probleme en allumant l'ordi

Question

Bonjour, 
J'ai deux problemes qui pourrait m'aider à les résoudre?

1er probleme 
Lorsque j'allume mon ordi ça me dit " l'application n'a pas réussi à s'initialiser correctement (0x0000005) cliquer sur OK pour arreter l'application " et ceci pour deux choses: 
- qttast.exe 
- Reader_sl.exe 

2nd probleme 
lorsque je veux mettre en route dr web ça me dit pareil pour ceci: _start.exe 

que faut il que je fasse pour regler ces problemes?

gen-hackman · Answer

salut

Desactive ton antivirus le temps de la manip ainsi que ton parefeu si présent

&#9654 Télécharge List&Kill'em et enregistre-le sur ton bureau

Il ne necessite pas d'installation 

&#9654double clic (clic droit "executer en tant qu'administrateur" pour Vista) pour lancer le scan

choisis la langue puis choisis l'option 1 = Mode Recherche

&#9654laisse travailler l'outil

le rapport va s'afficher , une fois le scan fini

&#9654&#9654&#9654&#9654&#9654&#9654&#9654 ATTENTION : Efface ton adresse IP stp !!!!

ici :

                                            [121]: KB973815 - Update
                                            [122]: KB973869 - Update
                                            [123]: XpsEPSC
Carte(s) r‚seau:                            4 carte(s) r‚seau install‚e(s).
                                            [01]: Bluetooth PAN Network Adapter
                                                  Nom de la connexion : Connexion au r‚seau local 2
                                                  tat :          Support d‚connect‚
                                            [02]: Intel(R) PRO/1000 CT Network Connection
                                                  Nom de la connexion : Connexion au r‚seau local
                                                  DHCP activ‚ :    Non
                                                  Adresse(s) IP
                                                  [01] : 192.168.0.11
                                            [03]: VirtualBox Host-Only Ethernet Adapter
                                                  Nom de la connexion : VirtualBox Host-Only Network
                                                  DHCP activ‚ :    Non
                                                  Adresse(s) IP
                                                  [01] : 192.168.56.1
                                            [04]: VirtualBox Host-Only Ethernet Adapter
                                                  Nom de la connexion : VirtualBox Host-Only Network #2
                                                  DHCP activ‚ :    Non
                                                  Adresse(s) IP
                                                  [01] : 192.168.217.1

Nom de l'image              PIDÿ Nom de la sessio Num‚ro d Utilisation 
========================= ====== ================ ======== ============
System Idle Process            0 Console                 0        16 Ko
System                         4 Console                 0       244 Ko
smss.exe                     916 Console                 0       400 Ko
csrss.exe                    972 Console                 0     4ÿ456 Ko
winlogon.exe                 996 Console                 0     3ÿ536 Ko

&#9654colle le contenu dans ta prochaine réponse

Cyn · Answer

Voilà j'ai fait ce que tu as dit
et voici le résultat:


List'em by g3n-h@ckm@n 1.0.2.8 

updated on 23.08.2009 ::::: 09.40 


Microsoft Windows XP [version 5.1.2600]
 

23/08/2009    11:13:02,06 
 
 
Infections : 
========== 
 

¤¤¤¤¤¤¤¤¤¤ Fichiers et dossiers presents : 

"C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat"  
"C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat"  
"C:\Program Files\Dealio"  
"C:\Program Files\dynamic toolbar"  
"C:\Program Files\Search Settings"  
"C:\WINDOWS\bwUnin-7.2.0.137-8876480SL.exe"  
"C:\WINDOWS\pack.epk"  
C:\WINDOWS\System32\_psisdecd.dll  
"C:\WINDOWS\System32\ACTSKN43.ocx"  
"C:\WINDOWS\system32\MSINET.oca"  
C:\WINDOWS\System32\setb6.tmp  
"C:\Documents and Settings\darty\Application Data\Dealio"  
"C:\Documents and Settings\darty\egos.txt"  
C:\Documents and Settings\darty\Local Settings\Application Data\cekok_nav.dat  
C:\Documents and Settings\darty\Local Settings\Application Data\cekok_navps.dat  
C:\Documents and Settings\darty\Local Settings\Application Data\cuuucqe_nav.dat  
C:\Documents and Settings\darty\Local Settings\Application Data\cuuucqe_navps.dat  
C:\Documents and Settings\darty\LOCAL Settings\Temp\QRC.exe  
 
¤¤¤¤¤¤¤¤¤¤ Clés de registre Presentes : 

"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe"  
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}"  
HKCR\EoRezoBHO.EoBho  
HKCR\EoRezoBHO.EoBho.1  
HKCR\Installer\UpgradeCodes\789034A89BAC50E4782F0A7BDBF75632  
HKCR\Installer\UpgradeCodes\A97CEC23332751B47BA4B95BAA50C9D0  
HKCR\MgMediaPlayer.GifAnimator  
HKCR\MgMediaPlayer.GifAnimator.1  
HKCR\SearchSettings.BHO  
HKCR\SearchSettings.BHO.1  
HKCR\SWEETIE.IEToolbar  
HKCR\SWEETIE.IEToolbar.1  
HKCR\SWEETIE.SWEETIE  
HKCR\SWEETIE.SWEETIE.3  
HKCR\SweetIM_URLSearchHook.ToolbarURLSearchHook  
HKCR\SweetIM_URLSearchHook.ToolbarURLSearchHook.1  
HKCR\Toolbar3.SWEETIE  
HKCR\Toolbar3.SWEETIE.1  
HKCR\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}  
HKCR\Typelib\{B4C656C9-F2E9-4E77-B3F4-443DF2BD778F}  
HKCR\Typelib\{B4C656C9-F2E9-4E77-B3F4-443DF2BD778F}  
HKCR\Typelib\{EEE6C35E-6118-11DC-9C72-001320C79847}  
HKCU\SOFTWARE\EoRezo  
HKCU\SOFTWARE\ItsLabel  
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{64F56FC1-1272-44CD-BA6E-39723696E350}  
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}  
HKLM\SOFTWARE\Classes\AppID\{362A53B2-2913-4F8A-82F5-7E0A23FDC6F9}  
HKLM\SOFTWARE\Classes\AppID\EoRezoBHO.dll  
HKLM\SOFTWARE\Classes\CLSID\{C7B76B90-3455-4AE6-A752-EAC4D19689E5}  
HKLM\SOFTWARE\Classes\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}  
HKLM\SOFTWARE\Classes\TypeLib\{B6ACB3F1-6A83-432C-B854-3E1056F87F4E}  
HKLM\Software\Dealio  
HKLM\SOFTWARE\EoRezo  
HKLM\SOFTWARE\Microsoft\ESENT\Process\SweetIM  
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\A97CEC23332751B47BA4B95BAA50C9D0  
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\789034A89BAC50E4782F0A7BDBF75632  
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{266C7330-C0F4-49E5-8F20-A56F9F822875}  
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A1E4213E-06AD-4C58-8315-92F11531D960}  
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\eoEngine_is1  
"HKLM\Software\Search Settings"  
HKLM\SOFTWARE\SweetIM  
"HKLM\Software\Trymedia Systems"  
 
¤¤¤¤¤¤¤¤¤¤ C:\WINDOWS\Prefetch : 

ACRORD32.EXE-32E4AFCD.pf
ADVCHECK163.EXE-1A421794.pf
ADVCHECK163.TMP-318A1CDB.pf
ALG.EXE-275708CF.pf
APPLEMOBILEDEVICESERVICE.EXE-061C7F51.pf
ASHMAISV.EXE-072F6A23.pf
ASHWEBSV.EXE-3530B302.pf
AU_.EXE-1BB43151.pf
AVAST.SETUP-295443AF.pf
A~NSISU_.EXE-37D94215.pf
CALC.EXE-02A5B4B1.pf
CCLEANER.EXE-09CFC2BC.pf
CCSETUP222[1].EXE-091F2AD2.pf
CDAC11BA.EXE-22E0E3D1.pf
CMD.EXE-034B0549.pf
CONMGR.EXE-1BC2F0BF.pf
CUREIT.EXE-38621FC6.pf
DEFRAG.EXE-2858C7E2.pf
DEVSVC.EXE-28D8C7FA.pf
DFRGNTFS.EXE-38C3807C.pf
DRWTSN32.EXE-01DDCF15.pf
DUMPREP.EXE-0AF2BF67.pf
DWWIN.EXE-2C373FB7.pf
GOOGLETOOLBARNOTIFIER.EXE-0047A1C5.pf
GOOGLEUPDATE.EXE-160E1F62.pf
GOOGLEUPDATER.EXE-1D8A4379.pf
GOOGLEUPDATERSERVICE.EXE-2F4A2F77.pf
IEXPLORE.EXE-2D97EBE6.pf
IMAPI.EXE-201490BB.pf
IMNOTFY.EXE-0B3D61EF.pf
INCMAIL.EXE-2A673D8E.pf
IPODSERVICE.EXE-37043579.pf
LAUNCHER.EXE-3028F8DC.pf
Layout.ini
LGPCSUITELANUCHER_SETUP.EXE-1E53B0B8.pf
LIST_KILLEM.EXE-0C20D6FC.pf
LIST_KILLEM[1].EXE-298A8DCE.pf
LOGONUI.EXE-312BE1BF.pf
MAGENTIC.EXE-0DC57411.pf
MAGENT~1.SCR-01B1980F.pf
MDNSRESPONDER.EXE-1E0EA707.pf
MGAPP.EXE-16DAAECD.pf
MODE.COM-318FFE37.pf
MPLAYERC_FR.EXE-056149FF.pf
MSFEEDSSYNC.EXE-05335A39.pf
MULTIMEDIA MANAGER.EXE-28CBC517.pf
MYSQLD-NT.EXE-1C1828D1.pf
NEODEFSCR.EXE-1E731B49.pf
NTOSBOOT-B00DFAAD.pf
OBEX.SETTINGS.EXE-0F9935F9.pf
PC SYNC.EXE-0D8D1D21.pf
PHONEEXPLORER.EXE-10F0C274.pf
REALSCHED.EXE-388D7C2D.pf
REG.EXE-07FA5B3F.pf
REGSVR32.EXE-396DEA2C.pf
RUNDLL32.EXE-3D479208.pf
RUNDLL32.EXE-6DF739B2.pf
RUNDLL32.EXE-6E8D4657.pf
RUNDLL32.EXE-707C9554.pf
RUNDLL32.EXE-753F1DF3.pf
SDUPDATE.EXE-2A88E3BA.pf
SHAREAZA.EXE-2B2ED3A8.pf
SOFTWAREUPDATE.EXE-1B81DBFD.pf
SPYBOTSD.EXE-1702AD5F.pf
SPYBOTSD162[1].EXE-003F522D.pf
SPYBOTSD162[1].TMP-16F62C17.pf
SPYBOTSD_INCLUDES.EXE-0921E068.pf
STYLEXP-UNINSTALL.EXE-3081CF6C.pf
STYLEXP.EXE-1BCB332C.pf
STYLEXPSERVICE.EXE-38538A3E.pf
SVCHOST.EXE-2D5FBD18.pf
TASKMGR.EXE-06144C13.pf
TEATIMER.EXE-0390E8A7.pf
TEATIMER166.EXE-055C05E2.pf
TEATIMER166.TMP-1A92957D.pf
UNINS000.EXE-38762295.pf
UNINS001.EXE-1688BB1D.pf
UNINSTALL.EXE-14B4BF4B.pf
UPDATE.EXE-0BDC03E6.pf
VERCLSID.EXE-28F52AD2.pf
VLC.EXE-02F29DFD.pf
WGATRAY.EXE-350D4455.pf
WIND.EXE-0B3E29C0.pf
WLXQUICKTIMECONTROLHOST.EXE-2CCEDF6E.pf
WMIPRVSE.EXE-0D449B4F.pf
WMPLAYER.EXE-1ACCF80B.pf
WSCNTFY.EXE-0B14C27D.pf
WUAUCLT.EXE-1360D60A.pf
_IU14D2N.TMP-30E35888.pf
_START.EXE-2A61E612.pf
 
 
 

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

gen-hackman · Answer

Redemarre en mode sans echec

&#9654 Relance List&Kill'em comme tu as fait pour l'option 1 (soit en clic droit pour vista),

mais cette fois-ci :

&#9654 choisis l'option 2 = Mode Destruction

laisse travailler l'outil

apres les verifications , un rapport va s'ouvrir.

&#9654 ferme-le.

un deuxieme rapport va s'ouvrir , 

&#9654 colle son contenu dans ta reponse

ensuite :

Télécharge Navilog1 depuis-ce lien

&#9654 Enregistrer la cible (du lien) sous... et enregistre-le sur ton bureau.
&#9654 Ensuite double clique sur navilog1.exe pour lancer l'installation.

