Rogue "XP Internet Security 2012"

Lalla -  
Bonsoir,

Me voilà dans de beaux draps...infectée par un Rogue je suis!!

Donc après fait connaissance avec la bête, j'ai pu contourner un peu ses blocage au moins pour naviguer avec internet explorer mais j'aimerais bien qu'il disparaisse définitivement.

Donc en bonne élève j'ai télécharger RogueKiller, là impossible de l'ouvrir, mais là encore j'ai pu ruser en cliquant sur "executer en tant que", mais une fois ouvert quand je clique sur 1 ben là il me dit que RigueKiller doit fermer blablabla et là je suis coincée... même mon mode sans échec veut pas marcher... :( et puis malware bytes anti malware j'arrive même pas à l'exécuter...

Je suis dans une impasse, si quelqu'un a un passage secret a me divulguer...

Merci pour votre aide à venir j'espère :)

Lalla

25 réponses

Résumé de la discussion

Une infection par RogueKiller et un rootkit soupçonné sur Windows XP et Internet Explorer 7 empêche l’utilisateur d’éliminer complètement le malware, malgré des tentatives comme l’exécution en tant qu’administrateur. Des solutions techniques ont été proposées avec un rapport OTL détaillé, incluant la suppression de barres d’outils et de moteurs de recherche indésirables, le nettoyage des préférences Firefox et la suppression d’ActiveX. D’autres réponses évoquent une configuration non respectée et suggèrent de reprendre l’opération, tandis qu’un troisième message présente un rapport qui détaille les processus terminés et les éléments du profil réinitialisés. La chronologie suggère une progression méthodique de nettoyage et d’analyse sans révéler une résolution finale, tout en présentant des checks périodiques et des actions répétées.

Bobot (l’IA à votre service)
  2. g3n-h@ckm@n
    re

    j'ai oublié une ligne ca n'a pas fonctionné refais-en un avec ca :

    :OTL
    IE - HKU\S-1-5-21-1963577801-2023874215-1520031096-1006\..\URLSearchHook: - Reg Error: Key error. File not found
    FF - prefs.js..browser.search.defaultthis.engineName: "Softonic_France Customized Web Search"
    FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2542115&SearchSource=3&q={searchTerms}"
    FF - prefs.js..browser.search.selectedEngine: "iMesh Web Search"
    FF - prefs.js..browser.startup.homepage: "http://search.imesh.net/"
    FF - prefs.js..keyword.URL: "http://www1.search-results.com/web?l=dis&q=&o=APN10653&apn_dtid=%5EIME001%5EYY%5EFR&shad=s_0043&gct=ds&apn_ptnrs=%5EAG1&d=1-0&lang=en&atb=sysid%3D1%3Auid%3D7df072a8fec0069e%3Asrc%3Dffb%3Ao%3DAPN10653%3Ab%3DiMesh%3Atg%3D&p2=%5EAG1%5EIME001%5EYY%5EFR"
    FF - prefs.js..browser.search.selectedEngine: "Bing"user_pref("browser.search.defaultenginename", "iMesh Web Search");
    [2010/09/25 02:40:58 | 000,000,000 | ---D | M] (Softonic_France Toolbar) -- C:\Documents and Settings\Anaïs\Application Data\Mozilla\Firefox\Profiles\33uda086.default\extensions\{364d4e0c-543f-4b85-abe3-19551139da4f}
    [2010/03/20 07:00:57 | 000,000,000 | ---D | M] (Softonic_France Toolbar) -- C:\Documents and Settings\Anaïs\Application Data\Mozilla\Firefox\Profiles\33uda086.default\extensions\{4daac69c-cba7-45e2-9bc8-1044483d3352}
    [2010/02/21 14:10:06 | 000,000,933 | ---- | M] () -- C:\Documents and Settings\Anaïs\Application Data\Mozilla\Firefox\Profiles\33uda086.default\searchplugins\conduit.xml
    [2010/09/02 10:09:28 | 000,002,486 | ---- | M] () -- C:\Documents and Settings\Anaïs\Application Data\Mozilla\Firefox\Profiles\33uda086.default\searchplugins\iMeshWebSearch.xml
    [2009/03/05 23:10:02 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
    [2009/04/01 07:02:01 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
    [2010/06/08 10:46:08 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
    [2010/09/07 20:01:50 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
    [2010/11/04 22:43:36 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
    [2011/02/07 16:16:47 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
    [2011/02/22 00:32:52 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
    [2010/09/02 10:09:28 | 000,002,486 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\iMeshWebSearch.xml
    O2 - BHO: (no name) - {64F56FC1-1272-44CD-BA6E-39723696E350} - No CLSID value found.
    O2 - BHO: (no name) - {C7B76B90-3455-4AE6-A752-EAC4D19689E5} - No CLSID value found.
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} http://download.divx.com/player/DivXBrowserPlugin.cab (Reg Error: Key error.)
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
    O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
    O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
    [2011/06/16 01:42:06 | 000,013,064 | -HS- | M] () -- C:\Documents and Settings\Anaïs\Local Settings\Application Data\v58041ysq61ef58s0dvm
    [2011/06/16 01:42:06 | 000,013,064 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\v58041ysq61ef58s0dvm
    [2011/06/16 01:18:39 | 009,435,574 | ---- | M] () -- C:\Documents and Settings\Anaïs\Bureau\mbam-setup-1.51.0.1200.exe
    [2011/06/16 00:49:49 | 000,511,488 | ---- | M] () -- C:\Documents and Settings\Anaïs\Bureau\winlogon.exe.exe (Rootkit.Dropper)
    [2011/04/23 18:21:11 | 000,000,064 | ---- | C] () -- C:\WINDOWS\System32\rp_stats.dat
    [2011/04/23 18:21:11 | 000,000,044 | ---- | C] () -- C:\WINDOWS\System32\rp_rules.dat
    [2009/07/05 20:51:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Anaïs\Application Data\EoRezo
    1. Lalla
      ok voilà j'ai refait mais j'ai toujours pas pu enregistrer dans ci-joint.fr ...

