Msn
joluis40 -  
Bonjour a tous!

je pense avoir été infecté par le virus: IS THIS YOU? pouvez vous m'aidez s'il vous plait?
Configuration: Windows Vista
Internet Explorer 7.0

52 réponses

Résumé de la discussion

Le fil porte sur une suspicion d'infection par le malware "IS THIS YOU?" sur un système Windows Vista avec Internet Explorer 7 et la demande d'aide pour diagnostiquer et nettoyer l'ordinateur. Plusieurs éléments de réponse proposent des outils et méthodes techniques: télécharger GenProc ou Ad-Remover, dézipper, exécuter des étapes spécifiques et générer des rapports pour analyser les fichiers infectés et les éléments malveillants. Des retours d'outils d'analyse antivirus indiquent des trojans et des adwares, notamment SweetIM et EoRezo, avec des éléments persistants dans AppData et le registre, et des rapports générés lors d'analyses complètes.

Bobot (l’IA à votre service)
  1. pimprenelle27 Contributeur sécurité
    Télécharge :

    - MSNFix (!aur3n7) et décompresse-le sur le Bureau.

    Regarde bien le Tuto Ici

    Ensuite :

    Redémarre en mode sans échec comme indiqué ici ; Choisis ta session courante.

    Lance le fichier MSNFix.bat qui se trouve dans le dossier MSNfix, sur le bureau.
    - Exécute l'option R.
    - Si l'infection est détectée, exécute l'option N.
    - Sauvegarde ce rapport sur ton bureau.

    Pour ceux qui ont vista, ne pas oublier de désactiver Le contrôle des comptes utilisateurs

    Le rapport sera enregistré dans C:\Windows\ sous le nom de MSNFix

    Mais il n'y aura pas que ça à faire il faudra vérifier s'il n'y a as d'autre infection.

    0
    1. joluis40 Auteur
      j'ai essayé ta méthode mais ça ne marche pas, aurai tu un autre moyen de virer cette m.... tout mon PC commence a bugguer! merci quand meme pour ta 1°réponse.
      0
      1. pimprenelle27 Contributeur sécurité
        As tu désactivé le contrôle des compte utilisateur et redémarré ton ordi?
        0
        1. joluis40 Auteur
          re pimprenelle! j'ai bien desactivé le controle des comptes utilisateur et redemarrer mon PC, je ne suis pas un pro de l'informatique et ce virus m'agace sérieusement! !
          0
          2. pimprenelle27 Contributeur sécurité
            et ça ne marche toujours pas ?

            fait ceci :

            Pour commencer : faire un petit nettoyage de l'ordi et du registre avec Ccleaner, regarde bien le Tuto CCleaner

            Ensuite :

            Télécharge le fichier d'installation d'HijackThis.

            Enregistre HJTInstall.exe sur ton bureau.

            Renomme Hijackthis en Tutu

            Double-clique sur HJTInstall.exe (tutu) pour lancer le programme

            Par défaut, il s'installera là :
            C:\Program Files\Trend Micro\HijackThis

            Accepte la licence en cliquant sur le bouton "I Accept"

            Choisis l'option "Do a system scan and save a log file"

            Clique sur "Save log" pour enregistrer le rapport qui s'ouvrira avec le bloc-note

            Clique sur "Edition -> Sélectionner tout", puis sur "Edition -> Copier" pour copier tout le contenu du rapport

            Colle le rapport que tu viens de copier sur ce forum

            Ne fixe encore AUCUNE ligne, cela pourrait empêcher ton PC de fonctionner correctement

            Tutoriaux (ne fixe rien pour le moment !!)

            Pour ceux qui ont vista, ne pas oublier de désactiver Le contrôle des comptes utilisateurs

            0
            1. joluis40 Auteur
              je pense avoir fais ce qu'il fallait, merci de m'aider ! !