Une fois l'installation terminée, le fix s'exécutera automatiquement.

&#9654 Au menu principal, Fais le choix 1 >>  Recherche / suppression automatique 

Patiente jusqu'au message :
*** Analyse Termine le ..... *** 

>>>>> Le fix peut durer une dizaine de minutes ;)

&#9654 Appuie sur une touche le bloc note va s'ouvrir.

&#9654 Copie-colle le rapport ici.

ensuite :


&#9654 Télécharge Ad-remover ( de C_XX ) sur ton bureau : 


&#9654 Déconnecte toi et ferme toutes applications en cours ! 

&#9654 Double clique sur "Ad-R.exe" pour lancer l'installation et laisse les paramètres d'installation par défaut . 

&#9654 Double-clique sur le raccourci Ad-remover qui est sur ton bureau pour lancer l'outil .
 
&#9654 Au menu principal choisis l'option "L" et tape sur [entrée] .

&#9654 Laisse travailler l'outil et ne touche à rien ... 

&#9654 Poste le rapport qui apparait à la fin , sur le forum ...

( Le rapport est sauvegardé aussi sous C:\Ad-report.log ) 
( CTRL+A Pour tout sélectionner , CTRL+C pour copier et CTRL+V pour coller ) 

&#9654 Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool. 
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. 
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.

Cyn · Answer

Pardon je n'avais pas totalement arrété avast donc je l'ai refait et voici le rapport:

List'em by g3n-h@ckm@n 1.0.2.8 

updated on 23.08.2009 ::::: 09.40 


Microsoft Windows XP [version 5.1.2600]
 

23/08/2009    11:36:15,71 
 
 
Infections : 
========== 
 

¤¤¤¤¤¤¤¤¤¤ Fichiers et dossiers presents : 

"C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat"  
"C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat"  
"C:\Program Files\Dealio"  
"C:\Program Files\dynamic toolbar"  
"C:\Program Files\Search Settings"  
"C:\WINDOWS\bwUnin-7.2.0.137-8876480SL.exe"  
"C:\WINDOWS\pack.epk"  
C:\WINDOWS\System32\_psisdecd.dll  
"C:\WINDOWS\System32\ACTSKN43.ocx"  
"C:\WINDOWS\system32\MSINET.oca"  
C:\WINDOWS\System32\setb6.tmp  
"C:\Documents and Settings\darty\Application Data\Dealio"  
"C:\Documents and Settings\darty\egos.txt"  
C:\Documents and Settings\darty\Local Settings\Application Data\cekok_nav.dat  
C:\Documents and Settings\darty\Local Settings\Application Data\cekok_navps.dat  
C:\Documents and Settings\darty\Local Settings\Application Data\cuuucqe_nav.dat  
C:\Documents and Settings\darty\Local Settings\Application Data\cuuucqe_navps.dat  
C:\Documents and Settings\darty\LOCAL Settings\Temp\QRC.exe  
 
¤¤¤¤¤¤¤¤¤¤ Clés de registre Presentes : 

"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe"  
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}"  
HKCR\EoRezoBHO.EoBho  
HKCR\EoRezoBHO.EoBho.1  
HKCR\Installer\UpgradeCodes\789034A89BAC50E4782F0A7BDBF75632  
HKCR\Installer\UpgradeCodes\A97CEC23332751B47BA4B95BAA50C9D0  
HKCR\MgMediaPlayer.GifAnimator  
HKCR\MgMediaPlayer.GifAnimator.1  
HKCR\SearchSettings.BHO  
HKCR\SearchSettings.BHO.1  
HKCR\SWEETIE.IEToolbar  
HKCR\SWEETIE.IEToolbar.1  
HKCR\SWEETIE.SWEETIE  
HKCR\SWEETIE.SWEETIE.3  
HKCR\SweetIM_URLSearchHook.ToolbarURLSearchHook  
HKCR\SweetIM_URLSearchHook.ToolbarURLSearchHook.1  
HKCR\Toolbar3.SWEETIE  
HKCR\Toolbar3.SWEETIE.1  
HKCR\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}  
HKCR\Typelib\{B4C656C9-F2E9-4E77-B3F4-443DF2BD778F}  
HKCR\Typelib\{B4C656C9-F2E9-4E77-B3F4-443DF2BD778F}  
HKCR\Typelib\{EEE6C35E-6118-11DC-9C72-001320C79847}  
HKCU\SOFTWARE\EoRezo  
HKCU\SOFTWARE\ItsLabel  
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{64F56FC1-1272-44CD-BA6E-39723696E350}  
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}  
HKLM\SOFTWARE\Classes\AppID\{362A53B2-2913-4F8A-82F5-7E0A23FDC6F9}  
HKLM\SOFTWARE\Classes\AppID\EoRezoBHO.dll  
HKLM\SOFTWARE\Classes\CLSID\{C7B76B90-3455-4AE6-A752-EAC4D19689E5}  
HKLM\SOFTWARE\Classes\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}  
HKLM\SOFTWARE\Classes\TypeLib\{B6ACB3F1-6A83-432C-B854-3E1056F87F4E}  
HKLM\Software\Dealio  
HKLM\SOFTWARE\EoRezo  
HKLM\SOFTWARE\Microsoft\ESENT\Process\SweetIM  
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\A97CEC23332751B47BA4B95BAA50C9D0  
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\789034A89BAC50E4782F0A7BDBF75632  
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{266C7330-C0F4-49E5-8F20-A56F9F822875}  
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A1E4213E-06AD-4C58-8315-92F11531D960}  
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\eoEngine_is1  
"HKLM\Software\Search Settings"  
HKLM\SOFTWARE\SweetIM  
"HKLM\Software\Trymedia Systems"  
 
¤¤¤¤¤¤¤¤¤¤ C:\WINDOWS\Prefetch : 

ACRORD32.EXE-32E4AFCD.pf
ADVCHECK163.EXE-1A421794.pf
ADVCHECK163.TMP-318A1CDB.pf
ALG.EXE-275708CF.pf
APPLEMOBILEDEVICESERVICE.EXE-061C7F51.pf
ASHMAISV.EXE-072F6A23.pf
ASHWEBSV.EXE-3530B302.pf
AU_.EXE-1BB43151.pf
AVAST.SETUP-295443AF.pf
A~NSISU_.EXE-37D94215.pf
CALC.EXE-02A5B4B1.pf
CCLEANER.EXE-09CFC2BC.pf
CCSETUP222[1].EXE-091F2AD2.pf
CDAC11BA.EXE-22E0E3D1.pf
CMD.EXE-034B0549.pf
CONMGR.EXE-1BC2F0BF.pf
CUREIT.EXE-38621FC6.pf
DEFRAG.EXE-2858C7E2.pf
DEVSVC.EXE-28D8C7FA.pf
DFRGNTFS.EXE-38C3807C.pf
DRWTSN32.EXE-01DDCF15.pf
DUMPREP.EXE-0AF2BF67.pf
DWWIN.EXE-2C373FB7.pf
GOOGLETOOLBARNOTIFIER.EXE-0047A1C5.pf
GOOGLEUPDATE.EXE-160E1F62.pf
GOOGLEUPDATER.EXE-1D8A4379.pf
GOOGLEUPDATERSERVICE.EXE-2F4A2F77.pf
IEXPLORE.EXE-2D97EBE6.pf
IMAPI.EXE-201490BB.pf
IMNOTFY.EXE-0B3D61EF.pf
INCMAIL.EXE-2A673D8E.pf
IPODSERVICE.EXE-37043579.pf
LAUNCHER.EXE-3028F8DC.pf
Layout.ini
LGPCSUITELANUCHER_SETUP.EXE-1E53B0B8.pf
LIST_KILLEM.EXE-0C20D6FC.pf
LIST_KILLEM[1].EXE-298A8DCE.pf
LOGONUI.EXE-312BE1BF.pf
MAGENTIC.EXE-0DC57411.pf
MAGENT~1.SCR-01B1980F.pf
MDNSRESPONDER.EXE-1E0EA707.pf
MGAPP.EXE-16DAAECD.pf
MODE.COM-318FFE37.pf
MPLAYERC_FR.EXE-056149FF.pf
MSFEEDSSYNC.EXE-05335A39.pf
MSNMSGR.EXE-0EBDBC56.pf
MULTIMEDIA MANAGER.EXE-28CBC517.pf
MYSQLD-NT.EXE-1C1828D1.pf
NEODEFSCR.EXE-1E731B49.pf
NOTEPAD.EXE-2F2D61E1.pf
NTOSBOOT-B00DFAAD.pf
OBEX.SETTINGS.EXE-0F9935F9.pf
PC SYNC.EXE-0D8D1D21.pf
PHONEEXPLORER.EXE-10F0C274.pf
REALSCHED.EXE-388D7C2D.pf
REG.EXE-07FA5B3F.pf
REGSVR32.EXE-396DEA2C.pf
RUNDLL32.EXE-3D479208.pf
RUNDLL32.EXE-6DF739B2.pf
RUNDLL32.EXE-6E8D4657.pf
RUNDLL32.EXE-707C9554.pf
RUNDLL32.EXE-753F1DF3.pf
SDUPDATE.EXE-2A88E3BA.pf
SHAREAZA.EXE-2B2ED3A8.pf
SOFTWAREUPDATE.EXE-1B81DBFD.pf
SPYBOTSD.EXE-1702AD5F.pf
SPYBOTSD162[1].EXE-003F522D.pf
SPYBOTSD162[1].TMP-16F62C17.pf
SPYBOTSD_INCLUDES.EXE-0921E068.pf
STYLEXP-UNINSTALL.EXE-3081CF6C.pf
STYLEXP.EXE-1BCB332C.pf
STYLEXPSERVICE.EXE-38538A3E.pf
SVCHOST.EXE-2D5FBD18.pf
TASKMGR.EXE-06144C13.pf
TEATIMER.EXE-0390E8A7.pf
TEATIMER166.EXE-055C05E2.pf
TEATIMER166.TMP-1A92957D.pf
UNINS000.EXE-38762295.pf
UNINS001.EXE-1688BB1D.pf
UNINSTALL.EXE-14B4BF4B.pf
UPDATE.EXE-0BDC03E6.pf
VERCLSID.EXE-28F52AD2.pf
VLC.EXE-02F29DFD.pf
WGATRAY.EXE-350D4455.pf
WIND.EXE-0B3E29C0.pf
WLCOMM.EXE-2F4516F1.pf
WLXQUICKTIMECONTROLHOST.EXE-2CCEDF6E.pf
WMIPRVSE.EXE-0D449B4F.pf
WMPLAYER.EXE-1ACCF80B.pf
WSCNTFY.EXE-0B14C27D.pf
WUAUCLT.EXE-1360D60A.pf
_IU14D2N.TMP-30E35888.pf
_START.EXE-2A61E612.pf
 
 
 

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

Maintenant je vais le faire en mode destruction et je donne le rapport des que je l'ai

gen-hackman · Answer

ok :)

Cyn · Answer

Voici le second rapport du mde destruction:

Kill'em by g3n-h@ckm@n 1.0.2.8 

updated on 23.08.2009 ::::: 09.40 


Microsoft Windows XP [version 5.1.2600]
 

23/08/2009    12:11:53,46 

Fichiers analysés : 
================= 
 

¤¤¤¤¤¤¤¤¤¤ Fichiers et dossiers presents : 

"C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat"  
"C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat"  
 
 
¤¤¤¤¤¤¤¤¤¤ Action sur les fichiers : 
  
Quarantaine : 


¤¤¤¤¤¤¤¤¤¤ Verification : 
 

 
Infections : 
========== 
 

¤¤¤¤¤¤¤¤¤¤ Fichiers et dossiers presents : 

"C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat"  
"C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat"  
 
¤¤¤¤¤¤¤¤¤¤ Clés de registre Presentes : 

