Pub intempestives

Résolu
Gunnar -  
Bonjour,

Comme beaucoup sur ce site, comme j'ai pu le remarquer, je rencontre un problème de pages publicitaires qui s'ouvrent toute seules

j'ai déjà téléchargé naviglog et j'ai déjà copié le rapport si l'un d'entre vous peut me donner un coup de main

Merci d'avance
Configuration: Windows XP
Firefox 3.0.8

33 réponses

Résumé de la discussion

Des pages publicitaires qui s'ouvrent automatiquement et l'analyse d'un rapport HijackThis sur Windows XP et Firefox 3.0.8 aident à identifier l'origine du dysfonctionnement observé précis. Des réponses décrivent des éléments potentiellement indésirables et des barres d'outils détectées par HijackThis, notamment SweetIM, Windows Live Toolbar, Online_TV et LphantBar, en précisant leurs emplacements et liens suspects. Les journaux montrent une liste longue de processus, services et programmes liés à Avast, Ad-Aware, LightScribe et d'autres outils installés, suggérant une contamination multiple et la nécessité d'un nettoyage ciblé. D'autres éléments détectés incluent des barres d'outils associées à des jeux en ligne comme Titan Poker et PokerStars, ce qui peut nécessiter une désinstallation manuelle et un redémarrage en mode sans échec.

Bobot (l’IA à votre service)
  1. Gunnar Auteur
    ok c'est bon je n'ai plus aucune pub qui s'affiche

    Je te remercie pour tout tu m'a été d'une très grande aide

    merci encore à une prochaine fois

    @+
    1. hisaeh
      Parfait !

      Peux tu me confirmer ne plus avoir de pubs intempestives ?

      Ensuite, je pense qu'il te faudrait changer d'antivirus, en virant Avast (qui n'est plus vraiment réactif en ce moment) et passer à Antivir.

      C'est un gage de sécurité complémentaire, mais il ne faut pas rêver...le meilleur anti-virus, c'est toi.

      Conserves Malwarebytes, et utilises le regulierement après l'avoir mis à jour .

      Bon surf.

      1. Gunnar Auteur
        et pour terminer j'ai crée mon propre point de restauration

        merci à ce soir
        3. Gunnar Auteur
          Et voila le résultat de toolcleaner

          [ Rapport ToolsCleaner version 2.3.5 (par A.Rothstein & dj QUIOU) ]

          --> Recherche:

          C:\fixnavi.txt: trouvé !
          C:\cleannavi.txt: trouvé !
          C:\TB.txt: trouvé !
          C:\Toolbar SD: trouvé !
          C:\Documents and Settings\All Users\Bureau\Navilog1.lnk: trouvé !
          C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
          C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1: trouvé !
          C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
          C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1\Navilog1.lnk: trouvé !
          C:\Documents and Settings\mimi et steph\Bureau\HijackThis.lnk: trouvé !
          C:\Documents and Settings\mimi et steph\Bureau\Ad-remover.lnk: trouvé !
          C:\Documents and Settings\mimi et steph\Bureau\ToolBarSD.exe: trouvé !
          C:\Documents and Settings\mimi et steph\Menu Démarrer\Programmes\Ad-remover: trouvé !
          C:\Documents and Settings\mimi et steph\Mes documents\cleannavi.txt: trouvé !
          C:\Program Files\Navilog1: trouvé !
          C:\Program Files\Ad-remover: trouvé !
          C:\Program Files\Navilog1\Navilog1.bat: trouvé !
          C:\Program Files\Trend Micro\HijackThis: trouvé !
          C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
          C:\Program Files\Trend Micro\HijackThis\hijackthis.log: trouvé !

          ---------------------------------
          --> Suppression:

          C:\Documents and Settings\All Users\Bureau\Navilog1.lnk: supprimé !
          C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: supprimé !
          C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1\Navilog1.lnk: supprimé !
          C:\Documents and Settings\mimi et steph\Bureau\HijackThis.lnk: supprimé !
          C:\Documents and Settings\mimi et steph\Bureau\Ad-remover.lnk: supprimé !
          C:\Documents and Settings\mimi et steph\Bureau\ToolBarSD.exe: supprimé !
          C:\Program Files\Navilog1\Navilog1.bat: supprimé !
          C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
          C:\fixnavi.txt: supprimé !
          C:\cleannavi.txt: supprimé !
          C:\TB.txt: supprimé !
          C:\Documents and Settings\mimi et steph\Mes documents\cleannavi.txt: supprimé !
          C:\Program Files\Trend Micro\HijackThis\hijackthis.log: supprimé !
          C:\Toolbar SD: supprimé !
          C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: supprimé !
          C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1: supprimé !
          C:\Documents and Settings\mimi et steph\Menu Démarrer\Programmes\Ad-remover: supprimé !
          C:\Program Files\Navilog1: supprimé !
          C:\Program Files\Ad-remover: supprimé !
          C:\Program Files\Trend Micro\HijackThis: supprimé !
          1. Gunnar Auteur
            pour le 2 j'ai utilisé regcleaner pour d'installer Boontygame et j'ai ensuite supprimer manuellement le dossier dans programefiles

            allé hop étape 3 maintenant !!!
            1. Gunnar Auteur
              bonjour,

              alors pour les pubs ça à l'air d'être mieux en tout cas rien depuis hier

              sinon oui je joue au poker en ligne et je regarde également des matchs de foot sur le net depuis peu.

              Voici le rapport du 1 :

              Logfile of Trend Micro HijackThis v2.0.2
              Scan saved at 12:58:41, on 20/04/2009
              Platform: Windows XP SP3 (WinNT 5.01.2600)
              MSIE: Internet Explorer v7.00 (7.00.6000.16827)
              Boot mode: Normal

              Running processes:
              C:\WINDOWS\System32\smss.exe
              C:\WINDOWS\system32\csrss.exe
              C:\WINDOWS\system32\winlogon.exe
              C:\WINDOWS\system32\services.exe
              C:\WINDOWS\system32\lsass.exe
              C:\WINDOWS\system32\svchost.exe
              C:\WINDOWS\system32\svchost.exe
              C:\WINDOWS\System32\svchost.exe
              C:\WINDOWS\system32\svchost.exe
              C:\WINDOWS\system32\svchost.exe
              C:\WINDOWS\Explorer.EXE
              C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
              C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
              C:\Program Files\Alwil Software\Avast4\ashServ.exe
              C:\WINDOWS\system32\spoolsv.exe
              C:\WINDOWS\system32\svchost.exe
              C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
              C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
              C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
              C:\Program Files\Bonjour\mDNSResponder.exe
              C:\WINDOWS\eHome\ehRecvr.exe
              C:\WINDOWS\eHome\ehSched.exe
              c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
              C:\WINDOWS\system32\nvsvc32.exe
              C:\Program Files\Spyware Doctor\pctsAuxs.exe
              C:\Program Files\Spyware Doctor\pctsSvc.exe
              C:\Program Files\Spyware Doctor\pctsTray.exe
              C:\WINDOWS\system32\svchost.exe
              C:\WINDOWS\system32\svchost.exe
              C:\WINDOWS\ehome\mcrdsvc.exe
              C:\WINDOWS\system32\wuauclt.exe
              C:\WINDOWS\system32\wbem\wmiprvse.exe
              C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
              C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
              C:\WINDOWS\system32\dllhost.exe
              C:\WINDOWS\System32\alg.exe
              C:\WINDOWS\ehome\ehtray.exe
              C:\WINDOWS\eHome\ehmsas.exe
              C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
              C:\WINDOWS\RTHDCPL.EXE
              C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
              C:\WINDOWS\system32\LVCOMSX.EXE
              C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
              C:\WINDOWS\system32\ctfmon.exe
              C:\Program Files\Microsoft Office\Office\WINWORD.EXE
              C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

              R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.microsoft.com/fwlink/?linkid=54896
              R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR
              R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR
              R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
              R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
              O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
              O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
              O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
              O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
              O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
              O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
              O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
              O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
              O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
              O4 - HKLM\..\Run: [LaunchApp] Alaunch
              O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
              O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
              O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
              O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
              O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
              O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
              O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
              O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
              O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
              O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
              O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
              O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
              O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
              O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
              O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
              O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
              O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
              O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
              O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
              O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
              O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
              O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
              O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
              O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
              O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?e316b8ba3f7e491c9313402f97baf6cd
              O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?e316b8ba3f7e491c9313402f97baf6cd
              O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
              O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
              O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
              O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
              O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
              O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
              O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
              O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
              O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
              O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
              O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
              O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
              O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
              O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
              O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
              O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
              O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
              O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
              O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
              O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
              O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
              O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
              O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
              1. hisaeh
                Un grand ménage de fait....

