HELP VIRUS INDESTRUCTIBLES Résolu/Fermé

Question

Bonjour, alors voila j'ai deux virus sur mon ordi qui sont Indestructibles et pourtant j'ai deux antivirus AVG free 8.5 et Antivirus Guard et meme avec ca >< j'arrive pas a les supprimer de mon PC
c les virus : TR/autorun.LS Trojan et Worm/delf.EOV 

Les antivirus sont en alertes permanant et m'envoie toute les minutes des pop-up qui me previent des virus 
Je sais plus quoi faire si vous avez une solution faite la moi savoir svp merci =)

Utilisateur anonyme · Answer

Bonjour

1)Un seul antivirus

2) 1-	Télécharge et installe le logiciel HijackThis : 

ici https://www.commentcamarche.net/telecharger/ 159 hijackthis 
ou ici http://www.trendsecure.com/portal/en-US/_download/HJTInstall.exe 
ou ici https://www.clubic.com/telecharger-fiche17891-hijackthis.html 

-->Clique sur le setup pour lancer l'installation : laisse toi guider et ne modifie pas les paramètres d'installation . 
A la fin de l’installation, le programme se lance automatiquement : ferme le en cliquant sur la croix rouge. 
Au final, tu dois avoir un raccourci sur ton bureau et aussi un cheminement comme : 
"C:\ program files\Trend Micro\HijackThis\HijackThis.exe " . 

(Ne lance pas ce prg pour l'instant et fais la suite ... ) 


2- Télécharge Random's System Information Tool (RSIT) de random/random et enregistre l'exécutable sur ton Bureau. 

-> http://images.malwareremoval.com/random/RSIT.exe 

! Déconnecte toi et ferme toutes tes applications en cours ! 

Double-clique sur " RSIT.exe " pour le lancer. 

-> Une première fenêtre s'ouvre avec en titre : " Disclaimer of warranty " . 

* Devant l'option "List files/folders created ..." , tu choisis : 2 months 

* clique ensuite sur " Continue " pour lancer l'analyse ... 


-> laisse faire le scan et ne touche pas au PC ... 


Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront (probablement avec le bloc-notes). 

Poste le contenu de " log.txt " (c'est celui qui apparaît à l'écran), ainsi que de " info.txt " (que tu verras dans la barre des tâches), pour analyse et attends la suite ... 

Important : poste un rapport, puis l'autre dans la réponse suivante ... 
Si tu essaies de poster les deux en même temps, cela risque d'être trop long pour le forum ... 
( Et si "log.txt" seul, ne passe pas non plus , fais le en 2 fois ... merci ... ) 

( Note : les rapports seront en outre sauvegardés dans ce dossier -> C:\rsit ) 

             Merci

Suchiro · Answer

Marche pas je suis bloquer a clique ensuite sur " Continue " pour lancer l'analyse ... 

il semblerai qu'il y'ai un probleme avec l'analyse elle ne marche pas il ya ecrit Line-1 
Error : Subscript used with non-array variable

Suchiro · Answer

j'arrive pas a copier coller le rapport ><

Suchiro · Answer

# User : chokbengboune (Administrateurs) # ACER-755E621E64
# Update on 14/07/09 by Chiquitine29 & C_XX
# Start at: 14:00:50 | 14/07/2009
# Website : http://pagesperso-orange.fr/NosTools/index.html

#               Intel(R) Pentium(R) 4 CPU 3.06GHz
# Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 6.0.2900.5512
# Windows Firewall Status : Enabled
# AV : Avira AntiVir PersonalEdition 8.0.1.30 [ (!) Disabled | Updated ]
# AV : avast! antivirus 4.8.0 [VPS 080827-0] 4.8.0 [ Enabled | Updated ]

# C:\ # Disque fixe local # 90,57 Go (26,9 Go free) [ACER] # NTFS
# D:\ # Disque fixe local # 91,82 Go (91,74 Go free) [ACERDATA] # FAT32
# E:\ # Disque CD-ROM

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\ACER-755E621E64.exe
C:\WINDOWS\chokbengboune.exe
C:\Program Files\Search Settings\SearchSettings.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application  Launcher.exe
C:\WINDOWS\Philips\SPC220NC\Monitor.exe
C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsoemon.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
C:\Program Files\Club-Internet\Controle Parental\bin\optproxy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\documents and settings\chokbengboune\local settings\application data\gqywo.exe
C:\Documents and Settings\chokbengboune\Application Data\Microsoft\Notification  de cadeaux MSN\lsnfier.exe
C:\Documents and Settings\chokbengboune\Local Settings\Application  Data\Google\Update\1.2.183.7\GoogleCrashHandler.exe
C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## | Registre Startup |

R1 - HKCU\..\Main: "Local Page"="C:\WINDOWS\system32\blank.htm" 
R1 - HKCU\..\Main: "Search Page"="https://www.google.com/?gws_rd=ssl" 
R1 - HKCU\..\Main: "Start Page"="https://www.google.fr/?gws_rd=ssl" 
R1 - HKCU\..\Main: "Secondary Start Pages"=hex (7):68,00,74,00,74,00,70,00,3a,00,2f,00,2f,00,77,00,\ 
F2 - HKLM\..\logon:"Userinit"="C:\WINDOWS\system32 \userinit.exe,C:\WINDOWS\smss.exe" 
F2 - HKLM\..\logon:"DefaultUserName"="chokbengboune" 
F2 - HKLM\..\logon:"AltDefaultUserName"="chokbengboune" 
F2 - HKLM\..\logon:"LegalNoticeCaption"="" 
F2 - HKLM\..\logon:"LegalNoticeText"="" 
04 - HKLM\..\Run:  EoEngine= 
04 - HKLM\..\Run:  PCSuiteTrayApplication=C:\Program Files\Nokia\Nokia PC Suite  6\LaunchApplication.exe -startup 
04 - HKLM\..\Run:  SearchSettings=C:\Program Files\Search  Settings\SearchSettings.exe 
04 - HKLM\..\Run:  Sony Ericsson PC Suite="C:\Program Files\Sony  Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions 
04 - HKLM\..\Run:  Monitor=C:\WINDOWS\Philips\SPC220NC\Monitor.exe 
04 - HKLM\..\Run:  MyWebSearch Plugin=rundll32 C:\PROGRA~1\MYWEBS~1 \bar\2.bin\M3PLUGIN.DLL,UPF 
04 - HKLM\..\Run:  My Web Search Bar=rundll32 C:\PROGRA~1\MYWEBS~1 \bar\2.bin\MWSBAR.DLL,S 
04 - HKLM\..\Run:  MyWebSearch Email Plugin=C:\PROGRA~1\MYWEBS~1 \bar\2.bin\mwsoemon.exe 
04 - HKLM\..\Run:  TkBellExe="C:\Program Files\Fichiers  communs\Real\Update_OBealsched.exe"  -osboot 
04 - HKLM\..\Run:  ACER-755E621E64=C:\WINDOWS\win.pif 
04 - HKLM\..\Run:  AVG8_TRAY=C:\PROGRA~1\AVG\AVG8\avgtray.exe 
04 - HKLM\..\Run:  QuickTime Task="C:\Program Files\QuickTime\qttask.exe" - atboottime 
04 - HKCU\..\Run:  CTFMON.EXE#C:\WINDOWS\system32\ctfmon.exe#  
04 - HKCU\..\Run:  MsnMsgr#"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"  /background#  
04 - HKCU\..\Run:  CHIC 16#C:\DOCUME~1\CHOKBE~1\APPLIC~1\TESTPU~1\sectblah.exe#  
04 - HKCU\..\Run:  swg#C:\Program  Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe#  
04 - HKCU\..\Run:  updateMgr#C:\Program Files\Adobe\Acrobat 7.0 \Reader\AdobeUpdateManager.exe AcRdB7_1_0#  
04 - HKCU\..\Run:  s9201#"C:\Documents and Settings\All Users\Application  Data\SoftLand Ltd\Antivirus 2008 XP\av2008xp.exe" /autorun#  
04 - HKCU\..\Run:  CanalPlayer#C:\Program Files\Lecteur  CANALPLAY\CanalPlayer.exe#  
04 - HKCU\..\Run:  Google Update#"C:\Documents and Settings\chokbengboune\Local  Settings\Application Data\Google\Update\GoogleUpdate.exe" /c#  
04 - HKCU\..\Run:  MyWebSearch Email Plugin#C:\PROGRA~1\MYWEBS~1 \bar\2.bin\mwsoemon.exe#  
04 - HKCU\..\Run:  chokbengboune#C:\DOCUME~1\CHOKBE~1\LOCALS~1\Temp\Tmp.com#  
04 - HKCU\..\Run:  gqywo#"c:\documents and settings\chokbengboune\local  settings\application data\gqywo.exe" gqywo#  

################## | Fichiers # Dossiers infectieux |

Présent ! C:\DOCUME~1\CHOKBE~1\LOCALS~1\Temp\Tmp.com  [a220bf5b8267afd8865d4cda591efa20]  
Présent ! C:\WINDOWS\services.exe [a220bf5b8267afd8865d4cda591efa20]  
Présent ! C:\WINDOWS\smss.exe [a220bf5b8267afd8865d4cda591efa20]  
Présent ! C:\WINDOWS\svchost.exe [a220bf5b8267afd8865d4cda591efa20]  
Présent ! C:\WINDOWS\system.exe [a220bf5b8267afd8865d4cda591efa20]

################## | C:\Documents and Settings\chokbengboune\Temporary Internet  Files |

Présent ! C:\DOCUME~1\CHOKBE~1\LOCALS~1\Temp\uninstall.exe  
Présent ! C:\DOCUME~1\CHOKBE~1\LOCALS~1\Temp\ICD1.tmp\jinstall.exe

################## | All Drives ... |

Présent ! C:\autorun.inf [8e73679ad05a9ba825411997ca598ff6]  
Présent ! D:\autorun.inf [8e73679ad05a9ba825411997ca598ff6]  

################## | Registre # Clés Run infectieuses |

Présent ! HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "chokbengboune"  
Présent ! HKCU\SOFTWARE\...\CurrentVersion\Policies\System "DisableRegistryTools"  ( 0x1 )  
Présent ! HKCU\SOFTWARE\...\CurrentVersion\Policies\System "DisableTaskMgr" ( 0x1  )  

################## | Registre # Mountpoints2 |

HKCU\..\..\Explorer\MountPoints2\J
Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE  Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
Shell\Open(&0)\command =J:\Recycled\ctfmon.exe 

HKCU\..\..\Explorer\MountPoints2\K
Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE  Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
Shell\Open(&0)\command =K:\Recycled\ctfmon.exe 

HKCU\..\..\Explorer\MountPoints2\{076ac4b2-307b-11dd-b8f4-00142aa641e3}
Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE  Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
Shell\Open(&0)\command =G:\Recycled\ctfmon.exe 

HKCU\..\..\Explorer\MountPoints2\{c15f4f42-1608-11dd-b8a0-806d6172696f}
Shell\Auto\command =C:\AutoRun.exe 
Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE  Shell32.DLL,ShellExec_RunDLL AutoRun.exe

HKCU\..\..\Explorer\MountPoints2\{c15f4f48-1608-11dd-b8a0-806d6172696f}
Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE  Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
Shell\Open(&0)\command =J:\Recycled\ctfmon.exe 

################## | Etat / Services / Informations |


# Affichage des fichiers cachés : OK
# Mode sans echec : OK
# Ndisuio -> Start = 3 ( Good = 3 | Bad = 4 ) 
# EapHost -> Start = 3 ( Good = 2 | Bad = 4 ) 
# Ip6Fw -> Start = 3 ( Good = 2 | Bad = 4 ) 
# SharedAccess -> Start = 2 ( Good = 2 | Bad = 4 ) 
# wuauserv -> Start = 2 ( Good = 2 | Bad = 4 ) 
# wscsvc -> Start = 2 ( Good = 2 | Bad = 4 ) 

################## | Cracks / Keygens / Serials |

################## | ! Fin du rapport # FindyKill V6.006 ! |

Suchiro · Answer

Quand tu dis déconnecte toi c'est pour msn ou je dois carément éteindre mon Modem??

Suchiro · Answer

Merde pour le premier rapport javais éteint le modem et laisser la page internet du forum ouverte pour suivre les étapes que t'avais mises

flamouth · Answer

Salut, 
Installe antivir (https://www.01net.com/telecharger/windows/Securite/antivirus-antitrojan/fiches/13198.html
meilleur antivirus gratuit
installe spybot (https://www.01net.com/telecharger/windows/Securite/anti-spyware/fiches/26157.html
Fait un scan complet de ton pc avec les deux logiciel
Voila et sinon si tu utilise firefox prend l'extention adblock plus (https://addons.mozilla.org/fr/firefox/addon/adblock-plus/ pour t'épagner les pub

flamouth · Answer

suite --> qui peuvent t'installer des trucs indésirable sans ton accord

Suchiro · Answer

OMG JE DOIS RECOMMENCER O_O

Suchiro · Answer

Voila j'ai refais sans erreur voici le premier rapport (option 1) = 



############################## | FindyKill V6.006 |

# User : chokbengboune (Administrateurs) # ACER-755E621E64
# Update on 14/07/09 by Chiquitine29 & C_XX
# Start at: 18:06:36 | 14/07/2009
# Website : http://pagesperso-orange.fr/NosTools/index.html

#               Intel(R) Pentium(R) 4 CPU 3.06GHz
# Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 6.0.2900.5512
# Windows Firewall Status : Enabled
# AV : Avira AntiVir PersonalEdition 8.0.1.30 [ (!) Disabled | Updated ]
# AV : avast! antivirus 4.8.0 [VPS 080827-0] 4.8.0 [ Enabled | Updated ]

# C:\ # Disque fixe local # 90,57 Go (31,23 Go free) [ACER] # NTFS
# D:\ # Disque fixe local # 91,82 Go (91,74 Go free) [ACERDATA] # FAT32
# E:\ # Disque CD-ROM
# F:\ # Disque amovible # 1,9 Go (423,88 Mo free) [PHONE CARD] # FAT