"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe"  
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}"  
HKCR\EoRezoBHO.EoBho  
HKCR\EoRezoBHO.EoBho.1  
HKCR\Installer\UpgradeCodes\789034A89BAC50E4782F0A7BDBF75632  
HKCR\Installer\UpgradeCodes\A97CEC23332751B47BA4B95BAA50C9D0  
HKCR\MgMediaPlayer.GifAnimator  
HKCR\MgMediaPlayer.GifAnimator.1  
HKCR\SearchSettings.BHO  
HKCR\SearchSettings.BHO.1  
HKCR\SWEETIE.IEToolbar  
HKCR\SWEETIE.IEToolbar.1  
HKCR\SWEETIE.SWEETIE  
HKCR\SWEETIE.SWEETIE.3  
HKCR\SweetIM_URLSearchHook.ToolbarURLSearchHook  
HKCR\SweetIM_URLSearchHook.ToolbarURLSearchHook.1  
HKCR\Toolbar3.SWEETIE  
HKCR\Toolbar3.SWEETIE.1  
HKCR\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}  
HKCR\Typelib\{B4C656C9-F2E9-4E77-B3F4-443DF2BD778F}  
HKCR\Typelib\{B4C656C9-F2E9-4E77-B3F4-443DF2BD778F}  
HKCR\Typelib\{EEE6C35E-6118-11DC-9C72-001320C79847}  
HKCU\SOFTWARE\EoRezo  
HKCU\SOFTWARE\ItsLabel  
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{64F56FC1-1272-44CD-BA6E-39723696E350}  
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}  
HKLM\SOFTWARE\Classes\AppID\{362A53B2-2913-4F8A-82F5-7E0A23FDC6F9}  
HKLM\SOFTWARE\Classes\AppID\EoRezoBHO.dll  
HKLM\SOFTWARE\Classes\CLSID\{C7B76B90-3455-4AE6-A752-EAC4D19689E5}  
HKLM\SOFTWARE\Classes\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}  
HKLM\SOFTWARE\Classes\TypeLib\{B6ACB3F1-6A83-432C-B854-3E1056F87F4E}  
HKLM\Software\Dealio  
HKLM\SOFTWARE\EoRezo  
HKLM\SOFTWARE\Microsoft\ESENT\Process\SweetIM  
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\A97CEC23332751B47BA4B95BAA50C9D0  
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\789034A89BAC50E4782F0A7BDBF75632  
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{266C7330-C0F4-49E5-8F20-A56F9F822875}  
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A1E4213E-06AD-4C58-8315-92F11531D960}  
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\eoEngine_is1  
"HKLM\Software\Search Settings"  
HKLM\SOFTWARE\SweetIM  
"HKLM\Software\Trymedia Systems"  
 
¤¤¤¤¤¤¤¤¤¤ C:\WINDOWS\Prefetch : 

DUMPREP.EXE-0AF2BF67.pf
DWWIN.EXE-2C373FB7.pf
GOOGLETOOLBARNOTIFIER.EXE-0047A1C5.pf
IEXPLORE.EXE-2D97EBE6.pf
Layout.ini
NTOSBOOT-B00DFAAD.pf
REG.EXE-07FA5B3F.pf
TASKMGR.EXE-06144C13.pf
WLXQUICKTIMECONTROLHOST.EXE-2CCEDF6E.pf
 
 
 

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

je vais maintenant telecharger navilog1 comme tu me l'a dit...

gen-hackman · Answer

tu l'as fait en mode sans echec , puis "executer en tant qu'administrateur" avec le clic droit la destruction ?

Cyn · Answer

En mode sans echec...non je n'ai pas fait ça.... je l'ai fait juste apres t'avoir répondu
comme tu vois je suis pas une pro de l'ordi!!!!!

mais voici le rapport de navilog1:

Fix Navipromo version 4.0.1 commencé le 23/08/2009 12:56:57,35

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!

Outil exécuté depuis C:\Program Files
avilog1

Mise à jour le 18.07.2009 à 11h00 par IL-MAFIOSO

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : AMD Sempron(tm)   2800+ )
BIOS : Phoenix - AwardBIOS v6.00PG
USER : darty ( Administrator )
BOOT : Normal boot

Antivirus : avast! antivirus 4.8.1335 [VPS 090822-0] 4.8.1335 (Not Activated)
Firewall  : Norton Internet Security 2004 (Not Activated)

C:\ (Local Disk) - NTFS - Total:144 Go (Free:41 Go)
D:\ (CD or DVD)
E:\ (USB)
F:\ (USB)
G:\ (USB)
H:\ (USB)


Recherche executée en mode normal 

Nettoyage exécuté au redémarrage de l'ordinateur


C:\Documents and Settings\darty\locals~1\applic~1\cekok.dat supprimé !
C:\Documents and Settings\darty\locals~1\applic~1\cuuucqe.dat supprimé !


Nettoyage contenu C:\WINDOWS\Temp effectué !
Nettoyage contenu C:\Documents and Settings\darty\locals~1\Temp effectué !


*** Sauvegarde du Registre vers dossier Safebackup ***

sauvegarde du Registre réalisée avec succès !

*** Nettoyage Registre ***

Nettoyage Registre Ok

Certificat Egroup supprimé !
Certificat OOO-Favorit supprimé !




*** Scan terminé 23/08/2009 13:54:49,96 ***

J'attends ta réponse pour savoir ce que je dois faire :)

gen-hackman · Answer

c est bon desinstalle navilog et passe a la suite

Cyn · Answer

Dans Ad-remov apres avoir choisi la langue une fenetre s'ouvre me disant:
"Le resident "tea timer.exe" de spybot-search & destroy est activé dans ce cas, le programme ne peut continuer à s'executer. veuillez en parler à la personne qui vous aide"

Que dois-je faire?

gen-hackman · Answer

desactive le resident de Spybot,le TeaTimer

Aide en video telechargeable :

http://sd-1.archive-host.com/membres/up/829108531491024/DesactiverTT.zip

Cyn · Answer

Voici le rapport de Ad-remov:

.
======= RAPPORT D'AD-REMOVER 1.1.4.5_O | UNIQUEMENT XP/VISTA/SEVEN =======
.
Mit à jour par C_XX le 24/06/2009 à 7:10 PM
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Lancé à: 15:14:02, 23/08/2009 | Mode Normal | Option: CLEAN
Exécuté de: C:\Program Files\Ad-remover\
Système d'exploitation: Microsoft® Windows XP™  Service Pack 3 v5.1.2600
Nom du PC: SN044109520409 | Utilisateur actuel: darty
.
Administrateur: Administrateur 
N'est pas administrateur: ASPNET 
Administrateur: darty 
N'est pas administrateur: HelpAssistant *Desactive* 
N'est pas administrateur: Invité *Desactive* 
N'est pas administrateur: SUPPORT_388945a0 *Desactive* 
. 
============== ÉLÉMENT(S) NEUTRALISÉ(S) ============== 
.
.
HKCR\AppID\{362A53B2-2913-4F8A-82F5-7E0A23FDC6F9}
HKCR\AppID\EoRezoBHO.DLL
HKCR\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}
HKCR\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064}
HKCR\CLSID\{C7B76B90-3455-4AE6-A752-EAC4D19689E5}
HKCR\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCR\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKCR\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}
HKCR\EoRezoBHO.EoBho
HKCR\EoRezoBHO.EoBho.1
HKCR\Interface\{B0D071A1-36B3-4757-A126-14C89C56013A}
HKCR\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}
HKCR\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}
HKCR\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}
HKCR\MediaPlayer.GraphicsUtils
HKCR\MediaPlayer.GraphicsUtils.1
HKCR\MgMediaPlayer.GifAnimator
HKCR\MgMediaPlayer.GifAnimator.1
HKCR\SearchSettings.BHO
HKCR\SearchSettings.BHO.1
HKCR\SWEETIE.IEToolbar
HKCR\SWEETIE.IEToolbar.1
HKCR\SWEETIE.SWEETIE
HKCR\SWEETIE.SWEETIE.3
HKCR\SweetIM_URLSearchHook.ToolbarURLSearchHook
HKCR\SweetIM_URLSearchHook.ToolbarURLSearchHook.1
HKCR\Toolbar3.SWEETIE
HKCR\Toolbar3.SWEETIE.1
HKCR\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}
HKCR\Typelib\{B4C656C9-F2E9-4E77-B3F4-443DF2BD778F}
HKCR\Typelib\{B6ACB3F1-6A83-432C-B854-3E1056F87F4E}
HKCR\Typelib\{EEE6C35E-6118-11DC-9C72-001320C79847}
HKCR\Typelib\{EEE6C35F-6118-11DC-9C72-001320C79847}
HKCU\Software\EoRezo
HKCU\Software\ItsLabel
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{64F56FC1-1272-44CD-BA6E-39723696E350}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKCU\Software\SweetIM
HKCU\Software\Trymedia Systems
HKLM\Software\Classes\Interface\{A439801C-961D-452C-AB42-7848E9CBD289}
HKLM\Software\Classes\Interface\{F4EBB1E2-21F3-4786-8CF4-16EC5925867F}
HKLM\Software\Dealio
HKLM\Software\EoRezo
HKLM\Software\Microsoft\ESENT\Process\SweetIM
HKLM\Software\Microsoft\Internet Explorer\Extensions\{E908B145-C847-4e85-B315-07E2E70DECF8}
HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C7B76B90-3455-4AE6-A752-EAC4D19689E5}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{266C7330-C0F4-49E5-8F20-A56F9F822875}
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{A1E4213E-06AD-4C58-8315-92F11531D960}
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\eoEngine_is1
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\SoftwareUpdate_is1
HKLM\Software\Search Settings
HKLM\Software\SweetIM
HKLM\Software\Trymedia Systems
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Eoengine
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Eodesk3d
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Softwarehelper
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Sweetim
HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\{EEE6C35D-6118-11DC-9C72-001320C79847}
HKLM\Software\Microsoft\Internet Explorer\Toolbar\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCR\CLSID\{6A87B991-A31F-4130-AE72-6D0C294BF082}
HKCR\CLSID\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
HKCR\Installer\Products\E3124E1ADA6085C43851291F51139D06
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\07D5290CDBDAE4242926B8E6CA650501
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\08E33F7B61DEFF24BB9673ED7D467636
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\0E3D8A5B48622A445A7DF73FEFF32C3F
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\1AC67655DD68F8240B2860F2D511EBD8
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\34EDDB1BFB3A2D448845F3EFD0F15A43
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\351716A953E21214898904032EAE2E81
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\397C771A7BCAC904697C3EC629ED33ED
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\427EA997C413D1D47907CBFC7B2DB432
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\4318DF19719275242801CBE292063A4C
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\45FC115D1FEAEF849A4E1610D6EC8BF0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\46A5861A389ADB844AF89E31BC9DF0A1
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\49B0E1A6FF50BBE4289E4E23DE6EA0C7
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\4CCCAC049F34D0540AAC13011398BEDB
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5C4389D0BFB302C479DE4178BD5D9EBA
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5D19F074C042AD34BAB463D4175A062E
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5D2B09BDEF4FE54418E6F3373CDBC7AC
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\61B65D3397A1FBF4CB1571B5E4F6B5B0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\68E8A05C60DD9254591DBD16C94EDDBF
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\697E782CF574CC34CBB9566440BA12BC
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\6AE27A8613CF7EA4782F2886F67295E5
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\7CE172051F585E04187BCB97570BFA74
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\86A901BA5265452499DCBF719C378EE3
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\88ABD1CD5C40EC84789A7F6EF86DAC5E
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\980289C22F80A7C4BB9323DC61255E4E
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\98CC8BF5A4A6E6C4ABF7051DDAB8B058
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\9A4B7EF3789F871419D9302583B20C15
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\A189D17A469616C4688D23E192996267
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\A6C53B0F76C44004A8F36716213017DB
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\B59F2D8189784CC46A4597F2842480B0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\BD746FB95FB8E5B45BF66BE54D5FD91F
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\CCF399FCD6D2D3F46BF02A1378654FC9
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D149C1355C98DE24E82CEFBD996FE06A
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D15DAF33C220F91468A1D7D57C31ACD7
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D3BA76A44C779424889063D5098ED2D6
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D6D0EB9FDBD90C04D92A7E729058F10D
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\DB59FDB786388EA4D897F3EE715683AC
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\DB8DAD19CFBCC2049A4477183787E8C5
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E1C820A74ED67374BA048B52CB3C3804
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Products\E3124E1ADA6085C43851291F51139D06
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E337925F629CF4C4FB08F3D9674DD839
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E4748F9A4181FCE46A23C13B517B9420
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\EC65F200D112357449C8B1BC3CFA03D0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\F327D0C73C0973644A21E8CC852267A0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\FA96423FE2B98E248A3B23548D1E22D9
.
C:\DOCUME~1\ALLUSE~1\APPLIC~1\SweetIM\Messenger 
C:\DOCUME~1\ALLUSE~1\APPLIC~1\SweetIM\Toolbars 
C:\DOCUME~1\ALLUSE~1\APPLIC~1\SweetIM\Messenger\conf 
C:\DOCUME~1\ALLUSE~1\APPLIC~1\SweetIM\Messenger\data 
C:\DOCUME~1\ALLUSE~1\APPLIC~1\SweetIM\Messenger\logs 
C:\DOCUME~1\ALLUSE~1\APPLIC~1\SweetIM\Messenger\update 
C:\DOCUME~1\ALLUSE~1\APPLIC~1\SweetIM\Messenger\conf\adapter.xml 
C:\DOCUME~1\ALLUSE~1\APPLIC~1\SweetIM\Messenger\conf\autoupdate.xml 
C:\DOCUME~1\ALLUSE~1\APPLIC~1\SweetIM\Messenger\conf\logger.xml 
C:\DOCUME~1\ALLUSE~1\APPLIC~1\SweetIM\Messenger\conf\messages.xml 
C:\DOCUME~1\ALLUSE~1\APPLIC~1\SweetIM\Messenger\conf\sweetim.xml 
C:\DOCUME~1\ALLUSE~1\APPLIC~1\SweetIM\Messenger\conf\sweetimapp.xml 
C:\DOCUME~1\ALLUSE~1\APPLIC~1\SweetIM\Messenger\conf\users 
C:\DOCUME~1\ALLUSE~1\APPLIC~1\SweetIM\Messenger\conf\users\main_user_config.xml 
C:\DOCUME~1\ALLUSE~1\APPLIC~1\SweetIM\Messenger\conf\users\seb.cyn@hotmail.fr 
C:\DOCUME~1\ALLUSE~1\APPLIC~1\SweetIM\Messenger\conf\users\seb.cyn@hotmail.fr\content_update_notification.xml 
C:\DOCUME~1\ALLUSE~1\APPLIC~1\SweetIM\Messenger\conf\users\seb.cyn@hotmail.fr\emoticons_shortcut.xml 
C:\DOCUME~1\ALLUSE~1\APPLIC~1\SweetIM\Messenger\conf\users\seb.cyn@hotmail.fr\user_config.xml 
C:\DOCUME~1\ALLUSE~1\APPLIC~1\SweetIM\Messenger\data\contentdb 
C:\DOCUME~1\ALLUSE~1\APPLIC~1\SweetIM\Messenger\data\contentdb\cache_indx.dat 
C:\DOCUME~1\ALLUSE~1\APPLIC~1\SweetIM\Messenger\update\sweetimsetup.exe 
C:\DOCUME~1\ALLUSE~1\APPLIC~1\SweetIM\Toolbars\Internet Explorer 
C:\DOCUME~1\ALLUSE~1\APPLIC~1\SweetIM\Toolbars\Internet Explorer\cache 
C:\DOCUME~1\ALLUSE~1\APPLIC~1\SweetIM\Toolbars\Internet Explorer\cache\0d922024f43d83ed230c4d61cce3a239.games1.bmp 
C:\DOCUME~1\ALLUSE~1\APPLIC~1\SweetIM\Toolbars\Internet Explorer\cache\11f36d4363b8e493b9e3a17b45c2612b.free_games.bmp 
C:\DOCUME~1\ALLUSE~1\APPLIC~1\SweetIM\Toolbars\Internet Explorer\cache\9af18640b8436a17ad76b7c578736544.wink.bmp 
C:\DOCUME~1\ALLUSE~1\APPLIC~1\SweetIM\Toolbars\Internet Explorer\cache\a58d003368a47b8a816a12537acccce1.winkhover.bmp 
C:\DOCUME~1\ALLUSE~1\APPLIC~1\SweetIM\Toolbars\Internet Explorer\cache\f64a71f602d078aa84829e36b8992194.toolbar31.xml 
C:\DOCUME~1\ALLUSE~1\APPLIC~1\SweetIM 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\cmhost.cyp 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\ConfMedia.cyp 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\db 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoDesk3d 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoDesk3d.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\eoDesktop 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\eoStats 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\host.cyp 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\SoftwareUpdate 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\user.cyp 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\db\cat.cyp 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoDesk3d\eoDesk3d.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\eoDesktop\config.xml 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\eoDesktop\eoDesktop.html 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\eoDesktop\userConfig.xml 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRssServer.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_01net_actualite.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_01net_actualite.gif 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_1201.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_abcbourse_analyse.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_abcbourse_news.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_advisto.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_advisto.gif 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_agenda_musical.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_agenda_musical.gif 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_aninmint.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_aninmint.gif 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_bbc.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_bbc.gif 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_bd_livres_krinein.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_companynewsgroup.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_companynewsgroup.gif 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_dvd_bonus.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_EoRezo_Horoscope.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_equipe_foot.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_equipe_foot.gif 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_eurotop_foot.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_eurotop_foot.gif 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_fcb_foot.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_football365_foot.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_france2_tv.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_france2_tv.gif 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_france3_tv.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_france3_tv.gif 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_fr_uefa_com.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_ft.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_ft.gif 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_iht.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_iht.gif 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_info_football_foot.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_jeux_france.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_jeux_france.gif 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_jeux_video.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_jeux_video.gif 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_latribune_investissement.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_latribune_investissement.gif 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_lefigaro_une.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_lefigaro_une.gif 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_lelombrik.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_lemonde_livres.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_lemonde_livres.gif 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_lesechos_conso.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_lesechos_conso.gif 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_lesechos_finance.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_lesechos_finance.gif 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_lesechos_patrimoine.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_lesechos_patrimoine.gif 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_le_figaro_entreprise.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_le_figaro_entreprise.gif 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_le_monde_entreprise.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_le_monde_entreprise.gif 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_liberation_actualite.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_liberation_actualite.gif 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_l_equipe_rugby.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_l_equipe_rugby.gif 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_madame_figaro_cuisine.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_mangaanime.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_msn_insolites.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_narutochaos.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_nord_cinema_box_office.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_nord_cinema_box_office.gif 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_nord_cinema_critique.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_nosamieslesstars.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_om_live.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_parisetudiant.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_parisetudiant_job.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_people_actustar.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_people_france2.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_people_france2.gif 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_people_madamefigaro.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_people_nouvelobs.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_people_nouvelobs.gif 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_people_tf1.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_people_tf1.gif 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_planet_psg.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_politique_nouvelobs.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_politique_nouvelobs.gif 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_politique_premier_ministre.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_politique_premier_ministre.gif 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_politique_tv5.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_politique_tv5.gif 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_ptdr.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_recette_dessert_cuisine.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_rtl_foot.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_rtl_foot.gif 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_tf1_actualite.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_tf1_actualite.gif 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_tf1_cinema.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_tf1_cinema.gif 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_tf1_economie.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_tf1_economie.gif 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_tf1_insolites.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_tf1_insolites.gif 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_umoor.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_yahoo_cuisine.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_yatahonga.cfg 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\EoRss\EoRss_yatahonga.gif 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\eoStats\eoStats.txt 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\SoftwareUpdate\SoftwareUpdate.exe 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\SoftwareUpdate\SoftwareUpdateHP.exe 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\SoftwareUpdate\unins000.dat 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\SoftwareUpdate\unins000.exe 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\SoftwareUpdate\user_config.cyp 
C:\DOCUME~1\darty\APPLIC~1\EoRezo\SoftwareUpdate\user_profil.cyp 
C:\DOCUME~1\darty\APPLIC~1\EoRezo 
C:\DOCUME~1\darty\APPLIC~1\ItsLabel\ItsTV 
C:\DOCUME~1\darty\APPLIC~1\ItsLabel\ItsTV\itsTV.xml 
C:\DOCUME~1\darty\APPLIC~1\ItsLabel\ItsTV\version.xml 
C:\DOCUME~1\darty\APPLIC~1\ItsLabel 
C:\Program Files\EoRezo\cmhost.cyp 
C:\Program Files\EoRezo\ConfMedia.cyp 
C:\Program Files\EoRezo\EoAdv 
C:\Program Files\EoRezo\EoEngine.exe 
C:\Program Files\EoRezo\eoEngine.url 
C:\Program Files\EoRezo\EoMultiLanguage.dll 
C:\Program Files\EoRezo\EoRezoComm.dll 
C:\Program Files\EoRezo\EoRezoImg_12.dll 
C:\Program Files\EoRezo\EoRezoImg_17.dll 
C:\Program Files\EoRezo\EoRezoImg_19.dll 
C:\Program Files\EoRezo\EoRezoImg_20.dll 
C:\Program Files\EoRezo\EoRezoImg_21.dll 
C:\Program Files\EoRezo\EoRezoImg_22.dll 
C:\Program Files\EoRezo\EoRezoImg_23.dll 
C:\Program Files\EoRezo\EoRezoTools_12.dll 
C:\Program Files\EoRezo\EoRezoTools_16.dll 
C:\Program Files\EoRezo\EoRezoTools_17.dll 
C:\Program Files\EoRezo\EoRezoTools_18.dll 
C:\Program Files\EoRezo\EoRezoTools_20.dll 
C:\Program Files\EoRezo\EoRezoTools_21.dll 
C:\Program Files\EoRezo\EoRezoTools_26.dll 
C:\Program Files\EoRezo\EoRezoTools_27.dll 
C:\Program Files\EoRezo\EoRezoTools_28.dll 
C:\Program Files\EoRezo\EoRezoTools_29.dll 
C:\Program Files\EoRezo\EoRezoTools_30.dll 
C:\Program Files\EoRezo\FreeImage.dll 
C:\Program Files\EoRezo\Host.cyp 
C:\Program Files\EoRezo\lang 
C:\Program Files\EoRezo\MngInstaller.dll 
C:\Program Files\EoRezo\unins000.dat 
C:\Program Files\EoRezo\unins000.exe 
C:\Program Files\EoRezo\user.cyp 
C:\Program Files\EoRezo\EoAdv\atl90.dll 
C:\Program Files\EoRezo\EoAdv\EoAdv.dll 
C:\Program Files\EoRezo\EoAdv\eoAdv.url 
C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll 
C:\Program Files\EoRezo\EoAdv\mfc90.dll 
C:\Program Files\EoRezo\EoAdv\Microsoft.VC90.ATL.manifest 
C:\Program Files\EoRezo\EoAdv\Microsoft.VC90.CRT.manifest 
C:\Program Files\EoRezo\EoAdv\Microsoft.VC90.MFC.manifest 
C:\Program Files\EoRezo\EoAdv\msvcr90.dll 
C:\Program Files\EoRezo\lang\ihm_eoclock.xml 
C:\Program Files\EoRezo\lang\ihm_eoengine.xml 
C:\Program Files\EoRezo\lang\ihm_eonet.xml 
C:\Program Files\EoRezo\lang\ihm_eorezotools.xml 
C:\Program Files\EoRezo\lang\ihm_eosudoku.xml 
C:\Program Files\EoRezo\lang\ihm_eoweather.xml 
C:\Program Files\EoRezo\lang\lang_en.xml 
C:\Program Files\EoRezo\lang\lang_es.xml 
C:\Program Files\EoRezo\lang\lang_fr.xml 
C:\Program Files\EoRezo\lang\lang_it.xml 
C:\Program Files\EoRezo 
C:\Program Files\SweetIM\Messenger 
C:\Program Files\SweetIM\Toolbars 
C:\Program Files\SweetIM\Messenger\default.xml 
C:\Program Files\SweetIM\Messenger\mgAdaptersProxy.dll 
C:\Program Files\SweetIM\Messenger\mgAIMAuto.dll 
C:\Program Files\SweetIM\Messenger\mgAIMMessengerAdapter.dll 
C:\Program Files\SweetIM\Messenger\mgArchive.dll 
C:\Program Files\SweetIM\Messenger\mgcommon.dll 
C:\Program Files\SweetIM\Messenger\mgcommunication.dll 
C:\Program Files\SweetIM\Messenger\mgconfig.dll 
C:\Program Files\SweetIM\Messenger\mgFlashPlayer.dll 
C:\Program Files\SweetIM\Messenger\mghooking.dll 
C:\Program Files\SweetIM\Messenger\mgICQAuto.dll 
C:\Program Files\SweetIM\Messenger\mgICQMessengerAdapter.dll 
C:\Program Files\SweetIM\Messenger\mgIEPlayer.dll 
C:\Program Files\SweetIM\Messenger\mglogger.dll 
C:\Program Files\SweetIM\Messenger\mgMediaPlayer.dll 
C:\Program Files\SweetIM\Messenger\mgMsnAuto.dll 
C:\Program Files\SweetIM\Messenger\mgMsnMessengerAdapter.dll 
C:\Program Files\SweetIM\Messenger\mgsimcommon.dll 
C:\Program Files\SweetIM\Messenger\mgSweetIM.dll 
C:\Program Files\SweetIM\Messenger\mgUpdateSupport.dll 
C:\Program Files\SweetIM\Messenger\mgxml_wrapper.dll 
C:\Program Files\SweetIM\Messenger\mgYahooAuto.dll 
C:\Program Files\SweetIM\Messenger\mgYahooMessengerAdapter.dll 
C:\Program Files\SweetIM\Messenger\msvcp71.dll 
C:\Program Files\SweetIM\Messenger\msvcr71.dll 
C:\Program Files\SweetIM\Messengeresources 
C:\Program Files\SweetIM\Messenger\SweetIM.exe 
C:\Program Files\SweetIM\Messengeresources\images 
C:\Program Files\SweetIM\Messengeresources\images\AudibleButton.png 
C:\Program Files\SweetIM\Messengeresources\images\DisplayPicturesButton.png 
C:\Program Files\SweetIM\Messengeresources\images\EmoticonButton.png 
C:\Program Files\SweetIM\Messengeresources\images\NudgeButton.png 
C:\Program Files\SweetIM\Messengeresources\images\SoundFxButton.png 
C:\Program Files\SweetIM\Messengeresources\images\WinksButton.png 
C:\Program Files\SweetIM\Toolbars\Internet Explorer 
C:\Program Files\SweetIM\Toolbars\Internet Explorer\ClearHist.exe 
C:\Program Files\SweetIM\Toolbars\Internet Explorer\conf 
C:\Program Files\SweetIM\Toolbars\Internet Explorer\default.xml 
C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgcommon.dll 
C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgconfig.dll 
C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll 
C:\Program Files\SweetIM\Toolbars\Internet Explorer\mglogger.dll 
C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgsimcommon.dll 
C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll 
C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgxml_wrapper.dll 
C:\Program Files\SweetIM\Toolbars\Internet Explorer\msvcp71.dll 
C:\Program Files\SweetIM\Toolbars\Internet Explorer\msvcr71.dll 
C:\Program Files\SweetIM\Toolbars\Internet Exploreresources 
C:\Program Files\SweetIM\Toolbars\Internet Explorer\conf\logger.xml 
C:\Program Files\SweetIM\Toolbars\Internet Exploreresources\affid.dat 
C:\Program Files\SweetIM\Toolbars\Internet Exploreresources\basis.xml 
C:\Program Files\SweetIM\Toolbars\Internet Exploreresources\Bookmarks_23x18.bmp 
C:\Program Files\SweetIM\Toolbars\Internet Exploreresources\Email_23x18.bmp 
C:\Program Files\SweetIM\Toolbars\Internet Exploreresources\Games_23x18.bmp 
C:\Program Files\SweetIM\Toolbars\Internet Exploreresources\Greetingcards_23x18.bmp 
C:\Program Files\SweetIM\Toolbars\Internet Exploreresources\Logo.bmp 
C:\Program Files\SweetIM\Toolbars\Internet Exploreresources\Mobile_23x18.bmp 
C:\Program Files\SweetIM\Toolbars\Internet Exploreresources\Music_23x18.bmp 
C:\Program Files\SweetIM\Toolbars\Internet Exploreresources\News_23x18.bmp 
C:\Program Files\SweetIM\Toolbars\Internet Exploreresources\Shoping_23x18.bmp 
C:\Program Files\SweetIM\Toolbars\Internet Exploreresources\SmileySmile.bmp 
C:\Program Files\SweetIM\Toolbars\Internet Exploreresources\SmileyWink.bmp 
C:\Program Files\SweetIM\Toolbars\Internet Exploreresources\sweetimicons.bmp 
C:\Program Files\SweetIM\Toolbars\Internet Exploreresources	oolbar.xml 
C:\Program Files\SweetIM\Toolbars\Internet Exploreresources\version.txt 
C:\Program Files\SweetIM 
C:\WINDOWS\Installer\21e0a3.msi 
C:\WINDOWS\Installer\242723b.msi 
C:\WINDOWS\Installer\2427241.msi 
C:\WINDOWS\Installer\d8a1a3.msi 
C:\WINDOWS\Prefetch\SWEETIM.EXE-19615F6D.pf 
C:\DOCUME~1\darty\Cookies\darty@ads.eorezo[2].txt 
C:\DOCUME~1\darty\Cookies\darty@eorezo[1].txt 
C:\DOCUME~1\darty\Cookies\darty@eorezo[2].txt 