                Pour résumer ta situation :

                1) As tu encore des pubs intempestives ?
                2) Tu as installé trop de Toolbar et pour certaines néfastes
                3) Tu joues au poker en ligne, c'est une source d'ennuis...

                Il faut savoir que dans ton cas pour l'instant, ces "infections" sont "légères" mais qu'elles t'exposent à des risques plus graves ( logiciels espions, détournements en tous genres, voire malwares plus "destructeurs"..., etc)

                Aussi, si tu souhaites continuer à profiter de jeux en ligne, ou de Tv en ligne, je t'invite à trouver un ordinateur qui sera utilisé spécifiquement pour ces opérations sans mettre en péril le reste de ton surf plus "conventionnel" (banque, recherche sur internet, etc) qui de ce fait sera à l'abri de logiciel espions....

                Il reste quelques petites choses et vérifications à faire :

                Lance Hijackthis et choisis la 2ème option:
                Do a system scan only

                A gauche, tu coches les lignes suivantes : 

                R3 - URLSearchHook: Online_TV Toolbar - {40d1c3a7-4ffb-4443-b3a0-a64b2df7fc3b} - C:\Program Files\Online_TV\tbOnl1.dll 
R3 - URLSearchHook: LphantBar Toolbar - {6b284373-1765-4464-a587-80fbc2b2eefa} - C:\Program Files\LphantBar\tbLph1.dll 
O2 - BHO: Online_TV Toolbar - {40d1c3a7-4ffb-4443-b3a0-a64b2df7fc3b} - C:\Program Files\Online_TV\tbOnl1.dll 
O2 - BHO: LphantBar Toolbar - {6b284373-1765-4464-a587-80fbc2b2eefa} - C:\Program Files\LphantBar\tbLph1.dll
O3 - Toolbar: Online_TV Toolbar - {40d1c3a7-4ffb-4443-b3a0-a64b2df7fc3b} - C:\Program Files\Online_TV\tbOnl1.dll 
O3 - Toolbar: LphantBar Toolbar - {6b284373-1765-4464-a587-80fbc2b2eefa} - C:\Program Files\LphantBar\tbLph1.dll 
9 - Extra button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files\PokerStars.NET\PokerStarsUpdate.exe 
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe


                Tu fermes toutes tes applications y compris ton navigateur internet, tu te deconnectes, et tu cliques en bas sur:
                FIXCHECKED

                Tu redémarres l'ordinateur et tu fais un nouveau rapport Hijackthis.

                2) Vois si tu peux désinstaller Boonty Games et/ou supprimer le dossier dans Program Files.

                3) Nettoyage des outils :
                Télécharge ToolsCleaner .sur le bureau
                http://pc-system.fr/

                Double-clique sur ToolsCleaner2.exe --> Recherche -->puis à la fin du scan: Suppression.
                Il est possible que ton bureau disparaisse.

                Fais un copier/coller du rapport qui se trouve dans C:\TCleaner.txt

                4) Mets à jour ta version de java. c'est une faille de sécurité qu'il faut combler.
                va sur ce site
                https://www.java.com/fr/download/manual.jsp

                Dans la partie Windows, clique sur vérifier maintenant.
                Une autre fenêtre va s'ouvrir. Suis les instructions.

                5) Les points de restauration :
                - Panneau de configuration --> Système --> Restauration du système
                cocher " Désactiver la restauration .... " (si elle est cochée sinon la décocher -- > valider -- > cocher)
                Une fenêtre va s’ouvrir pour t’avertir que les points de restauration existants seront supprimés.
                Accepte.
                Redémarre.
                Et recommence l’opération pour réactiver la restauration.
                Décoche ensuite « Désactiver la restauration .... » pour réactiver la restauration système
                - Tu vas recréer un point de restauration propre.
                Pour recréer un point de restauration :
                Démarrer --> Programmes --> Accessoires --> Outils système --> Restauration système
                Choisis "Créer un point de restauration". Suis les invites.

                A ce soir...
                1. Gunnar Auteur
                  Merci encore bon courage pour éplucher tout çà et à demain
                  1. Gunnar Auteur
                    et enfin le dernier

                    Logfile of Trend Micro HijackThis v2.0.2
                    Scan saved at 00:37:30, on 20/04/2009
                    Platform: Windows XP SP3 (WinNT 5.01.2600)
                    MSIE: Internet Explorer v7.00 (7.00.6000.16827)
                    Boot mode: Normal

                    Running processes:
                    C:\WINDOWS\System32\smss.exe
                    C:\WINDOWS\system32\csrss.exe
                    C:\WINDOWS\system32\winlogon.exe
                    C:\WINDOWS\system32\services.exe
                    C:\WINDOWS\system32\lsass.exe
                    C:\WINDOWS\system32\svchost.exe
                    C:\WINDOWS\system32\svchost.exe
                    C:\WINDOWS\System32\svchost.exe
                    C:\WINDOWS\system32\svchost.exe
                    C:\WINDOWS\system32\svchost.exe
                    C:\WINDOWS\Explorer.EXE
                    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
                    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                    C:\Program Files\Alwil Software\Avast4\ashServ.exe
                    C:\WINDOWS\system32\spoolsv.exe
                    C:\WINDOWS\system32\svchost.exe
                    C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
                    C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                    C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
                    C:\Program Files\Bonjour\mDNSResponder.exe
                    C:\WINDOWS\eHome\ehRecvr.exe
                    C:\WINDOWS\eHome\ehSched.exe
                    c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
                    C:\Program Files\Spyware Doctor\pctsAuxs.exe
                    C:\Program Files\Spyware Doctor\pctsSvc.exe
                    C:\Program Files\Spyware Doctor\pctsTray.exe
                    C:\WINDOWS\system32\svchost.exe
                    C:\WINDOWS\system32\svchost.exe
                    C:\WINDOWS\ehome\mcrdsvc.exe
                    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                    C:\WINDOWS\system32\dllhost.exe
                    C:\WINDOWS\System32\alg.exe
                    C:\WINDOWS\ehome\ehtray.exe
                    C:\WINDOWS\eHome\ehmsas.exe
                    C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
                    C:\WINDOWS\RTHDCPL.EXE
                    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                    C:\WINDOWS\system32\LVCOMSX.EXE
                    C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
                    C:\WINDOWS\system32\ctfmon.exe
                    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
                    C:\WINDOWS\system32\wbem\wmiprvse.exe

                    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
                    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
                    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
                    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                    R3 - URLSearchHook: Online_TV Toolbar - {40d1c3a7-4ffb-4443-b3a0-a64b2df7fc3b} - C:\Program Files\Online_TV\tbOnl1.dll
                    R3 - URLSearchHook: LphantBar Toolbar - {6b284373-1765-4464-a587-80fbc2b2eefa} - C:\Program Files\LphantBar\tbLph1.dll
                    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                    O2 - BHO: Online_TV Toolbar - {40d1c3a7-4ffb-4443-b3a0-a64b2df7fc3b} - C:\Program Files\Online_TV\tbOnl1.dll
                    O2 - BHO: LphantBar Toolbar - {6b284373-1765-4464-a587-80fbc2b2eefa} - C:\Program Files\LphantBar\tbLph1.dll
                    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
                    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
                    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                    O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
                    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                    O3 - Toolbar: Online_TV Toolbar - {40d1c3a7-4ffb-4443-b3a0-a64b2df7fc3b} - C:\Program Files\Online_TV\tbOnl1.dll
                    O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
                    O3 - Toolbar: LphantBar Toolbar - {6b284373-1765-4464-a587-80fbc2b2eefa} - C:\Program Files\LphantBar\tbLph1.dll
                    O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
                    O4 - HKLM\..\Run: [LaunchApp] Alaunch
                    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
                    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
                    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
                    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
                    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
                    O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
                    O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
                    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
                    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
                    O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
                    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                    O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
                    O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
                    O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
                    O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
                    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                    O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
                    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
                    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
                    O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
                    O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?e316b8ba3f7e491c9313402f97baf6cd
                    O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?e316b8ba3f7e491c9313402f97baf6cd
                    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
                    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
                    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                    O9 - Extra button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files\PokerStars.NET\PokerStarsUpdate.exe
                    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
                    O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
                    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
                    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                    O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
                    O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
                    O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
                    O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
                    O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
                    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
                    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
                    O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
                    O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
                    1. Gunnar Auteur
                      Rapport du 5

                      Malwarebytes' Anti-Malware 1.36
                      Version de la base de données: 2012
                      Windows 5.1.2600 Service Pack 3

                      20/04/2009 00:34:02
                      mbam-log-2009-04-20 (00-34-02).txt

                      Type de recherche: Examen rapide
                      Eléments examinés: 76472
                      Temps écoulé: 3 minute(s), 57 second(s)

                      Processus mémoire infecté(s): 0
                      Module(s) mémoire infecté(s): 0
                      Clé(s) du Registre infectée(s): 1
                      Valeur(s) du Registre infectée(s): 0
                      Elément(s) de données du Registre infecté(s): 0
                      Dossier(s) infecté(s): 0
                      Fichier(s) infecté(s): 0

                      Processus mémoire infecté(s):
                      (Aucun élément nuisible détecté)

                      Module(s) mémoire infecté(s):
                      (Aucun élément nuisible détecté)

                      Clé(s) du Registre infectée(s):
                      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\multi media france toolbar (Adware.Trace) -> Quarantined and deleted successfully.