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\ACER-755E621E64.exe
C:\WINDOWS\chokbengboune.exe
C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Club-Internet\Controle Parental\bin\optproxy.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Search Settings\SearchSettings.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\WINDOWS\Philips\SPC220NC\Monitor.exe
C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsoemon.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\documents and settings\chokbengboune\local settings\application data\gqywo.exe
C:\Documents and Settings\chokbengboune\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe
C:\Documents and Settings\chokbengboune\Local Settings\Application Data\Google\Update\1.2.183.7\GoogleCrashHandler.exe
C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## | Registre Startup |

R1 - HKCU\..\Main: "Local Page"="C:\WINDOWS\system32\blank.htm" 
R1 - HKCU\..\Main: "Search Page"="https://www.google.com/?gws_rd=ssl" 
R1 - HKCU\..\Main: "Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome" 
R1 - HKCU\..\Main: "Secondary Start Pages"=hex(7):68,00,74,00,74,00,70,00,3a,00,2f,00,2f,00,77,00,\ 
R1 - HKCU\..\Main: "Window Title"="" 
F2 - HKLM\..\logon:"Userinit"="C:\WINDOWS\system32\userinit.exe,C:\DOCUME~1\CHOKBE~1\LOCALS~1\smss.exe" 
F2 - HKLM\..\logon:"DefaultUserName"="chokbengboune" 
F2 - HKLM\..\logon:"AltDefaultUserName"="chokbengboune" 
F2 - HKLM\..\logon:"LegalNoticeCaption"="" 
F2 - HKLM\..\logon:"LegalNoticeText"="" 
04 - HKLM\..\Run:  EoEngine= 
04 - HKLM\..\Run:  PCSuiteTrayApplication=C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup 
04 - HKLM\..\Run:  SearchSettings=C:\Program Files\Search Settings\SearchSettings.exe 
04 - HKLM\..\Run:  Sony Ericsson PC Suite="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions 
04 - HKLM\..\Run:  Monitor=C:\WINDOWS\Philips\SPC220NC\Monitor.exe 
04 - HKLM\..\Run:  MyWebSearch Plugin=rundll32 C:\PROGRA~1\MYWEBS~1\bar\2.bin\M3PLUGIN.DLL,UPF 
04 - HKLM\..\Run:  My Web Search Bar=rundll32 C:\PROGRA~1\MYWEBS~1\bar\2.bin\MWSBAR.DLL,S 
04 - HKLM\..\Run:  MyWebSearch Email Plugin=C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsoemon.exe 
04 - HKLM\..\Run:  TkBellExe="C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot 
04 - HKLM\..\Run:  ACER-755E621E64=C:\WINDOWS\win.pif 
04 - HKLM\..\Run:  AVG8_TRAY=C:\PROGRA~1\AVG\AVG8\avgtray.exe 
04 - HKLM\..\Run:  QuickTime Task="C:\Program Files\QuickTime\qttask.exe" -atboottime 
04 - HKCU\..\Run:  CTFMON.EXE#C:\WINDOWS\system32\ctfmon.exe#  
04 - HKCU\..\Run:  MsnMsgr#"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background#  
04 - HKCU\..\Run:  CHIC 16#C:\DOCUME~1\CHOKBE~1\APPLIC~1\TESTPU~1\sectblah.exe#  
04 - HKCU\..\Run:  swg#C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe#  
04 - HKCU\..\Run:  updateMgr#C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0#  
04 - HKCU\..\Run:  s9201#"C:\Documents and Settings\All Users\Application Data\SoftLand Ltd\Antivirus 2008 XP\av2008xp.exe" /autorun#  
04 - HKCU\..\Run:  CanalPlayer#C:\Program Files\Lecteur CANALPLAY\CanalPlayer.exe#  
04 - HKCU\..\Run:  Google Update#"C:\Documents and Settings\chokbengboune\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c#  
04 - HKCU\..\Run:  MyWebSearch Email Plugin#C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsoemon.exe#  
04 - HKCU\..\Run:  gqywo#"c:\documents and settings\chokbengboune\local settings\application data\gqywo.exe" gqywo#  
04 - HKCU\..\Run:  chokbengboune#C:\DOCUME~1\CHOKBE~1\LOCALS~1\Temp\Tmp.com#  

################## | Fichiers # Dossiers infectieux |

Présent ! C:\DOCUME~1\CHOKBE~1\LOCALS~1\Temp\Tmp.com [a220bf5b8267afd8865d4cda591efa20]  
Présent ! C:\WINDOWS\services.exe [a220bf5b8267afd8865d4cda591efa20]  
Présent ! C:\WINDOWS\smss.exe [a220bf5b8267afd8865d4cda591efa20]  
Présent ! C:\WINDOWS\svchost.exe [a220bf5b8267afd8865d4cda591efa20]  

################## | C:\Documents and Settings\chokbengboune\Temporary Internet Files |


################## | All Drives ... |


################## | Registre # Clés Run infectieuses |

Présent ! HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "chokbengboune"  

################## | Registre # Mountpoints2 |


################## | Etat / Services / Informations |

# Affichage des fichiers cachés : OK
# Mode sans echec : OK
# Ndisuio -> Start = 3 ( Good = 3 | Bad = 4 ) 
# EapHost -> Start = 2 ( Good = 2 | Bad = 4 ) 
# Ip6Fw -> Start = 2 ( Good = 2 | Bad = 4 ) 
# SharedAccess -> Start = 2 ( Good = 2 | Bad = 4 ) 
# wuauserv -> Start = 2 ( Good = 2 | Bad = 4 ) 
# wscsvc -> Start = 2 ( Good = 2 | Bad = 4 ) 

# C:\autorun.inf ( # Not infected ) -> Folder created by FindyKill.  
# D:\autorun.inf ( # Not infected ) -> Folder created by FindyKill.  

################## | Cracks / Keygens / Serials |


################## | ! Fin du rapport # FindyKill V6.006 ! |

Suchiro · Answer

Voila j'ai refais sans erreur voici le premier rapport (option 1) = 



############################## | FindyKill V6.006 |

# User : chokbengboune (Administrateurs) # ACER-755E621E64
# Update on 14/07/09 by Chiquitine29 & C_XX
# Start at: 18:06:36 | 14/07/2009
# Website : http://pagesperso-orange.fr/NosTools/index.html

#               Intel(R) Pentium(R) 4 CPU 3.06GHz
# Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 6.0.2900.5512
# Windows Firewall Status : Enabled
# AV : Avira AntiVir PersonalEdition 8.0.1.30 [ (!) Disabled | Updated ]
# AV : avast! antivirus 4.8.0 [VPS 080827-0] 4.8.0 [ Enabled | Updated ]

# C:\ # Disque fixe local # 90,57 Go (31,23 Go free) [ACER] # NTFS
# D:\ # Disque fixe local # 91,82 Go (91,74 Go free) [ACERDATA] # FAT32
# E:\ # Disque CD-ROM
# F:\ # Disque amovible # 1,9 Go (423,88 Mo free) [PHONE CARD] # FAT

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\ACER-755E621E64.exe
C:\WINDOWS\chokbengboune.exe
C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Club-Internet\Controle Parental\bin\optproxy.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Search Settings\SearchSettings.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\WINDOWS\Philips\SPC220NC\Monitor.exe
C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsoemon.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\documents and settings\chokbengboune\local settings\application data\gqywo.exe
C:\Documents and Settings\chokbengboune\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe
C:\Documents and Settings\chokbengboune\Local Settings\Application Data\Google\Update\1.2.183.7\GoogleCrashHandler.exe
C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## | Registre Startup |

R1 - HKCU\..\Main: "Local Page"="C:\WINDOWS\system32\blank.htm" 
R1 - HKCU\..\Main: "Search Page"="https://www.google.com/?gws_rd=ssl" 
R1 - HKCU\..\Main: "Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome" 
R1 - HKCU\..\Main: "Secondary Start Pages"=hex(7):68,00,74,00,74,00,70,00,3a,00,2f,00,2f,00,77,00,\ 
R1 - HKCU\..\Main: "Window Title"="" 
F2 - HKLM\..\logon:"Userinit"="C:\WINDOWS\system32\userinit.exe,C:\DOCUME~1\CHOKBE~1\LOCALS~1\smss.exe" 
F2 - HKLM\..\logon:"DefaultUserName"="chokbengboune" 
F2 - HKLM\..\logon:"AltDefaultUserName"="chokbengboune" 
F2 - HKLM\..\logon:"LegalNoticeCaption"="" 
F2 - HKLM\..\logon:"LegalNoticeText"="" 
04 - HKLM\..\Run:  EoEngine= 
04 - HKLM\..\Run:  PCSuiteTrayApplication=C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup 
04 - HKLM\..\Run:  SearchSettings=C:\Program Files\Search Settings\SearchSettings.exe 
04 - HKLM\..\Run:  Sony Ericsson PC Suite="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions 
04 - HKLM\..\Run:  Monitor=C:\WINDOWS\Philips\SPC220NC\Monitor.exe 
04 - HKLM\..\Run:  MyWebSearch Plugin=rundll32 C:\PROGRA~1\MYWEBS~1\bar\2.bin\M3PLUGIN.DLL,UPF 
04 - HKLM\..\Run:  My Web Search Bar=rundll32 C:\PROGRA~1\MYWEBS~1\bar\2.bin\MWSBAR.DLL,S 
04 - HKLM\..\Run:  MyWebSearch Email Plugin=C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsoemon.exe 
04 - HKLM\..\Run:  TkBellExe="C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot 
04 - HKLM\..\Run:  ACER-755E621E64=C:\WINDOWS\win.pif 
04 - HKLM\..\Run:  AVG8_TRAY=C:\PROGRA~1\AVG\AVG8\avgtray.exe 
04 - HKLM\..\Run:  QuickTime Task="C:\Program Files\QuickTime\qttask.exe" -atboottime 
04 - HKCU\..\Run:  CTFMON.EXE#C:\WINDOWS\system32\ctfmon.exe#  
04 - HKCU\..\Run:  MsnMsgr#"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background#  
04 - HKCU\..\Run:  CHIC 16#C:\DOCUME~1\CHOKBE~1\APPLIC~1\TESTPU~1\sectblah.exe#  
04 - HKCU\..\Run:  swg#C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe#  
04 - HKCU\..\Run:  updateMgr#C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0#  
04 - HKCU\..\Run:  s9201#"C:\Documents and Settings\All Users\Application Data\SoftLand Ltd\Antivirus 2008 XP\av2008xp.exe" /autorun#  
04 - HKCU\..\Run:  CanalPlayer#C:\Program Files\Lecteur CANALPLAY\CanalPlayer.exe#  
04 - HKCU\..\Run:  Google Update#"C:\Documents and Settings\chokbengboune\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c#  
04 - HKCU\..\Run:  MyWebSearch Email Plugin#C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsoemon.exe#  
04 - HKCU\..\Run:  gqywo#"c:\documents and settings\chokbengboune\local settings\application data\gqywo.exe" gqywo#  
04 - HKCU\..\Run:  chokbengboune#C:\DOCUME~1\CHOKBE~1\LOCALS~1\Temp\Tmp.com#  

################## | Fichiers # Dossiers infectieux |

Présent ! C:\DOCUME~1\CHOKBE~1\LOCALS~1\Temp\Tmp.com [a220bf5b8267afd8865d4cda591efa20]  
Présent ! C:\WINDOWS\services.exe [a220bf5b8267afd8865d4cda591efa20]  
Présent ! C:\WINDOWS\smss.exe [a220bf5b8267afd8865d4cda591efa20]  
Présent ! C:\WINDOWS\svchost.exe [a220bf5b8267afd8865d4cda591efa20]  

################## | C:\Documents and Settings\chokbengboune\Temporary Internet Files |


################## | All Drives ... |


################## | Registre # Clés Run infectieuses |

Présent ! HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "chokbengboune"  

################## | Registre # Mountpoints2 |


################## | Etat / Services / Informations |

# Affichage des fichiers cachés : OK
# Mode sans echec : OK
# Ndisuio -> Start = 3 ( Good = 3 | Bad = 4 ) 
# EapHost -> Start = 2 ( Good = 2 | Bad = 4 ) 
# Ip6Fw -> Start = 2 ( Good = 2 | Bad = 4 ) 
# SharedAccess -> Start = 2 ( Good = 2 | Bad = 4 ) 
# wuauserv -> Start = 2 ( Good = 2 | Bad = 4 ) 
# wscsvc -> Start = 2 ( Good = 2 | Bad = 4 ) 

# C:\autorun.inf ( # Not infected ) -> Folder created by FindyKill.  
# D:\autorun.inf ( # Not infected ) -> Folder created by FindyKill.  