(!) -- Fichiers temporaires supprimés.

.
============== Scan additionnel ==============
.
.
. 

* Internet Explorer Version 8.0.6001.18702 *

[HKEY_CURRENT_USER\..\Internet Explorer\Main]

Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://search.msn.com/spbasic.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://fr.msn.com/

[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

   Tabs: res://ieframe.dll/tabswelcome.htm

============== Suspect (Cracks, Serials ... ) ==============

. 
.
===================================
.
28312 Octet(s) - C:\Ad-Report-CLEAN.log 
.
4 Fichier(s) - C:\DOCUME~1\darty\LOCALS~1\Temp 
2 Fichier(s) - C:\WINDOWS\Temp 
.
17 Fichier(s) - C:\Program Files\Ad-remover\BACKUP
204 Fichier(s) - C:\Program Files\Ad-remover\QUARANTINE
.
Fin à: 17:05:26 | 23/08/2009
.
============== E.O.F ==============
.

gen-hackman · Answer

Télécharge OTL de OLDTimer

&#9654 enregistre le sur ton Bureau.

&#9654 Double clic sur OTL.exe pour le lancer.

&#9654 Coche les 2 cases Lop et Purity

&#9654 Coche la case devant scan all users

&#9654 règle-le sur "60 Days"

&#9654 dans la colonne de gauche , mets tout sur all

&#9654Clic sur Run Scan.

A la fin du scan, le Bloc-Notes va s'ouvrir avec le rapport (OTL.txt).

Ce fichier est sur ton Bureau (en général C:\Documents and settings\le_nom_de_ta_session\OTL.txt)

&#9654&#9654&#9654 NE LE POSTE PAS SUR LE FORUM

Pour me le transmettre clique sur ce lien : http://www.cijoint.fr/

ou celui-ci : https://www.cjoint.com/

&#9654 Clique sur Parcourir et cherche le fichier ci-dessus.

&#9654 Clique sur Ouvrir.

&#9654 Clique sur "Cliquez ici pour déposer le fichier".

Un lien de cette forme :

http://www.cijoint.fr/cjlink.php?file=cjge368/cijSKAP5fU.txt

est ajouté dans la page.

&#9654 Copie ce lien dans ta réponse.

Tu feras la meme chose avec le "Extra.txt".

Cyn · Answer

Voici le lien du premier OLT.Txt:

http://www.cijoint.fr/cjlink.php?file=cj200908/cijGOpofgY.txt 

et le second Extra.Txt:

http://www.cijoint.fr/cjlink.php?file=cj200908/cijSLoc144.txt

gen-hackman · Answer

&#9654 Télécharge HostXpert sur ton Bureau :

&#9654 Décompresse-le (Clic droit >> Extraire ici) 

&#9654 Double-clique sur HostsXpert pour le lancer 

&#9654 clique sur le bouton "Restore MS Hosts File" puis ferme le programme 

PS : Avant de cliquer sur le bouton "Restore MS Hosts File", vérifie que le cadenas en haut à gauche est ouvert sinon tu vas avoir un message d'erreur. 

&#9654 s'il est fermé , clique dessus  :)

ensuite :


&#9654 télécharge LOP S&D sur ton Bureau.

&#9654 Double-clique dessus pour lancer l'installation
&#9654 Puis double-clique sur le raccourci Lop S&D présent sur ton Bureau
&#9654 Séléctionne la langue souhaitée , puis choisis l'option 1 (Recherche)
&#9654 Patiente jusqu'à la fin du scan

&#9654 Poste le rapport généré (C:\lopR.txt)

Cyn · Answer

Voici le rapport:


   --------------------\  Lop S&D 4.2.5-0   XP/Vista

   Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Uniprocessor Free : AMD Sempron(tm)   2800+ )
   BIOS : Phoenix - AwardBIOS v6.00PG
   USER : darty ( Administrator )
   BOOT : Normal boot
   Antivirus : avast! antivirus 4.8.1335 [VPS 090822-0] 4.8.1335 (Not Activated)
   Firewall  : Norton Internet Security 2004 (Not Activated)
   C:\ (Local Disk) - NTFS - Total:144 Go (Free:42 Go)
   D:\ (CD or DVD)
   E:\ (USB)
   F:\ (USB)
   G:\ (USB)
   H:\ (USB)

   "C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
   Option : [1] ( 23/08/2009|17:47 )
 
   --------------------\  Listing des dossiers dans APPLIC~1

   [07/08/2009|11:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
   [19/08/2009|07:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
   [03/04/2005|09:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL
   [03/02/2008|19:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
   [03/02/2008|19:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
   [08/02/2008|13:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AVS4YOU
   [17/11/2006|13:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BOONTY
   [04/03/2007|15:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Creative
   [25/12/2008|18:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Cyberlink
   [27/12/2007|11:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1\EPSON
   [01/01/2008|21:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\FLEXnet
   [20/01/2009|14:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
   [29/06/2009|12:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google Updater
   [12/11/2008|18:02] C:\DOCUME~1\ALLUSE~1\APPLIC~1\IM
   [12/11/2008|18:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\IncrediMail
   [17/11/2006|13:58] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Macrovision
   [29/10/2008|16:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [11/04/2006|09:02] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
   [16/08/2004|19:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBSI
   [20/12/2007|19:39] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skyline
   [22/08/2009|16:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
   [01/06/2008|20:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TomTom
   [26/03/2007|18:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Trymedia
   [27/12/2007|11:30] C:\DOCUME~1\ALLUSE~1\APPLIC~1\UDL
   [21/12/2008|20:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ulead Systems
   [02/03/2005|13:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint
   [02/07/2006|18:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
   [29/10/2008|16:30] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WindowsLiveInstaller
   [29/10/2008|16:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller

   [13/11/2008|13:41] C:\DOCUME~1\darty\APPLIC~1\Adobe
   [10/12/2006|09:53] C:\DOCUME~1\darty\APPLIC~1\AdobeUM
   [03/04/2005|09:08] C:\DOCUME~1\darty\APPLIC~1\AOL
   [04/04/2008|08:53] C:\DOCUME~1\darty\APPLIC~1\Apple Computer
   [07/11/2008|14:00] C:\DOCUME~1\darty\APPLIC~1\AVS4YOU
   [05/02/2008|20:23] C:\DOCUME~1\darty\APPLIC~1\AVSMedia
   [11/05/2009|18:00] C:\DOCUME~1\darty\APPLIC~1\Bluefive software
   [15/07/2008|08:04] C:\DOCUME~1\darty\APPLIC~1\ConvertTemp
   [04/03/2007|15:08] C:\DOCUME~1\darty\APPLIC~1\Creative
   [25/12/2008|18:54] C:\DOCUME~1\darty\APPLIC~1\CyberLink
   [03/04/2007|18:53] C:\DOCUME~1\darty\APPLIC~1\DeskSoft
   [26/10/2008|19:42] C:\DOCUME~1\darty\APPLIC~1\DivX
   [27/05/2009|11:48] C:\DOCUME~1\darty\APPLIC~1\dvdcss
   [03/04/2005|12:15] C:\DOCUME~1\darty\APPLIC~1\FotoWire
   [23/08/2007|10:11] C:\DOCUME~1\darty\APPLIC~1\GetRightToGo
   [06/02/2007|13:19] C:\DOCUME~1\darty\APPLIC~1\Google
   [03/04/2005|01:23] C:\DOCUME~1\darty\APPLIC~1\Help
   [28/03/2007|15:29] C:\DOCUME~1\darty\APPLIC~1\Hemera
   [16/08/2004|19:19] C:\DOCUME~1\darty\APPLIC~1\Identities
   [19/04/2009|19:14] C:\DOCUME~1\darty\APPLIC~1\ImTOO Software Studio
   [26/10/2008|19:24] C:\DOCUME~1\darty\APPLIC~1\InstallShield
   [10/04/2005|18:41] C:\DOCUME~1\darty\APPLIC~1\Leadertech
   [26/10/2008|19:32] C:\DOCUME~1\darty\APPLIC~1\LG Electronics
   [23/06/2007|18:13] C:\DOCUME~1\darty\APPLIC~1\Macromedia
   [10/04/2005|13:29] C:\DOCUME~1\darty\APPLIC~1\Media Player Classic
   [18/02/2009|13:13] C:\DOCUME~1\darty\APPLIC~1\Microsoft
   [01/06/2008|20:21] C:\DOCUME~1\darty\APPLIC~1\Mozilla
   [05/10/2007|11:19] C:\DOCUME~1\darty\APPLIC~1\MSNInstaller
   [06/06/2009|15:16] C:\DOCUME~1\darty\APPLIC~1\NavX
   [07/05/2009|19:37] C:\DOCUME~1\darty\APPLIC~1\Pegasys Inc
   [07/04/2005|23:56] C:\DOCUME~1\darty\APPLIC~1\Real
   [28/04/2009|11:21] C:\DOCUME~1\darty\APPLIC~1\Samsung
   [29/12/2008|09:49] C:\DOCUME~1\darty\APPLIC~1\Shareaza
   [20/12/2007|19:47] C:\DOCUME~1\darty\APPLIC~1\Skyline
   [10/04/2005|18:42] C:\DOCUME~1\darty\APPLIC~1\Sonic
   [02/03/2005|13:20] C:\DOCUME~1\darty\APPLIC~1\Sun
   [13/10/2007|22:20] C:\DOCUME~1\darty\APPLIC~1\Temporary
   [26/12/2007|14:38] C:\DOCUME~1\darty\APPLIC~1\TomTom
   [03/10/2007|16:26] C:\DOCUME~1\darty\APPLIC~1\TransRender
   [14/11/2008|10:28] C:\DOCUME~1\darty\APPLIC~1\Ulead Systems
   [12/11/2008|18:14] C:\DOCUME~1\darty\APPLIC~1\Uniblue
   [05/09/2007|20:15] C:\DOCUME~1\darty\APPLIC~1\vlc
   [04/05/2007|11:27] C:\DOCUME~1\darty\APPLIC~1\WinRAR
   [15/06/2009|09:57] C:\DOCUME~1\darty\APPLIC~1\XnView