      ========== OTL ==========
      Registry value HKEY_USERS\S-1-5-21-1963577801-2023874215-1520031096-1006\Software\Microsoft\Internet Explorer\URLSearchHooks\\ deleted successfully.
      Prefs.js: "Softonic_France Customized Web Search" removed from browser.search.defaultthis.engineName
      Prefs.js: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2542115&SearchSource=3&q={searchTerms}" removed from browser.search.defaulturl
      Prefs.js: "iMesh Web Search" removed from browser.search.selectedEngine
      Prefs.js: "http://search.imesh.com/" removed from browser.startup.homepage
      Prefs.js: "http://search.imesh.com/web?src=ffb&systemid=1&q=" removed from keyword.URL
      Prefs.js: "Bing"user_pref("browser.search.defaultenginename", "iMesh Web Search"); removed from browser.search.selectedEngine
      C:\Documents and Settings\Anaïs\Application Data\Mozilla\Firefox\Profiles\33uda086.default\extensions\{364d4e0c-543f-4b85-abe3-19551139da4f}\searchplugin folder moved successfully.
      C:\Documents and Settings\Anaïs\Application Data\Mozilla\Firefox\Profiles\33uda086.default\extensions\{364d4e0c-543f-4b85-abe3-19551139da4f}\META-INF folder moved successfully.
      C:\Documents and Settings\Anaïs\Application Data\Mozilla\Firefox\Profiles\33uda086.default\extensions\{364d4e0c-543f-4b85-abe3-19551139da4f}\lib folder moved successfully.
      C:\Documents and Settings\Anaïs\Application Data\Mozilla\Firefox\Profiles\33uda086.default\extensions\{364d4e0c-543f-4b85-abe3-19551139da4f}\defaults folder moved successfully.
      C:\Documents and Settings\Anaïs\Application Data\Mozilla\Firefox\Profiles\33uda086.default\extensions\{364d4e0c-543f-4b85-abe3-19551139da4f}\components folder moved successfully.
      C:\Documents and Settings\Anaïs\Application Data\Mozilla\Firefox\Profiles\33uda086.default\extensions\{364d4e0c-543f-4b85-abe3-19551139da4f}\chrome folder moved successfully.
      C:\Documents and Settings\Anaïs\Application Data\Mozilla\Firefox\Profiles\33uda086.default\extensions\{364d4e0c-543f-4b85-abe3-19551139da4f} folder moved successfully.
      C:\Documents and Settings\Anaïs\Application Data\Mozilla\Firefox\Profiles\33uda086.default\extensions\{4daac69c-cba7-45e2-9bc8-1044483d3352}\searchplugin folder moved successfully.
      C:\Documents and Settings\Anaïs\Application Data\Mozilla\Firefox\Profiles\33uda086.default\extensions\{4daac69c-cba7-45e2-9bc8-1044483d3352}\META-INF folder moved successfully.
      C:\Documents and Settings\Anaïs\Application Data\Mozilla\Firefox\Profiles\33uda086.default\extensions\{4daac69c-cba7-45e2-9bc8-1044483d3352}\lib folder moved successfully.
      C:\Documents and Settings\Anaïs\Application Data\Mozilla\Firefox\Profiles\33uda086.default\extensions\{4daac69c-cba7-45e2-9bc8-1044483d3352}\defaults folder moved successfully.
      C:\Documents and Settings\Anaïs\Application Data\Mozilla\Firefox\Profiles\33uda086.default\extensions\{4daac69c-cba7-45e2-9bc8-1044483d3352}\components folder moved successfully.
      C:\Documents and Settings\Anaïs\Application Data\Mozilla\Firefox\Profiles\33uda086.default\extensions\{4daac69c-cba7-45e2-9bc8-1044483d3352}\chrome folder moved successfully.
      C:\Documents and Settings\Anaïs\Application Data\Mozilla\Firefox\Profiles\33uda086.default\extensions\{4daac69c-cba7-45e2-9bc8-1044483d3352} folder moved successfully.
      C:\Documents and Settings\Anaïs\Application Data\Mozilla\Firefox\Profiles\33uda086.default\searchplugins\conduit.xml moved successfully.
      C:\Documents and Settings\Anaïs\Application Data\Mozilla\Firefox\Profiles\33uda086.default\searchplugins\iMeshWebSearch.xml moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\chrome\locale\zh-TW\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\chrome\locale\zh-TW folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\chrome\locale\zh-CN\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\chrome\locale\zh-CN folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\chrome\locale\sv-SE\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\chrome\locale\sv-SE folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\chrome\locale\ko-KR\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\chrome\locale\ko-KR folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\chrome\locale\ja-JP\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\chrome\locale\ja-JP folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\chrome\locale\it-IT\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\chrome\locale\it-IT folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\chrome\locale\fr-FR\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\chrome\locale\fr-FR folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\chrome\locale\es-ES\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\chrome\locale\es-ES folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\chrome\locale\en-US\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\chrome\locale\en-US folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\chrome\locale\de-DE\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\chrome\locale\de-DE folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\chrome\locale folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\chrome\content\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\chrome\content folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\chrome folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\chrome\locale\zh-TW\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\chrome\locale\zh-TW folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\chrome\locale\zh-CN\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\chrome\locale\zh-CN folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\chrome\locale\sv-SE\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\chrome\locale\sv-SE folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\chrome\locale\ko-KR\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\chrome\locale\ko-KR folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\chrome\locale\ja-JP\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\chrome\locale\ja-JP folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\chrome\locale\it-IT\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\chrome\locale\it-IT folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\chrome\locale\fr-FR\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\chrome\locale\fr-FR folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\chrome\locale\es-ES\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\chrome\locale\es-ES folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\chrome\locale\en-US\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\chrome\locale\en-US folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\chrome\locale\de-DE\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\chrome\locale\de-DE folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\chrome\locale folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\chrome\content\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\chrome\content folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\chrome folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\zh-TW\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\zh-TW folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\zh-CN\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\zh-CN folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\sv-SE\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\sv-SE folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\ko-KR\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\ko-KR folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\ja-JP\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\ja-JP folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\it-IT\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\it-IT folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\fr-FR\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\fr-FR folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\es-ES\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\es-ES folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\en-US\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\en-US folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\de-DE\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\de-DE folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\content\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\content folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\zh-TW\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\zh-TW folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\zh-CN\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\zh-CN folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\sv-SE\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\sv-SE folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\ko-KR\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\ko-KR folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\ja-JP\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\ja-JP folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\it-IT\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\it-IT folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\fr-FR\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\fr-FR folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\es-ES\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\es-ES folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\en-US\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\en-US folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\de-DE\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\de-DE folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\content\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\content folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\zh-TW\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\zh-TW folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\zh-CN\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\zh-CN folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\sv-SE\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\sv-SE folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\ko-KR\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\ko-KR folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\ja-JP\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\ja-JP folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\it-IT\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\it-IT folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\fr-FR\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\fr-FR folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\es-ES\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\es-ES folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\en-US\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\en-US folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\de-DE\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\de-DE folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\content\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\content folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\zh-TW\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\zh-TW folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\zh-CN\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\zh-CN folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\sv-SE\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\sv-SE folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\ko-KR\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\ko-KR folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\ja-JP\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\ja-JP folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\it-IT\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\it-IT folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\fr-FR\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\fr-FR folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\es-ES\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\es-ES folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\en-US\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\en-US folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\de-DE\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\de-DE folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\content\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\content folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\chrome\locale\zh-TW\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\chrome\locale\zh-TW folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\chrome\locale\zh-CN\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\chrome\locale\zh-CN folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\chrome\locale\sv-SE\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\chrome\locale\sv-SE folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\chrome\locale\ko-KR\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\chrome\locale\ko-KR folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\chrome\locale\ja-JP\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\chrome\locale\ja-JP folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\chrome\locale\it-IT\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\chrome\locale\it-IT folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\chrome\locale\fr-FR\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\chrome\locale\fr-FR folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\chrome\locale\es-ES\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\chrome\locale\es-ES folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\chrome\locale\en-US\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\chrome\locale\en-US folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\chrome\locale\de-DE\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\chrome\locale\de-DE folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\chrome\locale folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\chrome\content\ffjcext folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\chrome\content folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\chrome folder moved successfully.
      C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} folder moved successfully.
      C:\Program Files\Mozilla Firefox\searchplugins\iMeshWebSearch.xml moved successfully.
      Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64F56FC1-1272-44CD-BA6E-39723696E350}\ deleted successfully.
      Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{64F56FC1-1272-44CD-BA6E-39723696E350}\ not found.
      Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C7B76B90-3455-4AE6-A752-EAC4D19689E5}\ deleted successfully.
      Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C7B76B90-3455-4AE6-A752-EAC4D19689E5}\ not found.
      Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Restrictions\ deleted successfully.
      Starting removal of ActiveX control {67DABFBF-D0AB-41FA-9C46-CC0F21721616}
      C:\WINDOWS\Downloaded Program Files\DivXPlugin.inf moved successfully.
      Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{67DABFBF-D0AB-41FA-9C46-CC0F21721616}\ deleted successfully.
      Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{67DABFBF-D0AB-41FA-9C46-CC0F21721616}\ not found.
      Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{67DABFBF-D0AB-41FA-9C46-CC0F21721616}\ not found.
      Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{67DABFBF-D0AB-41FA-9C46-CC0F21721616}\ not found.
      Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
      Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
      Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
      Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
      Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
      Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
      Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
      C:\WINDOWS\Downloaded Program Files\erma.inf moved successfully.
      Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully.
      Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
      Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
      Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
      Starting removal of ActiveX control {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
      Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\ deleted successfully.
      Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\ deleted successfully.
      Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\ deleted successfully.
      Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\ not found.
      Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\ not found.
      Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
      Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
      Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
      Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
      Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
      Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
      C:\WINDOWS\Downloaded Program Files\gp.inf not found.
      Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.
      Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
      Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
      Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
      C:\Documents and Settings\Anaïs\Local Settings\Application Data\v58041ysq61ef58s0dvm moved successfully.
      C:\Documents and Settings\All Users\Application Data\v58041ysq61ef58s0dvm moved successfully.
      C:\Documents and Settings\Anaïs\Bureau\mbam-setup-1.51.0.1200.exe moved successfully.
      File C:\Documents and Settings\Anaïs\Bureau\winlogon.exe.exe (Rootkit.Dropper) not found.
      C:\WINDOWS\system32\rp_stats.dat moved successfully.
      C:\WINDOWS\system32\rp_rules.dat moved successfully.
      Folder C:\Documents and Settings\Anaïs\Application Data\EoRezo\ not found.