################## | Cracks / Keygens / Serials |


################## | ! Fin du rapport # FindyKill V6.006 ! |

Suchiro · Answer

Voila le rapport de (l'option 2) : 

############################## | FindyKill V6.006 |

# User : chokbengboune (Administrateurs) # ACER-755E621E64
# Update on 14/07/09 by Chiquitine29 & C_XX
# Start at: 18:22:18 | 14/07/2009
# Website : http://pagesperso-orange.fr/NosTools/index.html

#               Intel(R) Pentium(R) 4 CPU 3.06GHz
# Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 6.0.2900.5512
# Windows Firewall Status : Enabled
# AV : Avira AntiVir PersonalEdition 8.0.1.30 [ (!) Disabled | Updated ]
# AV : avast! antivirus 4.8.0 [VPS 080827-0] 4.8.0 [ Enabled | Updated ]

# C:\ # Disque fixe local # 90,57 Go (31,23 Go free) [ACER] # NTFS
# D:\ # Disque fixe local # 91,82 Go (91,74 Go free) [ACERDATA] # FAT32
# E:\ # Disque CD-ROM

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\vistaui.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avwsc.exe
C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwssvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\userinit.exe
C:\DOCUME~1\CHOKBE~1\LOCALS~1\explorer.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Club-Internet\Controle Parental\bin\optproxy.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\ACER-755E621E64.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\chokbengboune.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## | Fichiers # Dossiers infectieux |

Supprimé ! "C:\DOCUME~1\CHOKBE~1\LOCALS~1\Temp\Tmp.com"    
Supprimé ! C:\WINDOWS\services.exe  
Supprimé ! C:\WINDOWS\smss.exe  
(!) Non supprimé ! C:\WINDOWS\svchost.exe  

################## | C:\Documents and Settings\chokbengboune\Temporary Internet Files |


################## | All Drives ... |

################## | Autres ... |


################## | Registre # Clés Run infectieuses |

Supprimé ! HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "chokbengboune"    

################## | Registre # Mountpoints2 |


################## | Listing des fichiers présent |

[16/12/2005 03:20|--a------|50] - C:\AUTOEXEC.BAT
[10/08/2007 10:01|---hs----|77824] - C:\AutoRun.exe
[29/04/2008 17:41|-rahs----|216] - C:\boot.ini
[05/08/2004 07:00|-rahs----|4952] - C:\Bootfont.bin
[19/02/2009 00:17|--a------|74] - C:\CMLoader.log
[16/12/2005 03:08|--a------|0] - C:\CONFIG.SYS
[14/07/2009 18:15|--a------|137067] - C:\error.log
[14/07/2009 18:35|--a------|3200] - C:\FindyKill.txt
[?|?|?] - C:\hiberfil.sys
[16/12/2005 03:08|-rahs----|0] - C:\IO.SYS
[16/12/2005 03:08|-rahs----|0] - C:\MSDOS.SYS
[05/08/2004 07:00|-rahs----|47564] - C:\NTDETECT.COM
[24/06/2009 22:35|-rahs----|252240] - C:
tldr
[14/07/2009 14:04|--a------|8245] - C:\pae.txt
[?|?|?] - C:\pagefile.sys
[16/12/2005 19:57|-rahs----|75] - C:\Preload.aaa
[21/01/2009 12:38|--a------|304160] - C:\SPC220NC.DAT
[30/06/2009 21:47|--ah-----|10000] - C:\sqmdata00.sqm
[30/06/2009 21:47|--ah-----|10000] - C:\sqmdata01.sqm
[30/06/2009 21:47|--ah-----|10000] - C:\sqmdata02.sqm
[30/06/2009 21:47|--ah-----|10000] - C:\sqmdata03.sqm
[30/06/2009 21:47|--ah-----|10000] - C:\sqmdata04.sqm
[30/06/2009 21:47|--ah-----|10000] - C:\sqmdata05.sqm
[30/06/2009 21:47|--ah-----|10000] - C:\sqmdata06.sqm
[30/06/2009 21:47|--ah-----|10000] - C:\sqmdata07.sqm
[30/06/2009 21:47|--ah-----|10000] - C:\sqmdata08.sqm
[30/06/2009 21:47|--ah-----|10000] - C:\sqmdata09.sqm
[30/06/2009 21:47|--ah-----|10000] - C:\sqmdata10.sqm
[30/06/2009 21:47|--ah-----|10000] - C:\sqmdata11.sqm
[30/06/2009 21:47|--ah-----|10000] - C:\sqmdata12.sqm
[30/06/2009 21:47|--ah-----|10000] - C:\sqmdata13.sqm
[30/06/2009 21:47|--ah-----|10000] - C:\sqmdata14.sqm
[30/06/2009 21:47|--ah-----|10000] - C:\sqmdata15.sqm
[30/06/2009 21:47|--ah-----|10000] - C:\sqmdata16.sqm
[30/06/2009 21:47|--ah-----|10000] - C:\sqmdata17.sqm
[30/06/2009 21:47|--ah-----|10000] - C:\sqmdata18.sqm
[30/06/2009 21:47|--ah-----|10000] - C:\sqmdata19.sqm
[30/06/2009 21:47|--ah-----|10000] - C:\sqmnoopt00.sqm
[30/06/2009 21:47|--ah-----|10000] - C:\sqmnoopt01.sqm
[30/06/2009 21:47|--ah-----|10000] - C:\sqmnoopt02.sqm
[30/06/2009 21:47|--ah-----|10000] - C:\sqmnoopt03.sqm
[30/06/2009 21:47|--ah-----|10000] - C:\sqmnoopt04.sqm
[30/06/2009 21:47|--ah-----|10000] - C:\sqmnoopt05.sqm
[30/06/2009 21:47|--ah-----|10000] - C:\sqmnoopt06.sqm
[30/06/2009 21:47|--ah-----|10000] - C:\sqmnoopt07.sqm
[30/06/2009 21:47|--ah-----|10000] - C:\sqmnoopt08.sqm
[30/06/2009 21:47|--ah-----|10000] - C:\sqmnoopt09.sqm
[30/06/2009 21:47|--ah-----|10000] - C:\sqmnoopt10.sqm
[30/06/2009 21:47|--ah-----|10000] - C:\sqmnoopt11.sqm
[30/06/2009 21:47|--ah-----|10000] - C:\sqmnoopt12.sqm
[30/06/2009 21:47|--ah-----|10000] - C:\sqmnoopt13.sqm
[30/06/2009 21:47|--ah-----|10000] - C:\sqmnoopt14.sqm
[30/06/2009 21:47|--ah-----|10000] - C:\sqmnoopt15.sqm
[30/06/2009 21:47|--ah-----|10000] - C:\sqmnoopt16.sqm
[30/06/2009 21:47|--ah-----|10000] - C:\sqmnoopt17.sqm
[30/06/2009 21:47|--ah-----|10000] - C:\sqmnoopt18.sqm
[30/06/2009 21:47|--ah-----|10000] - C:\sqmnoopt19.sqm
[02/05/2005 14:39|--a------|9398] - D:\-3.cns
[30/06/2009 21:46|--a------|10000] - D:\airdash.cns
[30/06/2009 21:46|--a------|10000] - D:\away.cns
[30/06/2009 21:46|--a------|10000] - D:\c.act
[30/06/2009 21:46|--a------|48104] - D:\cloud.air
[30/06/2009 21:46|--a------|14226] - D:\cloud.cmd
[30/06/2009 21:46|--a------|64346] - D:\cloud.cns
[30/06/2009 21:46|--a------|10000] - D:\cloud.def
[30/06/2009 21:46|--a------|861061] - D:\cloud.sff
[30/06/2009 21:46|--a------|1227523] - D:\cloud.snd
[30/06/2009 21:46|--a------|10000] - D:\jump.cns
[30/06/2009 21:46|--a------|10000] - D:\power.cns
[30/06/2009 21:46|--a------|11379] - D:\striker.cns
[02/05/2005 14:24|--a------|2236] - D:\à–¾‘.txt
[10/08/2007 10:01|---hs----|77824] - D:\AutoRun.exe
[04/08/2004 00:55|--a------|28672] - D:\setupSNK.exe

################## | Vaccination |

# C:\autorun.inf ( # Not infected ) -> Folder created by FindyKill.  
# D:\autorun.inf ( # Not infected ) -> Folder created by FindyKill.  

################## | Etat / Services / Informations |

# Mode sans echec : OK


# Affichage des fichiers cachés : OK

# Ndisuio -> Start = 3 ( Good = 3 | Bad = 4 ) 
# EapHost -> Start = 2 ( Good = 2 | Bad = 4 ) 
# Ip6Fw -> Start = 2 ( Good = 2 | Bad = 4 ) 
# SharedAccess -> Start = 2 ( Good = 2 | Bad = 4 ) 
# wuauserv -> Start = 2 ( Good = 2 | Bad = 4 ) 
# wscsvc -> Start = 2 ( Good = 2 | Bad = 4 ) 

################## | PEH ... |


################## | Cracks / Keygens / Serials |


################## | ! Fin du rapport # FindyKill V6.006 ! |

Suchiro · Answer

Voila le rapport de la derniere étape : 