              Logfile of Trend Micro HijackThis v2.0.2
              Scan saved at 23:50:34, on 20/03/2009
              Platform: Windows Vista SP1 (WinNT 6.00.1905)
              MSIE: Internet Explorer v7.00 (7.00.6001.18000)
              Boot mode: Normal

              Running processes:
              C:\Windows\system32\Dwm.exe
              C:\Windows\Explorer.EXE
              C:\Windows\system32\taskeng.exe
              C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
              C:\Windows\System32\rundll32.exe
              C:\Program Files\HP\QuickPlay\QPService.exe
              C:\Program Files\Windows Defender\MSASCui.exe
              C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
              C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
              C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
              C:\Program Files\Java\jre6\bin\jusched.exe
              C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
              C:\Program Files\QuickTime\qttask.exe
              C:\Program Files\SweetIM\Messenger\SweetIM.exe
              C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
              C:\Program Files\Alwil Software\Avast4\ashDisp.exe
              C:\Program Files\Windows Sidebar\sidebar.exe
              C:\Windows\fxsteller.exe
              C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
              C:\Windows\ehome\ehtray.exe
              C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
              C:\Program Files\Windows Media Player\wmpnscfg.exe
              C:\Program Files\OpenOffice.org 3\program\soffice.exe
              C:\Program Files\OpenOffice.org 3\program\soffice.bin
              C:\Program Files\Windows Live\Messenger\msnmsgr.exe
              C:\Windows\ehome\ehmsas.exe
              C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE
              C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
              C:\Program Files\Windows Live\Contacts\wlcomm.exe
              C:\Windows\system32\SearchFilterHost.exe
              C:\Program Files\Internet Explorer\iexplore.exe
              C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
              C:\Program Files\Windows Live\Toolbar\wltuser.exe
              c:\Users\Coyote\Downloads\HiJackThis.exe

              R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=compaq-notebook.msn.com&ocid=HPDHP&pc=CPNTDF
              R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
              R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=compaq-notebook.msn.com&ocid=HPDHP&pc=CPNTDF
              R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
              R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
              R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=compaq-notebook.msn.com&ocid=HPDHP&pc=CPNTDF
              R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
              R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
              O1 - Hosts: ::1 localhost
              O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
              O2 - BHO: ShoppingAdsHelper - {2C86C605-6081-D104-96F7-F765C20B22F1} - C:\Program Files\ShoppingAdsHelper\ShoppingAdsHelper-3.dll
              O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
              O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
              O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
              O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
              O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
              O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
              O2 - BHO: EoBHO - {C7B76B90-3455-4AE6-A752-EAC4D19689E5} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)
              O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
              O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
              O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
              O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
              O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
              O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
              O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\2.0"
              O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
              O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
              O4 - HKLM\..\Run: [QlbCtrl.exe] C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
              O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
              O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
              O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
              O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
              O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
              O4 - HKLM\..\Run: [SweetIM] C:\Program Files\SweetIM\Messenger\SweetIM.exe
              O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
              O4 - HKLM\..\Run: [EoEngine] "C:\Program Files\EoRezo\EoEngine.exe"
              O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
              O4 - HKLM\..\Run: [Windows UDP Control Center] fxsteller.exe
              O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
              O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
              O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
              O4 - HKCU\..\Run: [MsnMsgr] ~"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
              O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
              O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
              O4 - HKCU\..\Run: [acxzup] "c:\users\coyote\appdata\local\acxzup.exe" acxzup
              O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
              O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
              O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
              O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
              O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
              O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
              O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
              O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
              O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
              O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
              O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
              O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
              O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
              O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
              O13 - Gopher Prefix:
              O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
              O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/resources/VistaMSNPUpldfr-fr.cab
              O16 - DPF: {588031A3-94BF-4CDD-86D0-939F6F93910F} (FixItClient Class) - https://fixit.support.microsoft.com/ActiveX/FixItClient.CAB
              O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
              O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
              O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
              O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
              O23 - Service: Com4QLBEx - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
              O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
              O23 - Service: Service Google Update (gupdate1c9911b63c96fa0) (gupdate1c9911b63c96fa0) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
              O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
              O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
              O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
              O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
              O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
              O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
              O23 - Service: Recovery Service for Windows - Unknown owner - C:\Windows\SMINST\BLService.exe
              O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
              O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
              O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
              0
              1. joluis40 Auteur
                je pense avoir fais ce qu'il fallait, merci de m'aider ! !

