all users\programdata\starware368\contexts\error.xml (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\all users\programdata\starware368\contexts\Related.xml (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\all users\programdata\starware368\contexts\Travel.xml (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\all users\programdata\starware368\simpleupdate\ProductMessagingConfig.xml (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\all users\programdata\starware368\simpleupdate\ProductMessagingConfig.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\all users\programdata\starware368\simpleupdate\SimpleUpdateConfig.xml (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\all users\programdata\starware368\simpleupdate\SimpleUpdateConfig.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\all users\programdata\starware368\simpleupdate\TimerManagerConfig.xml (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\all users\programdata\starware368\simpleupdate\TimerManagerConfig.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\compaq_eier\programdata\starware368\Button_6\Button_6Options.xml (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\compaq_eier\programdata\starware368\Button_6\Button_6Options.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\compaq_eier\programdata\starware368\Button_7\Button_7Options.xml (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\compaq_eier\programdata\starware368\Button_7\Button_7Options.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\compaq_eier\programdata\starware368\Button_8\Button_8Options.xml (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\compaq_eier\programdata\starware368\Button_8\Button_8Options.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\compaq_eier\programdata\starware368\Download\DownloadOptions.xml (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\compaq_eier\programdata\starware368\Download\DownloadOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\compaq_eier\programdata\starware368\Lyrics\LyricsOptions.xml (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\compaq_eier\programdata\starware368\Lyrics\LyricsOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\compaq_eier\programdata\starware368\music_search\Music_SearchOptions.xml (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\compaq_eier\programdata\starware368\music_search\Music_SearchOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\compaq_eier\programdata\starware368\Radio_UK\Radio_UKOptions.xml (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\compaq_eier\programdata\starware368\Radio_UK\Radio_UKOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\localservice\programdata\starware368\Button_7\Button_7Options.xml (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\localservice\programdata\starware368\Button_7\Button_7Options.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\localservice\programdata\starware368\Button_8\Button_8Options.xml (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\localservice\programdata\starware368\Button_8\Button_8Options.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
c:\documents and settings\all users\programdata\MPK\key.bin (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\documents and settings\all users\programdata\MPK\M0000 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\documents and settings\all users\programdata\MPK\S0000 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\documents and settings\all users\programdata\MPK\2\D0000 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\documents and settings\all users\programdata\MPK\2\S0000 (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\documents and settings\all users\programdata\MPK\refog keylogger\Acheter maintenant!.lnk (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\documents and settings\all users\programdata\MPK\refog keylogger\Aide.lnk (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\documents and settings\all users\programdata\MPK\refog keylogger\Désinstaller REFOG Keylogger.lnk (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\documents and settings\all users\programdata\MPK\refog keylogger\Page d'accueil de REFOG Keylogger.lnk (Refog.Keylogger) -> Quarantined and deleted successfully.
c:\documents and settings\all users\programdata\MPK\refog keylogger\REFOG Keylogger.lnk (Refog.Keylogger) -> Quarantined and deleted successfully.
0
Réponse 16 / 33
Utilisateur anonyme
 
Re,

Supprime la quarantaine de malwarebyte.Pour ce faire tu clic sur l'onglet "quarantaine de malwarebyte et tu clic sur "tout supprimer".

Tu redémarre ton PC normalement et tu me refait un log avec RSIT.