                      Valeur(s) du Registre infectée(s):
                      (Aucun élément nuisible détecté)

                      Elément(s) de données du Registre infecté(s):
                      (Aucun élément nuisible détecté)

                      Dossier(s) infecté(s):
                      (Aucun élément nuisible détecté)

                      Fichier(s) infecté(s):
                      (Aucun élément nuisible détecté)
                      1. Gunnar Auteur
                        voici le rapport du 4 :

                        -----------\\ ToolBar S&D 1.2.8 XP/Vista

                        Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
                        X86-based PC ( Multiprocessor Free : AMD Athlon(tm) 64 Processor 3500+ )
                        BIOS : )Phoenix - Award WorkstationBIOS v6.00PG
                        USER : mimi et steph ( Administrator )
                        BOOT : Normal boot
                        Antivirus : avast! antivirus 4.8.1335 [VPS 090419-0] 4.8.1335 (Activated)
                        C:\ (Local Disk) - NTFS - Total:71 Go (Free:9 Go)
                        D:\ (Local Disk) - FAT32 - Total:71 Go (Free:57 Go)
                        E:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go)
                        F:\ (USB)
                        G:\ (USB)
                        H:\ (USB)
                        I:\ (USB)
                        J:\ (USB)

                        "C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
                        Option : [2] ( 20/04/2009| 0:22 )

                        -----------\\ SUPPRESSION

                        Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-12-12-22-57-16
                        Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-12-12-22-57-16.xm_
                        Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\about.gif
                        Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\action.gif
                        Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\age_of_emerald16x16.gif
                        Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\aquapark16x16.gif
                        Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\arcade.gif
                        Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\Azada16x16.gif
                        Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\bricks_of_lore16x16.gif
                        Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\burger_shop16x16.gif
                        Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\buy.gif
                        Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\cards.gif
                        Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\caution.gif
                        Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\cradle_rome16x16.gif
                        Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\deals.gif
                        Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\death_nile16x16.gif
                        Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\diner_dash_hometown_hero16x16.gif
                        Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\download.gif
                        Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\el_dorado_quest16x16.gif
                        Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\emerald_tale16x16.gif
                        Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\fashion_fits16x16.gif
                        Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\feedback.gif
                        Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\gold_miner_vegas16x16.gif
                        Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\help.gif
                        Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\highlight.gif
                        Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\jigsaw.gif
                        Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\kids.gif
                        Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\luxor3_new16x16.gif
                        Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\mahjong.gif
                        Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\multiplayer.gif
                        Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\mygames.gif
                        Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\newGames.gif
                        Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\oberonconfig.xm_
                        Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\obSearchHistory.dat
                        Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\partner.gif
                        Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\poker_superstars_316x16.gif
                        Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\popup_off.gif
                        Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\popup_on.gif
                        Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\puzzle.gif
                        Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\search.gif
                        Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\sendafriend.gif
                        Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\sports.gif
                        Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\stone_of_destiny16x16.gif
                        Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\trial.gif
                        Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\uninstall.gif
                        Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\update.gif
                        Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\webgame.gif
                        Supprime! - C:\Program Files\GamesBar\Localization-French.ini
                        Supprime! - C:\Program Files\GamesBar\uninst.exe
                        Supprime! - C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\GamesBar
                        Supprime! - C:\Program Files\Multi_Media_France\INSTALL.LOG
                        Supprime! - C:\Program Files\Multi_Media_France\LanguagePack.xml
                        Supprime! - C:\Program Files\Multi_Media_France\LocalSettings.txt
                        Supprime! - C:\Program Files\Multi_Media_France\RadioPlayer
                        Supprime! - C:\Program Files\Multi_Media_France\tbMul0.dll
                        Supprime! - C:\Program Files\Multi_Media_France\tbMul1.dll
                        Supprime! - C:\Program Files\Multi_Media_France\tbMult.dll
                        Supprime! - C:\Program Files\Multi_Media_France\ThirdPartyComponents.xml
                        Supprime! - C:\Program Files\Multi_Media_France\toolbar.cfg
                        Supprime! - C:\Program Files\Multi_Media_France\UNWISE.EXE
                        Supprime! - C:\Program Files\Multi_Media_France\UNWISE.INI
                        Supprime! - C:\Program Files\Multi_Media_France\update.xml
                        Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar
                        Supprime! - C:\Program Files\GamesBar
                        Supprime! - C:\Program Files\Multi_Media_France

                        -----------\\ Recherche de Fichiers / Dossiers ...

                        -----------\\ [..\Internet Explorer\Main]

                        [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
                        "Local Page"="C:\\WINDOWS\\system32\\blank.htm"
                        "Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
                        "Search Page"="https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC"
                        "Search Bar"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
                        "SearchMigratedDefaultURL"="https://www.bing.com/?scope=web&mkt=fr-FR{searchTerms}&src={referrer:source?}"
                        "Default_search_url"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
                        "Default_page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
                        "Window Title"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"

                        [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
                        "Default_Page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
                        "Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
                        "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
                        "Start Page"="https://www.msn.com/fr-fr/"
                        "Search bar"="http://www.bing.com/spresults.aspx"

                        --------------------\\ Recherche d'autres infections

                        Aucune autre infection trouvée !

                        1 - "C:\ToolBar SD\TB_1.txt" - 20/04/2009| 0:24 - Option : [2]

                        -----------\\ Fin du rapport a 0:24:05,84
                        2. Gunnar Auteur
                          voici le rapport du 2 :

                          Logfile of Trend Micro HijackThis v2.0.2
                          Scan saved at 00:09:32, on 20/04/2009
                          Platform: Windows XP SP3 (WinNT 5.01.2600)
                          MSIE: Internet Explorer v7.00 (7.00.6000.16827)
                          Boot mode: Normal

                          Running processes:
                          C:\WINDOWS\System32\smss.exe
                          C:\WINDOWS\system32\csrss.exe
                          C:\WINDOWS\system32\winlogon.exe
                          C:\WINDOWS\system32\services.exe
                          C:\WINDOWS\system32\lsass.exe
                          C:\WINDOWS\system32\svchost.exe
                          C:\WINDOWS\system32\svchost.exe
                          C:\WINDOWS\System32\svchost.exe
                          C:\WINDOWS\system32\svchost.exe
                          C:\WINDOWS\system32\svchost.exe
                          C:\WINDOWS\Explorer.EXE
                          C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
                          C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                          C:\Program Files\Alwil Software\Avast4\ashServ.exe
                          C:\WINDOWS\system32\spoolsv.exe
                          C:\WINDOWS\system32\svchost.exe
                          C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
                          C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                          C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
                          C:\Program Files\Bonjour\mDNSResponder.exe
                          C:\WINDOWS\eHome\ehRecvr.exe
                          C:\WINDOWS\eHome\ehSched.exe
                          c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
                          C:\WINDOWS\system32\nvsvc32.exe
                          C:\Program Files\Spyware Doctor\pctsAuxs.exe
                          C:\Program Files\Spyware Doctor\pctsSvc.exe
                          C:\WINDOWS\system32\svchost.exe
                          C:\Program Files\Spyware Doctor\pctsTray.exe
                          C:\WINDOWS\system32\svchost.exe
                          C:\WINDOWS\ehome\mcrdsvc.exe
                          C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                          C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                          C:\WINDOWS\system32\dllhost.exe
                          C:\WINDOWS\System32\alg.exe
                          C:\WINDOWS\ehome\ehtray.exe
                          C:\WINDOWS\eHome\ehmsas.exe
                          C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
                          C:\WINDOWS\RTHDCPL.EXE
                          C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                          C:\WINDOWS\system32\LVCOMSX.EXE
                          C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
                          C:\WINDOWS\system32\ctfmon.exe
                          C:\WINDOWS\system32\wuauclt.exe
                          C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
                          C:\WINDOWS\system32\wbem\wmiprvse.exe