                Logfile of Trend Micro HijackThis v2.0.2
                Scan saved at 23:50:34, on 20/03/2009
                Platform: Windows Vista SP1 (WinNT 6.00.1905)
                MSIE: Internet Explorer v7.00 (7.00.6001.18000)
                Boot mode: Normal

                Running processes:
                C:\Windows\system32\Dwm.exe
                C:\Windows\Explorer.EXE
                C:\Windows\system32\taskeng.exe
                C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
                C:\Windows\System32\rundll32.exe
                C:\Program Files\HP\QuickPlay\QPService.exe
                C:\Program Files\Windows Defender\MSASCui.exe
                C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
                C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
                C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
                C:\Program Files\Java\jre6\bin\jusched.exe
                C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
                C:\Program Files\QuickTime\qttask.exe
                C:\Program Files\SweetIM\Messenger\SweetIM.exe
                C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
                C:\Program Files\Alwil Software\Avast4\ashDisp.exe
                C:\Program Files\Windows Sidebar\sidebar.exe
                C:\Windows\fxsteller.exe
                C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
                C:\Windows\ehome\ehtray.exe
                C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                C:\Program Files\Windows Media Player\wmpnscfg.exe
                C:\Program Files\OpenOffice.org 3\program\soffice.exe
                C:\Program Files\OpenOffice.org 3\program\soffice.bin
                C:\Program Files\Windows Live\Messenger\msnmsgr.exe
                C:\Windows\ehome\ehmsas.exe
                C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE
                C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
                C:\Program Files\Windows Live\Contacts\wlcomm.exe
                C:\Windows\system32\SearchFilterHost.exe
                C:\Program Files\Internet Explorer\iexplore.exe
                C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
                C:\Program Files\Windows Live\Toolbar\wltuser.exe
                c:\Users\Coyote\Downloads\HiJackThis.exe

                R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/...
                R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/...
                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
                R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/...
                R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
                R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
                O1 - Hosts: ::1 localhost
                O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                O2 - BHO: ShoppingAdsHelper - {2C86C605-6081-D104-96F7-F765C20B22F1} - C:\Program Files\ShoppingAdsHelper\ShoppingAdsHelper-3.dll
                O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
                O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
                O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
                O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
                O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
                O2 - BHO: EoBHO - {C7B76B90-3455-4AE6-A752-EAC4D19689E5} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)
                O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
                O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
                O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
                O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
                O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
                O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
                O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\2.0"
                O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
                O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
                O4 - HKLM\..\Run: [QlbCtrl.exe] C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
                O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
                O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
                O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
                O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
                O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                O4 - HKLM\..\Run: [SweetIM] C:\Program Files\SweetIM\Messenger\SweetIM.exe
                O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
                O4 - HKLM\..\Run: [EoEngine] "C:\Program Files\EoRezo\EoEngine.exe"
                O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                O4 - HKLM\..\Run: [Windows UDP Control Center] fxsteller.exe
                O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
                O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
                O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
                O4 - HKCU\..\Run: [MsnMsgr] ~"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
                O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
                O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                O4 - HKCU\..\Run: [acxzup] "c:\users\coyote\appdata\local\acxzup.exe" acxzup
                O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
                O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
                O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
                O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
                O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
                O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
                O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
                O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
                O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
                O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
                O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
                O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
                O13 - Gopher Prefix:
                O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
                O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/resources/VistaMSNPUpldfr-fr.cab
                O16 - DPF: {588031A3-94BF-4CDD-86D0-939F6F93910F} (FixItClient Class) - https://fixit.support.microsoft.com/ActiveX/FixItClient.CAB
                O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                O23 - Service: Com4QLBEx - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
                O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
                O23 - Service: Service Google Update (gupdate1c9911b63c96fa0) (gupdate1c9911b63c96fa0) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
                O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
                O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
                O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
                O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
                O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
                O23 - Service: Recovery Service for Windows - Unknown owner - C:\Windows\SMINST\BLService.exe
                O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
                O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
                O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
                0
                1. pimprenelle27 Contributeur sécurité
                  Alors d'abords ceci infection eozero :

                  AD-Remover : recherche

                  * Sous Vista : ▶ Désactive le contrôle des comptes utilisateurs (tu le réactiveras après ta désinfection):

                  * Clique sur Démarrer puis sur panneau de configuration
                  * Double Clique sur l'icône "Comptes d'utilisateurs"
                  * Clique ensuite sur désactiver et valide.
                  * Redémarre le PC

                  ▶ Télécharge et enregistre le fichier d installation sur ton bureau :

                  http://sd-1.archive-host.com/membres/up/16506160323759868/AD-R.exe

                  ▶ Double clique sur le programme d'installation , et installe le dans son emplacement par défaut. ( le bureau )

                  ▶ Ouvre le dossier Ad-remover présent sur ton bureau

                  ▶ Double clique sur Ad-remover.bat.