======= RAPPORT D'AD-REMOVER 1.1.4.5_O | UNIQUEMENT XP/VISTA/SEVEN =======
.
Mit à jour par C_XX le 24/06/2009 à 7:10 PM
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Lancé à: 18:53:43, 14/07/2009 | Mode Normal | Option: SCAN
Exécuté de: C:\Program Files\Ad-remover\
Système d'exploitation: Microsoft® Windows XP™  Service Pack 3 v5.1.2600
Nom du PC: ACER-755E621E64 | Utilisateur actuel: chokbengboune
.
Administrateur: Administrateur 
N'est pas administrateur: ASPNET 
Administrateur: chokbengboune 
N'est pas administrateur: HelpAssistant *Desactive* 
N'est pas administrateur: Invité *Desactive* 
N'est pas administrateur: SUPPORT_388945a0 *Desactive* 
. 
============== ÉLÉMENT(S) TROUVÉ(S) ============== 
.
Service: "MyWebSearchService"
.
HKCR\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} 
HKCR\CLSID\{64F56FC1-1272-44CD-BA6E-39723696E350} 
HKCR\CLSID\{9afb8248-617f-460d-9366-d71cdeda3179} 
HKCR\EoRezoBHO.EoBho 
HKCR\EoRezoBHO.EoBho.1 
HKCR\FunWebProducts.DataControl 
HKCR\FunWebProducts.DataControl 
HKCR\FunWebProducts.DataControl.1 
HKCR\FunWebProducts.DataControl.1 
HKCR\FunWebProducts.HistoryKillerScheduler 
HKCR\FunWebProducts.HistoryKillerScheduler 
HKCR\FunWebProducts.HistoryKillerScheduler.1 
HKCR\FunWebProducts.HistoryKillerScheduler.1 
HKCR\FunWebProducts.HistorySwatterControlBar 
HKCR\FunWebProducts.HistorySwatterControlBar 
HKCR\FunWebProducts.HistorySwatterControlBar.1 
HKCR\FunWebProducts.HistorySwatterControlBar.1 
HKCR\FunWebProducts.HTMLMenu 
HKCR\FunWebProducts.HTMLMenu 
HKCR\FunWebProducts.HTMLMenu.1 
HKCR\FunWebProducts.HTMLMenu.1 
HKCR\FunWebProducts.HTMLMenu.2 
HKCR\FunWebProducts.HTMLMenu.2 
HKCR\FunWebProducts.IECookiesManager 
HKCR\FunWebProducts.IECookiesManager 
HKCR\FunWebProducts.IECookiesManager.1 
HKCR\FunWebProducts.IECookiesManager.1 
HKCR\FunWebProducts.KillerObjManager 
HKCR\FunWebProducts.KillerObjManager 
HKCR\FunWebProducts.KillerObjManager.1 
HKCR\FunWebProducts.KillerObjManager.1 
HKCR\FunWebProducts.PopSwatterBarButton 
HKCR\FunWebProducts.PopSwatterBarButton 
HKCR\FunWebProducts.PopSwatterBarButton.1 
HKCR\FunWebProducts.PopSwatterBarButton.1 
HKCR\FunWebProducts.PopSwatterSettingsControl 
HKCR\FunWebProducts.PopSwatterSettingsControl 
HKCR\FunWebProducts.PopSwatterSettingsControl.1 
HKCR\FunWebProducts.PopSwatterSettingsControl.1 
HKCR\Interface\{1093995a-ba37-41d2-836e-091067c4ad17} 
HKCR\Interface\{120927bf-1700-43bc-810f-fab92549b390} 
HKCR\Interface\{17DE5E5E-BFE3-4E83-8E1F-8755795359EC} 
HKCR\Interface\{1f52a5fa-a705-4415-b975-88503b291728} 
HKCR\Interface\{247a115f-06c2-4fb3-967d-2d62d3cf4f0a} 
HKCR\Interface\{2e3537fc-cf2f-4f56-af54-5a6a3dd375cc} 
HKCR\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} 
HKCR\Interface\{3e1656ed-f60e-4597-b6aa-b6a58e171495} 
HKCR\Interface\{3E53E2CB-86DB-4A4A-8BD9-FFEB7A64DF82} 
HKCR\Interface\{6e74766c-4d93-4cc0-96d1-47b8e07ff9ca} 
HKCR\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} 
HKCR\Interface\{90449521-d834-4703-bb4e-d3aa44042ff8} 
HKCR\Interface\{991AAC62-B100-47CE-8B75-253965244f69} 
HKCR\Interface\{a626cdbd-3d13-4f78-b819-440a28d7e8fc} 
HKCR\Interface\{B0D071A1-36B3-4757-A126-14C89C56013A} 
HKCR\Interface\{bbabdc90-f3d5-4801-863a-ee6ae529862d} 
HKCR\Interface\{cf54be1c-9359-4395-8533-1657cf209cfe} 
HKCR\Interface\{d6ff3684-ad3b-48eb-bbb4-b9e6c5a355c1} 
HKCR\Interface\{de38c398-b328-4f4c-a3ad-1b5e4ed93477} 
HKCR\Interface\{e342af55-b78a-4cd0-a2bb-da7f52d9d25e} 
HKCR\Interface\{e342af55-b78a-4cd0-a2bb-da7f52d9d25f} 
HKCR\Interface\{eb9e5c1c-b1f9-4c2b-be8a-27d6446fdaf8} 
HKCR\MyWebSearch.ChatSessionPlugin 
HKCR\MyWebSearch.ChatSessionPlugin.1 
HKCR\MyWebSearch.HTMLPanel 
HKCR\MyWebSearch.HTMLPanel.1 
HKCR\MyWebSearch.OutlookAddin 
HKCR\MyWebSearch.OutlookAddin.1 
HKCR\MyWebSearch.PseudoTransparentPlugin 
HKCR\MyWebSearch.PseudoTransparentPlugin.1 
HKCR\MyWebSearchToolBar.SettingsPlugin 
HKCR\MyWebSearchToolBar.SettingsPlugin.1 
HKCR\MyWebSearchToolBar.ToolbarPlugin 
HKCR\MyWebSearchToolBar.ToolbarPlugin.1 
HKCR\screensavercontrol.screensaverinstaller 
HKCR\screensavercontrol.screensaverinstaller 
HKCR\screensavercontrol.screensaverinstaller.1 
HKCR\screensavercontrol.screensaverinstaller.1 
HKCR\SearchSettings.BHO 
HKCR\SearchSettings.BHO.1 
HKCR\TypeLib\{07B18EA0-A523-4961-B6BB-170DE4475CCA} 
HKCR\TypeLib\{0D26BC71-A633-4E71-AD31-EADC3A1B6A3A} 
HKCR\TypeLib\{29D67D3C-509A-4544-903F-C8C1B8236554} 
HKCR\TypeLib\{3E720450-B472-4954-B7AA-33069EB53906} 
HKCR\TypeLib\{7473D290-B7BB-4F24-AE82-7E2CE94BB6A9} 
HKCR\TypeLib\{8CA01F0E-987C-49C3-B852-2F1AC4A7094C} 
HKCR\TypeLib\{8E6F1830-9607-4440-8530-13BE7C4B1D14} 
HKCR\Typelib\{B4C656C9-F2E9-4E77-B3F4-443DF2BD778F} 
HKCR\TypeLib\{C8CECDE3-1AE1-4C4A-AD82-6D5B00212144} 
HKCR\TypeLib\{D518921A-4A03-425E-9873-B9A71756821E} 
HKCR\TypeLib\{E47CAEE0-DEEA-464A-9326-3F2801535A4D} 
HKCR\TypeLib\{E79DFBC0-5697-4FBD-94E5-5B2A9C7C1612} 
HKCR\TypeLib\{F42228FB-E84E-479E-B922-FBBD096E792C} 
HKCU\Software\EoRezo 
HKCU\Software\Fun Web Products 
HKCU\Software\FunWebProducts 
HKCU\Software\ItsLabel 
HKCU\Software\MediaHoldings 
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0} 
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF1-072E-44CF-8957-5838F569A31D} 
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA1-A523-4961-B6BB-170DE4475CCA} 
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EAB-A523-4961-B6BB-170DE4475CCA} 
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} 
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8} 
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{64F56FC1-1272-44CD-BA6E-39723696E350} 
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9FF05104-B030-46FC-94B8-81276E4E27DF} 
HKCU\Software\MyWebSearch 
HKLM\SOFTWARE\Classes\CLSID\{00A6FAF1-072E-44cf-8957-5838F569A31D} 
HKLM\SOFTWARE\Classes\CLSID\{00A6FAF6-072E-44cf-8957-5838F569A31D} 
HKLM\SOFTWARE\Classes\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA} 
HKLM\SOFTWARE\Classes\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA} 
HKLM\SOFTWARE\Classes\CLSID\{07B18EAB-A523-4961-B6BB-170DE4475CCA} 
HKLM\SOFTWARE\Classes\CLSID\{0F8ECF4F-3646-4C3A-8881-8E138FFCAF70} 
HKLM\SOFTWARE\Classes\CLSID\{1E0DE227-5CE4-4ea3-AB0C-8B03E1AA76BC} 
HKLM\SOFTWARE\Classes\CLSID\{25560540-9571-4D7B-9389-0F166788785A} 
HKLM\SOFTWARE\Classes\CLSID\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8} 
HKLM\SOFTWARE\Classes\CLSID\{3E720452-B472-4954-B7AA-33069EB53906} 
HKLM\SOFTWARE\Classes\CLSID\{53CED2D0-5E9A-4761-9005-648404E6F7E5} 
HKLM\SOFTWARE\Classes\CLSID\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C} 
HKLM\Software\Classes\CLSID\{64F56FC1-1272-44CD-BA6E-39723696E350} 
HKLM\SOFTWARE\Classes\CLSID\{7473D292-B7BB-4f24-AE82-7E2CE94BB6A9} 
HKLM\SOFTWARE\Classes\CLSID\{7473D294-B7BB-4f24-AE82-7E2CE94BB6A9} 
HKLM\SOFTWARE\Classes\CLSID\{7473D296-B7BB-4f24-AE82-7E2CE94BB6A9} 
HKLM\SOFTWARE\Classes\CLSID\{84DA4FDF-A1CF-4195-8688-3E961F505983} 
HKLM\SOFTWARE\Classes\CLSID\{8E6F1832-9607-4440-8530-13BE7C4B1D14} 
HKLM\SOFTWARE\Classes\CLSID\{938AA51A-996C-4884-98CE-80DD16A5C9DA} 
HKLM\SOFTWARE\Classes\CLSID\{98D9753D-D73B-42D5-8C85-4469CDA897AB} 
HKLM\SOFTWARE\Classes\CLSID\{9FF05104-B030-46FC-94B8-81276E4E27DF} 
HKLM\SOFTWARE\Classes\CLSID\{A9571378-68A1-443d-B082-284F960C6D17} 
HKLM\SOFTWARE\Classes\CLSID\{ADB01E81-3C79-4272-A0F1-7B2BE7A782DC} 
HKLM\SOFTWARE\Classes\CLSID\{B813095C-81C0-4E40-AA14-67520372B987} 
HKLM\SOFTWARE\Classes\CLSID\{C9D7BE3E-141A-4C85-8CD6-32461F3DF2C7} 
HKLM\SOFTWARE\Classes\CLSID\{CFF4CE82-3AA2-451F-9B77-7165605FB835} 
HKLM\SOFTWARE\Classes\CLSID\{D9FFFB27-D62A-4D64-8CEC-1FF006528805} 
HKLM\SOFTWARE\Classes\CLSID\{E79DFBCA-5697-4fbd-94E5-5B2A9C7C1612} 
HKLM\Software\Classes\EoRezoBHO.EoBho 
HKLM\Software\Classes\EoRezoBHO.EoBho.1 
HKLM\Software\Classes\FunWebProducts.DataControl 
HKLM\Software\Classes\FunWebProducts.DataControl.1 
HKLM\Software\Classes\FunWebProducts.HistoryKillerScheduler 
HKLM\Software\Classes\FunWebProducts.HistoryKillerScheduler.1 
HKLM\Software\Classes\FunWebProducts.HistorySwatterControlBar 
HKLM\Software\Classes\FunWebProducts.HistorySwatterControlBar.1 
HKLM\Software\Classes\FunWebProducts.HTMLMenu 
HKLM\Software\Classes\FunWebProducts.HTMLMenu.1 
HKLM\Software\Classes\FunWebProducts.HTMLMenu.2 
HKLM\Software\Classes\FunWebProducts.IECookiesManager 
HKLM\Software\Classes\FunWebProducts.IECookiesManager.1 
HKLM\Software\Classes\FunWebProducts.KillerObjManager 
HKLM\Software\Classes\FunWebProducts.KillerObjManager.1 
HKLM\Software\Classes\FunWebProducts.PopSwatterBarButton 
HKLM\Software\Classes\FunWebProducts.PopSwatterBarButton.1 
HKLM\Software\Classes\FunWebProducts.PopSwatterSettingsControl 
HKLM\Software\Classes\FunWebProducts.PopSwatterSettingsControl.1 
HKLM\SOFTWARE\Classes\Interface\{07B18EAA-A523-4961-B6BB-170DE4475CCA} 
HKLM\SOFTWARE\Classes\Interface\{07B18EAC-A523-4961-B6BB-170DE4475CCA} 
HKLM\SOFTWARE\Classes\Interface\{3E720451-B472-4954-B7AA-33069EB53906} 
HKLM\SOFTWARE\Classes\Interface\{3E720453-B472-4954-B7AA-33069EB53906} 
HKLM\SOFTWARE\Classes\Interface\{63D0ED2B-B45B-4458-8B3B-60C69BBBD83C} 
HKLM\SOFTWARE\Classes\Interface\{63D0ED2D-B45B-4458-8B3B-60C69BBBD83C} 
HKLM\SOFTWARE\Classes\Interface\{72EE7F04-15BD-4845-A005-D6711144D86A} 
HKLM\SOFTWARE\Classes\Interface\{7473D291-B7BB-4F24-AE82-7E2CE94BB6A9} 
HKLM\SOFTWARE\Classes\Interface\{7473D293-B7BB-4F24-AE82-7E2CE94BB6A9} 
HKLM\SOFTWARE\Classes\Interface\{7473D295-B7BB-4F24-AE82-7E2CE94BB6A9} 
HKLM\SOFTWARE\Classes\Interface\{7473D297-B7BB-4F24-AE82-7E2CE94BB6A9} 
HKLM\Software\Classes\Interface\{B0D071A1-36B3-4757-A126-14C89C56013A} 
HKLM\SOFTWARE\Classes\Interface\{E79DFBC9-5697-4FBD-94E5-5B2A9C7C1612} 
HKLM\SOFTWARE\Classes\Interface\{E79DFBCB-5697-4FBD-94E5-5B2A9C7C1612} 
HKLM\SOFTWARE\Classes\Interface\{F87D7FB5-9DC5-4C8C-B998-D8DFE02E2978} 
HKLM\Software\Classes\screensavercontrol.screensaverinstaller 
HKLM\Software\Classes\screensavercontrol.screensaverinstaller.1 
HKLM\Software\Classes\SearchSettings.BHO 
HKLM\Software\Classes\SearchSettings.BHO.1 
HKLM\SOFTWARE\Classes\TypeLib\{07B18EA0-A523-4961-B6BB-170DE4475CCA} 
HKLM\SOFTWARE\Classes\TypeLib\{07B18EA0-A523-4961-B6BB-170DE4475CCA} 
HKLM\SOFTWARE\Classes\TypeLib\{0D26BC71-A633-4E71-AD31-EADC3A1B6A3A} 
HKLM\SOFTWARE\Classes\TypeLib\{0D26BC71-A633-4E71-AD31-EADC3A1B6A3A} 
HKLM\SOFTWARE\Classes\TypeLib\{29D67D3C-509A-4544-903F-C8C1B8236554} 
HKLM\SOFTWARE\Classes\TypeLib\{29D67D3C-509A-4544-903F-C8C1B8236554} 
HKLM\SOFTWARE\Classes\TypeLib\{3E720450-B472-4954-B7AA-33069EB53906} 
HKLM\SOFTWARE\Classes\TypeLib\{3E720450-B472-4954-B7AA-33069EB53906} 
HKLM\SOFTWARE\Classes\TypeLib\{7473D290-B7BB-4F24-AE82-7E2CE94BB6A9} 
HKLM\SOFTWARE\Classes\TypeLib\{7473D290-B7BB-4F24-AE82-7E2CE94BB6A9} 
HKLM\SOFTWARE\Classes\TypeLib\{8CA01F0E-987C-49C3-B852-2F1AC4A7094C} 
HKLM\SOFTWARE\Classes\TypeLib\{8CA01F0E-987C-49C3-B852-2F1AC4A7094C} 
HKLM\SOFTWARE\Classes\TypeLib\{8E6F1830-9607-4440-8530-13BE7C4B1D14} 
HKLM\SOFTWARE\Classes\TypeLib\{8E6F1830-9607-4440-8530-13BE7C4B1D14} 
HKLM\Software\Classes\Typelib\{B4C656C9-F2E9-4E77-B3F4-443DF2BD778F} 
HKLM\SOFTWARE\Classes\TypeLib\{C8CECDE3-1AE1-4C4A-AD82-6D5B00212144} 
HKLM\SOFTWARE\Classes\TypeLib\{C8CECDE3-1AE1-4C4A-AD82-6D5B00212144} 
HKLM\SOFTWARE\Classes\TypeLib\{D518921A-4A03-425E-9873-B9A71756821E} 
HKLM\SOFTWARE\Classes\TypeLib\{D518921A-4A03-425E-9873-B9A71756821E} 
HKLM\SOFTWARE\Classes\TypeLib\{E47CAEE0-DEEA-464A-9326-3F2801535A4D} 
HKLM\SOFTWARE\Classes\TypeLib\{E47CAEE0-DEEA-464A-9326-3F2801535A4D} 
HKLM\SOFTWARE\Classes\TypeLib\{E79DFBC0-5697-4FBD-94E5-5B2A9C7C1612} 
HKLM\SOFTWARE\Classes\TypeLib\{E79DFBC0-5697-4FBD-94E5-5B2A9C7C1612} 
HKLM\SOFTWARE\Classes\TypeLib\{F42228FB-E84E-479E-B922-FBBD096E792C} 
HKLM\SOFTWARE\Classes\TypeLib\{F42228FB-E84E-479E-B922-FBBD096E792C} 
HKLM\Software\Dealio 
HKLM\Software\EoRezo 
HKLM\Software\FocusInteractive 
HKLM\Software\Fun Web Products 
HKLM\Software\ItsLabel 
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59C7FC09-1C83-4648-B3E6-003D2BBC7481} 
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68AF847F-6E91-45DD-9B68-D6A12C30E5D7} 
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170B96C-28D4-4626-8358-27E6CAEEF907} 
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D1A71FA0-FF48-48DD-9B6D-7A13A3E42127} 
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DDB1968E-EAD6-40FD-8DAE-FF14757F60C7} 
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F138D901-86F0-4383-99B6-9CDD406036DA} 
HKLM\Software\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll 
HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0} 
HKLM\Software\Microsoft\Multimedia\WMPlayer\Schemes\f3pss 
HKLM\Software\Microsoft\Office\Outlook\Addins\MyWebSearch.OutlookAddin 
HKLM\Software\Microsoft\Office\Word\Addins\MyWebSearch.OutlookAddin 
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00A6FAF1-072E-44cf-8957-5838F569A31D} 
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{07B18EA1-A523-4961-B6BB-170DE4475CCA} 
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64F56FC1-1272-44CD-BA6E-39723696E350} 
HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{07B18EAB-A523-4961-B6BB-170DE4475CCA} 
HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{25560540-9571-4D7B-9389-0F166788785A} 
HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8} 
HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3E720452-B472-4954-B7AA-33069EB53906} 
HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C} 
HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7473d294-b7bb-4f24-ae82-7e2ce94bb6a9} 
HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{98D9753D-D73B-42D5-8C85-4469CDA897AB} 
HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9FF05104-B030-46FC-94B8-81276E4E27DF} 
HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{E79DFBCA-5697-4FBD-94E5-5B2A9C7C1612} 
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{0B1AAC97-8563-41D9-AE47-58E6A222F0E1} 
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{94C3BB3A-56A1-43DE-A242-8B41F46E97EF} 
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\MyWebSearch bar Uninstall 
HKLM\Software\MyWebSearch 
HKLM\Software\Search Settings 
HKLM\SYSTEM\ControlSet002\Enum\Root\LEGACY_MYWEBSEARCHSERVICE 
HKLM\SYSTEM\ControlSet002\Services\MyWebSearchService 
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MYWEBSEARCHSERVICE 
HKLM\SYSTEM\CurrentControlSet\Services\MyWebSearchService 
HKU\S-1-5-21-76024868-3490971780-2620484061-1006\Software\Eorezo 
HKU\S-1-5-21-76024868-3490971780-2620484061-1006\Software\ItsLabel 
HKU\S-1-5-21-76024868-3490971780-2620484061-1006\Software\Microsoft\Internet Explorer\Searchscopes\{56256A51-B582-467E-B8D4-7786EDA79AE0} 
HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform\FunWebProducts 
HKLM\Software\Microsoft\Windows Media\Wmsdk\Sources\F3PopularScreenSavers 
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MyWebSearch Email Plugin 
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Eoengine 
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\MyWebSearch Email Plugin 
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\MyWebSearch Plugin 
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\My Web Search Bar 
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\SearchSettings 
HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\{E312764E-7706-43F1-8DAB-FCDD2B1E416D} 
HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\{00A6FAF6-072E-44CF-8957-5838F569A31D} 
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} 
HKLM\Software\Microsoft\Internet Explorer\Toolbar\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} 
HKCR\CLSID\{E312764E-7706-43F1-8DAB-FCDD2B1E416D} 
HKLM\Software\Classes\CLSID\{E312764E-7706-43F1-8DAB-FCDD2B1E416D} 
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E312764E-7706-43F1-8DAB-FCDD2B1E416D} 
.
C:\DOCUME~1\CHOKBE~1\APPLIC~1\Dealio 
C:\DOCUME~1\CHOKBE~1\APPLIC~1\EoRezo 
C:\DOCUME~1\CHOKBE~1\APPLIC~1\ItsLabel 
C:\DOCUME~1\CHOKBE~1\APPLIC~1\Search Settings 
C:\Program Files\Dealio Toolbar 
C:\Program Files\EoRezo 
C:\Program Files\FunWebProducts 
C:\Program Files\Mozilla Firefox\extensions\search@searchsettings.com 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} 
C:\Program Files\MyWebSearch 
C:\Program Files\Search Settings 
C:\Program Files\Mozilla Firefox\Plugins\NPMyWebS.dll 
C:\Program Files\Mozilla Firefox\chrome\m3ffxtbr.jar 
C:\Program Files\Mozilla Firefox\chrome\m3ffxtbr.manifest 
C:\WINDOWS\System32\f3PSSavr.scr 
C:\WINDOWS\Installer\f57e36.msi 
C:\WINDOWS\Installer\f57e4b.msi 
C:\Program Files\Windows Live\Messenger\Riched20.dll 
C:\Program Files\Windows Live\Messenger\Msimg32.dll 
.
============== Scan additionnel ==============
.