                          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
                          R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
                          R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
                          R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
                          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                          R3 - URLSearchHook: Multi Media France Toolbar - {7009fcd4-05be-44f4-9583-93fe419ab7b0} - C:\Program Files\Multi_Media_France\tbMul1.dll
                          R3 - URLSearchHook: Online_TV Toolbar - {40d1c3a7-4ffb-4443-b3a0-a64b2df7fc3b} - C:\Program Files\Online_TV\tbOnl1.dll
                          R3 - URLSearchHook: LphantBar Toolbar - {6b284373-1765-4464-a587-80fbc2b2eefa} - C:\Program Files\LphantBar\tbLph1.dll
                          O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                          O2 - BHO: Online_TV Toolbar - {40d1c3a7-4ffb-4443-b3a0-a64b2df7fc3b} - C:\Program Files\Online_TV\tbOnl1.dll
                          O2 - BHO: LphantBar Toolbar - {6b284373-1765-4464-a587-80fbc2b2eefa} - C:\Program Files\LphantBar\tbLph1.dll
                          O2 - BHO: Multi Media France Toolbar - {7009fcd4-05be-44f4-9583-93fe419ab7b0} - C:\Program Files\Multi_Media_France\tbMul1.dll
                          O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
                          O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                          O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
                          O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                          O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
                          O3 - Toolbar: Multi Media France Toolbar - {7009fcd4-05be-44f4-9583-93fe419ab7b0} - C:\Program Files\Multi_Media_France\tbMul1.dll
                          O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                          O3 - Toolbar: Online_TV Toolbar - {40d1c3a7-4ffb-4443-b3a0-a64b2df7fc3b} - C:\Program Files\Online_TV\tbOnl1.dll
                          O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
                          O3 - Toolbar: LphantBar Toolbar - {6b284373-1765-4464-a587-80fbc2b2eefa} - C:\Program Files\LphantBar\tbLph1.dll
                          O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
                          O4 - HKLM\..\Run: [LaunchApp] Alaunch
                          O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
                          O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
                          O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
                          O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
                          O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
                          O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
                          O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
                          O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
                          O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
                          O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
                          O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                          O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
                          O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
                          O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
                          O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
                          O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                          O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                          O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                          O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                          O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                          O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                          O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
                          O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
                          O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
                          O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?e316b8ba3f7e491c9313402f97baf6cd
                          O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?e316b8ba3f7e491c9313402f97baf6cd
                          O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
                          O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
                          O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                          O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                          O9 - Extra button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files\PokerStars.NET\PokerStarsUpdate.exe
                          O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                          O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                          O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
                          O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
                          O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
                          O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                          O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                          O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                          O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                          O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                          O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
                          O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
                          O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
                          O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                          O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
                          O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
                          O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
                          O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
                          O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
                          O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
                          1. Gunnar Auteur
                            voici le rapport du 1 :

                            ------- LOGFILE OF AD-REMOVER 1.1.3.2 | ONLY XP/VISTA -------

                            Updated by C_XX on 19/04/2009 at 22:00
                            Contact: AdRemover.contact@gmail.com
                            Website: http://pagesperso-orange.fr/FindyKill.Ad.Remover/

                            **** LIMITED TO ****

                            Known Adwares
                            Eorezo
                            It's TV
                            Sweetim

                            ********************

                            Start at: 23:21:59, 19/04/2009 | Boot mode: Normal Boot
                            Option: CLEAN | Executed from: C:\Program Files\Ad-remover\Ad-remover.bat
                            Operating System: Microsoft® Windows XP™ Service Pack 3 (version 5.1.2600)
                            Computer Name: SALLE-A-MANGER
                            Current User: mimi et steph - Administrator
                            Drive(s):
                            - C:\ (File System: NTFS)
                            - D:\ (File System: FAT32)
                            - E:\ (File System: CDFS)

                            (!) ---- IE start pages/Tabs reset

                            ============ Known Adwares Deleted ============

                            .
                            HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\AdVantage
                            HKCR\AppID\TR.DLL
                            HKCR\AppID\{69E0089F-28BC-4BB5-862B-E2B07C3B83C6}
                            HKCR\Interface\{5AC3A9EF-C0F8-41D4-B4E2-B7CEBB794151}
                            HKCR\Interface\{862DEF42-89AA-49FA-AE1F-8A84B1B08A17}
                            HKCR\Interface\{F6E4845D-1D13-4BC0-942D-B9191524CC48}
                            HKCR\TR.TRFactory
                            HKCR\TR.TRFactory.1
                            HKCR\TypeLib\{DABF362D-D442-4402-9208-CA9ED70DD01E}
                            HKCU\Software\AdVantage
                            HKCU\Software\Grand Virtual
                            HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
                            HKCU\Software\pacificpoker
                            HKCU\Software\PartyGaming
                            HKCU\Software\Poker 770
                            HKCU\Software\pokerinstaller
                            HKCU\Software\Titan Poker
                            HKLM\Software\Microsoft\Internet Explorer\Extensions\{49783ED4-258D-4f9f-BE11-137C18D3E543}
                            HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Everest Poker
                            HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Pacific Poker
                            HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Poker 770
                            HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Titan Poker
                            HKLM\Software\Poker 770
                            HKLM\Software\Titan Poker
                            HKCR\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
                            HKCR\CLSID\{602D9049-B4AC-4A25-BF75-A9B54D747CBA}
                            .
                            C:\Poker\Poker 770
                            C:\Poker\Titan Poker
                            C:\Program Files\Advantage
                            C:\Program Files\Conduit
                            C:\Program Files\Everest Poker
                            C:\Program Files\PacificPoker4
                            C:\Documents and Settings\mimi et steph\Menudm~1\Progra~1\Pacific Poker
                            C:\Documents and Settings\All Users\Menudm~1\Progra~1\Everest Poker
                            C:\Documents and Settings\All Users\Menudm~1\Progra~1\Poker 770
                            C:\Documents and Settings\All Users\Menudm~1\Progra~1\Titan Poker
                            C:\Documents and Settings\mimi et steph\Menudm~1\Pacific Poker.lnk
                            C:\Documents and Settings\All Users\Menudm~1\Titan Poker.lnk
                            C:\Documents and Settings\mimi et steph\Application Data\Mozilla\Firefox\Profiles\p1r27v6a.default\searchplugins\conduit.xml
                            C:\Documents and Settings\mimi et steph\Application Data\Microsoft\Internet Explorer\Quick Launch\Pacific Poker.lnk
                            C:\Documents and Settings\mimi et steph\Application Data\Microsoft\Internet Explorer\Quick Launch\Titan Poker.lnk
                            C:\Documents and Settings\mimi et steph\Bureau\Everest Poker.exe
                            C:\Documents and Settings\mimi et steph\Bureau\Titan Poker.lnk
                            C:\WINDOWS\Prefetch\CASINO.EXE-17445361.pf
                            C:\Documents and Settings\mimi et steph\Cookies\mimi_et_steph@atdmt[2].txt
                            C:\Documents and Settings\mimi et steph\Cookies\mimi_et_steph@bs.serving-sys[1].txt
                            C:\Documents and Settings\mimi et steph\Cookies\mimi et steph@search.conduit[2].txt
                            C:\Documents and Settings\mimi et steph\Cookies\mimi_et_steph@search.conduit[2].txt
                            C:\Documents and Settings\mimi et steph\Cookies\mimi_et_steph@storage.conduit[2].txt
                            C:\Documents and Settings\mimi et steph\Cookies\mimi_et_steph@partygaming.122.2o7[1].txt
                            C:\Documents and Settings\mimi et steph\Cookies\mimi_et_steph@partypoker[1].txt

                            +-----------------| Eorezo Elements Deleted :

                            .

                            +-----------------| It's TV Elements Deleted :

                            .