      OTL by OldTimer - Version 3.2.24.1 log created on 06252011_192022
  3. g3n-h@ckm@n
    ATTENTION !!! : Script personnalisé pour cette machine uniquement , ne pas reproduire !!

    si tu as XP => double clique
    si tu as Vista ou windows 7 => clic droit "executer en tant que...."

    sur OTL.exe pour le lancer.

    ▶Copie la liste qui se trouve en gras ci-dessous,

    ▶ colle-la dans la zone sous "Personnalisation" :


    :processes
    explorer.exe
    iexplore.exe
    firefox.exe
    msnmsgr.exe
    Teatimer.exe

    IE - HKU\S-1-5-21-1963577801-2023874215-1520031096-1006\..\URLSearchHook: - Reg Error: Key error. File not found
    FF - prefs.js..browser.search.defaultthis.engineName: "Softonic_France Customized Web Search"
    FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2542115&SearchSource=3&q={searchTerms}"
    FF - prefs.js..browser.search.selectedEngine: "iMesh Web Search"
    FF - prefs.js..browser.startup.homepage: "http://search.imesh.net/"
    FF - prefs.js..keyword.URL: "http://www1.search-results.com/web?l=dis&q=&o=APN10653&apn_dtid=%5EIME001%5EYY%5EFR&shad=s_0043&gct=ds&apn_ptnrs=%5EAG1&d=1-0&lang=en&atb=sysid%3D1%3Auid%3D7df072a8fec0069e%3Asrc%3Dffb%3Ao%3DAPN10653%3Ab%3DiMesh%3Atg%3D&p2=%5EAG1%5EIME001%5EYY%5EFR"
    FF - prefs.js..browser.search.selectedEngine: "Bing"user_pref("browser.search.defaultenginename", "iMesh Web Search");
    [2010/09/25 02:40:58 | 000,000,000 | ---D | M] (Softonic_France Toolbar) -- C:\Documents and Settings\Anaïs\Application Data\Mozilla\Firefox\Profiles\33uda086.default\extensions\{364d4e0c-543f-4b85-abe3-19551139da4f}
    [2010/03/20 07:00:57 | 000,000,000 | ---D | M] (Softonic_France Toolbar) -- C:\Documents and Settings\Anaïs\Application Data\Mozilla\Firefox\Profiles\33uda086.default\extensions\{4daac69c-cba7-45e2-9bc8-1044483d3352}
    [2010/02/21 14:10:06 | 000,000,933 | ---- | M] () -- C:\Documents and Settings\Anaïs\Application Data\Mozilla\Firefox\Profiles\33uda086.default\searchplugins\conduit.xml
    [2010/09/02 10:09:28 | 000,002,486 | ---- | M] () -- C:\Documents and Settings\Anaïs\Application Data\Mozilla\Firefox\Profiles\33uda086.default\searchplugins\iMeshWebSearch.xml
    [2009/03/05 23:10:02 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
    [2009/04/01 07:02:01 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
    [2010/06/08 10:46:08 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
    [2010/09/07 20:01:50 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
    [2010/11/04 22:43:36 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
    [2011/02/07 16:16:47 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
    [2011/02/22 00:32:52 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
    [2010/09/02 10:09:28 | 000,002,486 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\iMeshWebSearch.xml
    O2 - BHO: (no name) - {64F56FC1-1272-44CD-BA6E-39723696E350} - No CLSID value found.
    O2 - BHO: (no name) - {C7B76B90-3455-4AE6-A752-EAC4D19689E5} - No CLSID value found.
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} http://download.divx.com/player/DivXBrowserPlugin.cab (Reg Error: Key error.)
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
    O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
    O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
    [2011/06/16 01:42:06 | 000,013,064 | -HS- | M] () -- C:\Documents and Settings\Anaïs\Local Settings\Application Data\v58041ysq61ef58s0dvm
    [2011/06/16 01:42:06 | 000,013,064 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\v58041ysq61ef58s0dvm
    [2011/06/16 01:18:39 | 009,435,574 | ---- | M] () -- C:\Documents and Settings\Anaïs\Bureau\mbam-setup-1.51.0.1200.exe
    [2011/06/16 00:49:49 | 000,511,488 | ---- | M] () -- C:\Documents and Settings\Anaïs\Bureau\winlogon.exe.exe (Rootkit.Dropper)
    [2011/04/23 18:21:11 | 000,000,064 | ---- | C] () -- C:\WINDOWS\System32\rp_stats.dat
    [2011/04/23 18:21:11 | 000,000,044 | ---- | C] () -- C:\WINDOWS\System32\rp_rules.dat
    [2009/07/05 20:51:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Anaïs\Application Data\EoRezo