* Mozilla FireFox Version 2.0.0.18 *

 Nom du profil: mu1lklqn.default (chokbengboune)
.
(Prefs.js) user_pref("browser.search.defaultenginename", "Yahoo"); 
(Prefs.js) user_pref("browser.search.selectedEngine", "Live Search"); 
(Prefs.js) user_pref("browser.startup.homepage", "hxxp://fr.msn.com/"); 
(Prefs.js) user_pref("browser.startup.homepage_override.mstone", "rv:1.8.1.18"); 
.
. 

* Internet Explorer Version 6.0.2900.5512 *

[HKEY_CURRENT_USER\..\Internet Explorer\Main]

Search bar: hxxp://www.google.com/ie
Search Page: hxxp://www.google.com
Start Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

Default_Page_URL: hxxp://global.acer.com
Default_Search_URL: hxxp://www.google.com/ie
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://fr.msn.com/

[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

   Tabs: hxxp://lo.st

============== Suspect (Cracks, Serials ... ) ==============

. 
C:\Documents and Settings\chokbengboune\WoW-2.3.2.7741-to-2.3.3.7799-frFR-patch.exe.part 
C:\Documents and Settings\chokbengboune\Bureau\Marvel vs Capcom 3\charsyuukenyuukenpatch3.rar 
.
===================================
.
18906 Octet(s) - C:\Ad-Report-SCAN.log 
.
20 Fichier(s) - C:\DOCUME~1\CHOKBE~1\LOCALS~1\Temp 
9 Fichier(s) - C:\WINDOWS\Temp 
.
1 Fichier(s) - C:\Program Files\Ad-remover\BACKUP
0 Fichier(s) - C:\Program Files\Ad-remover\QUARANTINE
.
Fin à: 19:08:49 | 14/07/2009
.
============== E.O.F ==============

Suchiro · Answer

je peut le faire en restant connecter ? pas besoin de me deco ?

Suchiro · Answer

Rapport AD remover (OPtion "L") : 