                            +-----------------| Sweetim Elements Deleted :

                            HKCU\Software\Microsoft\Internet Explorer\UrlSearchHooks\\{EEE6C35D-6118-11DC-9C72-001320C79847}
                            HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{BC4FFE41-DE9F-46FA-B455-AAD49B9F9938}
                            HKLM\Software\Microsoft\Internet Explorer\Toolbar\\{EEE6C35B-6118-11DC-9C72-001320C79847}
                            HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EEE6C35B-6118-11DC-9C72-001320C79847}
                            HKCR\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}
                            HKCR\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064}
                            HKCR\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}
                            HKCR\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847}
                            HKCR\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}
                            HKCR\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}
                            HKCR\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}
                            HKCR\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}
                            HKCR\MediaPlayer.GraphicsUtils
                            HKCR\MediaPlayer.GraphicsUtils.1
                            HKCR\MgMediaPlayer.GifAnimator
                            HKCR\MgMediaPlayer.GifAnimator.1
                            HKCR\SWEETIE.IEToolbar
                            HKCR\SWEETIE.IEToolbar.1
                            HKCR\SWEETIE.SWEETIE
                            HKCR\SWEETIE.SWEETIE.3
                            HKCR\SweetIM_URLSearchHook.ToolbarURLSearchHook
                            HKCR\SweetIM_URLSearchHook.ToolbarURLSearchHook.1
                            HKCR\Toolbar3.SWEETIE
                            HKCR\Toolbar3.SWEETIE.1
                            HKCR\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}
                            HKCR\Typelib\{EEE6C35E-6118-11DC-9C72-001320C79847}
                            HKCR\Typelib\{EEE6C35F-6118-11DC-9C72-001320C79847}
                            HKCU\Software\SWEETIE
                            HKCU\Software\SweetIM
                            HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}
                            HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1A0AADCD-3A72-4B5F-900F-E3BB5A838E2A}
                            HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BC4FFE41-DE9F-46fa-B455-AAD49B9F9938}
                            HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
                            HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
                            HKLM\Software\Classes\Interface\{A439801C-961D-452C-AB42-7848E9CBD289}
                            HKLM\Software\Classes\Interface\{F4EBB1E2-21F3-4786-8CF4-16EC5925867F}
                            HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}
                            HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe
                            HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{266C7330-C0F4-49E5-8F20-A56F9F822875}
                            HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}
                            HKLM\Software\SweetIM
                            HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\07D5290CDBDAE4242926B8E6CA650501
                            HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\08E33F7B61DEFF24BB9673ED7D467636
                            HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\0E3D8A5B48622A445A7DF73FEFF32C3F
                            HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\1AC67655DD68F8240B2860F2D511EBD8
                            HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536
                            HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\34EDDB1BFB3A2D448845F3EFD0F15A43
                            HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\351716A953E21214898904032EAE2E81
                            HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\397C771A7BCAC904697C3EC629ED33ED
                            HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\427EA997C413D1D47907CBFC7B2DB432
                            HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\4318DF19719275242801CBE292063A4C
                            HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\45FC115D1FEAEF849A4E1610D6EC8BF0
                            HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\46A5861A389ADB844AF89E31BC9DF0A1
                            HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\49B0E1A6FF50BBE4289E4E23DE6EA0C7
                            HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\4CCCAC049F34D0540AAC13011398BEDB
                            HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5C4389D0BFB302C479DE4178BD5D9EBA
                            HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5D19F074C042AD34BAB463D4175A062E
                            HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5D2B09BDEF4FE54418E6F3373CDBC7AC
                            HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\61B65D3397A1FBF4CB1571B5E4F6B5B0
                            HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\68E8A05C60DD9254591DBD16C94EDDBF
                            HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\697E782CF574CC34CBB9566440BA12BC
                            HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\6AE27A8613CF7EA4782F2886F67295E5
                            HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\7CE172051F585E04187BCB97570BFA74
                            HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\86A901BA5265452499DCBF719C378EE3
                            HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\88ABD1CD5C40EC84789A7F6EF86DAC5E
                            HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\980289C22F80A7C4BB9323DC61255E4E
                            HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\98CC8BF5A4A6E6C4ABF7051DDAB8B058
                            HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\9A4B7EF3789F871419D9302583B20C15
                            HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\A189D17A469616C4688D23E192996267
                            HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\A6C53B0F76C44004A8F36716213017DB
                            HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\B59F2D8189784CC46A4597F2842480B0
                            HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\BD746FB95FB8E5B45BF66BE54D5FD91F
                            HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\CCF399FCD6D2D3F46BF02A1378654FC9
                            HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D149C1355C98DE24E82CEFBD996FE06A
                            HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D15DAF33C220F91468A1D7D57C31ACD7
                            HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D3BA76A44C779424889063D5098ED2D6
                            HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D6D0EB9FDBD90C04D92A7E729058F10D
                            HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\DB59FDB786388EA4D897F3EE715683AC
                            HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\DB8DAD19CFBCC2049A4477183787E8C5
                            HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E1C820A74ED67374BA048B52CB3C3804
                            HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E337925F629CF4C4FB08F3D9674DD839
                            HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E4748F9A4181FCE46A23C13B517B9420
                            HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\EC65F200D112357449C8B1BC3CFA03D0
                            HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\F327D0C73C0973644A21E8CC852267A0
                            HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\FA96423FE2B98E248A3B23548D1E22D9
                            .
                            C:\WINDOWS\Installer\31ba3c.msi
                            C:\WINDOWS\Installer\31ba42.msi
                            C:\Program Files\SweetIM
                            C:\Documents and Settings\mimi et steph\Application Data\Mozilla\Firefox\Profiles\p1r27v6a.default\searchplugins\sweetim.xml
                            C:\Documents and Settings\mimi et steph\Application Data\Mozilla\Firefox\Profiles\p1r27v6a.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}
                            C:\Documents and Settings\mimi et steph\Application Data\Mozilla\Firefox\Profiles\p1r27v6a.default\SweetIMToolbarData
                            C:\Documents and Settings\All Users\Application Data\SweetIM
                            C:\Documents and Settings\mimi et steph\Cookies\mimi_et_steph@sweetim[2].txt

                            (!) ---- Temp files deleted.
                            (!) ---- Recycle bin emptied in all drives.

                            +-----------------| Added Scan :

                            ---- Mozilla FireFox Version 3.0.8 ----

                            ProfilePath: p1r27v6a.default (mimi et steph)
                            .
                            Prefs.js: Browser.Search.DefaultEngineName: "SweetIM Search"
                            Prefs.js: Browser.Search.DefaultEngineName: "chrome://browser-region/locale/region.properties"
                            Prefs.js: Browser.Search.SelectedEngine: "Google"
                            Prefs.js: Browser.Search.DefaultUrl: "hxxp://search.sweetim.com/search.asp?src=2&q="
                            Prefs.js: Browser.Search.DefaultUrl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1105889&SearchSource=3&q="
                            Prefs.js: Browser.Startup.HomePage: "http:/free.fr"
                            .
                            (Prefs.js) REMOVED: user_pref("browser.search.defaultenginename", "SweetIM Search");
                            (Prefs.js) REMOVED: user_pref("browser.search.defaulturl", "https://search.sweetim.com/search.asp?src=2&q=");
                            (Prefs.js) REMOVED: user_pref("keyword.URL", "https://search.sweetim.com/search.asp?src=2&q=");
                            (Prefs.js) REMOVED: user_pref("sweetim.toolbar.highlight.colors", "#FFFF00,#00FFE4,#5AFF00,#0087FF,#FFCC00,#FF00F0");
                            (Prefs.js) REMOVED: user_pref("sweetim.toolbar.logger.ConsoleHandler.MinReportLevel", "7");
                            (Prefs.js) REMOVED: user_pref("sweetim.toolbar.logger.FileHandler.FileName", "ff-toolbar.log");
                            (Prefs.js) REMOVED: user_pref("sweetim.toolbar.logger.FileHandler.MaxFileSize", "200000");
                            (Prefs.js) REMOVED: user_pref("sweetim.toolbar.logger.FileHandler.MinReportLevel", "7");
                            (Prefs.js) REMOVED: user_pref("sweetim.toolbar.mode.debug", "false");
                            (Prefs.js) REMOVED: user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "chrome://browser-region/locale/region.properties");
                            (Prefs.js) REMOVED: user_pref("sweetim.toolbar.previous.browser.search.defaulturl", "http://search.conduit.com/ResultsExt.aspx?ctid=CT1105889&SearchSource=3&q=");
                            (Prefs.js) REMOVED: user_pref("sweetim.toolbar.previous.browser.startup.homepage", "https://www.free.fr/freebox/index.html");
                            (Prefs.js) REMOVED: user_pref("sweetim.toolbar.previous.keyword.URL", "chrome://browser-region/locale/region.properties");
                            (Prefs.js) REMOVED: user_pref("sweetim.toolbar.search.external", "<?xml version=\"1.0\"?><TOOLBAR><EXTERNAL_SEARCH engine=\"http://*google.*\" param=\"q=\" /><EXTERNAL_SEARCH engine=\"https://search.yahoo.com/*\" param=\"p=\" /><EXTERNAL_SEARCH engine=\"http://search.sweetim.*\" param=\"q=\" /><EXTERNAL_SEARCH engine=\"http://*.live.*/*\" param=\"q=\" /><EXTERNAL_SEARCH engine=\"http://*youtube.com/\" param=\"search_query=\" /><EXTERNAL_SEARCH engine=\"http://*.ebay.*/search/*\" param=\"satitle=\" /><EXTERNAL_SEARCH engine=\"http://*.amazon.com/s/*\" param=\"field-keywords=\" /></TOOLBAR>");
                            (Prefs.js) REMOVED: user_pref("sweetim.toolbar.search.history.capacity", "10");
                            (Prefs.js) REMOVED: user_pref("sweetim.toolbar.simapp_id", "{73BD8808-E1B3-11DD-A52D-001167672E29}");
                            (Prefs.js) REMOVED: user_pref("sweetim.toolbar.urls.homepage", "https://home.sweetim.com/");
                            (Prefs.js) REMOVED: user_pref("sweetim.toolbar.version", "1.0.0.8");
                            .
                            .
                            .
                            .