    :Reg
    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    "TkBellExe"=-

    :commands
    [CLEARALLRESTOREPOINTS]
    [emptytemp]
    [start explorer]
    [reboot]


    ▶ Clique sur "Correction" pour lancer la suppression.

    ▶ Poste le rapport qui logiquement s'ouvrira tout seul en fin de travail appres le redemarrage.

    ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
    ¤¤¤¤¤¤¤¤¤¤¤¤_g3n-h@ckm@n developper_¤¤¤¤¤¤¤¤¤¤¤
    ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤_Pre_scan_¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
    ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
    1. Lalla
      Bonjour :)

      Voici le rapport je n'ai pas réussi à l'envoyer via cijoint.fr

      All processes killed
      ========== PROCESSES ==========
      No active process named explorer.exe was found!
      Process iexplore.exe killed successfully!
      No active process named firefox.exe was found!
      No active process named msnmsgr.exe was found!
      No active process named Teatimer.exe was found!
      No active process named URLSearchHook: - Reg Error: Key error. File not found was found!
      No active process named FF - prefs.js..browser.search.defaultthis.engineName: "Softonic_France Customized Web Search" was found!
      No active process named FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2542115&SearchSource=3&q={searchTerms}" was found!
      No active process named FF - prefs.js..browser.search.selectedEngine: "iMesh Web Search" was found!
      No active process named FF - prefs.js..browser.startup.homepage: "http://search.imesh.com/" was found!
      No active process named FF - prefs.js..keyword.URL: "http://search.imesh.com/web?src=ffb&systemid=1&q=" was found!
      No active process named FF - prefs.js..browser.search.selectedEngine: "Bing"user_pref("browser.search.defaultenginename", "iMesh Web Search"); was found!
      No active process named {364d4e0c-543f-4b85-abe3-19551139da4f} was found!
      No active process named {4daac69c-cba7-45e2-9bc8-1044483d3352} was found!
      No active process named conduit.xml was found!
      No active process named iMeshWebSearch.xml was found!
      No active process named {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} was found!
      No active process named {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} was found!
      No active process named {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} was found!
      No active process named {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} was found!
      No active process named {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} was found!
      No active process named {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} was found!
      No active process named {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} was found!
      No active process named iMeshWebSearch.xml was found!
      No active process named O2 - BHO: (no name) - {64F56FC1-1272-44CD-BA6E-39723696E350} - No CLSID value found. was found!
      No active process named O2 - BHO: (no name) - {C7B76B90-3455-4AE6-A752-EAC4D19689E5} - No CLSID value found. was found!
      No active process named Restrictions present was found!
      No active process named O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} http://download.divx.com/player/DivXBrowserPlugin.cab was found!
      No active process named O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab was found!
      No active process named O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab was found!
      No active process named O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab was found!
      No active process named O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab was found!
      No active process named O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab was found!
      No active process named v58041ysq61ef58s0dvm was found!
      No active process named v58041ysq61ef58s0dvm was found!
      No active process named mbam-setup-1.51.0.1200.exe was found!
      No active process named winlogon.exe.exe was found!
      No active process named rp_stats.dat was found!
      No active process named rp_rules.dat was found!
      No active process named EoRezo was found!
      ========== REGISTRY ==========
      Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\TkBellExe deleted successfully.
      ========== COMMANDS ==========
      Restore points cleared and new OTL Restore Point set!

      [EMPTYTEMP]

      User: Administrateur
      ->Temp folder emptied: 0 bytes
      ->Temporary Internet Files folder emptied: 67 bytes
      ->Java cache emptied: 12118713 bytes
      ->Flash cache emptied: 56507 bytes

      User: All Users

      User: Anaïs
      ->Temp folder emptied: 1051305 bytes
      ->Temporary Internet Files folder emptied: 9345133 bytes
      ->Java cache emptied: 0 bytes
      ->FireFox cache emptied: 5015391 bytes
      ->Flash cache emptied: 2027247 bytes

      User: Default User
      ->Temp folder emptied: 0 bytes
      ->Temporary Internet Files folder emptied: 32902 bytes
      ->Java cache emptied: 12118713 bytes
      ->Flash cache emptied: 56507 bytes

      User: LocalService
      ->Temp folder emptied: 66016 bytes
      ->Temporary Internet Files folder emptied: 32902 bytes

      User: NetworkService
      ->Temp folder emptied: 0 bytes
      ->Temporary Internet Files folder emptied: 33170 bytes

      %systemdrive% .tmp files removed: 0 bytes
      %systemroot% .tmp files removed: 0 bytes
      %systemroot%\System32 .tmp files removed: 2676224 bytes
      %systemroot%\System32\dllcache .tmp files removed: 0 bytes
      %systemroot%\System32\drivers .tmp files removed: 0 bytes
      Windows Temp folder emptied: 0 bytes
      %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
      %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
      RecycleBin emptied: 113250472 bytes

      Total Files Cleaned = 151,00 mb

      OTL by OldTimer - Version 3.2.24.1 log created on 06252011_140601

      Files\Folders moved on Reboot...

      Registry entries deleted on Reboot...

      Merci :)
  4. g3n-h@ckm@n
    ok quels soucis nous reste-t-il ?
    1. Lalla
      Et bien ma foi aucun!!! Non?

      :)) En tout cas un grand merci pour tout ton aide très précieuse!!