                  * Sous Vista : clic droit sur AD-Remover et sélectionner "Exécuter en tant qu'administrateur"

                  ▶ Au menu principal choisi l'option "A"

                  ▶ Poste le rapport qui apparait à la fin.

                  ( le rapport est sauvegardé aussi sous C:\Ad-report.log )

                  (CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

                  Note :

                  Process.exe est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
                  Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
                  Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.
                  0
                  1. joluis40 Auteur
                    VOILA CE QUI L'EN RESSORT :

                    ------- LOGFILE OF AD-REMOVER 1.1.1.9 | ONLY XP/VISTA -------

                    Updated by C_XX on 18/03/2009 at 21:20 - AdRemover.contact@gmail.com

                    Start at: 0:21:12, Sat 21/03/2009 | Boot mode: Normal Boot
                    Option: SCAN | Executed from: C:\Program Files\Ad-remover\Ad-remover.bat
                    Operating System: Microsoft® Windows Vista™ Home Premium Service Pack 1 (version 6.0.6001)
                    Computer Name: PC-DE-COYOTE
                    Current User: Coyote - Administrator
                    Drive(s):
                    - C:\ (File System: NTFS)
                    - D:\ (File System: NTFS)
                    System Drive: C:\
                    Windows Directory: C:\Windows\
                    System Directory: C:\Windows\System32\

                    --- Running Processes: 81

                    +-----------------| Boonty/Boonty Games Elements Found:

                    .
                    .

                    +-----------------| Eorezo Elements Found:

                    HKCR\AppID\{362A53B2-2913-4F8A-82F5-7E0A23FDC6F9}
                    HKCR\AppID\EoRezoBHO.DLL
                    HKCR\CLSID\{C7B76B90-3455-4AE6-A752-EAC4D19689E5}
                    HKCR\EoRezoBHO.EoBho
                    HKCR\EoRezoBHO.EoBho.1
                    HKCR\Typelib\{B6ACB3F1-6A83-432C-B854-3E1056F87F4E}
                    HKCU\Software\EoRezo
                    HKLM\Software\EoRezo
                    HKLM\Software\Classes\AppID\{362A53B2-2913-4F8A-82F5-7E0A23FDC6F9}
                    HKLM\Software\Classes\AppID\EoRezoBHO.DLL
                    HKLM\Software\Classes\CLSID\{C7B76B90-3455-4AE6-A752-EAC4D19689E5}
                    HKLM\Software\Classes\EoRezoBHO.EoBho
                    HKLM\Software\Classes\EoRezoBHO.EoBho.1
                    HKLM\Software\Classes\TypeLib\{B6ACB3F1-6A83-432C-B854-3E1056F87F4E}
                    HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C7B76B90-3455-4AE6-A752-EAC4D19689E5}
                    HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\Eoengine
                    .
                    C:\Users\Coyote\AppData\Roaming\EoRezo

                    +-----------------| Infected Poker Softwares Elements Found:

                    .

                    +-----------------| FunWebProducts/MyWay/MyWebSearch Elements Found:

                    .
                    .

                    +-----------------| It's TV Elements Found:

                    .

                    +-----------------| Sweetim Elements Found:

                    HKCR\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}
                    HKCR\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064}
                    HKCR\MediaPlayer.GraphicsUtils
                    HKCR\MediaPlayer.GraphicsUtils.1
                    HKCR\MgMediaPlayer.GifAnimator
                    HKCR\MgMediaPlayer.GifAnimator.1
                    HKCR\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}
                    HKCU\Software\SweetIM
                    HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
                    HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
                    HKLM\Software\Classes\MediaPlayer.GraphicsUtils
                    HKLM\Software\Classes\MediaPlayer.GraphicsUtils.1
                    HKLM\Software\Classes\MgMediaPlayer.GifAnimator
                    HKLM\Software\Classes\MgMediaPlayer.GifAnimator.1
                    HKLM\Software\Classes\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}
                    HKLM\Software\Classes\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}
                    HKLM\Software\Classes\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064}
                    HKLM\Software\Classes\Interface\{A439801C-961D-452C-AB42-7848E9CBD289}
                    HKLM\Software\Classes\Interface\{F4EBB1E2-21F3-4786-8CF4-16EC5925867F}
                    HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe
                    HKLM\Software\SweetIM
                    HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\Sweetim
                    HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EEE6C35B-6118-11DC-9C72-001320C79847}
                    HKCU\Software\Microsoft\Internet Explorer\InternetRegistry\Registry\User\S-1-5-21-3160323180-1118315530-3963894545-1000\Software\Sweetim
                    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\07D5290CDBDAE4242926B8E6CA650501
                    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\08E33F7B61DEFF24BB9673ED7D467636
                    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\0E3D8A5B48622A445A7DF73FEFF32C3F
                    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\1AC67655DD68F8240B2860F2D511EBD8
                    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536
                    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\34EDDB1BFB3A2D448845F3EFD0F15A43
                    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\427EA997C413D1D47907CBFC7B2DB432
                    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\4318DF19719275242801CBE292063A4C
                    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\45FC115D1FEAEF849A4E1610D6EC8BF0
                    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\46A5861A389ADB844AF89E31BC9DF0A1
                    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\49B0E1A6FF50BBE4289E4E23DE6EA0C7
                    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\4CCCAC049F34D0540AAC13011398BEDB
                    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5C4389D0BFB302C479DE4178BD5D9EBA
                    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5D19F074C042AD34BAB463D4175A062E
                    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5D2B09BDEF4FE54418E6F3373CDBC7AC
                    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\61B65D3397A1FBF4CB1571B5E4F6B5B0
                    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\68E8A05C60DD9254591DBD16C94EDDBF
                    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\697E782CF574CC34CBB9566440BA12BC
                    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\6AE27A8613CF7EA4782F2886F67295E5
                    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\7CE172051F585E04187BCB97570BFA74
                    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\86A901BA5265452499DCBF719C378EE3
                    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\88ABD1CD5C40EC84789A7F6EF86DAC5E
                    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\980289C22F80A7C4BB9323DC61255E4E
                    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\9A4B7EF3789F871419D9302583B20C15
                    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\A6C53B0F76C44004A8F36716213017DB
                    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\B59F2D8189784CC46A4597F2842480B0
                    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\BD746FB95FB8E5B45BF66BE54D5FD91F
                    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\CCF399FCD6D2D3F46BF02A1378654FC9
                    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D149C1355C98DE24E82CEFBD996FE06A
                    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\DB59FDB786388EA4D897F3EE715683AC
                    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\DB8DAD19CFBCC2049A4477183787E8C5
                    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E1C820A74ED67374BA048B52CB3C3804
                    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E337925F629CF4C4FB08F3D9674DD839
                    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\EC65F200D112357449C8B1BC3CFA03D0
                    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\F327D0C73C0973644A21E8CC852267A0
                    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\FA96423FE2B98E248A3B23548D1E22D9
                    .
                    C:\Windows\Installer\2b7f8c0.msi
                    C:\Program Files\SweetIM
                    C:\ProgramData\SweetIM