                            ---- Internet Explorer Version 7.0.5730.13 ----

                            [HKEY_CURRENT_USER\..\Internet Explorer\Main]

                            Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
                            Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                            Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
                            Search Page: hxxp://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR
                            Start page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

                            [HKEY_USERS\S-1-5-21-1111381166-3485837779-2022451641-1005\..\Internet Explorer\Main]

                            Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
                            Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                            Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
                            Search Page: hxxp://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR
                            Start page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

                            [HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

                            Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
                            Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                            Search bar: hxxp://search.msn.com/spbasic.htm
                            Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                            Start page: hxxp://fr.msn.com/

                            [HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

                            Tabs: hxxp://ieframe.dll/tabswelcome.htm

                            +---------------------------------------------------------------------------+

                            16663 Byte(s) - C:\Ad-Report-Clean-19.04.2009.log
                            18418 Byte(s) - C:\Ad-Report-Scan-19.04.2009.log

                            1 File(s) - C:\Program Files\Ad-remover\TOOLS\BACKUP
                            16 File(s) - C:\Program Files\Ad-remover\TOOLS\QUARANTINE

                            End at: 23:49:18 | 19/04/2009
                            .
                            +-----------------| E.O.F
                            .
                            2. hisaeh
                              1 ) Déconnectes toi et fermes toutes applications en cours !

                              * Relances "Ad-remover" : au menu principal choisi l'option "B" . clean
                              puis option A (supprimer tout )

                              --> le programme va travailler ...

                              * Postes le rapport qui apparait à la fin

                              ( le rapport est sauvegardé aussi sous C:\Ad-report.log )

                              /!\ Si le Bureau ne réapparait pas presse Ctrl + Alt + Suppr , Onglet "Fichier" , "Nouvelle tâche" , tapes explorer.exe et valides) /!\

                              2) Relance Hijackthis et choisis la 2ème option :
                              DO A SYSTEM SCAN ONLY

                              Ensuite, à gauche tu coches les lignes suivantes :

                              O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                              O4 - HKCU\..\Run: [AdVantage] "C:\Program Files\AdVantage\AdVantage.exe"

                              Tu fermes toutes les applications y compris le navigateur internet, tu te deconnectes et tu cliques en bas sur :
                              FIXCHECKED

                              Ensuite, tu redemarres ton ordinateur et tu postes un nouveau rapport Hijackthis.

                              3 ) Supprime le dossier c:/programs files /advantage
                              s'il existe.
                              Essaie en mode sans echec si necessaire.
                              Sinon, on fera autrement demain.

                              4) Télécharge Toolbar-S&D (Team IDN) sur ton Bureau.
                              https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2

                              * Lance l'installation du programme en exécutant le fichier téléchargé.
                              * Double-clique maintenant sur le raccourci de Toolbar-S&D.
                              * Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.
                              * Choisis directement l'option 2 (nettoyage). Patiente jusqu'à la fin de la recherche.
                              * Poste le rapport généré. (C:\TB.txt)

                              5) Tu télécharges MalwareBytes.
                              http://www.malwarebytes.org/mbam/program/mbam-setup.exe

                              Tu l'installes. Choisis les options par défaut.
                              A la fin de l’installation, il te sera demandé de mettre à jour MalwareBytes et de l’exécuter .

                              Dans l’onglet Recherche, sélectionne Exécuter un examen rapide.
                              Clique sur recherche. Tu ne sélectionnes que les disques durs de l’ordinateur.
                              Clique sur lancer l’examen.

                              A la fin de la recherche, Comme il est demandé, clique sur afficher les résultats de la recherche.
                              Choisis alors Supprimer la selection pour nettoyer les infections.
                              Tu postes le rapport dans ton prochain message.

                              Si tu ne le retrouves pas, ouvre MalwareBytes et regarde dans l’onglet Rapport/logs. Il y est.
                              Clique dessus et choisir ouvrir.

                              6) Tu refais un log hijackthis et tu postes le rapport.

                              Merci !
                              A demain.

                              1. Gunnar Auteur
                                voila,

                                ------- LOGFILE OF AD-REMOVER 1.1.3.2 | ONLY XP/VISTA -------

                                Updated by C_XX on 19/04/2009 at 22:00
                                Contact: AdRemover.contact@gmail.com
                                Website: http://pagesperso-orange.fr/FindyKill.Ad.Remover/

                                Start at: 22:47:19, 19/04/2009 | Boot mode: Normal Boot
                                Option: SCAN | Executed from: C:\Program Files\Ad-remover\Ad-remover.bat
                                Operating System: Microsoft® Windows XP™ Service Pack 3 (version 5.1.2600)
                                Computer Name: SALLE-A-MANGER
                                Current User: mimi et steph - Administrator
                                Drive(s):
                                - C:\ (File System: NTFS)
                                - D:\ (File System: FAT32)
                                - E:\ (File System: CDFS)