   [03/04/2005|09:08] C:\DOCUME~1\DEFAUL~1\APPLIC~1\AOL
   [16/08/2004|19:19] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
   [01/12/2007|08:44] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
   [02/03/2005|13:33] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Real
   [02/03/2005|13:20] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Sun
   [02/03/2005|13:29] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Symantec
   [02/03/2005|13:27] C:\DOCUME~1\DEFAUL~1\APPLIC~1\You've Got Pictures Screensaver

   [15/11/2006|15:50] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

   [01/12/2007|08:42] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

 
   --------------------\  Tâches planifiées dans C:\WINDOWS	asks

   [23/08/2009 17:01][--a------] C:\WINDOWS	asks\GoogleUpdateTaskMachineUA.job
   [23/08/2009 13:53][--a------] C:\WINDOWS	asks\GoogleUpdateTaskMachineCore.job
   [23/08/2009 14:10][--a------] C:\WINDOWS	asks\Google Software Updater.job
   [23/08/2009 15:32][--ah-----] C:\WINDOWS	asks\User_Feed_Synchronization-{7CCB03B1-058F-4863-B501-2EAEA341A433}.job
   [19/08/2009 14:56][--a------] C:\WINDOWS	asks\AppleSoftwareUpdate.job
   [23/08/2009 13:53][--ah-----] C:\WINDOWS	asks\SA.DAT
   [05/08/2004 15:00][-r-h-----] C:\WINDOWS	asks\desktop.ini

   --------------------\  Listing des dossiers dans C:\Program Files

   [07/11/2008|20:22] C:\Program Files\AC3Filter
   [23/01/2009|20:49] C:\Program Files\Active Pixels 3-05
   [21/06/2006|12:56] C:\Program Files\Adesign
   [19/08/2009|07:38] C:\Program Files\Adobe
   [23/08/2009|17:05] C:\Program Files\Ad-remover
   [30/03/2006|14:12] C:\Program Files\Alwil Software
   [23/11/2008|19:18] C:\Program Files\Anuman Interactive
   [28/12/2008|11:51] C:\Program Files\Apple Software Update
   [23/11/2008|19:28] C:\Program Files\ArcRail 2.0
   [08/02/2008|10:09] C:\Program Files\AviSynth 2.5
   [07/11/2008|14:02] C:\Program Files\AVS4YOU
   [05/02/2008|12:00] C:\Program Files\AVSMedia
   [28/12/2008|11:35] C:\Program Files\Bonjour
   [11/02/2007|21:33] C:\Program Files\Boonty
   [26/12/2008|21:02] C:\Program Files\BoontyGames
   [04/01/2007|14:25] C:\Program Files\Brightstar
   [11/04/2005|11:08] C:\Program Files\Canon
   [04/11/2007|11:08] C:\Program Files\CartaGoGo
   [22/08/2009|13:53] C:\Program Files\CCleaner
   [21/01/2007|10:41] C:\Program Files\CDex
   [25/09/2006|19:14] C:\Program Files\Clockwork Games
   [26/07/2008|01:06] C:\Program Files\Codemasters
   [04/03/2007|15:06] C:\Program Files\Creative
   [25/12/2008|18:45] C:\Program Files\CyberLink
   [10/04/2005|12:25] C:\Program Files\Defensor Demo
   [28/04/2009|10:31] C:\Program Files\DIFX
   [19/09/2006|18:38] C:\Program Files\directx
   [07/05/2009|19:35] C:\Program Files\DivX
   [14/03/2009|21:44] C:\Program Files\DynaV
   [27/12/2006|14:42] C:\Program Files\Emoticons-plus.com
   [22/08/2009|14:21] C:\Program Files\eMule
   [27/12/2007|11:29] C:\Program Files\epson
   [21/12/2008|20:13] C:\Program Files\Fichiers communs
   [23/08/2007|10:09] C:\Program Files\FLV Player
   [10/06/2009|19:55] C:\Program Files\Free Video Converter
   [26/07/2008|00:39] C:\Program Files\Freecorder
   [23/08/2007|10:12] C:\Program Files\Freecorder Toolbar
   [14/12/2007|19:15] C:\Program Files\GlobalStar Software
   [22/06/2009|20:51] C:\Program Files\Google
   [04/03/2008|09:27] C:\Program Files\Google Video
   [28/10/2008|10:25] C:\Program Files\iColorFolder
   [11/02/2009|18:45] C:\Program Files\IncrediMail
   [28/04/2009|10:45] C:\Program Files\InstallShield Installation Information
   [29/07/2009|18:03] C:\Program Files\Internet Explorer
   [07/08/2009|11:47] C:\Program Files\iPod
   [05/02/2008|11:28] C:\Program Files\iPodConverter
   [14/12/2007|18:53] C:\Program Files\ISE Games
   [07/08/2009|11:48] C:\Program Files\iTunes
   [21/12/2008|20:05] C:\Program Files\iWizz
   [23/01/2009|21:14] C:\Program Files\Jasc Software Inc
   [24/07/2007|08:23] C:\Program Files\Java
   [28/09/2006|19:44] C:\Program Files\JeffProd
   [28/09/2006|19:46] C:\Program Files\JHC SoftWare
   [18/12/2006|11:57] C:\Program Files\Kartracing
   [18/06/2009|09:01] C:\Program Files\Kit ADSL
   [02/03/2005|13:27] C:\Program Files\Learn2.com
   [26/10/2008|19:26] C:\Program Files\LG Electronics
   [26/10/2008|19:26] C:\Program Files\LG PC Suite 2
   [10/04/2005|12:25] C:\Program Files\LightDriver
   [08/02/2007|19:24] C:\Program Files\Ligos
   [03/04/2005|12:15] C:\Program Files\Logitech
   [11/10/2007|07:51] C:\Program Files\Magentic
   [10/04/2005|13:28] C:\Program Files\Media Player Classic
   [11/02/2007|20:55] C:\Program Files\Mes Jeux T‚l‚charg‚s
   [21/10/2008|16:05] C:\Program Files\Messenger
   [16/06/2009|07:56] C:\Program Files\Micro Application
   [17/06/2008|20:01] C:\Program Files\Micro‹ds
   [21/12/2008|11:23] C:\Program Files\Microsoft
   [07/07/2007|07:28] C:\Program Files\Microsoft CAPICOM 2.1.0.2
   [16/08/2004|19:11] C:\Program Files\microsoft frontpage
   [27/10/2006|09:28] C:\Program Files\microsoft office
   [29/10/2008|16:33] C:\Program Files\Microsoft SQL Server Compact Edition
   [02/03/2005|13:36] C:\Program Files\Microsoft Works
   [02/03/2005|13:38] C:\Program Files\Microsoft.NET
   [26/12/2008|20:56] C:\Program Files\Midas Interactive Entertainment Ltd
   [12/04/2008|19:16] C:\Program Files\MotoRacer3
   [21/10/2008|15:57] C:\Program Files\Movie Maker
   [08/08/2009|18:10] C:\Program Files\MSBuild
   [05/10/2007|11:20] C:\Program Files\MSN
   [03/04/2006|10:22] C:\Program Files\MSN Apps
   [16/08/2004|19:03] C:\Program Files\MSN Gaming Zone
   [15/11/2006|17:36] C:\Program Files\MSXML 4.0
   [23/08/2009|13:57] C:\Program Files\Navilog1
   [21/10/2008|15:53] C:\Program Files\NetMeeting
   [19/09/2006|18:23] C:\Program Files\Nobilis
   [16/08/2004|19:03] C:\Program Files\Online Services
   [16/05/2008|12:37] C:\Program Files\OpenAL
   [13/08/2009|18:06] C:\Program Files\Outlook Express
   [12/11/2006|15:14] C:\Program Files\Photo Story 3 for Windows
   [24/01/2009|16:45] C:\Program Files\PhotoFiltre
   [23/01/2009|20:19] C:\Program Files\Picasa2
   [30/07/2008|09:25] C:\Program Files\PIXresizer
   [07/09/2007|10:51] C:\Program Files\PND Speed  Camera Sync
   [07/08/2009|11:43] C:\Program Files\QuickTime
   [02/03/2005|13:26] C:\Program Files\Real
   [08/02/2008|10:09] C:\Program Files\Red Kawa
   [11/12/2006|21:40] C:\Program Files\Red Storm Entertainment
   [08/08/2009|18:10] C:\Program Files\Reference Assemblies
   [23/08/2007|10:11] C:\Program Files\Replay Media Catcher
   [18/09/2006|19:10] C:\Program Files\RoadRoll
   [02/03/2005|13:19] C:\Program Files\S3Inc
   [07/01/2009|16:52] C:\Program Files\Safari
   [28/04/2009|10:29] C:\Program Files\Samsung
   [16/08/2004|19:07] C:\Program Files\Services en ligne
   [29/12/2008|09:49] C:\Program Files\Shareaza
   [10/04/2005|21:22] C:\Program Files\Sierra On-Line
   [04/03/2007|14:55] C:\Program Files\SightSpeed
   [23/11/2008|15:07] C:\Program Files\Simulateur de conduite 3D Demo
   [19/03/2009|21:35] C:\Program Files\Singles
   [20/12/2007|19:39] C:\Program Files\Skyline
   [25/07/2008|23:24] C:\Program Files\SMC
   [23/12/2006|16:05] C:\Program Files\SoftChris
   [02/03/2005|13:40] C:\Program Files\Sonic
   [18/12/2006|23:08] C:\Program Files\Sony Corporation
   [22/08/2009|15:38] C:\Program Files\Spybot - Search & Destroy
   [13/04/2006|13:34] C:\Program Files\TGTSoft
   [26/12/2007|14:36] C:\Program Files\TomTom DesktopSuite
   [04/06/2009|20:29] C:\Program Files\TomTom HOME 2
   [04/06/2009|20:30] C:\Program Files\TomTom International B.V
   [14/12/2007|18:34] C:\Program Files\Trymedia
   [11/12/2006|21:13] C:\Program Files\Ubi Soft
   [21/04/2005|22:05] C:\Program Files\Ubisoft
   [25/09/2006|20:08] C:\Program Files\Uninstall Information
   [28/03/2006|09:18] C:\Program Files\USB Driver-Express
   [26/03/2007|20:15] C:\Program Files\Valusoft
   [05/09/2007|20:13] C:\Program Files\VideoLAN
   [02/03/2005|13:27] C:\Program Files\Viewpoint
   [25/04/2007|09:17] C:\Program Files\Virtools
   [30/03/2006|14:19] C:\Program Files\Wanadoo
   [27/04/2005|09:25] C:\Program Files\Wanadoo Messager
   [18/10/2007|07:37] C:\Program Files\Windows Desktop Search
   [05/04/2009|18:02] C:\Program Files\Windows Live
   [21/12/2008|11:23] C:\Program Files\Windows Live SkyDrive
   [14/11/2008|10:18] C:\Program Files\Windows Media Components
   [13/02/2007|09:50] C:\Program Files\Windows Media Connect 2
   [21/10/2008|15:53] C:\Program Files\Windows Media Player
   [21/10/2008|15:53] C:\Program Files\Windows NT
   [28/03/2006|09:20] C:\Program Files\WindowsUpdate
   [04/05/2007|18:56] C:\Program Files\WinRAR
   [10/04/2005|21:38] C:\Program Files\WON
   [16/08/2004|19:11] C:\Program Files\xerox
   [13/04/2006|13:28] C:\Program Files\XviD
   [28/04/2009|10:10] C:\Program Files\Yahoo!
   [01/01/2007|21:09] C:\Program Files\Zuma Deluxe