.
======= RAPPORT D'AD-REMOVER 1.1.4.5_O | UNIQUEMENT XP/VISTA/SEVEN =======
.
Mit à jour par C_XX le 24/06/2009 à 7:10 PM
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Lancé à: 20:17:03, 16/07/2009 | Mode Normal | Option: CLEAN
Exécuté de: C:\Program Files\Ad-remover\
Système d'exploitation: Microsoft® Windows XP™  Service Pack 3 v5.1.2600
Nom du PC: ACER-755E621E64 | Utilisateur actuel: chokbengboune
.
Administrateur: Administrateur 
N'est pas administrateur: ASPNET 
Administrateur: chokbengboune 
N'est pas administrateur: HelpAssistant *Desactive* 
N'est pas administrateur: Invité *Desactive* 
N'est pas administrateur: SUPPORT_388945a0 *Desactive* 
. 
============== ÉLÉMENT(S) NEUTRALISÉ(S) ============== 
.
Service: "MyWebSearchService"
.
HKCR\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239}
HKCR\CLSID\{64F56FC1-1272-44CD-BA6E-39723696E350}
HKCR\CLSID\{9afb8248-617f-460d-9366-d71cdeda3179}
HKCR\EoRezoBHO.EoBho
HKCR\EoRezoBHO.EoBho.1
HKCR\FunWebProducts.DataControl
HKCR\FunWebProducts.DataControl.1
HKCR\FunWebProducts.HistoryKillerScheduler
HKCR\FunWebProducts.HistoryKillerScheduler.1
HKCR\FunWebProducts.HistorySwatterControlBar
HKCR\FunWebProducts.HistorySwatterControlBar.1
HKCR\FunWebProducts.HTMLMenu
HKCR\FunWebProducts.HTMLMenu.1
HKCR\FunWebProducts.HTMLMenu.2
HKCR\FunWebProducts.IECookiesManager
HKCR\FunWebProducts.IECookiesManager.1
HKCR\FunWebProducts.KillerObjManager
HKCR\FunWebProducts.KillerObjManager.1
HKCR\FunWebProducts.PopSwatterBarButton
HKCR\FunWebProducts.PopSwatterBarButton.1
HKCR\FunWebProducts.PopSwatterSettingsControl
HKCR\FunWebProducts.PopSwatterSettingsControl.1
HKCR\Interface\{1093995a-ba37-41d2-836e-091067c4ad17}
HKCR\Interface\{120927bf-1700-43bc-810f-fab92549b390}
HKCR\Interface\{17DE5E5E-BFE3-4E83-8E1F-8755795359EC}
HKCR\Interface\{1f52a5fa-a705-4415-b975-88503b291728}
HKCR\Interface\{247a115f-06c2-4fb3-967d-2d62d3cf4f0a}
HKCR\Interface\{2e3537fc-cf2f-4f56-af54-5a6a3dd375cc}
HKCR\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc}
HKCR\Interface\{3e1656ed-f60e-4597-b6aa-b6a58e171495}
HKCR\Interface\{3E53E2CB-86DB-4A4A-8BD9-FFEB7A64DF82}
HKCR\Interface\{6e74766c-4d93-4cc0-96d1-47b8e07ff9ca}
HKCR\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff}
HKCR\Interface\{90449521-d834-4703-bb4e-d3aa44042ff8}
HKCR\Interface\{991AAC62-B100-47CE-8B75-253965244f69}
HKCR\Interface\{a626cdbd-3d13-4f78-b819-440a28d7e8fc}
HKCR\Interface\{B0D071A1-36B3-4757-A126-14C89C56013A}
HKCR\Interface\{bbabdc90-f3d5-4801-863a-ee6ae529862d}
HKCR\Interface\{cf54be1c-9359-4395-8533-1657cf209cfe}
HKCR\Interface\{d6ff3684-ad3b-48eb-bbb4-b9e6c5a355c1}
HKCR\Interface\{de38c398-b328-4f4c-a3ad-1b5e4ed93477}
HKCR\Interface\{e342af55-b78a-4cd0-a2bb-da7f52d9d25e}
HKCR\Interface\{e342af55-b78a-4cd0-a2bb-da7f52d9d25f}
HKCR\Interface\{eb9e5c1c-b1f9-4c2b-be8a-27d6446fdaf8}
HKCR\MyWebSearch.ChatSessionPlugin
HKCR\MyWebSearch.ChatSessionPlugin.1
HKCR\MyWebSearch.HTMLPanel
HKCR\MyWebSearch.HTMLPanel.1
HKCR\MyWebSearch.OutlookAddin
HKCR\MyWebSearch.OutlookAddin.1
HKCR\MyWebSearch.PseudoTransparentPlugin
HKCR\MyWebSearch.PseudoTransparentPlugin.1
HKCR\MyWebSearchToolBar.SettingsPlugin
HKCR\MyWebSearchToolBar.SettingsPlugin.1
HKCR\MyWebSearchToolBar.ToolbarPlugin
HKCR\MyWebSearchToolBar.ToolbarPlugin.1
HKCR\screensavercontrol.screensaverinstaller
HKCR\screensavercontrol.screensaverinstaller.1
HKCR\SearchSettings.BHO
HKCR\SearchSettings.BHO.1
HKCR\TypeLib\{07B18EA0-A523-4961-B6BB-170DE4475CCA}
HKCR\TypeLib\{0D26BC71-A633-4E71-AD31-EADC3A1B6A3A}
HKCR\TypeLib\{29D67D3C-509A-4544-903F-C8C1B8236554}
HKCR\TypeLib\{3E720450-B472-4954-B7AA-33069EB53906}
HKCR\TypeLib\{7473D290-B7BB-4F24-AE82-7E2CE94BB6A9}
HKCR\TypeLib\{8CA01F0E-987C-49C3-B852-2F1AC4A7094C}
HKCR\TypeLib\{8E6F1830-9607-4440-8530-13BE7C4B1D14}
HKCR\Typelib\{B4C656C9-F2E9-4E77-B3F4-443DF2BD778F}
HKCR\TypeLib\{C8CECDE3-1AE1-4C4A-AD82-6D5B00212144}
HKCR\TypeLib\{D518921A-4A03-425E-9873-B9A71756821E}
HKCR\TypeLib\{E47CAEE0-DEEA-464A-9326-3F2801535A4D}
HKCR\TypeLib\{E79DFBC0-5697-4FBD-94E5-5B2A9C7C1612}
HKCR\TypeLib\{F42228FB-E84E-479E-B922-FBBD096E792C}
HKCU\Software\EoRezo
HKCU\Software\Fun Web Products
HKCU\Software\FunWebProducts
HKCU\Software\ItsLabel
HKCU\Software\MediaHoldings
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF1-072E-44CF-8957-5838F569A31D}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{64F56FC1-1272-44CD-BA6E-39723696E350}
HKCU\Software\MyWebSearch
HKLM\SOFTWARE\Classes\CLSID\{00A6FAF1-072E-44cf-8957-5838F569A31D}
HKLM\SOFTWARE\Classes\CLSID\{00A6FAF6-072E-44cf-8957-5838F569A31D}
HKLM\SOFTWARE\Classes\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
HKLM\SOFTWARE\Classes\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
HKLM\SOFTWARE\Classes\CLSID\{07B18EAB-A523-4961-B6BB-170DE4475CCA}
HKLM\SOFTWARE\Classes\CLSID\{0F8ECF4F-3646-4C3A-8881-8E138FFCAF70}
HKLM\SOFTWARE\Classes\CLSID\{1E0DE227-5CE4-4ea3-AB0C-8B03E1AA76BC}
HKLM\SOFTWARE\Classes\CLSID\{25560540-9571-4D7B-9389-0F166788785A}
HKLM\SOFTWARE\Classes\CLSID\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8}
HKLM\SOFTWARE\Classes\CLSID\{3E720452-B472-4954-B7AA-33069EB53906}
HKLM\SOFTWARE\Classes\CLSID\{53CED2D0-5E9A-4761-9005-648404E6F7E5}
HKLM\SOFTWARE\Classes\CLSID\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C}
HKLM\SOFTWARE\Classes\CLSID\{7473D292-B7BB-4f24-AE82-7E2CE94BB6A9}
HKLM\SOFTWARE\Classes\CLSID\{7473D294-B7BB-4f24-AE82-7E2CE94BB6A9}
HKLM\SOFTWARE\Classes\CLSID\{7473D296-B7BB-4f24-AE82-7E2CE94BB6A9}
HKLM\SOFTWARE\Classes\CLSID\{84DA4FDF-A1CF-4195-8688-3E961F505983}
HKLM\SOFTWARE\Classes\CLSID\{8E6F1832-9607-4440-8530-13BE7C4B1D14}
HKLM\SOFTWARE\Classes\CLSID\{938AA51A-996C-4884-98CE-80DD16A5C9DA}
HKLM\SOFTWARE\Classes\CLSID\{98D9753D-D73B-42D5-8C85-4469CDA897AB}
HKLM\SOFTWARE\Classes\CLSID\{9FF05104-B030-46FC-94B8-81276E4E27DF}
HKLM\SOFTWARE\Classes\CLSID\{A9571378-68A1-443d-B082-284F960C6D17}
HKLM\SOFTWARE\Classes\CLSID\{ADB01E81-3C79-4272-A0F1-7B2BE7A782DC}
HKLM\SOFTWARE\Classes\CLSID\{B813095C-81C0-4E40-AA14-67520372B987}
HKLM\SOFTWARE\Classes\CLSID\{C9D7BE3E-141A-4C85-8CD6-32461F3DF2C7}
HKLM\SOFTWARE\Classes\CLSID\{CFF4CE82-3AA2-451F-9B77-7165605FB835}
HKLM\SOFTWARE\Classes\CLSID\{D9FFFB27-D62A-4D64-8CEC-1FF006528805}
HKLM\SOFTWARE\Classes\CLSID\{E79DFBCA-5697-4fbd-94E5-5B2A9C7C1612}
HKLM\SOFTWARE\Classes\Interface\{07B18EAA-A523-4961-B6BB-170DE4475CCA}
HKLM\SOFTWARE\Classes\Interface\{07B18EAC-A523-4961-B6BB-170DE4475CCA}
HKLM\SOFTWARE\Classes\Interface\{3E720451-B472-4954-B7AA-33069EB53906}
HKLM\SOFTWARE\Classes\Interface\{3E720453-B472-4954-B7AA-33069EB53906}
HKLM\SOFTWARE\Classes\Interface\{63D0ED2B-B45B-4458-8B3B-60C69BBBD83C}
HKLM\SOFTWARE\Classes\Interface\{63D0ED2D-B45B-4458-8B3B-60C69BBBD83C}
HKLM\SOFTWARE\Classes\Interface\{72EE7F04-15BD-4845-A005-D6711144D86A}
HKLM\SOFTWARE\Classes\Interface\{7473D291-B7BB-4F24-AE82-7E2CE94BB6A9}
HKLM\SOFTWARE\Classes\Interface\{7473D293-B7BB-4F24-AE82-7E2CE94BB6A9}
HKLM\SOFTWARE\Classes\Interface\{7473D295-B7BB-4F24-AE82-7E2CE94BB6A9}
HKLM\SOFTWARE\Classes\Interface\{7473D297-B7BB-4F24-AE82-7E2CE94BB6A9}
HKLM\SOFTWARE\Classes\Interface\{E79DFBC9-5697-4FBD-94E5-5B2A9C7C1612}
HKLM\SOFTWARE\Classes\Interface\{E79DFBCB-5697-4FBD-94E5-5B2A9C7C1612}
HKLM\SOFTWARE\Classes\Interface\{F87D7FB5-9DC5-4C8C-B998-D8DFE02E2978}
HKLM\Software\Dealio
HKLM\Software\EoRezo
HKLM\Software\FocusInteractive
HKLM\Software\Fun Web Products
HKLM\Software\ItsLabel
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59C7FC09-1C83-4648-B3E6-003D2BBC7481}
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68AF847F-6E91-45DD-9B68-D6A12C30E5D7}
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170B96C-28D4-4626-8358-27E6CAEEF907}
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D1A71FA0-FF48-48DD-9B6D-7A13A3E42127}
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DDB1968E-EAD6-40FD-8DAE-FF14757F60C7}
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F138D901-86F0-4383-99B6-9CDD406036DA}
HKLM\Software\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll
HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0}
HKLM\Software\Microsoft\Multimedia\WMPlayer\Schemes\f3pss
HKLM\Software\Microsoft\Office\Outlook\Addins\MyWebSearch.OutlookAddin
HKLM\Software\Microsoft\Office\Word\Addins\MyWebSearch.OutlookAddin
HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\MyWebSearch bar Uninstall
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00A6FAF1-072E-44cf-8957-5838F569A31D}
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64F56FC1-1272-44CD-BA6E-39723696E350}
HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{07B18EAB-A523-4961-B6BB-170DE4475CCA}
HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{25560540-9571-4D7B-9389-0F166788785A}
HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8}
HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3E720452-B472-4954-B7AA-33069EB53906}
HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C}
HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7473d294-b7bb-4f24-ae82-7e2ce94bb6a9}
HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{98D9753D-D73B-42D5-8C85-4469CDA897AB}
HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9FF05104-B030-46FC-94B8-81276E4E27DF}
HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{E79DFBCA-5697-4FBD-94E5-5B2A9C7C1612}
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{0B1AAC97-8563-41D9-AE47-58E6A222F0E1}
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{94C3BB3A-56A1-43DE-A242-8B41F46E97EF}
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\MyWebSearch bar Uninstall
HKLM\Software\MyWebSearch
HKLM\Software\Search Settings
HKLM\SYSTEM\ControlSet002\Enum\Root\LEGACY_MYWEBSEARCHSERVICE
HKLM\SYSTEM\ControlSet002\Services\MyWebSearchService
HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform\FunWebProducts
HKLM\Software\Microsoft\Windows Media\Wmsdk\Sources\F3PopularScreenSavers
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MyWebSearch Email Plugin
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Eoengine
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\MyWebSearch Email Plugin
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\MyWebSearch Plugin
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\My Web Search Bar
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\SearchSettings
HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\{00A6FAF6-072E-44CF-8957-5838F569A31D}
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F}
HKLM\Software\Microsoft\Internet Explorer\Toolbar\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}
HKCR\CLSID\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
.
C:\DOCUME~1\CHOKBE~1\APPLIC~1\Dealioes 
C:\DOCUME~1\CHOKBE~1\APPLIC~1\Dealio	emp 
C:\DOCUME~1\CHOKBE~1\APPLIC~1\Dealioes\widgets.xml 
C:\DOCUME~1\CHOKBE~1\APPLIC~1\Dealio	emp\http___www_dealio_com_rss_coupons-deals_dotd_.xml 
C:\DOCUME~1\CHOKBE~1\APPLIC~1\Dealio 
C:\DOCUME~1\CHOKBE~1\APPLIC~1\EoRezo\cache 
C:\DOCUME~1\CHOKBE~1\APPLIC~1\EoRezo\cmhost.cyp 
C:\DOCUME~1\CHOKBE~1\APPLIC~1\EoRezo\ConfMedia.cyp 
C:\DOCUME~1\CHOKBE~1\APPLIC~1\EoRezo\db 
C:\DOCUME~1\CHOKBE~1\APPLIC~1\EoRezo\eoDesktop 
C:\DOCUME~1\CHOKBE~1\APPLIC~1\EoRezo\host.cyp 
C:\DOCUME~1\CHOKBE~1\APPLIC~1\EoRezo\user.cyp 
C:\DOCUME~1\CHOKBE~1\APPLIC~1\EoRezo\db\cat.cyp 
C:\DOCUME~1\CHOKBE~1\APPLIC~1\EoRezo\eoDesktop\config.xml 
C:\DOCUME~1\CHOKBE~1\APPLIC~1\EoRezo\eoDesktop\eoDesktop.html 
C:\DOCUME~1\CHOKBE~1\APPLIC~1\EoRezo\eoDesktop\userConfig.xml 
C:\DOCUME~1\CHOKBE~1\APPLIC~1\EoRezo 
C:\DOCUME~1\CHOKBE~1\APPLIC~1\ItsLabel\ItsTV 
C:\DOCUME~1\CHOKBE~1\APPLIC~1\ItsLabel\ItsTV\itsTV.xml 
C:\DOCUME~1\CHOKBE~1\APPLIC~1\ItsLabel 
C:\DOCUME~1\CHOKBE~1\APPLIC~1\Mozilla\Firefox\Profiles\mu1lklqn.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\chrome 
C:\DOCUME~1\CHOKBE~1\APPLIC~1\Mozilla\Firefox\Profiles\mu1lklqn.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\chrome.manifest.dev 
C:\DOCUME~1\CHOKBE~1\APPLIC~1\Mozilla\Firefox\Profiles\mu1lklqn.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\defaults 
C:\DOCUME~1\CHOKBE~1\APPLIC~1\Mozilla\Firefox\Profiles\mu1lklqn.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\install.rdf 
C:\DOCUME~1\CHOKBE~1\APPLIC~1\Mozilla\Firefox\Profiles\mu1lklqn.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\install.rdf.bak 
C:\DOCUME~1\CHOKBE~1\APPLIC~1\Mozilla\Firefox\Profiles\mu1lklqn.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\META-INF 
C:\DOCUME~1\CHOKBE~1\APPLIC~1\Mozilla\Firefox\Profiles\mu1lklqn.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\chrome\ajtoolbar.jar 
C:\DOCUME~1\CHOKBE~1\APPLIC~1\Mozilla\Firefox\Profiles\mu1lklqn.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\defaults\preferences 
C:\DOCUME~1\CHOKBE~1\APPLIC~1\Mozilla\Firefox\Profiles\mu1lklqn.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\defaults\preferences\ask.gif 
C:\DOCUME~1\CHOKBE~1\APPLIC~1\Mozilla\Firefox\Profiles\mu1lklqn.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\defaults\preferences\config.dat 
C:\DOCUME~1\CHOKBE~1\APPLIC~1\Mozilla\Firefox\Profiles\mu1lklqn.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\defaults\preferences\config.dat.bak 
C:\DOCUME~1\CHOKBE~1\APPLIC~1\Mozilla\Firefox\Profiles\mu1lklqn.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\defaults\preferences\contents.rdf 
C:\DOCUME~1\CHOKBE~1\APPLIC~1\Mozilla\Firefox\Profiles\mu1lklqn.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\defaults\preferences\snipit.js 
C:\DOCUME~1\CHOKBE~1\APPLIC~1\Mozilla\Firefox\Profiles\mu1lklqn.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\META-INF\manifest.mf 
C:\DOCUME~1\CHOKBE~1\APPLIC~1\Mozilla\Firefox\Profiles\mu1lklqn.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\META-INF\zigbert.rsa 
C:\DOCUME~1\CHOKBE~1\APPLIC~1\Mozilla\Firefox\Profiles\mu1lklqn.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\META-INF\zigbert.sf 
C:\DOCUME~1\CHOKBE~1\APPLIC~1\Mozilla\Firefox\Profiles\mu1lklqn.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D} 
C:\DOCUME~1\CHOKBE~1\APPLIC~1\Search Settings\kb128 
C:\DOCUME~1\CHOKBE~1\APPLIC~1\Search Settings\kb128	emp 
C:\DOCUME~1\CHOKBE~1\APPLIC~1\Search Settings\kb128	emp\ws-14438.log 
C:\DOCUME~1\CHOKBE~1\APPLIC~1\Search Settings\kb128	emp\ws-14439.log 
C:\DOCUME~1\CHOKBE~1\APPLIC~1\Search Settings\kb128	emp\ws-14440.log 
C:\DOCUME~1\CHOKBE~1\APPLIC~1\Search Settings\kb128	emp\ws-14441.log 
C:\DOCUME~1\CHOKBE~1\APPLIC~1\Search Settings 
C:\Program Files\AskBarDis\bar 
C:\Program Files\AskBarDis\PopSwatter 
C:\Program Files\AskBarDis\unins000.dat 
C:\Program Files\AskBarDis\bar\Cache 
C:\Program Files\AskBarDis\bar\History 
C:\Program Files\AskBarDis\bar\Settings 
C:\Program Files\AskBarDis\bar\Cache\000A5AB2 
C:\Program Files\AskBarDis\bar\Cache\000A5CE4 
C:\Program Files\AskBarDis\bar\Cache\000A5E2C.bin 
C:\Program Files\AskBarDis\bar\Cache\000A60DC.bin 
C:\Program Files\AskBarDis\bar\Cache\000A61D6.bin 
C:\Program Files\AskBarDis\bar\Cache\000A62DF.bin 
C:\Program Files\AskBarDis\bar\Cache\000A63E9.bin 
C:\Program Files\AskBarDis\bar\Cache\000A64E3.bin 