                                ============ Known Adwares Found ============

                                .
                                HKCR\AppID\TR.DLL
                                HKCR\AppID\{69E0089F-28BC-4BB5-862B-E2B07C3B83C6}
                                HKCR\Interface\{5AC3A9EF-C0F8-41D4-B4E2-B7CEBB794151}
                                HKCR\Interface\{862DEF42-89AA-49FA-AE1F-8A84B1B08A17}
                                HKCR\Interface\{F6E4845D-1D13-4BC0-942D-B9191524CC48}
                                HKCR\TR.TRFactory
                                HKCR\TR.TRFactory.1
                                HKCR\TypeLib\{DABF362D-D442-4402-9208-CA9ED70DD01E}
                                HKCU\Software\AdVantage
                                HKCU\Software\Grand Virtual
                                HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
                                HKCU\Software\pacificpoker
                                HKCU\Software\PartyGaming
                                HKCU\Software\Poker 770
                                HKCU\Software\pokerinstaller
                                HKCU\Software\Titan Poker
                                HKLM\Software\Classes\AppID\TR.DLL
                                HKLM\Software\Classes\AppID\{69E0089F-28BC-4BB5-862B-E2B07C3B83C6}
                                HKLM\Software\Classes\Interface\{5AC3A9EF-C0F8-41D4-B4E2-B7CEBB794151}
                                HKLM\Software\Classes\Interface\{862DEF42-89AA-49FA-AE1F-8A84B1B08A17}
                                HKLM\Software\Classes\Interface\{F6E4845D-1D13-4BC0-942D-B9191524CC48}
                                HKLM\Software\Classes\TR.TRFactory
                                HKLM\Software\Classes\TR.TRFactory.1
                                HKLM\Software\Classes\TypeLib\{DABF362D-D442-4402-9208-CA9ED70DD01E}
                                HKLM\Software\Microsoft\Internet Explorer\Extensions\{49783ED4-258D-4f9f-BE11-137C18D3E543}
                                HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Everest Poker
                                HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Pacific Poker
                                HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Poker 770
                                HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Titan Poker
                                HKLM\Software\Poker 770
                                HKLM\Software\Titan Poker
                                HKU\S-1-5-21-1111381166-3485837779-2022451641-1005\Software\Titan Poker
                                HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\AdVantage
                                HKCR\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
                                HKLM\Software\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
                                HKCR\CLSID\{602D9049-B4AC-4A25-BF75-A9B54D747CBA}
                                HKLM\Software\Classes\CLSID\{602D9049-B4AC-4A25-BF75-A9B54D747CBA}
                                .
                                C:\Poker\Poker 770
                                C:\Poker\Titan Poker
                                C:\Program Files\Advantage
                                C:\Program Files\Conduit
                                C:\Program Files\Everest Poker
                                C:\Program Files\PacificPoker4
                                C:\Documents and Settings\mimi et steph\Menudm~1\Progra~1\Pacific Poker
                                C:\Documents and Settings\All Users\Menudm~1\Progra~1\Everest Poker
                                C:\Documents and Settings\All Users\Menudm~1\Progra~1\Poker 770
                                C:\Documents and Settings\All Users\Menudm~1\Progra~1\Titan Poker
                                C:\Documents and Settings\mimi et steph\Menudm~1\Pacific Poker.lnk
                                C:\Documents and Settings\All Users\Menudm~1\Titan Poker.lnk
                                C:\Documents and Settings\mimi et steph\Application Data\Mozilla\Firefox\Profiles\p1r27v6a.default\searchplugins\conduit.xml
                                C:\Documents and Settings\mimi et steph\Application Data\Microsoft\Internet Explorer\Quick Launch\Pacific Poker.lnk
                                C:\Documents and Settings\mimi et steph\Application Data\Microsoft\Internet Explorer\Quick Launch\Titan Poker.lnk
                                C:\Documents and Settings\mimi et steph\Bureau\Everest Poker.exe
                                C:\Documents and Settings\mimi et steph\Bureau\Titan Poker.lnk
                                C:\WINDOWS\Prefetch\CASINO.EXE-17445361.pf
                                C:\Documents and Settings\mimi et steph\Cookies\mimi_et_steph@atdmt[2].txt
                                C:\Documents and Settings\mimi et steph\Cookies\mimi_et_steph@bs.serving-sys[1].txt
                                C:\Documents and Settings\mimi et steph\Cookies\mimi et steph@search.conduit[2].txt
                                C:\Documents and Settings\mimi et steph\Cookies\mimi_et_steph@search.conduit[2].txt
                                C:\Documents and Settings\mimi et steph\Cookies\mimi_et_steph@storage.conduit[2].txt
                                C:\Documents and Settings\mimi et steph\Cookies\mimi_et_steph@partygaming.122.2o7[1].txt
                                C:\Documents and Settings\mimi et steph\Cookies\mimi_et_steph@partypoker[1].txt

                                +-----------------| Eorezo Elements Found:

                                .

                                +-----------------| It's TV Elements Found:

                                .

                                +-----------------| Sweetim Elements Found:

                                HKCR\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}
                                HKCR\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064}
                                HKCR\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}
                                HKCR\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847}
                                HKCR\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}
                                HKCR\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}
                                HKCR\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}
                                HKCR\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}
                                HKCR\MediaPlayer.GraphicsUtils
                                HKCR\MediaPlayer.GraphicsUtils.1
                                HKCR\MgMediaPlayer.GifAnimator
                                HKCR\MgMediaPlayer.GifAnimator.1
                                HKCR\SWEETIE.IEToolbar
                                HKCR\SWEETIE.IEToolbar.1
                                HKCR\SWEETIE.SWEETIE
                                HKCR\SWEETIE.SWEETIE.3
                                HKCR\SweetIM_URLSearchHook.ToolbarURLSearchHook
                                HKCR\SweetIM_URLSearchHook.ToolbarURLSearchHook.1
                                HKCR\Toolbar3.SWEETIE
                                HKCR\Toolbar3.SWEETIE.1
                                HKCR\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}
                                HKCR\Typelib\{EEE6C35E-6118-11DC-9C72-001320C79847}
                                HKCR\Typelib\{EEE6C35F-6118-11DC-9C72-001320C79847}
                                HKCU\Software\SWEETIE
                                HKCU\Software\SweetIM
                                HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}
                                HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1A0AADCD-3A72-4B5F-900F-E3BB5A838E2A}
                                HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BC4FFE41-DE9F-46fa-B455-AAD49B9F9938}
                                HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
                                HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
                                HKLM\Software\Classes\MediaPlayer.GraphicsUtils
                                HKLM\Software\Classes\MediaPlayer.GraphicsUtils.1
                                HKLM\Software\Classes\MgMediaPlayer.GifAnimator
                                HKLM\Software\Classes\MgMediaPlayer.GifAnimator.1
                                HKLM\Software\Classes\SWEETIE.IEToolbar
                                HKLM\Software\Classes\SWEETIE.IEToolbar.1
                                HKLM\Software\Classes\SWEETIE.SWEETIE
                                HKLM\Software\Classes\SWEETIE.SWEETIE.3
                                HKLM\Software\Classes\SweetIM_URLSearchHook.ToolbarURLSearchHook
                                HKLM\Software\Classes\SweetIM_URLSearchHook.ToolbarURLSearchHook.1
                                HKLM\Software\Classes\Toolbar3.SWEETIE
                                HKLM\Software\Classes\Toolbar3.SWEETIE.1
                                HKLM\Software\Classes\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}
                                HKLM\Software\Classes\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}
                                HKLM\Software\Classes\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}
                                HKLM\Software\Classes\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}
                                HKLM\Software\Classes\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064}
                                HKLM\Software\Classes\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}
                                HKLM\Software\Classes\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847}
                                HKLM\Software\Classes\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}
                                HKLM\Software\Classes\Interface\{A439801C-961D-452C-AB42-7848E9CBD289}
                                HKLM\Software\Classes\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}
                                HKLM\Software\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}
                                HKLM\Software\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}
                                HKLM\Software\Classes\Interface\{F4EBB1E2-21F3-4786-8CF4-16EC5925867F}
                                HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}
                                HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe
                                HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{266C7330-C0F4-49E5-8F20-A56F9F822875}
                                HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}
                                HKLM\Software\SweetIM
                                HKCU\Software\Microsoft\Internet Explorer\UrlSearchHooks\\{EEE6C35D-6118-11DC-9C72-001320C79847}
                                HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{BC4FFE41-DE9F-46FA-B455-AAD49B9F9938}
                                HKLM\Software\Microsoft\Internet Explorer\Toolbar\\{EEE6C35B-6118-11DC-9C72-001320C79847}
                                HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EEE6C35B-6118-11DC-9C72-001320C79847}
                                HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\07D5290CDBDAE4242926B8E6CA650501
                                HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\08E33F7B61DEFF24BB9673ED7D467636
                                HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\0E3D8A5B48622A445A7DF73FEFF32C3F
                                HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\1AC67655DD68F8240B2860F2D511EBD8
                                HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536
                                HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\34EDDB1BFB3A2D448845F3EFD0F15A43
                                HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\351716A953E21214898904032EAE2E81
                                HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\397C771A7BCAC904697C3EC629ED33ED
                                HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\427EA997C413D1D47907CBFC7B2DB432
                                HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\4318DF19719275242801CBE292063A4C
                                HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\45FC115D1FEAEF849A4E1610D6EC8BF0
                                HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\46A5861A389ADB844AF89E31BC9DF0A1
                                HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\49B0E1A6FF50BBE4289E4E23DE6EA0C7
                                HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\4CCCAC049F34D0540AAC13011398BEDB
                                HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5C4389D0BFB302C479DE4178BD5D9EBA
                                HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5D19F074C042AD34BAB463D4175A062E
                                HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5D2B09BDEF4FE54418E6F3373CDBC7AC
                                HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\61B65D3397A1FBF4CB1571B5E4F6B5B0
                                HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\68E8A05C60DD9254591DBD16C94EDDBF
                                HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\697E782CF574CC34CBB9566440BA12BC
                                HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\6AE27A8613CF7EA4782F2886F67295E5
                                HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\7CE172051F585E04187BCB97570BFA74
                                HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\86A901BA5265452499DCBF719C378EE3
                                HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\88ABD1CD5C40EC84789A7F6EF86DAC5E
                                HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\980289C22F80A7C4BB9323DC61255E4E
                                HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\98CC8BF5A4A6E6C4ABF7051DDAB8B058
                                HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\9A4B7EF3789F871419D9302583B20C15
                                HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\A189D17A469616C4688D23E192996267
                                HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\A6C53B0F76C44004A8F36716213017DB
                                HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\B59F2D8189784CC46A4597F2842480B0
                                HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\BD746FB95FB8E5B45BF66BE54D5FD91F
                                HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\CCF399FCD6D2D3F46BF02A1378654FC9
                                HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D149C1355C98DE24E82CEFBD996FE06A
                                HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D15DAF33C220F91468A1D7D57C31ACD7
                                HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D3BA76A44C779424889063D5098ED2D6
                                HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D6D0EB9FDBD90C04D92A7E729058F10D
                                HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\DB59FDB786388EA4D897F3EE715683AC
                                HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\DB8DAD19CFBCC2049A4477183787E8C5
                                HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E1C820A74ED67374BA048B52CB3C3804
                                HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E337925F629CF4C4FB08F3D9674DD839
                                HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E4748F9A4181FCE46A23C13B517B9420
                                HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\EC65F200D112357449C8B1BC3CFA03D0
                                HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\F327D0C73C0973644A21E8CC852267A0
                                HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\FA96423FE2B98E248A3B23548D1E22D9
                                .
                                C:\WINDOWS\Installer\31ba3c.msi
                                C:\WINDOWS\Installer\31ba42.msi
                                C:\Program Files\SweetIM
                                C:\Documents and Settings\mimi et steph\Application Data\Mozilla\Firefox\Profiles\p1r27v6a.default\searchplugins\sweetim.xml
                                C:\Documents and Settings\mimi et steph\Application Data\Mozilla\Firefox\Profiles\p1r27v6a.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}
                                C:\Documents and Settings\mimi et steph\Application Data\Mozilla\Firefox\Profiles\p1r27v6a.default\SweetIMToolbarData
                                C:\Documents and Settings\All Users\Application Data\SweetIM
                                C:\Documents and Settings\mimi et steph\Cookies\mimi_et_steph@sweetim[2].txt