   --------------------\  Listing des dossiers dans C:\Program Files\Fichiers communs

   [19/08/2009|07:39] C:\Program Files\Fichiers communs\Adobe
   [03/04/2005|09:09] C:\Program Files\Fichiers communs\AOL
   [07/08/2009|11:47] C:\Program Files\Fichiers communs\Apple
   [07/11/2008|14:02] C:\Program Files\Fichiers communs\AVSMedia
   [17/11/2006|13:30] C:\Program Files\Fichiers communs\BOONTY Shared
   [02/03/2005|13:38] C:\Program Files\Fichiers communs\DESIGNER
   [03/04/2005|12:15] C:\Program Files\Fichiers communs\FotoWire
   [27/12/2007|11:33] C:\Program Files\Fichiers communs\InstallShield
   [14/11/2008|10:19] C:\Program Files\Fichiers communs\InterVideo
   [02/03/2005|13:20] C:\Program Files\Fichiers communs\Java
   [03/04/2005|12:12] C:\Program Files\Fichiers communs\Logitech
   [01/01/2008|21:32] C:\Program Files\Fichiers communs\Macrovision Shared
   [28/03/2007|15:23] C:\Program Files\Fichiers communs\Micro Application Shared
   [05/03/2009|19:00] C:\Program Files\Fichiers communs\Microsoft Shared
   [16/08/2004|19:06] C:\Program Files\Fichiers communs\MSSoap
   [02/03/2005|13:26] C:\Program Files\Fichiers communs\Nullsoft
   [03/04/2005|12:44] C:\Program Files\Fichiers communs\ODBC
   [16/11/2008|11:23] C:\Program Files\Fichiers communs\Real
   [16/08/2004|19:06] C:\Program Files\Fichiers communs\Services
   [02/03/2005|13:40] C:\Program Files\Fichiers communs\Sonic Shared
   [16/08/2004|18:56] C:\Program Files\Fichiers communs\SpeechEngines
   [10/04/2005|18:41] C:\Program Files\Fichiers communs\SureThing Shared
   [30/03/2006|14:11] C:\Program Files\Fichiers communs\Symantec Shared
   [21/10/2008|15:53] C:\Program Files\Fichiers communs\System
   [27/03/2008|11:40] C:\Program Files\Fichiers communs\Vbox
   [29/10/2008|16:24] C:\Program Files\Fichiers communs\Windows Live
   [06/03/2008|15:42] C:\Program Files\Fichiers communs\WindowsLiveInstaller
   [16/11/2008|11:23] C:\Program Files\Fichiers communs\xing shared

   --------------------\  Process

   ( 44 Processes )

   iexplore.exe ~ [PID:876]
   iexplore.exe ~ [PID:2012]

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   Aucun fichier / dossier Lop trouvé ! 
 
   --------------------\  Verification du Registre
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2009-08-23 17:50:57
   Windows 5.1.2600 Service Pack 3 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 86
 
   --------------------\  Recherche d'autres infections


   Aucune autre infection trouvée  !

   [F:6][D:6]-> C:\DOCUME~1\darty\LOCALS~1\Temp
   [F:76][D:0]-> C:\DOCUME~1\darty\Cookies
   [F:3154][D:15]-> C:\DOCUME~1\darty\LOCALS~1\TEMPOR~1\content.IE5

   1 - "C:\Lop SD\LopR_1.txt" - 23/08/2009|17:54 - Option : [1]

   --------------------\  Fin du rapport a 17:54:00

gen-hackman · Answer

&#9654 Télécharge HostXpert sur ton Bureau :

&#9654 Décompresse-le (Clic droit >> Extraire ici) 

&#9654 Double-clique sur HostsXpert pour le lancer 

&#9654 clique sur le bouton "Restore MS Hosts File" puis ferme le programme 

PS : Avant de cliquer sur le bouton "Restore MS Hosts File", vérifie que le cadenas en haut à gauche est ouvert sinon tu vas avoir un message d'erreur. 

&#9654 s'il est fermé , clique dessus  :)

ensuite :


&#9654 Télécharge Zeb-Restoreet enregistre ce fichier sur le bureau. 

&#9654-Clic droit Zeb-Restore.zip ==> Extraire tout choisis comme lieu d'enregistrement le bureau.
 
&#9654-Ouvre le dossier ZR_1.0.0.37 ==> double clic sur Zeb-Restore.exe 

&#9654- Coche la case devant :sites de confiance

&#9654- Ne coche aucune autre case 

&#9654-Clique sur Restaurer 

&#9654-Redémarre ton PC

ensuite :

dis les soucis pesistants

Cyn · Answer

J'ai un probleme: le dossier  ZR_1.0.0.37 ne veux pas s'ouvrir.....

gen-hackman · Answer

Clic droit Zeb-Restore.zip ==> Extraire tout choisis comme lieu d'enregistrement le bureau.

Cyn · Answer

C'est bien ce que j'ai fait mais il ne veut pas s'ouvrir
Je comprends pas.

gen-hackman · Answer

message d'erreur ?

Cyn · Answer

non aucun message d'erreur

gen-hackman · Answer

attends je viens de comprendre 


tu as fait ce qu'il fallait , tu as cliqué sur "restaurer" et il ne s'est rien passé....bah c'est normal mdr !!!

Cyn · Answer

Là j'avoue que je comprends pas trop... j'ai pas cliqué sur restaurer car le dossier ZR_1.0.0.37 ne s'est jamais ouvert...
qu'est ce que je fais je redémarre l'ordinateur?

gen-hackman · Answer

là j'avoue que je ne comprends pas pourquoi on peu pas remettre la conformité dans les sites de confiance....ca....

Cyn · Answer

et donc qu'est ce que je fais maintenant????

gen-hackman · Answer

########### [ Option 1  ( Recherche )  ]


&#9654 Télécharge FindyKill de Chiquitine29 sur ton bureau : 

http://sd-1.archive-host.com/membres/up/116615172019703188/FindyKill.exe

! Déconnecte toi et ferme toutes applications en cours ! 

&#9654 Double clique (clic droit "en tant qu'administrateur" pour Vista) sur "FindyKill.exe" pour lancer l'installation et laisse les paramètres d'instalation par défaut . 

&#9654 Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...)

&#9654 Double-clique (clic droit "en tant qu'administrateur" pour Vista)sur le raccourci FindyKill qui est sur ton bureau pour lancer l'outil .
 
&#9654 Au menu principal choisis l'option " F " pour français et tape sur [entrée] . 

&#9654 Au second menu Choisis l'option " 1 " (recherche) et tape sur [entrée] 

&#9654 Laisse travailler l'outil et ne touche à rien ... 

&#9654 Poste le rapport qui apparait à la fin , sur le forum ...

( le rapport est sauvegardé aussi sous C:\FindyKill.txt ) 
( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

Cyn · Answer

Voilà le rapport:

############################## | FindyKill V5.006 |

# User : darty (Administrateurs) # SN044109520409
# Update on 14/08/09 by Chiquitine29
# Start at: 19:55:38 | 23/08/2009
# Website : http://pagesperso-orange.fr/NosTools/index.html

# AMD Sempron(tm)   2800+
# Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 8.0.6001.18702
# Windows Firewall Status : Disabled
# AV : avast! antivirus 4.8.1335 [VPS 090822-0] 4.8.1335 [ (!) Disabled | Updated ]
# FW : Norton Internet Security[ (!) Disabled ]2004

# C:\ # Disque fixe local # 144,04 Go (42,09 Go free) [HDD] # NTFS
# D:\ # Disque CD-ROM
# E:\ # Disque amovible
# F:\ # Disque amovible
# G:\ # Disque amovible
# H:\ # Disque amovible

############################## | Processus actifs |


################## | C: |


################## | C:\WINDOWS |


################## | C:\WINDOWS\system32 |


################## | C:\WINDOWS\system32\drivers |


################## | C:\DOCUME~1\darty\APPLIC~1 |


################## | C:\Documents and Settings\darty\Temporary Internet Files |


################## | Registre / Clés infectieuses |


################## | Etat / Services / Informations |

# Affichage des fichiers cachés : OK
 
# Mode sans echec : OK

# Ndisuio -> Start = 3 ( Good = 3 | Bad = 4 ) 
# EapHost -> Start = 3 ( Good = 2 | Bad = 4 ) 
# Ip6Fw -> Start = 3 ( Good = 2 | Bad = 4 ) 
# SharedAccess -> Start = 2 ( Good = 2 | Bad = 4 ) 
# wuauserv -> Start = 2 ( Good = 2 | Bad = 4 ) 
# wscsvc -> Start = 2 ( Good = 2 | Bad = 4 ) 


################## | Cracks / Keygens / Serials |


################## | ! Fin du rapport # FindyKill V5.006 ! |

gen-hackman · Answer

lol

########### [ Option 2  ( Suppression )  ] 



&#9654 Déconnecte toi et ferme toutes application en cours ( navigateur compris ) . 

&#9654 Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...)

&#9654 Relance "FindyKill" (clic droit "en tant qu'administrateur" pour Vista): au menu principal choisis l'option " F " pour français et tape sur [entrée] .

&#9654 Au second menu choisis l'option 2 (suppression) et tape sur [entrée] 

&#9654 Le pc va redémarrer automatiquement ...

&#9654 le programme va travailler , ne touche à rien ... , ton bureau ne sera pas accessible c est normal !

&#9654 Poste le rapport qui apparait à la fin ( le rapport est sauvegardé aussi sous C:\FindyKill.txt ) 

&#9654 Si le Bureau ne réapparait pas, presse Ctrl + Alt + Suppr , Onglet "Fichier" , "Nouvelle tâche" , tape explorer.exe et valide

Cyn · Answer

Voici le rapport:

############################## | FindyKill V5.006 |

# User : darty (Administrateurs) # SN044109520409
# Update on 14/08/09 by Chiquitine29
# Start at: 20:17:51 | 23/08/2009
# Website : http://pagesperso-orange.fr/NosTools/index.html

# AMD Sempron(tm)   2800+
# Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 8.0.6001.18702
# Windows Firewall Status : Enabled
# AV : avast! antivirus 4.8.1335 [VPS 090822-0] 4.8.1335 [ (!) Disabled | Updated ]
# FW : Norton Internet Security[ (!) Disabled ]2004

# C:\ # Disque fixe local # 144,04 Go (42,09 Go free) [HDD] # NTFS
# D:\ # Disque CD-ROM
# E:\ # Disque amovible
# F:\ # Disque amovible
# G:\ # Disque amovible
# H:\ # Disque amovible

############################## | Processus actifs |


################## | C: |


################## | C:\WINDOWS |

Supprimé ! C:\WINDOWS\Prefetch\WINUPGRO.EXE-0F8DCEDB.pf  

################## | C:\WINDOWS\system32 |


################## | C:\WINDOWS\system32\drivers |


################## | C:\Documents and Settings\darty\Application Data |


################## | Autres ... |


################## | Temporary Internet Files |


################## | Registre / Clés infectieuses | 


################## | Etat / Services / Informations |

# Mode sans echec : OK


# Affichage des fichiers cachés : OK

# Ndisuio -> Start = 3 ( Good = 3 | Bad = 4 ) 
# EapHost -> Start = 2 ( Good = 2 | Bad = 4 ) 
# Ip6Fw -> Start = 2 ( Good = 2 | Bad = 4 ) 
# SharedAccess -> Start = 2 ( Good = 2 | Bad = 4 ) 
# wuauserv -> Start = 2 ( Good = 2 | Bad = 4 ) 
# wscsvc -> Start = 2 ( Good = 2 | Bad = 4 ) 


################## | PEH ... |


################## | Cracks / Keygens / Serials |


################## | ! Fin du rapport # FindyKill V5.006 ! |

gen-hackman · Answer

réessaie zeb-restore

Cyn · Answer

toujours le même probleme ça ne veut pas s'ouvrir

gen-hackman · Answer

refais un OTL stp ?

Cyn · Answer

Voici le 1er lien:

http://www.cijoint.fr/cjlink.php?file=cj200908/cijOT542wf.txt 

le 2nd:

http://www.cijoint.fr/cjlink.php?file=cj200908/cij9TzkPbJ.txt

Cyn · Answer

tu me diras ce que tu en penses demain !!!

gen-hackman · Answer

euh tu peux me les faire passer par l autre lien stp ?