      Un dernier conseil : si j'ai Avira antivir et malwarebites, ça suffit comme protection?

      :)
  6. g3n-h@ckm@n
    est-il possible de faire fonctionner malwarebytes maintenant ?
    1. lalla
      Bonjour!

      Oui j'ai réussi à faire fonctionner malwarebytes voici son rapport :
      http://www.cijoint.fr/cjlink.php?file=cj201106/cijC6KS7uh.txt

      Merci :)
  7. g3n-h@ckm@n
    config non respectée recommence
    1. Lalla
      re,

      Alors effectivement j'avais sauté ce passage!
      OTL.txt: http://www.cijoint.fr/cjlink.php?file=cj201106/cijVaO1AEI.txt

      Extra : http://www.cijoint.fr/cjlink.php?file=cj201106/cijAGVVYfQ.txt

      :)
  8. g3n-h@ckm@n
    Télécharge ici :OTL

    ▶ enregistre le sur ton Bureau.

    si tu as XP => double clique
    si tu as Vista ou windows 7 => clic droit "executer en tant que...."

    sur OTL.exe pour le lancer.

    ▶ => Clique ici pour voir la Configuration

    ▶Clic sur Analyse.

    A la fin du scan, le Bloc-Notes va s'ouvrir avec le rapport (OTL.txt).

    Ce fichier est sur ton Bureau (en général C:\Documents and settings\le_nom_de_ta_session\OTL.txt)

    ▶▶▶ NE LE POSTE PAS SUR LE FORUM (il est trop long)

    Pour me le transmettre clique sur ce lien : http://www.cijoint.fr/

    ▶ Clique sur Parcourir et cherche le fichier ci-dessus.

    ▶ Clique sur Ouvrir.

    ▶ Clique sur "Cliquez ici pour déposer le fichier".

    juste au niveau du bouton , en fin de chargement du fichier , Un lien de cette forme apparaitra :

    http://www.cijoint.fr/cjlink.php?file=cjge368/cijSKAP5fU.txt

    ▶ Copie ce lien dans ta réponse.

    ▶▶ Tu feras la meme chose avec le "Extra.txt" qui logiquement sera aussi sur ton bureau.
    1. Lalla
      Bonjour,

      A chasue fois je crois que j'en ai finis mais non! Décidément!
      Donc voici le fichier OTL.txt :
      http://www.cijoint.fr/cjlink.php?file=cj201106/cij2dfwVKH.txt
      et le fichier Extra.txt :
      http://www.cijoint.fr/cjlink.php?file=cj201106/cijQCrktNC.txt

      En te remerciant,
  9. g3n-h@ckm@n
    desinstalle spyware terminator et ad-aware si presents dans la liste des programmes intallés
    1. Lalla
      C'est fait....

      en te remerciant,
  10. Lalla
    Bonjour,

    Voici le ComboFix.txt :
    http://www.cijoint.fr/cjlink.php?file=cj201106/cijJ422TQM.txt

    Merci
    1. g3n-h@ckm@n
      telecharge ce fichier

      dezippe-le et depose le fichier cfscript.txt qu'il contient sur l icone de combofix et laisse tourner puis poste le rapport

      http://www.cijoint.fr/cjlink.php?file=cj201106/cij4IkHvNm.zip
    2. Lalla
      Bonjour,

      Voilà le rapport.
      http://www.cijoint.fr/cjlink.php?file=cj201106/cijJleQr7n.txt

      En te remerciant,
  11. g3n-h@ckm@n

    __________________________________________________
    =>/!\Le script qui suit a été écrit spécialement cet ordinateur/!\ <=
    =>il est fort déconseillé de le transposer sur un autre ordinateur !<=
    ----------------------------------------------------------------------------

    Toujours avec toutes les protections désactivées, fais ceci :

    ▶ Ouvre le bloc-notes (Menu démarrer --> programmes --> accessoires --> bloc-notes)
    ▶ Copie/colle dans le bloc-notes ce qui entre les lignes ci dessous (sans les lignes) :

    ----------------------------------------------------------
    KillAll::

    Folder::
    c:\documents and settings\Anaïs\Application Data\imeshbandmltbpi
    c:\documents and settings\Anaïs\Local Settings\Application Data\iMesh
    c:\program files\iMesh Applications

    Registry::
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "TkBellExe"=-
    "QuickTime Task"=-
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\sharedaccess\parameters\firewallpolicy\standardprofile]

    FireFox::
    FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2542115&SearchSource=3&q={searchTerms}
    FF - prefs.js: browser.search.selectedEngine - iMesh Web Search
    FF - prefs.js: browser.startup.homepage - hxxp://search.imesh.com/
    FF - prefs.js: keyword.URL - hxxp://search.imesh.com/web?src=ffb&systemid=1&q=
    FF - prefs.js: browser.search.selectedEngine - Bing);user_pref(browser.search.defaultenginename, iMesh Web Search

    RegLock::
    [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
    [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
    [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
    [HKEY_LOCAL_MACHINE\software\Swearware\backup\winsock2\Parameters]


    ------------------------------------------------------------------

    ▶ Enregistre ce fichier sur ton Bureau (et pas ailleurs !) sous le nom CFScript.txt
    ▶ Quitte le Bloc Notes

    ▶ Fais un glisser/déposer de ce fichier CFScript sur le fichier combofix

    ▶ Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal ! Ne touche à rien tant que le scan n'est pas terminé.
    ▶ Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
    ▶ Si le fichier ne s'ouvre pas, il se trouve ici => C:\ComboFix.txt

    1. g3n-h@ckm@n
      poste le rapport via cijoint.fr stp
      1. Lalla
        Désolée j'avais oublié voici le lien :
        http://www.cijoint.fr/cjlink.php?file=cj201106/cijQDF6aoA.txt
    2. g3n-h@ckm@n

      /!\ ATTENTION SUIVRE A LA LETTRE CES INDICATIONS/!\

      __________________________________________________________
      >Ce logiciel n'est à utiliser que prescrit par un helper qualifié et formé à l'outil.<
      >>>>>>>Ne pas utiliser en dehors de ce cas de figure : dangereux!<<<<<<<<
      =====================================================

      ▶ Surtout , pense à l'enregistrement à renommer Combofix en "ton prenom.exe" avant qu'il soit enregistré sur ton disque dur

      Telecharge ici : Combofix

      Avant d'utiliser ComboFix :

      Si tu utilises AVG, IL FAUT IMPERATIVEMENT LE DESINSTALLER avant d'utiliser Combofix car il peut causer des dégâts en interaction avec l'outil pouvant mener à la réinstallation totale du système.
      La simple désactivation du résident n'est pas suffisante.
      Télécharge le désinstalleur d'AVG sur ce lien : https://www.avg.com/fr-fr/avg-remover
      Choisis la version adéquate (32 ou 64 bits)/!\