                                +-----------------| Added Scan:

                                ---- Mozilla FireFox Version 3.0.8 ----

                                ProfilePath: p1r27v6a.default (mimi et steph)
                                .
                                Prefs.js: Browser.Search.DefaultEngineName: "SweetIM Search"
                                Prefs.js: Browser.Search.DefaultEngineName: "chrome://browser-region/locale/region.properties"
                                Prefs.js: Browser.Search.SelectedEngine: "Google"
                                Prefs.js: Browser.Search.DefaultUrl: "hxxp://search.sweetim.com/search.asp?src=2&q="
                                Prefs.js: Browser.Search.DefaultUrl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1105889&SearchSource=3&q="
                                Prefs.js: Browser.Startup.HomePage: "http:/free.fr"
                                .
                                (Prefs.js) FOUND: user_pref("CT1105889.AboutPrivacyUrl", "http://www.conduit.com");
                                (Prefs.js) FOUND: user_pref("CT1105889.CTPBaseServerUrl", "http://services.conduit.com/");
                                (Prefs.js) FOUND: user_pref("CT1105889.Server", "http://users.conduit.com");
                                (Prefs.js) FOUND: user_pref("browser.search.defaultenginename", "SweetIM Search");
                                (Prefs.js) FOUND: user_pref("browser.search.defaulturl", "https://search.sweetim.com/search.asp?src=2&q=");
                                (Prefs.js) FOUND: user_pref("keyword.URL", "https://search.sweetim.com/search.asp?src=2&q=");
                                (Prefs.js) FOUND: user_pref("sweetim.toolbar.highlight.colors", "#FFFF00,#00FFE4,#5AFF00,#0087FF,#FFCC00,#FF00F0");
                                (Prefs.js) FOUND: user_pref("sweetim.toolbar.logger.ConsoleHandler.MinReportLevel", "7");
                                (Prefs.js) FOUND: user_pref("sweetim.toolbar.logger.FileHandler.FileName", "ff-toolbar.log");
                                (Prefs.js) FOUND: user_pref("sweetim.toolbar.logger.FileHandler.MaxFileSize", "200000");
                                (Prefs.js) FOUND: user_pref("sweetim.toolbar.logger.FileHandler.MinReportLevel", "7");
                                (Prefs.js) FOUND: user_pref("sweetim.toolbar.mode.debug", "false");
                                (Prefs.js) FOUND: user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "chrome://browser-region/locale/region.properties");
                                (Prefs.js) FOUND: user_pref("sweetim.toolbar.previous.browser.search.defaulturl", "http://search.conduit.com/ResultsExt.aspx?ctid=CT1105889&SearchSource=3&q=");
                                (Prefs.js) FOUND: user_pref("sweetim.toolbar.previous.browser.startup.homepage", "https://www.free.fr/freebox/index.html");
                                (Prefs.js) FOUND: user_pref("sweetim.toolbar.previous.keyword.URL", "chrome://browser-region/locale/region.properties");
                                (Prefs.js) FOUND: user_pref("sweetim.toolbar.search.external", "<?xml version=\"1.0\"?><TOOLBAR><EXTERNAL_SEARCH engine=\"http://*google.*\" param=\"q=\" /><EXTERNAL_SEARCH engine=\"https://search.yahoo.com/*\" param=\"p=\" /><EXTERNAL_SEARCH engine=\"http://search.sweetim.*\" param=\"q=\" /><EXTERNAL_SEARCH engine=\"http://*.live.*/*\" param=\"q=\" /><EXTERNAL_SEARCH engine=\"http://*youtube.com/\" param=\"search_query=\" /><EXTERNAL_SEARCH engine=\"http://*.ebay.*/search/*\" param=\"satitle=\" /><EXTERNAL_SEARCH engine=\"http://*.amazon.com/s/*\" param=\"field-keywords=\" /></TOOLBAR>");
                                (Prefs.js) FOUND: user_pref("sweetim.toolbar.search.history.capacity", "10");
                                (Prefs.js) FOUND: user_pref("sweetim.toolbar.simapp_id", "{73BD8808-E1B3-11DD-A52D-001167672E29}");
                                (Prefs.js) FOUND: user_pref("sweetim.toolbar.urls.homepage", "https://home.sweetim.com/");
                                (Prefs.js) FOUND: user_pref("sweetim.toolbar.version", "1.0.0.8");
                                .
                                .
                                .
                                .

                                ---- Internet Explorer Version 7.0.5730.13 ----

                                [HKEY_CURRENT_USER\..\Internet Explorer\Main]

                                Search bar: hxxp://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR
                                Search Page: hxxp://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR
                                Start page: hxxp://home.sweetim.com

                                [HKEY_USERS\S-1-5-21-1111381166-3485837779-2022451641-1005\..\Internet Explorer\Main]

                                Search bar: hxxp://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR
                                Search Page: hxxp://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR
                                Start page: hxxp://home.sweetim.com

                                [HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

                                Default_Page_URL: hxxp://go.microsoft.com/fwlink/?LinkId=69157
                                Default_Search_URL: hxxp://go.microsoft.com/fwlink/?LinkId=54896
                                Search Page: hxxp://go.microsoft.com/fwlink/?LinkId=54896
                                Start page: hxxp://home.sweetim.com

                                [HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

                                Tabs: hxxp://ieframe.dll/tabswelcome.htm

                                +---------------------------------------------------------------------------+

                                18188 Byte(s) - C:\Ad-Report-Scan-19.04.2009.log

                                0 File(s) - C:\Program Files\Ad-remover\TOOLS\BACKUP
                                0 File(s) - C:\Program Files\Ad-remover\TOOLS\QUARANTINE

                                End at: 23:05:11 | 19/04/2009
                                .
                                +-----------------| E.O.F
                                .
                                • 1
                                • 2

                                Discussions similaires

                                Ouvrir un fichier .pub sans Publisher
                                baissaoui

                                0 réponse
                                Ouvrir document Publisher sans Publisher
                                Curtis Hayes

                                7 réponses
                                Lire, afficher, exécuter un fichier *.pub sans Publisher
                                jeannoellaurenti

                                1 réponse
                                Publicité "Bidru n'en peut plus"
                                _Ritchi_

                                5 réponses
                                musique de pub
                                zabou

                                7 réponses