merci
0
Réponse 17 / 33
adela80 Messages postés 46 Statut Membre
 
Logfile of random's system information tool 1.06 (written by random/random)
Run by Compaq_Eier at 2009-06-02 20:45:43
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 15 GB (21%) free of 70 GB
Total RAM: 511 MB (17% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:46:21, on 02/06/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SYSTEM32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\windows\system\hpsysdrv.exe
C:\Programfiler\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Programfiler\QuickTime\QTTask.exe
C:\Programfiler\Fellesfiler\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Programfiler\iTunes\iTunesHelper.exe
C:\Programfiler\Google\Google Desktop Search\GoogleDesktop.exe
C:\HP\KBD\KBD.EXE
C:\Programfiler\Telenor\Telenorhjelpen\Telenor.exe
C:\Programfiler\Java\jre6\bin\jusched.exe
C:\Programfiler\Hp\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\AVG\AVG8\avgfws8.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Programfiler\Fellesfiler\Real\Update_OB\realsched.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Programfiler\Java\jre6\bin\jqs.exe
C:\Programfiler\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe
C:\Program Files\Real\SKL\alsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Programfiler\AVG\AVG8\avgcsrvx.exe
C:\Programfiler\AVG\AVG8\avgcsrvx.exe
C:\Programfiler\Google\Google Desktop Search\GoogleDesktop.exe
C:\Programfiler\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Compaq_Eier\Skrivebord\antivirus2\RSIT.exe
C:\Program Files\Compaq_Eier.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programfiler\Yahoo!\Companion\Installs\cpn\yt.dll
F2 - REG:system.ini: UserInit=c:\windows\system32\userinit.exe
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programfiler\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programfiler\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Programfiler\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Programfiler\AVG\AVG8\avgssie.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programfiler\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\Programfiler\AVG\AVG8\avgtoolbar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programfiler\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programfiler\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programfiler\Windows Live Toolbar\msntb.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Programfiler\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll (file missing)
O2 - BHO: Telenor Telenorhjelpen Plugin - {DB87CDE1-EF9C-44EB-A42F-6D0B3C72C516} - C:\Programfiler\Telenor\Telenorhjelpen\IEFixItNowPlugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programfiler\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programfiler\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programfiler\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programfiler\Windows Live Toolbar\msntb.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\Programfiler\AVG\AVG8\avgtoolbar.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [Snarvei til egenskapsside for High Definition Audio] HDAShCut.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Programfiler\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [Creative WebCam Tray] C:\Programfiler\Creative\Shared Files\CAMTRAY.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programfiler\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [MsgCenterExe] "C:\Programfiler\Fellesfiler\Real\Update_OB\RealOneMessageCenter.exe" -osboot
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programfiler\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Programfiler\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Telenorhjelpen] "C:\Programfiler\Telenor\Telenorhjelpen\Telenor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programfiler\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Programfiler\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Programfiler\Fellesfiler\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [MsnMsgr] ~"C:\Programfiler\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Messenger (Yahoo!)] ~"C:\Programfiler\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETTVERKSTJENESTE')
O4 - HKUS\S-1-5-18\..\Run: [msnmsgr] "C:\Programfiler\Windows Live\Messenger\msnmsgr.exe" /background (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [msnmsgr] "C:\Programfiler\Windows Live\Messenger\msnmsgr.exe" /background (User 'Default user')
O4 - Startup: Outil de détection de support Picture Motion Browser.lnk = C:\Programfiler\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Programfiler\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programfiler\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programfiler\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Tilkoblingshjelp - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Tilkoblingshjelp - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} -
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Programfiler\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www3.snapfish.fr/SnapfishActivia.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {BA162249-F2C5-4851-8ADC-FC58CB424243} (Image Uploader Control) - http://copainsdavant.linternaute.com/html_include_bibliotheque/objimageuploader/5.0.15.0/ImageUploader5.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: fin - {5C472352-90D0-4214-BF20-8E4A2B82F980} - (no file)
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Programfiler\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FELLES~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/html - (no CLSID) - (no file)
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL,C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: arm32reg - C:\WINDOWS\
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Programfiler\Fellesfiler\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: AVG8 Firewall (avgfws8) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgfws8.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Programfiler\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programfiler\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Programfiler\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programfiler\Java\jre6\bin\jqs.exe
O23 - Service: Salsvc - Unknown owner - C:\Program Files\Real\SKL\alsvc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - c:\Programfiler\Fellesfiler\Symantec Shared\SNDSrvc.exe
0
Réponse 18 / 33
Utilisateur anonyme
 
Re;

---> Télécharge OTM (D'OldTimer) sur ton Bureau :

---> Double-clique sur OTMoveIt3.exe afin de le lancer.

---> Copie (Ctrl+C) le texte suivant en gras ci-dessous :

:processes
explorer.exe

:Reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\arm32reg]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\arm32reg]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"=""

:commands
[emptytemp]
[start explorer]


---> Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved.

---> Clique maintenant sur le bouton MoveIt! puis ferme OTMoveIt3.

Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer.
Accepte en cliquant sur YES.

---> Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\
Le nom du rapport correspond au moment de sa création : date_heure.log
0
Réponse 19 / 33
adela80 Messages postés 46 Statut Membre
 
========== PROCESSES ==========
Process explorer.exe killed successfully.
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\arm32reg\\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\arm32reg\\ not found.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\"AppInit_DLLS"|"" /E : value set successfully!
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\COMPAQ~1\LOKALE~1\Temp\~DFE3E7.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Internet Explorer cache folder emptied.
File delete failed. C:\Documents and Settings\Compaq_Eier\Lokale innstillinger\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
User's Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\1227b5d7-8101-4ad4-a11b-bc9a308c0b04.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\12919d91-5e2a-4c75-90be-e4d3d39b5a8b.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\846e3210-ec26-4b20-b614-8ba1e0ce70f7.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\a34c60a5-4841-4fd7-a588-6ebeb936e02f.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\ca4358ca-d44a-4654-a7bb-ca6a8fc041b5.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\d6cb84bf-47b7-423e-a4d2-531d47e2b96e.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\ec3beee2-0800-4d7d-967c-6c268921c583.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_2d8.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
File delete failed. C:\Documents and Settings\Compaq_Eier\Lokale innstillinger\Programdata\Mozilla\Firefox\Profiles\ez13n66f.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Compaq_Eier\Lokale innstillinger\Programdata\Mozilla\Firefox\Profiles\ez13n66f.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Compaq_Eier\Lokale innstillinger\Programdata\Mozilla\Firefox\Profiles\ez13n66f.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Compaq_Eier\Lokale innstillinger\Programdata\Mozilla\Firefox\Profiles\ez13n66f.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Compaq_Eier\Lokale innstillinger\Programdata\Mozilla\Firefox\Profiles\ez13n66f.default\XUL.mfl scheduled to be deleted on reboot.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully

OTM by OldTimer - Version 2.1.0.0 log created on 06022009_205949

Files moved on Reboot...
C:\DOCUME~1\COMPAQ~1\LOKALE~1\Temp\~DFE3E7.tmp moved successfully.
C:\WINDOWS\temp\1227b5d7-8101-4ad4-a11b-bc9a308c0b04.tmp moved successfully.
C:\WINDOWS\temp\12919d91-5e2a-4c75-90be-e4d3d39b5a8b.tmp moved successfully.
C:\WINDOWS\temp\846e3210-ec26-4b20-b614-8ba1e0ce70f7.tmp moved successfully.
File C:\WINDOWS\temp\a34c60a5-4841-4fd7-a588-6ebeb936e02f.tmp not found!
File C:\WINDOWS\temp\ca4358ca-d44a-4654-a7bb-ca6a8fc041b5.tmp not found!
C:\WINDOWS\temp\d6cb84bf-47b7-423e-a4d2-531d47e2b96e.tmp moved successfully.
File C:\WINDOWS\temp\ec3beee2-0800-4d7d-967c-6c268921c583.tmp not found!
File C:\WINDOWS\temp\Perflib_Perfdata_2d8.dat not found!
C:\Documents and Settings\Compaq_Eier\Lokale innstillinger\Programdata\Mozilla\Firefox\Profiles\ez13n66f.default\Cache\_CACHE_001_ moved successfully.
C:\Documents and Settings\Compaq_Eier\Lokale innstillinger\Programdata\Mozilla\Firefox\Profiles\ez13n66f.default\Cache\_CACHE_002_ moved successfully.
C:\Documents and Settings\Compaq_Eier\Lokale innstillinger\Programdata\Mozilla\Firefox\Profiles\ez13n66f.default\Cache\_CACHE_003_ moved successfully.
C:\Documents and Settings\Compaq_Eier\Lokale innstillinger\Programdata\Mozilla\Firefox\Profiles\ez13n66f.default\Cache\_CACHE_MAP_ moved successfully.
C:\Documents and Settings\Compaq_Eier\Lokale innstillinger\Programdata\Mozilla\Firefox\Profiles\ez13n66f.default\XUL.mfl moved successfully.

Registry entries deleted on Reboot...
0
Réponse 20 / 33
Utilisateur anonyme
 
Re,

Redémarre ton PC , et refait je pense un dernier log avec RSIT.

merci
0
  • 1
  • 2

Discussions similaires

Analyse des logs hijackthis
philnoug -
nayas13 -

35 réponses
spywar
stephane74 -
stephane74 -

4 réponses
Processus et démarrage
baptcollot -
baptcollot -

4 réponses
Analyse logs hijackthis
embêté -
Utilisateur anonyme -

21 réponses
rapport Hijackthis
kawito33 -
kawito33 -

87 réponses