      Les logiciels d'émulation de CD comme Daemon Tools peuvent gêner les outils de désinfection. Utilise Defogger pour les désactiver temporairement :

      ▶ Télécharge Defogger (de jpshortstuff) sur ton Bureau

      ▶ Lance le

      Une fenêtre apparait : clique sur "Disable"

      ▶ Fais redémarrer l'ordinateur si l'outil te le demande

      Note : Quand nous aurons terminé la désinfection, tu pourras réactiver ces logiciels en relançant Defogger et en cliquant sur "Re-enable"

      _________________________________________________________
      >> referme les fenêtres de tous les programmes en cours.
      >> Désactive provisoirement et seulement le temps de l'utilisation de ComboFix,
      >>la protection en temps réel de ton Antivirus et de tes Antispywares,
      >>qui peuvent gêner fortement la procédure de recherche et de nettoyage de l'outil.
      °°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°

      si tu as XP => double clique
      si tu as Vista ou windows 7 => clic droit "executer en tant que...."

      sur combofix renommé

      ¤¤¤¤¤¤¤¤¤¤ LAISSE-LE INSTALLER LA CONSOLE DE RECUPERATION S'IL TE LE DEMANDE ¤¤¤¤¤¤¤¤¤¤

      ▶ !!!!!NE TOUCHE A RIEN PENDANT LE TRAVAIL DE COMBOFIX (SOURIS/CLAVIER.....)!!!!!

      ▶ n'oublie pas de reactiver la garde de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet.

      ▶▶ Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.