C:\Program Files\AskBarDis\bar\History\search 
C:\Program Files\AskBarDis\bar\Settings\config.dat 
C:\Program Files\AskBarDis\bar\Settings\config.dat.bak 
C:\Program Files\AskBarDis\bar\Settings\prevcfg.htm 
C:\Program Files\AskBarDis\PopSwatter\History 
C:\Program Files\AskBarDis\PopSwatter\History\allowed 
C:\Program Files\AskBarDis\PopSwatter\History
otallow 
C:\Program Files\AskBarDis 
C:\Program Files\Dealio Toolbar\config.ini 
C:\Program Files\Dealio Toolbar\DealioToolbarIE.dll 
C:\Program Files\Dealio Toolbar\Res 
C:\Program Files\Dealio Toolbar\SearchSettingsKit.exe 
C:\Program Files\Dealio Toolbar\WidgiHelper.exe 
C:\Program Files\Dealio Toolbar\Res\amazon.gif 
C:\Program Files\Dealio Toolbar\Res\apple.gif 
C:\Program Files\Dealio Toolbar\Res\barnes.gif 
C:\Program Files\Dealio Toolbar\Res\bestbuy.gif 
C:\Program Files\Dealio Toolbar\Res\dealio_logo.gif 
C:\Program Files\Dealio Toolbar\Res\dealio_logo_hover.gif 
C:\Program Files\Dealio Toolbar\Res\ebay.gif 
C:\Program Files\Dealio Toolbar\Res\icon_settings.gif 
C:\Program Files\Dealio Toolbar\Res\macys.gif 
C:\Program Files\Dealio Toolbar\Res
ewegg.gif 
C:\Program Files\Dealio Toolbar\Res\overstock.gif 
C:\Program Files\Dealio Toolbar\Res\search-button-hover.gif 
C:\Program Files\Dealio Toolbar\Res\search-button.gif 
C:\Program Files\Dealio Toolbar\Res\search-chevron-hover.gif 
C:\Program Files\Dealio Toolbar\Res\search-chevron.gif 
C:\Program Files\Dealio Toolbar\Res\search_amazon.gif 
C:\Program Files\Dealio Toolbar\Res\search_dealio.gif 
C:\Program Files\Dealio Toolbar\Res\search_ebay.gif 
C:\Program Files\Dealio Toolbar\Res\search_yahoo.gif 
C:\Program Files\Dealio Toolbar\Res\separator.gif 
C:\Program Files\Dealio Toolbar\Res	arget.gif 
C:\Program Files\Dealio Toolbar\Res\walmart.gif 
C:\Program Files\Dealio Toolbar\Res\widgets.xml 
C:\Program Files\Dealio Toolbar 
C:\Program Files\EoRezo\EoAdv 
C:\Program Files\EoRezo\EoAdv\eoAdv.url 
C:\Program Files\EoRezo\EoAdv	mp 
C:\Program Files\EoRezo\EoAdv	mp\eoRezoBho.dll.2103 
C:\Program Files\EoRezo 
C:\Program Files\FunWebProducts\ScreenSaver 
C:\Program Files\FunWebProducts\Shared 
C:\Program Files\FunWebProducts\ScreenSaver\Images 
C:\Program Files\FunWebProducts\ScreenSaver\Images\0009EED8.urr 
C:\Program Files\FunWebProducts\Shared\Cache 
C:\Program Files\FunWebProducts\Shared\Cache\CursorManiaBtn.html 
C:\Program Files\FunWebProducts\Shared\Cache\MyFunCardsIMBtn.html 
C:\Program Files\FunWebProducts\Shared\Cache\SmileyCentralBtn.html 
C:\Program Files\FunWebProducts\Shared\Cache\WebfettiBtn-new.htmlx 
C:\Program Files\FunWebProducts\Shared\Cache\WebfettiBtn.html 
C:\Program Files\FunWebProducts 
C:\Program Files\Mozilla Firefox\extensions\search@searchsettings.com\CHROME 
C:\Program Files\Mozilla Firefox\extensions\search@searchsettings.com\chrome.manifest 
C:\Program Files\Mozilla Firefox\extensions\search@searchsettings.com\COMPONENTS 
C:\Program Files\Mozilla Firefox\extensions\search@searchsettings.com\install.rdf 
C:\Program Files\Mozilla Firefox\extensions\search@searchsettings.com\CHROME\CONTENT 
C:\Program Files\Mozilla Firefox\extensions\search@searchsettings.com\CHROME\LOCALE 
C:\Program Files\Mozilla Firefox\extensions\search@searchsettings.com\CHROME\SKIN 
C:\Program Files\Mozilla Firefox\extensions\search@searchsettings.com\CHROME\CONTENT\DStringsUtils.js 
C:\Program Files\Mozilla Firefox\extensions\search@searchsettings.com\CHROME\CONTENT\searchsettingsplugin.js 
C:\Program Files\Mozilla Firefox\extensions\search@searchsettings.com\CHROME\CONTENT\searchsettingsplugin.xul 
C:\Program Files\Mozilla Firefox\extensions\search@searchsettings.com\CHROME\LOCALE\EN-US 
C:\Program Files\Mozilla Firefox\extensions\search@searchsettings.com\CHROME\LOCALE\EN-US\searchsettingsplugin.dtd 
C:\Program Files\Mozilla Firefox\extensions\search@searchsettings.com\CHROME\LOCALE\EN-US\searchsettingsplugin.properties 
C:\Program Files\Mozilla Firefox\extensions\search@searchsettings.com\COMPONENTS\IFBHOSearch.xpt 
C:\Program Files\Mozilla Firefox\extensions\search@searchsettings.com\COMPONENTS\IFBHOSearchHelperEngine.xpt 
C:\Program Files\Mozilla Firefox\extensions\search@searchsettings.com\COMPONENTS\IFHelperPreferences.xpt 
C:\Program Files\Mozilla Firefox\extensions\search@searchsettings.com\COMPONENTS\SearchSettingsFF.dll 
C:\Program Files\Mozilla Firefox\extensions\search@searchsettings.com 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\chrome 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\chrome.manifest 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\components 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\install.rdf 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\chrome\content 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\chrome\locale 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\chrome\skin 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\chrome\content\chevron.js 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\chrome\content\chevron.xul 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\chrome\content\login.js 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\chrome\content\login.xul 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\chrome\content\parser.js 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\chrome\content\RssTickerWidget.js 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\chrome\content\searchbox.js 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\chrome\content\searchbox.xul 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\chrome\content\widgichevron.js 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\chrome\content\widgicomm.js 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\chrome\content\widgihandling.js 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\chrome\content\widgilisteners.js 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\chrome\content\widgitoolbarplugin.js 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\chrome\content\widgitoolbarplugin.xul 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\chrome\content\widgiui.js 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\chrome\locale\EN-US 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\chrome\locale\EN-US\searchbox.dtd 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\chrome\locale\EN-US\widgitoolbarplugin.dtd 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\chrome\locale\EN-US\widgitoolbarplugin.properties 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\chrome\locale\EN-US\yahoo-search.gif 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\chrome\skin\amazon.gif 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\chrome\skin\apple.gif 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\chrome\skin\barnes.gif 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\chrome\skin\bestbuy.gif 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\chrome\skin\chevron.gif 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\chrome\skin\dealio_logo.gif 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\chrome\skin\dealio_logo_hover.gif 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\chrome\skin\ebay.gif 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\chrome\skin\icon_settings.gif 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\chrome\skin\macys.gif 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\chrome\skin
ewegg.gif 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\chrome\skin\overstock.gif 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\chrome\skin\search-button-hover.gif 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\chrome\skin\search-button.gif 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\chrome\skin\search-chevron-hover.gif 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\chrome\skin\search-chevron.gif 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\chrome\skin\searchbox.css 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\chrome\skin\search_amazon.gif 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\chrome\skin\search_dealio.gif 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\chrome\skin\search_ebay.gif 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\chrome\skin\search_yahoo.gif 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\chrome\skin\separator.gif 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\chrome\skin	arget.gif 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\chrome\skin\walmart.gif 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\chrome\skin\widgitoolbarplugin.css 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\components\config.ini 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\components\DealioToolbarFF.dll 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\components\IFBHOHelperWidgiToolbar.xpt 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\components\IFBHOWidgiToolbar.xpt 
C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} 
C:\Program Files\MyWebSearch\bar 
C:\Program Files\MyWebSearch\bar\1.bin 
C:\Program Files\MyWebSearch\bar\2.bin 
C:\Program Files\MyWebSearch\bar\Avatar 
C:\Program Files\MyWebSearch\bar\Cache 
C:\Program Files\MyWebSearch\bar\Game 
C:\Program Files\MyWebSearch\bar\History 
C:\Program Files\MyWebSearch\bar\icons 
C:\Program Files\MyWebSearch\bar\Message 
C:\Program Files\MyWebSearch\bar\Notifier 
C:\Program Files\MyWebSearch\bar\Settings 
C:\Program Files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL 
C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL 
C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE 
C:\Program Files\MyWebSearch\bar\1.bin\MWSOEPLG.DLL 
C:\Program Files\MyWebSearch\bar\1.bin\MWSOESTB.DLL 
C:\Program Files\MyWebSearch\bar\2.bin\F3BKGERR.JPG 
C:\Program Files\MyWebSearch\bar\2.bin\F3CJPEG.DLL 
C:\Program Files\MyWebSearch\bar\2.bin\F3DTACTL.DLL 
C:\Program Files\MyWebSearch\bar\2.bin\F3HISTSW.DLL 
C:\Program Files\MyWebSearch\bar\2.bin\F3HKSTUB.DLL 
C:\Program Files\MyWebSearch\bar\2.bin\F3HTMLMU.DLL 
C:\Program Files\MyWebSearch\bar\2.bin\F3HTTPCT.DLL 
C:\Program Files\MyWebSearch\bar\2.bin\F3POPSWT.DLL 
C:\Program Files\MyWebSearch\bar\2.bin\F3PSSAVR.SCR 
C:\Program Files\MyWebSearch\bar\2.bin\F3REGHK.DLL 
C:\Program Files\MyWebSearch\bar\2.bin\F3REPROX.DLL 
C:\Program Files\MyWebSearch\bar\2.bin\F3RESTUB.DLL 
C:\Program Files\MyWebSearch\bar\2.bin\F3SCHMON.EXE 
C:\Program Files\MyWebSearch\bar\2.bin\F3SCRCTR.DLL 
C:\Program Files\MyWebSearch\bar\2.bin\F3SPACER.WMV 
C:\Program Files\MyWebSearch\bar\2.bin\F3WALLPP.DAT 
C:\Program Files\MyWebSearch\bar\2.bin\F3WPHOOK.DLL 
C:\Program Files\MyWebSearch\bar\2.bin\FWPBUDDY.PNG 
C:\Program Files\MyWebSearch\bar\2.bin\M3FFXTBR.JAR 
C:\Program Files\MyWebSearch\bar\2.bin\M3FFXTBR.MANIFEST 
C:\Program Files\MyWebSearch\bar\2.bin\M3HIGHIN.EXE 
C:\Program Files\MyWebSearch\bar\2.bin\M3HTML.DLL 
C:\Program Files\MyWebSearch\bar\2.bin\M3IDLE.DLL 
C:\Program Files\MyWebSearch\bar\2.bin\M3IMPIPE.EXE 
C:\Program Files\MyWebSearch\bar\2.bin\M3MEDINT.EXE 
C:\Program Files\MyWebSearch\bar\2.bin\M3MSG.DLL 
C:\Program Files\MyWebSearch\bar\2.bin\M3NTSTBR.JAR 
C:\Program Files\MyWebSearch\bar\2.bin\M3NTSTBR.MANIFEST 
C:\Program Files\MyWebSearch\bar\2.bin\M3OUTLCN.DLL 
C:\Program Files\MyWebSearch\bar\2.bin\M3PLUGIN.DLL 
C:\Program Files\MyWebSearch\bar\2.bin\M3SKIN.DLL 
C:\Program Files\MyWebSearch\bar\2.bin\M3SKPLAY.EXE 
C:\Program Files\MyWebSearch\bar\2.bin\M3SLSRCH.EXE 
C:\Program Files\MyWebSearch\bar\2.bin\M3SRCHMN.EXE 
C:\Program Files\MyWebSearch\bar\2.bin\MWSBAR.DLL 
C:\Program Files\MyWebSearch\bar\2.bin\MWSOEMON.EXE 
C:\Program Files\MyWebSearch\bar\2.bin\MWSOEPLG.DLL 
C:\Program Files\MyWebSearch\bar\2.bin\MWSOESTB.DLL 
C:\Program Files\MyWebSearch\bar\2.bin\MWSSRCAS.DLL 
C:\Program Files\MyWebSearch\bar\2.bin\MWSSVC.EXE 
C:\Program Files\MyWebSearch\bar\2.bin\NPMYWEBS.DLL 
C:\Program Files\MyWebSearch\bar\Avatar\COMMON.F3S 
C:\Program Files\MyWebSearch\bar\Cache\00026B43 
C:\Program Files\MyWebSearch\bar\Cache\0002BEC2 
C:\Program Files\MyWebSearch\bar\Cache\0004B3FA 
C:\Program Files\MyWebSearch\bar\Cache\00070E84 
C:\Program Files\MyWebSearch\bar\Cache\00085443 
C:\Program Files\MyWebSearch\bar\Cache\000855CA.bin 
C:\Program Files\MyWebSearch\bar\Cache\00085731.bin 
C:\Program Files\MyWebSearch\bar\Cache\0008583B.bin 
C:\Program Files\MyWebSearch\bar\Cache\00085935.bin 
C:\Program Files\MyWebSearch\bar\Cache\00085A2F 
C:\Program Files\MyWebSearch\bar\Cache\0009DF48.bin 
C:\Program Files\MyWebSearch\bar\Cache\0009E052.bin 
C:\Program Files\MyWebSearch\bar\Cache\0009E274.bin 
C:\Program Files\MyWebSearch\bar\Cache\0009E3EB.bin 
C:\Program Files\MyWebSearch\bar\Cache\000DDB2E.bin 
C:\Program Files\MyWebSearch\bar\Cache\files.ini 
C:\Program Files\MyWebSearch\bar\Game\CHECKERS.F3S 
C:\Program Files\MyWebSearch\bar\Game\CHESS.F3S 
C:\Program Files\MyWebSearch\bar\Game\REVERSI.F3S 
C:\Program Files\MyWebSearch\bar\History\search3 
C:\Program Files\MyWebSearch\bar\icons\CM.ICO 
C:\Program Files\MyWebSearch\bar\icons\MFC.ICO 
C:\Program Files\MyWebSearch\bar\icons\PSS.ICO 
C:\Program Files\MyWebSearch\bar\icons\SMILEY.ICO 
C:\Program Files\MyWebSearch\bar\icons\WB.ICO 
C:\Program Files\MyWebSearch\bar\icons\ZWINKY.ICO 
C:\Program Files\MyWebSearch\bar\Message\COMMON.F3S 
C:\Program Files\MyWebSearch\bar\Notifier\COMMON.F3S 
C:\Program Files\MyWebSearch\bar\Notifier\DOG.F3S 
C:\Program Files\MyWebSearch\bar\Notifier\FISH.F3S 
C:\Program Files\MyWebSearch\bar\Notifier\KUNGFU.F3S 
C:\Program Files\MyWebSearch\bar\Notifier\LIFEGARD.F3S 
C:\Program Files\MyWebSearch\bar\Notifier\MAID.F3S 
C:\Program Files\MyWebSearch\bar\Notifier\MAILBOX.F3S 
C:\Program Files\MyWebSearch\bar\Notifier\OPERA.F3S 
C:\Program Files\MyWebSearch\bar\Notifier\ROBOT.F3S 
C:\Program Files\MyWebSearch\bar\Notifier\SEDUCT.F3S 
C:\Program Files\MyWebSearch\bar\Notifier\SURFER.F3S 
C:\Program Files\MyWebSearch\bar\Settings\prevcfg2.htm 
C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat 
C:\Program Files\MyWebSearch 
C:\Program Files\Search Settings\kb128 
C:\Program Files\Search Settings\SearchSettings.exe 
C:\Program Files\Search Settings\kb128es 
C:\Program Files\Search Settings\kb128\SearchSettings.dll 
C:\Program Files\Search Settings\kb128\SearchSettingsRes409.dll 
C:\Program Files\Search Settings\kb128	emp 
C:\Program Files\Search Settings 
C:\Program Files\Mozilla Firefox\Plugins\NPMyWebS.dll 
C:\Program Files\Mozilla Firefox\chrome\m3ffxtbr.jar 
C:\Program Files\Mozilla Firefox\chrome\m3ffxtbr.manifest 
C:\WINDOWS\System32\f3PSSavr.scr 
C:\WINDOWS\Installer\f57e36.msi 
C:\WINDOWS\Installer\f57e4b.msi 
C:\Program Files\Windows Live\Messengeriched20.dll 
C:\Program Files\Windows Live\Messenger\msimg32.dll 
C:\WINDOWS\Prefetch\M3SRCHMN.EXE-0D1390A7.pf 
C:\WINDOWS\Prefetch\SEARCHSETTINGS.EXE-30EFBC20.pf 
C:\DOCUME~1\CHOKBE~1\Cookies\chokbengboune@mywebsearch[1].txt 
C:\DOCUME~1\CHOKBE~1\Cookies\chokbengboune@mywebsearch[2].txt 
C:\DOCUME~1\CHOKBE~1\Cookies\chokbengboune@partypoker[2].txt 