Cyn · Answer

voila il suffit de demander!!!
le premier:

https://www.cjoint.com/?iyiyW7am64

le second:

https://www.cjoint.com/?iyiAnvTSdw

gen-hackman · Answer

&#9654 Télécharge TOOLBAR S&D ( de Eric_71/Team IDN ) sur ton bureau : 


!! Déconnecte toi,desactive tes protections résidentes, et ferme toutes tes applications en cours le temps de la manip. !! 

&#9654 Double-clique sur ToolBar SD.exe pour lancer l'outil et laisse toi guider ...
 
&#9654 option recherche puis [Entrée].  

Un rapport sera généré à la fin du processus : poste son contenu dans ta prochaine réponse 

( le rapport est en outre sauvegardé ici -> C:\TB.txt ) 

Tutoriel

Cyn · Answer

le rappport obtenu:


   -----------\  ToolBar S&D 1.2.9   XP/Vista

   Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Uniprocessor Free : AMD Sempron(tm)   2800+ )
   BIOS : Phoenix - AwardBIOS v6.00PG
   USER : darty ( Administrator )
   BOOT : Normal boot
   Antivirus : avast! antivirus 4.8.1335 [VPS 090823-0] 4.8.1335 (Not Activated)
   Firewall  : Norton Internet Security 2004 (Not Activated)
   C:\ (Local Disk) - NTFS - Total:144 Go (Free:42 Go)
   D:\ (CD or DVD)
   E:\ (USB)
   F:\ (USB)
   G:\ (USB)
   H:\ (USB)

   "C:\ToolBar SD" ( MAJ : 22-08-2009|18:42 )
   Option : [1] ( 24/08/2009| 8:49 )

   -----------\  Recherche de Fichiers / Dossiers ...

   C:\DOCUME~1\ALLUSE~1\MENUDÉ~1\PROGRA~1\Dealio

   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Local Page"="C:\WINDOWS\system32\blank.htm"
   "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
   "SearchMigratedDefaultURL"="https://www.bing.com/?q=&cc=fr&toHttps=1&redig=1E53E3A9742C4065BE103AB0F6C5F6C4{searchTerms}"
   "Default_Page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
   "Default_search_url"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "Search bar"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Window Title"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "Local Page"="C:\WINDOWS\system32\blank.htm"
   "Start Page"="https://www.msn.com/fr-fr"
   "Search Bar"="http://www.bing.com/spresults.aspx"
   "Default_Page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
   "CustomizeSearch"="http://dnl.crawler.com/support/sa_customize.aspx?TbId=66022"


   --------------------\  Recherche d'autres infections


   Aucune autre infection trouvée  !


   1 - "C:\ToolBar SD\TB_1.txt" - 24/08/2009| 8:52 - Option : [1]

   -----------\  Fin du rapport a  8:52:20,17

gen-hackman · Answer

&#9654 Relance Toolbar-S&D en double-cliquant sur le raccourci
 
&#9654 Tape sur "2" puis valide en appuyant sur "Entrée".
 
! Ne ferme pas la fenêtre lors de la suppression !
 
Un rapport sera généré, 

&#9654 poste son contenu ici. 

NOTE : Si ton Bureau ne réapparait pas, appuie simultanément sur Ctrl+Alt+Suppr pour ouvrir le Gestionnaire des tâches. 
Rends-toi sur l'onglet "Processus". Clique en haut à gauche sur Fichier et choisis "Exécuter..." 
Tape explorer puis valide.

Cyn · Answer

le rapport:


   -----------\  ToolBar S&D 1.2.9   XP/Vista

   Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Uniprocessor Free : AMD Sempron(tm)   2800+ )
   BIOS : Phoenix - AwardBIOS v6.00PG
   USER : darty ( Administrator )
   BOOT : Normal boot
   Antivirus : avast! antivirus 4.8.1335 [VPS 090823-0] 4.8.1335 (Not Activated)
   Firewall  : Norton Internet Security 2004 (Not Activated)
   C:\ (Local Disk) - NTFS - Total:144 Go (Free:42 Go)
   D:\ (CD or DVD)
   E:\ (USB)
   F:\ (USB)
   G:\ (USB)
   H:\ (USB)

   "C:\ToolBar SD" ( MAJ : 22-08-2009|18:42 )
   Option : [2] ( 24/08/2009| 9:02 )

   -----------\ SUPPRESSION

   Supprime! - C:\DOCUME~1\ALLUSE~1\MENUDÉ~1\PROGRA~1\Dealio

   -----------\  Recherche de Fichiers / Dossiers ...


   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Local Page"="C:\WINDOWS\system32\blank.htm"
   "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
   "SearchMigratedDefaultURL"="https://www.bing.com/?q=&cc=fr&toHttps=1&redig=1E53E3A9742C4065BE103AB0F6C5F6C4{searchTerms}"
   "Default_Page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
   "Default_search_url"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "Search bar"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Window Title"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "Local Page"="C:\WINDOWS\system32\blank.htm"
   "Start Page"="https://www.msn.com/fr-fr/"
   "Search Bar"="http://www.bing.com/spresults.aspx"
   "Default_Page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
   "CustomizeSearch"="http://dnl.crawler.com/support/sa_customize.aspx?TbId=66022"


   --------------------\  Recherche d'autres infections


   Aucune autre infection trouvée  !


   1 - "C:\ToolBar SD\TB_1.txt" - 24/08/2009| 8:52 - Option : [1]
   2 - "C:\ToolBar SD\TB_2.txt" - 24/08/2009| 9:04 - Option : [2]

   -----------\  Fin du rapport a  9:04:40,85

gen-hackman · Answer

&#9654 Double clic sur OTL.exe pour le lancer.


&#9654Copie la liste qui se trouve en gras ci-dessous,

&#9654 colle-la dans la zone sous Customs Scans/Fixes :

:processes
explorer.exe
iexplore.exe
firefox.exe
msnmsgr.exe
Teatimer.exe

:services
Boonty Games

:OTL
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\ipp - No CLSID value found
O16 - DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab (Java Plug-in 1.5.0_09)
O16 - DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab (Java Plug-in 1.5.0_10)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab (Java Plug-in 1.6.0_01)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB (Reg Error: Key error.)


:reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"=-
"iTunesHelper"=-
"QuickTime Task"=-
"TkBellExe"=-
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\WINDOWS\system32\sessmgr.exe"="C:\WINDOWS\system32\sessmgr.exe:*:Enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Internet Explorer\iexplore.exe"="C:\Program Files\Internet Explorer\iexplore.exe:*:Enabled:Internet Explorer"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search]
"CustomizeSearch"=""
"SearchAssistant"=""

:files
C:\Documents and Settings\darty\Application Data\Temporary
C:\Documents and Settings\All Users\Application Data\BOONTY
C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
C:\Documents and Settings\darty\Bureau\Internet Explorer.lnk

:commands
[emptytemp]
[reboot]


&#9654 Clique sur RunFix pour lancer la suppression.


&#9654 Poste le rapport.

Cyn · Answer

le rapport:

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
Process iexplore.exe killed successfully!
No active process named firefox.exe was found!
No active process named msnmsgr.exe was found!
No active process named Teatimer.exe was found!
========== SERVICES/DRIVERS ==========

Service\Driver Boonty Games deleted successfully.
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\msdaipp\ deleted successfully.
File Protocol\Handler\msdaipp - No CLSID value found not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ipp\ deleted successfully.
File Protocol\Handler\ipp - No CLSID value found not found.
Starting removal of ActiveX control {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {33564D57-0000-0010-8000-00AA00389B71}
C:\WINDOWS\Downloaded Program Files\WMV9VCM.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{33564D57-0000-0010-8000-00AA00389B71}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{33564D57-0000-0010-8000-00AA00389B71}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{33564D57-0000-0010-8000-00AA00389B71}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{33564D57-0000-0010-8000-00AA00389B71}\ not found.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Adobe Reader Speed Launcher deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\iTunesHelper deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\QuickTime Task deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\TkBellExe deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\"C:\WINDOWS\system32\sessmgr.exe"|"C:\WINDOWS\system32\sessmgr.exe:*:Enabled:@xpsp2res.dll,-22019" /E : value set successfully!
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\"C:\Program Files\Internet Explorer\iexplore.exe"|"C:\Program Files\Internet Explorer\iexplore.exe:*:Enabled:Internet Explorer" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search\"CustomizeSearch"|"" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search\"SearchAssistant"|"" /E : value set successfully!
========== FILES ==========
C:\Documents and Settings\darty\Application Data\Temporary moved successfully.
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses moved successfully.
C:\Documents and Settings\All Users\Application Data\BOONTY moved successfully.
C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}\x86\x86 moved successfully.
C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}\x86 moved successfully.
C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906} moved successfully.
C:\Documents and Settings\darty\Bureau\Internet Explorer.lnk moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: darty
File delete failed. C:\Documents and Settings\darty\Local Settings\Temp\~DFBF64.tmp scheduled to be deleted on reboot.
->Temp folder emptied: 950272 bytes
->Temporary Internet Files folder emptied: 63374236 bytes
->Java cache emptied: 0 bytes
->Apple Safari cache emptied: 362812 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
 
User: LocalService
->Temp folder emptied: 66016 bytes
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 7152013 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Propriétaire
 
%systemdrive% .tmp files removed: 0 bytes
C:\WINDOWS\msdownld.tmp folder deleted successfully.
%systemroot% .tmp files removed: 19569 bytes
%systemroot%\System32 .tmp files removed: 1613872 bytes
File delete failed. C:\WINDOWS	emp\_avast4_\Webshlock.txt scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS	emp\Perflib_Perfdata_580.dat scheduled to be deleted on reboot.
Windows Temp folder emptied: 49816 bytes
RecycleBin emptied: 438000 bytes
 
Total Files Cleaned = 70,66 mb
 
 
OTL by OldTimer - Version 3.0.10.7 log created on 08242009_092446

Files\Folders moved on Reboot...
C:\Documents and Settings\darty\Local Settings\Temp\~DFBF64.tmp moved successfully.
File move failed. C:\WINDOWS	emp\_avast4_\Webshlock.txt scheduled to be moved on reboot.
C:\WINDOWS	emp\Perflib_Perfdata_580.dat moved successfully.

Registry entries deleted on Reboot...

gen-hackman · Answer

Imprime ces instructions car il faudra fermer toutes les fenêtres et applications lors de l'installation et de l'analyse.



&#9654 Télécharge :

Malwarebytes  

ou  :

Malwarebytes

&#9654 Installe le ( choisis bien "francais" ; ne modifie pas les paramètres d'installe ) et mets le à jour .

(NB : Si tu as un message d'erreur t'indiquant qu'il te manque "COMCTL32.OCX" lors de l'installe, alors télécharge le ici : COMCTL32.OCX

&#9654 Potasses le Tuto pour te familiariser avec le prg :


( cela dit, il est très simple d'utilisation ).

relance malwarebytes en suivant scrupuleusement ces consignes :

! Déconnecte toi et ferme toutes applications en cours !

&#9654 Lance Malwarebyte's .

Fais un examen dit "Complet" .

&#9654 Laisse le programme travailler ( et ne rien faire d'autre avec le PC durant le scan ).
&#9654 à la fin tu cliques sur "résultat" .
&#9654 Vérifie que tous les objets infectés soient validés, puis clique sur " suppression " .

&#9654 Note : si il faut redémarrer ton PC pour finir le nettoyage, fais le !


&#9654 Poste le rapport sauvegardé après la suppression des objets infectés (dans l'onglet "rapport/log"de Malwarebytes, le dernier en date)

Cyn · Answer

Je suis désolé maisje ne peux pas le faire maintenant car je dois partir, je le ferais donc soit ce soir soit demain !

gen-hackman · Answer

bien , à te lire ;)

Cyn · Answer

j'ai un probleme...j'ai bien télécharger et installé Malwarebytes mais il ne veut pas s'ouvrir comme le precedent....

Cyn · Answer

En plus maintenant quand j'ouvre internet ce n'est plus ma page d'acceuil  j'ai essayé de la remettre mais ça ne marche pas : je tombe toujours sur : microids.com et quand je veux le changer en faisant propiétés sur le lien du bureau dans cible il y a:
  "C:\Program Files\Internet Explorer\iexplore.exe"  -nohome https://www.microids.com/  
et si je met OK il me dit:
 "le dossier'D:\' specifié dans le champs demarré n'est pas valide. verifier que le dossier existe et que le chemin est correct"

Probleme en allumant l'ordi

48 réponses

Votre réponse

Newsletters