      1. Lalla
        ComboFix 11-06-16.02 - Anaïs 17/06/2011 17:30:14.1.1 - x86
        Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.1022.641 [GMT 2:00]
        Lancé depuis: c:\documents and settings\Anaïs\Bureau\Anna.exe.exe
        .
        .
        (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
        .
        .
        c:\documents and settings\Anaïs\Application Data\OfferBox
        c:\documents and settings\Anaïs\Application Data\OfferBox\config.dat
        c:\documents and settings\Anaïs\Application Data\OfferBox\config.xml
        c:\documents and settings\Anaïs\Application Data\PriceGong
        c:\documents and settings\Anaïs\Application Data\PriceGong\Data\1.xml
        c:\documents and settings\Anaïs\Application Data\PriceGong\Data\a.xml
        c:\documents and settings\Anaïs\Application Data\PriceGong\Data\b.xml
        c:\documents and settings\Anaïs\Application Data\PriceGong\Data\c.xml
        c:\documents and settings\Anaïs\Application Data\PriceGong\Data\d.xml
        c:\documents and settings\Anaïs\Application Data\PriceGong\Data\e.xml
        c:\documents and settings\Anaïs\Application Data\PriceGong\Data\f.xml
        c:\documents and settings\Anaïs\Application Data\PriceGong\Data\g.xml
        c:\documents and settings\Anaïs\Application Data\PriceGong\Data\h.xml
        c:\documents and settings\Anaïs\Application Data\PriceGong\Data\i.xml
        c:\documents and settings\Anaïs\Application Data\PriceGong\Data\J.xml
        c:\documents and settings\Anaïs\Application Data\PriceGong\Data\k.xml
        c:\documents and settings\Anaïs\Application Data\PriceGong\Data\l.xml
        c:\documents and settings\Anaïs\Application Data\PriceGong\Data\m.xml
        c:\documents and settings\Anaïs\Application Data\PriceGong\Data\mru.xml
        c:\documents and settings\Anaïs\Application Data\PriceGong\Data\n.xml
        c:\documents and settings\Anaïs\Application Data\PriceGong\Data\o.xml
        c:\documents and settings\Anaïs\Application Data\PriceGong\Data\p.xml
        c:\documents and settings\Anaïs\Application Data\PriceGong\Data\q.xml
        c:\documents and settings\Anaïs\Application Data\PriceGong\Data\r.xml
        c:\documents and settings\Anaïs\Application Data\PriceGong\Data\s.xml
        c:\documents and settings\Anaïs\Application Data\PriceGong\Data\t.xml
        c:\documents and settings\Anaïs\Application Data\PriceGong\Data\u.xml
        c:\documents and settings\Anaïs\Application Data\PriceGong\Data\v.xml
        c:\documents and settings\Anaïs\Application Data\PriceGong\Data\w.xml
        c:\documents and settings\Anaïs\Application Data\PriceGong\Data\x.xml
        c:\documents and settings\Anaïs\Application Data\PriceGong\Data\y.xml
        c:\documents and settings\Anaïs\Application Data\PriceGong\Data\z.xml
        c:\documents and settings\Anaïs\WINDOWS
        c:\program files\OfferBox
        c:\program files\OfferBox\OfferBoxBHO.dll
        D:\Autorun.inf
        .
        .
        ((((((((((((((((((((((((((((( Fichiers créés du 2011-05-17 au 2011-06-17 ))))))))))))))))))))))))))))))))))))
        .
        .
        2011-06-16 00:27 . 2011-06-16 00:27 61952 ----a-w- c:\windows\system32\getmac.exe
        2011-06-16 00:27 . 2011-06-16 00:27 86528 ----a-w- c:\windows\system32\eventtriggers.exe
        2011-06-16 00:27 . 2011-06-16 00:27 53248 ----a-w- c:\windows\system32\eventcreate.exe
        2011-06-16 00:27 . 2011-06-16 00:27 65536 ----a-w- c:\windows\system32\driverquery.exe
        2011-06-16 00:27 . 2011-06-16 00:27 57344 ----a-w- c:\windows\system32\cipher.exe
        2011-06-16 00:27 . 2011-06-16 00:27 158208 ----a-w- c:\windows\system32\bootcfg.exe
        2011-06-16 00:27 . 2011-06-16 00:27 32768 ----a-w- c:\windows\system32\asr_pfu.exe
        2011-06-16 00:27 . 2011-06-16 00:27 37888 ----a-w- c:\windows\system32\asr_ldm.exe
        2011-06-16 00:27 . 2011-06-16 00:27 30720 ----a-w- c:\windows\system32\asr_fmt.exe
        2011-06-16 00:27 . 2011-06-17 15:21 -------- d-----w- C:\Kill'em
        2011-06-15 23:07 . 2011-06-15 23:07 -------- d-----w- C:\RK_Quarantine
        2011-06-15 22:29 . 2011-06-15 22:30 -------- d-----w- c:\documents and settings\Administrateur
        2011-06-10 18:20 . 2011-06-10 18:20 -------- d-----w- c:\documents and settings\Anaïs\Application Data\imeshbandmltbpi
        2011-06-10 18:17 . 2011-06-10 18:18 -------- d-----w- c:\documents and settings\Anaïs\Local Settings\Application Data\iMesh
        2011-06-10 18:14 . 2011-06-11 10:59 -------- d-----w- c:\program files\iMesh Applications
        2011-06-10 18:11 . 2011-06-10 18:11 -------- d-----w- c:\documents and settings\Anaïs\Local Settings\Application Data\PackageAware
        .
        .
        .
        (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
        .
        2008-04-07 08:02 . 2008-06-15 09:16 67696 -c--a-w- c:\program files\mozilla firefox\components\jar50.dll
        2008-04-07 08:02 . 2008-06-15 09:16 54376 -c--a-w- c:\program files\mozilla firefox\components\jsd3250.dll
        2008-04-07 08:02 . 2008-06-15 09:16 34952 -c--a-w- c:\program files\mozilla firefox\components\myspell.dll
        2008-04-07 08:02 . 2008-06-15 09:16 46720 -c--a-w- c:\program files\mozilla firefox\components\spellchk.dll
        2008-04-07 08:02 . 2008-06-15 09:16 172144 -c--a-w- c:\program files\mozilla firefox\components\xpinstal.dll
        .
        .
        ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
        .
        .
        *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
        REGEDIT4
        .
        [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-06-14 2424192]
        .
        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2010-03-02 202256]
        "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-12-11 286720]
        .
        [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
        "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
        .
        c:\documents and settings\All Users\Menu D'marrer\Programmes\D'marrage\
        Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
        .
        [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
        "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
        .
        [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
        2009-09-03 13:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll
        .
        [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Démarrage rapide de HP Photosmart Premier.lnk]
        path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Démarrage rapide de HP Photosmart Premier.lnk
        backup=c:\windows\pss\Démarrage rapide de HP Photosmart Premier.lnkCommon Startup
        .
        [HKLM\~\startupfolder\C:^Documents and Settings^Anaïs^Menu Démarrer^Programmes^Démarrage^Notification de cadeaux MSN.lnk]
        path=c:\documents and settings\Anaïs\Menu Démarrer\Programmes\Démarrage\Notification de cadeaux MSN.lnk
        backup=c:\windows\pss\Notification de cadeaux MSN.lnkStartup
        .
        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
        2010-03-24 18:17 952768 ----a-w- c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe
        .
        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
        2009-10-03 09:45 39792 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
        .
        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CANAL+ CANALSAT A LA DEMANDE]
        2010-05-03 11:21 163992 ----a-r- c:\program files\Canal+\CANAL+ CANALSAT A LA DEMANDE\Launcher.exe
        .
        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
        2007-12-11 09:56 286720 ----a-w- c:\program files\QuickTime\QTTask.exe
        .
        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
        2010-10-29 13:49 249064 ----a-w- c:\program files\Fichiers communs\Java\Java Update\jusched.exe
        .
        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
        2010-03-02 14:38 202256 ----a-w- c:\program files\Fichiers communs\Real\Update_OB\realsched.exe
        .
        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
        "DisableNotifications"= 1 (0x1)
        .
        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
        "%windir%\\system32\\sessmgr.exe"=
        "c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
        "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
        "c:\\Program Files\\CrossLoop\\CrossLoopConnect.exe"=
        "c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
        "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
        "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
        "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
        "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
        .
        R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [03/04/2009 21:50 64288]
        R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [23/11/2009 09:43 12872]
        R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [23/11/2009 09:43 67656]
        R2 CanalPlus.VOD;CanalPlus.VOD;c:\program files\Canal+\CANAL+ CANALSAT A LA DEMANDE\VOD\CanalPlus.VOD.exe [03/05/2010 13:17 188416]
        R3 HSFHWATI;HSFHWATI;c:\windows\system32\drivers\HSFHWATI.sys [22/08/2005 11:06 231424]
        S2 gupdate1c9dadbc2282a78;Service Google Update (gupdate1c9dadbc2282a78);c:\program files\Google\Update\GoogleUpdate.exe [22/05/2009 14:49 133104]
        S3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\system32\drivers\ASPI32.SYS [05/02/2008 19:54 16512]
        S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.Sys [12/07/2009 15:35 36608]
        S3 gupdatem;Service Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [22/05/2009 14:49 133104]
        S3 Lavasoft Kernexplorer;Lavasoft helper driver;\??\c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys --> c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys [?]
        S3 PTV339;Mini DualTV USB;c:\windows\system32\drivers\PTV339.SYS [20/04/2008 20:59 278144]
        S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [23/11/2009 09:43 12872]
        S3 Service CANALPLAY;Service CANALPLAY;c:\program files\Lecteur CANALPLAY\CanalPlayService.exe [25/05/2010 22:10 450560]
        .
        --- Autres Services/Pilotes en mémoire ---
        .
        *NewlyCreated* - WUAUSERV
        .
        [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
        HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
        .
        Contenu du dossier 'Tâches planifiées'
        .
        2011-06-17 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
        - c:\program files\Google\Update\GoogleUpdate.exe [2009-05-22 12:49]
        .
        2011-06-17 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
        - c:\program files\Google\Update\GoogleUpdate.exe [2009-05-22 12:49]
        .
        2011-06-17 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1963577801-2023874215-1520031096-1006.job
        - c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-09 17:38]
        .
        2011-06-11 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1963577801-2023874215-1520031096-1006.job
        - c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-09 17:38]
        .
        .
        ------- Examen supplémentaire -------
        .
        uStart Page = hxxp://www.google.com/
        uDefault_Search_URL = hxxp://www.google.com/ie
        uInternet Connection Wizard,ShellNext = hxxp://www.hp.com/
        uSearchAssistant = hxxp://www.google.com/ie
        uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
        IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
        Trusted Zone: canalplay.com
        Trusted Zone: canalplusactive.com
        Trusted Zone: canalplay.com
        Trusted Zone: canalplusactive.com
        TCP: DhcpNameServer = 89.2.0.1 89.2.0.2
        DPF: {0972B098-DEE9-4279-AC7E-4BAAA029102D} - hxxp://assets.photobox.com/assets/aurigma/ImageUploader5.cab?20110217084203
        FF - ProfilePath - c:\documents and settings\Anaïs\Application Data\Mozilla\Firefox\Profiles\33uda086.default\
        FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2542115&SearchSource=3&q={searchTerms}
        FF - prefs.js: browser.search.selectedEngine - iMesh Web Search
        FF - prefs.js: browser.startup.homepage - hxxp://search.imesh.com/
        FF - prefs.js: browser.startup.homepage - hxxp://fr.msn.com/
        FF - prefs.js: keyword.URL - hxxp://search.imesh.com/web?src=ffb&systemid=1&q=
        FF - prefs.js: browser.search.selectedEngine - Bing);user_pref(browser.search.defaultenginename, iMesh Web Search
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=867034&p=
        FF - prefs.js: browser.search.selectedEngine - Yahoo
        FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search
    3. g3n-h@ckm@n
      ok c'est pas normal que tu ne puisses pas faire ca :

      https://forums.commentcamarche.net/forum/affich-22377836-rogue-xp-internet-security-2012#3

      chez moi ca fonctionne....

      ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Pre_Script ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

      ¤¤¤¤¤ XP | Vista | Seven - 32/64 bits ¤¤¤¤¤

      Utilisateur : gen-hackman (Administrateurs)
      Ordinateur : GEN-HACKMAN-PC
      Système d'exploitation : Windows 7 (32 bits) Service Pack 1
      Internet Explorer : 9.0.8112.16421
      Mozilla Firefox : 4.0.1 (fr)

      Switchs possibles :

      processes:: | file:: | folder::
      Registry:: | Driver:: | replace::
      txt:: | Host:: | DNS:: | NsLook::
      Command:: | list:: | attrib::

      Script : 01:37:52

      ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

      switchs :

      file::
      F:\RECYCLER\S-1-5-21-2214276341-3544434524-6043330-4321\update.exe
      C:\Documents and Settings\All Users\Application Data\v58041ysq61ef58s0dvm
      C:\Documents and Settings\Anaïs\Local Settings\Application Data\v58041ysq61ef58s0dvm

      folder::
      C:\Documents and Settings\Anaïs\Application Data\imeshbandmltbpi
      C:\Documents and Settings\Anaïs\Local Settings\Application Data\iMesh
      C:\Documents and Settings\Anaïs\Application Data\OfferBox
      C:\Documents and Settings\Anaïs\Local Settings\Application Data\Conduit
      C:\Documents and Settings\Anaïs\Application Data\PriceGong

      Registry::
      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "TkBellExe"=-
      "QuickTime Task"=-

      ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

      Modification du registre effectuéé

      ¤

      Absent : F:\RECYCLER\S-1-5-21-2214276341-3544434524-6043330-4321\update.exe
      Absent : C:\Documents and Settings\All Users\Application Data\v58041ysq61ef58s0dvm
      Absent : C:\Documents and Settings\Anaïs\Local Settings\Application Data\v58041ysq61ef58s0dvm

      ¤

      Absent : C:\Documents and Settings\Anaïs\Application Data\imeshbandmltbpi
      Absent : C:\Documents and Settings\Anaïs\Local Settings\Application Data\iMesh
      Absent : C:\Documents and Settings\Anaïs\Application Data\OfferBox
      Absent : C:\Documents and Settings\Anaïs\Local Settings\Application Data\Conduit
      Absent : C:\Documents and Settings\Anaïs\Application Data\PriceGong

      ¤

      Fin : 01:37:52

      ¤¤¤¤¤¤¤¤¤¤ ( EOF ) ¤¤¤¤¤¤¤¤¤¤
      1. Lalla
        je ne comprends pas je suis scrupuleusement tes instructions, rien n'y fait!!
    4. g3n-h@ckm@n
      salut tig' ^^

      @Lalla

      as-tu tous tes documents apparents ainsi que ton menu demarrer comme il l'etait avant l infection ?
      1. Lalla
        Oui j'ai tous mes documents apparents ainsi que mon menu démarrer comme avant l'infection.
    5. Lalla
      Bonjour Tigzy,

      Suite au Prescan je peux maintenant faire une recherche avec Roguekiller. Mais quand le rogue était toujours dans mon ordi, impossible de faire une recherche avec Roguekiller il me disait que Roguekiller devait être fermé.

      Apparement je n'arrive pas à faire un Pre_script correctement mais je ne comprend pas ce qui ne marche pas. Selon toute apparence le rogue n'est plus dans mon ordi (plus rien n'est bloqué) mais est-ce seulement une apparence ou suis-je tirée d'affaire?

      Merci :)

      Lalla
      1. Tigzy Contributeur sécurité
        Tu avais essayé de le renommer en winlogon.exe comme conseillé?
      2. Lalla
        oui je l'avais renommé et là il m'a demandé de l'ouvrir en mode admnistrateur mais comme mon mode sans échec ne voulait pas marcher j'étais coincée...
      3. Tigzy Contributeur sécurité
        J'ai pas tout suivi,
        Maintenant il y a plus besoin de lancer en mode Admin, c'est automatique
      4. Lalla
        oui maintenant je n'ai plus besoin de le lancer en mode admin.
    6. Tigzy Contributeur sécurité
      Salut

      Tu as des précisions sur le plantage de RogueKiller?
      ça arrive à quel moment? il est marqué quoi sur la console bleue?
      2. Lalla
        Ah donc oui j'avais Antivir qui était toujours activé donc je l'ai désactivé et j'ai refait le pre_script en faisant bien "enregistrer" mais ça me redit pareil :(

        ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Pre_Script ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

        ¤¤¤¤¤ XP | Vista | Seven - 32/64 bits ¤¤¤¤¤

        Utilisateur : Anaïs (Administrateurs)
        Ordinateur : PC323193453271
        Système d'exploitation : Microsoft Windows XP (32 bits)
        Internet Explorer : 8.0.6001.18702
        Mozilla Firefox : 2.0.0.14 (fr)

        Switchs possibles :

        processes:: | file:: | folder::
        Registry:: | Driver:: | replace::
        txt:: | Host:: | DNS:: | NsLook::
        Command:: | list:: | attrib::

        Script : 13:42:03

        ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

        switchs :

        ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

        explorer.exe -> Processus redémarré

        Fin : 13:42:03

        ¤¤¤¤¤¤¤¤¤¤ ( EOF ) ¤¤¤¤¤¤¤¤¤¤
        1. g3n-h@ckm@n
          alors soit :

          tu fais pas enregistrer tout court mais enregistrer sous donc , pas bon
          tu as encore une protection d'activée tel que je le vois quand tu as utilisé pre_scan :

          1856 | C:\Program Files\Avira\AntiVir Desktop\avguard.exe - SYSTEM - Normal - "C:\Program Files\Avira\AntiVir Desktop\avguard.exe" - 864

          • 1
          • 2

          Discussions similaires

          Security boot fail lors du démarrage
          Steu

          5 réponses
          SecurityHealth est a désactiver ou pas au démarrage de W10 Pro 64 ?
          Walti55

          2 réponses
          FOTOSE (allemagne)
          lix

          13 réponses
          Comment retirer le SECURE BOOT ?
          Elparigo60

          10 réponses
          Security Boot Fail Windows 10 Acer
          benjamin5800

          22 réponses