(!) -- Fichiers temporaires supprimés.

.
============== Scan additionnel ==============
.

* Mozilla FireFox Version 2.0.0.18 *

 Nom du profil: mu1lklqn.default (chokbengboune)
.
(Prefs.js) user_pref("browser.search.defaultenginename", "Yahoo"); 
(Prefs.js) user_pref("browser.search.selectedEngine", "Live Search"); 
(Prefs.js) user_pref("browser.startup.homepage", "hxxp://fr.msn.com/"); 
(Prefs.js) user_pref("browser.startup.homepage_override.mstone", "rv:1.8.1.18"); 
.
. 

* Internet Explorer Version 6.0.2900.5512 *

[HKEY_CURRENT_USER\..\Internet Explorer\Main]

Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Search Page: hxxp://www.google.com
Start Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://search.msn.com/spbasic.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://fr.msn.com/

[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

   Tabs: res://ieframe.dll/tabswelcome.htm

============== Suspect (Cracks, Serials ... ) ==============

. 
C:\Documents and Settings\chokbengboune\WoW-2.3.2.7741-to-2.3.3.7799-frFR-patch.exe.part 
C:\Documents and Settings\chokbengboune\Bureau\Marvel vs Capcom 3\charsyuukenyuukenpatch3.rar 
.
===================================
.
35024 Octet(s) - C:\Ad-Report-CLEAN.log 
19221 Octet(s) - C:\Ad-Report-SCAN.log 
.
116 Fichier(s) - C:\DOCUME~1\CHOKBE~1\LOCALS~1\Temp 
4 Fichier(s) - C:\WINDOWS\Temp 
.
17 Fichier(s) - C:\Program Files\Ad-remover\BACKUP
76 Fichier(s) - C:\Program Files\Ad-remover\QUARANTINE
.
Fin à: 20:32:58 | 16/07/2009
.
============== E.O.F ==============

Suchiro · Answer

Fix Navipromo version 4.0.1 commencé le 16/07/2009 20:42:04,25

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!

Outil exécuté depuis C:\Program Files
avilog1

Mise à jour le 14.07.2009 à 14h00 par IL-MAFIOSO

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free :               Intel(R) Pentium(R) 4 CPU 3.06GHz )
BIOS : Default System BIOS
USER : chokbengboune ( Administrator )
BOOT : Normal boot

Antivirus : avast! antivirus 4.8.0 [VPS 080827-0] 4.8.0 (Activated)


C:\ (Local Disk) - NTFS - Total:90 Go (Free:25 Go)
D:\ (Local Disk) - FAT32 - Total:91 Go (Free:91 Go)
E:\ (CD or DVD)


Recherche executée en mode normal 

Nettoyage exécuté au redémarrage de l'ordinateur


C:\WINDOWS\system32
vs2.inf supprimé !
C:\Documents and Settings\chokbengboune\locals~1\applic~1\akgmomw_navfx.dat supprimé !
C:\Documents and Settings\chokbengboune\locals~1\applic~1\aqikq_navfx.dat supprimé !
C:\Documents and Settings\chokbengboune\locals~1\applic~1\kogsu.dat supprimé !
C:\Documents and Settings\chokbengboune\locals~1\applic~1\kogsu_nav.dat supprimé !
C:\Documents and Settings\chokbengboune\locals~1\applic~1\kogsu_navps.dat supprimé !
C:\WINDOWS\prefetch\kogsu*.pf supprimé !
C:\Documents and Settings\chokbengboune\locals~1\applic~1\wsyqs.exe supprimé !
C:\Documents and Settings\chokbengboune\locals~1\applic~1\wsyqs.dat supprimé !
C:\Documents and Settings\chokbengboune\locals~1\applic~1\wsyqs_navps.dat supprimé !


Nettoyage contenu C:\WINDOWS\Temp effectué !
Nettoyage contenu C:\Documents and Settings\chokbengboune\locals~1\Temp effectué !


*** Sauvegarde du Registre vers dossier Safebackup ***

sauvegarde du Registre réalisée avec succès !

*** Nettoyage Registre ***

Nettoyage Registre Ok

Certificat Egroup supprimé !
Certificat Electronic-Group supprimé !
Certificat OOO-Favorit supprimé !


C:\WINDOWS\Tasks\A7014523918AFFEF.job trouvé ! Infection Lop possible non traitée par cet outil !


*** Scan terminé 16/07/2009 20:52:36,85 ***

Suchiro · Answer

sa a l'air inquiétant =/ as tu trouver quelquechose ? pour guerrir mon PC ?

Suchiro · Answer

Ce n'est pas grave mais je me demande un truc mon pere a Formater mon PC et il ya plu de signe de virus est ce que sa veut dire qu'ils sont dead ?

Suchiro · Answer

Sinon je dois faire l'analyse en mode déco ?

Suchiro · Answer

Voici le rapport fait sans deconexion mai par contre jai bien desactiver lantivirus



--------------------\  Lop S&D 4.2.5-0   XP/Vista

   Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 2
   X86-based PC ( Multiprocessor Free :               Intel(R) Pentium(R) 4 CPU 3.06GHz )
   BIOS : Default System BIOS
   USER : Kenny ( Administrator )
   BOOT : Normal boot
   Antivirus : Norton AntiVirus 2005 2005 (Activated)
   Firewall  : Norton Internet Worm Protection 2005 (Activated)
   C:\ (Local Disk) - NTFS - Total:90 Go (Free:73 Go)
   D:\ (Local Disk) - FAT32 - Total:91 Go (Free:91 Go)
   E:\ (CD or DVD)
   F:\ (USB)
   G:\ (USB)
   H:\ (USB)
   I:\ (USB)
   J:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go)

   "C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
   Option : [1] ( 02/08/2009|14:46 )
 
   --------------------\  Listing des dossiers dans APPLIC~1

   [31/07/2009|15:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
   [31/07/2009|16:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\DAEMON Tools Lite
   [31/07/2009|15:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
   [31/07/2009|16:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
   [31/07/2009|14:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [31/07/2009|19:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\NOS
   [31/07/2009|15:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec

   [31/07/2009|15:08] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
   [31/07/2009|15:08] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
   [16/12/2005|03:23] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Symantec

   [31/07/2009|15:48] C:\DOCUME~1\Kenny\APPLIC~1\Adobe
   [31/07/2009|16:41] C:\DOCUME~1\Kenny\APPLIC~1\DAEMON Tools Lite
   [31/07/2009|15:29] C:\DOCUME~1\Kenny\APPLIC~1\Google
   [31/07/2009|15:08] C:\DOCUME~1\Kenny\APPLIC~1\Identities
   [31/07/2009|14:34] C:\DOCUME~1\Kenny\APPLIC~1\Macromedia
   [31/07/2009|14:43] C:\DOCUME~1\Kenny\APPLIC~1\Microsoft
   [31/07/2009|15:32] C:\DOCUME~1\Kenny\APPLIC~1\Mozilla
   [31/07/2009|14:38] C:\DOCUME~1\Kenny\APPLIC~1\MSNInstaller
   [31/07/2009|14:28] C:\DOCUME~1\Kenny\APPLIC~1\Symantec
   [31/07/2009|15:40] C:\DOCUME~1\Kenny\APPLIC~1\WinRAR

   [31/07/2009|15:08] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

   [31/07/2009|15:08] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

   [01/08/2009|04:26] C:\DOCUME~1\sommany\APPLIC~1\Adobe
   [01/08/2009|04:25] C:\DOCUME~1\sommany\APPLIC~1\Google
   [31/07/2009|15:08] C:\DOCUME~1\sommany\APPLIC~1\Identities
   [31/07/2009|06:57] C:\DOCUME~1\sommany\APPLIC~1\Macromedia
   [31/07/2009|14:19] C:\DOCUME~1\sommany\APPLIC~1\Microsoft
   [31/07/2009|14:23] C:\DOCUME~1\sommany\APPLIC~1\MSNInstaller
   [16/12/2005|03:23] C:\DOCUME~1\sommany\APPLIC~1\Symantec
 
   --------------------\  Tâches planifiées dans C:\WINDOWS	asks

   [02/08/2009 13:54][--a------] C:\WINDOWS	asks\GoogleUpdateTaskUserS-1-5-21-3353168870-2893502780-51574917-1006UA.job
   [31/07/2009 06:54][--a------] C:\WINDOWS	asks\GoogleUpdateTaskUserS-1-5-21-3353168870-2893502780-51574917-1006Core.job
   [02/08/2009 11:50][--ah-----] C:\WINDOWS	asks\SA.DAT
   [16/12/2005 03:25][--a------] C:\WINDOWS	asks\Symantec NetDetect.job
   [05/08/2004 07:00][-r-h-----] C:\WINDOWS	asks\desktop.ini

   --------------------\  Listing des dossiers dans C:\Program Files

   [31/07/2009|06:23] C:\Program Files\Acer
   [16/12/2005|03:18] C:\Program Files\Adobe
   [31/07/2009|14:54] C:\Program Files\Ask Search Assistant
   [16/12/2005|03:06] C:\Program Files\ComPlus Applications
   [16/12/2005|03:22] C:\Program Files\CyberLink
   [31/07/2009|19:35] C:\Program Files\DAEMON Tools Lite
   [31/07/2009|16:38] C:\Program Files\DAEMON Tools Toolbar
   [31/07/2009|14:32] C:\Program Files\Fichiers communs
   [31/07/2009|15:28] C:\Program Files\Google
   [31/07/2009|20:42] C:\Program Files\InstallShield Installation Information
   [01/08/2009|05:01] C:\Program Files\Internet Explorer
   [16/12/2005|03:21] C:\Program Files\Java
   [31/07/2009|06:25] C:\Program Files\LifeView DTV
   [31/07/2009|20:42] C:\Program Files\LucasArts
   [01/08/2009|05:02] C:\Program Files\Messenger
   [31/07/2009|14:54] C:\Program Files\Messenger Plus! Live
   [31/07/2009|14:36] C:\Program Files\Microsoft
   [01/08/2009|05:01] C:\Program Files\Microsoft CAPICOM 2.1.0.2
   [31/07/2009|15:09] C:\Program Files\microsoft frontpage
   [16/12/2005|03:07] C:\Program Files\Movie Maker
   [02/08/2009|14:04] C:\Program Files\Mozilla Firefox
   [31/07/2009|14:38] C:\Program Files\MSN
   [16/12/2005|03:06] C:\Program Files\MSN Gaming Zone
   [16/12/2005|03:07] C:\Program Files\NetMeeting
   [31/07/2009|06:23] C:\Program Files\NewTech Infosystems
   [16/12/2005|11:53] C:\Program Files\Norton AntiVirus
   [31/07/2009|16:35] C:\Program Files\NOS
   [31/07/2009|15:09] C:\Program Files\Online Services
   [31/07/2009|15:09] C:\Program Files\Outlook Express
   [16/12/2005|03:14] C:\Program Files\Realtek
   [31/07/2009|15:09] C:\Program Files\Services en ligne
   [31/07/2009|15:09] C:\Program Files\Symantec
   [16/12/2005|03:17] C:\Program Files\Uninstall Information
   [31/07/2009|14:36] C:\Program Files\Windows Live
   [31/07/2009|14:35] C:\Program Files\Windows Live SkyDrive
   [31/07/2009|06:48] C:\Program Files\Windows Media Player
   [31/07/2009|15:09] C:\Program Files\Windows NT
   [16/12/2005|03:07] C:\Program Files\WindowsUpdate
   [31/07/2009|15:40] C:\Program Files\WinRAR
   [31/07/2009|15:09] C:\Program Files\xerox

   --------------------\  Listing des dossiers dans C:\Program Files\Fichiers communs

   [31/07/2009|15:09] C:\Program Files\Fichiers communs\Adobe
   [31/07/2009|06:23] C:\Program Files\Fichiers communs\ArcSoft
   [16/12/2005|03:19] C:\Program Files\Fichiers communs\InstallShield
   [16/12/2005|03:21] C:\Program Files\Fichiers communs\Java
   [31/07/2009|14:36] C:\Program Files\Fichiers communs\Microsoft Shared
   [31/07/2009|15:09] C:\Program Files\Fichiers communs\MSSoap
   [16/12/2005|03:20] C:\Program Files\Fichiers communs\muvee Technologies
   [16/12/2005|03:19] C:\Program Files\Fichiers communs\NewTech Infosystems
   [31/07/2009|15:09] C:\Program Files\Fichiers communs\ODBC
   [31/07/2009|15:09] C:\Program Files\Fichiers communs\Services
   [31/07/2009|15:09] C:\Program Files\Fichiers communs\SpeechEngines
   [02/08/2009|11:55] C:\Program Files\Fichiers communs\Symantec Shared
   [16/12/2005|03:06] C:\Program Files\Fichiers communs\System
   [31/07/2009|14:32] C:\Program Files\Fichiers communs\Windows Live

   --------------------\  Process

   ( 53 Processes )

   IEXPLORE.EXE ~ [PID:2832]

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   C:\DOCUME~1\Kenny\Cookies\kenny@advertising[1].txt
 
   --------------------\  Verification du Registre
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2009-08-02 14:47:35
   Windows 5.1.2600 Service Pack 2 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 0
 
   --------------------\  Recherche d'autres infections


   Aucune autre infection trouvée  !

   [F:132][D:4]-> C:\DOCUME~1\Kenny\LOCALS~1\Temp
   [F:198][D:0]-> C:\DOCUME~1\Kenny\Cookies
   [F:3456][D:8]-> C:\DOCUME~1\Kenny\LOCALS~1\TEMPOR~1\content.IE5

   1 - "C:\Lop SD\LopR_1.txt" - 02/08/2009|14:48 - Option : [1]

   --------------------\  Fin du rapport a 14:48:14

Suchiro · Answer

Oui et merci pour toute ton aide =)

Suchiro · Answer

Ola je suis desolé devoir reparler de ce probleme mais en faite meme apres le formatage il ya encore des traces de virus en faite ca ne c'était pas manifester les 3 premiers jours c'est pour sa que je pensait qu'il n(y avait plus rien mais aujourdhui sa devient comme avant ! 
Mon antivirus est en alerte 24/24 h  Est ce que tu peut m'aider ? stp

Suchiro · Answer

Ola je suis desolé devoir reparler de ce probleme mais en faite meme apres le formatage il ya encore des traces de virus en faite ca ne c'était pas manifester les 3 premiers jours c'est pour sa que je pensait qu'il n(y avait plus rien mais aujourdhui sa devient comme avant ! 
Mon antivirus est en alerte 24/24 h  Est ce que tu peut m'aider ? stp

HELP VIRUS INDESTRUCTIBLES

23 réponses

Discussions similaires

Newsletters