                    ============ Other Adwares Found ============

                    .
                    HKCR\AppID\ShoppingAdsHelper.DLL
                    HKCR\AppID\{647D5A4E-78B5-53ED-7E75-1940D1DFFEA4}
                    HKCR\CLSID\{AF56FD81-28A2-0159-4922-1211155898A9}
                    HKCR\CLSID\{2C86C605-6081-D104-96F7-F765C20B22F1}
                    HKCR\CLSID\{913E9215-EB81-7E43-76E6-FC26E50E264C}
                    HKCR\Interface\{2003E25F-91DA-7AC2-239B-A263B7D2441B}
                    HKCR\Interface\{8DC03F36-EFED-89C0-3C14-469B513E5651}
                    HKCR\Interface\{B00F1048-6A9F-DAA3-5103-5DCFA3E4719A}
                    HKCR\ShoppingAdsHelper.BrowserWatcher
                    HKCR\ShoppingAdsHelper.BrowserWatcher.1
                    HKCR\ShoppingAdsHelper.PornPro_BHO
                    HKCR\ShoppingAdsHelper.PornPro_BHO.1
                    HKCR\ShoppingAdsHelper.PrecacheBrowserHost
                    HKCR\ShoppingAdsHelper.PrecacheBrowserHost.1
                    HKCR\TypeLib\{A9FC1C11-B511-D9B9-0E29-01A8D05AE107}
                    HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2C86C605-6081-D104-96f7-F765C20b22F1}
                    HKCU\Software\ShoppingAdsHelper
                    HKLM\Software\Classes\AppID\ShoppingAdsHelper.DLL
                    HKLM\Software\Classes\AppID\{647D5A4E-78B5-53ED-7E75-1940D1DFFEA4}
                    HKLM\Software\Classes\CLSID\{AF56FD81-28A2-0159-4922-1211155898A9}
                    HKLM\Software\Classes\CLSID\{2C86C605-6081-D104-96F7-F765C20B22F1}
                    HKLM\Software\Classes\CLSID\{913E9215-EB81-7E43-76E6-FC26E50E264C}
                    HKLM\Software\Classes\Interface\{2003E25F-91DA-7AC2-239B-A263B7D2441B}
                    HKLM\Software\Classes\Interface\{8DC03F36-EFED-89C0-3C14-469B513E5651}
                    HKLM\Software\Classes\Interface\{B00F1048-6A9F-DAA3-5103-5DCFA3E4719A}
                    HKLM\Software\Classes\ShoppingAdsHelper.BrowserWatcher
                    HKLM\Software\Classes\ShoppingAdsHelper.BrowserWatcher.1
                    HKLM\Software\Classes\ShoppingAdsHelper.PornPro_BHO
                    HKLM\Software\Classes\ShoppingAdsHelper.PornPro_BHO.1
                    HKLM\Software\Classes\ShoppingAdsHelper.PrecacheBrowserHost
                    HKLM\Software\Classes\ShoppingAdsHelper.PrecacheBrowserHost.1
                    HKLM\Software\Classes\TypeLib\{A9FC1C11-B511-D9B9-0E29-01A8D05AE107}
                    HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2C86C605-6081-D104-96F7-F765C20B22F1}
                    HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\PlayMP3
                    HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\ShoppingAdsHelper
                    .
                    C:\Program Files\ShoppingAdsHelper

                    +-----------------| Added Scan:

                    ---- Internet Explorer Version 7.0.6001.18000 ----

                    +-[HKEY_CURRENT_USER\..\Internet Explorer\Main]

                    Default_Page_URL: hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fr_fr&c=83&bd=Presario&pf=cnnb
                    Default_Search_URL: hxxp://www.google.com/ie
                    Search bar: hxxp://www.google.com/ie
                    Search Page: hxxp://www.google.com
                    Start page: hxxp://www.google.fr/

                    +-[HKEY_USERS\S-1-5-21-3160323180-1118315530-3963894545-1000\..\Internet Explorer\Main]

                    Default_Page_URL: hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fr_fr&c=83&bd=Presario&pf=cnnb
                    Default_Search_URL: hxxp://www.google.com/ie
                    Search bar: hxxp://www.google.com/ie
                    Search Page: hxxp://www.google.com
                    Start page: hxxp://www.google.fr/

                    +-[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

                    Default_Page_URL: hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fr_fr&c=83&bd=Presario&pf=cnnb
                    Default_Search_URL: hxxp://go.microsoft.com/fwlink/?LinkId=54896
                    Search Page: hxxp://go.microsoft.com/fwlink/?LinkId=54896
                    Start page: hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fr_fr&c=83&bd=Presario&pf=cnnb

                    +-[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

                    Tabs: hxxp://y.lo.st

                    +---------------------------------------------------------------------------+

                    11119 Byte(s) - C:\Ad-Report-Scan-21.03.2009.log

                    0 File(s) - C:\Program Files\Ad-remover\TOOLS\BACKUP
                    0 File(s) - C:\Program Files\Ad-remover\TOOLS\QUARANTINE

                    End at: 0:25:19 | 21/03/2009
                    .
                    +-----------------| E.O.F - 169 Lines
                    .
                    0
                    1. x-file
                      ok,relance adremover et choisis option b (nettoiage) ensuite coche 2 et 6 ensuite s pour suprime
                      0
                  2. pimprenelle27 Contributeur sécurité
                    Merci de ton aide mais pas besoin.

                    AD-Remover : nettoyage

                    ! Déconnectes toi et fermes toutes applications en cours !

                    ● Relances "Ad-remover" : au menu principal choisi l'option "B" .

                    ● Coche à l'écran de sélection :

                    1. Suppression Boonty/BoontyGames
                    2. Suppression Eorezo
                    3. Suppression Everest Poker
                    4. Suppression Funwebproduct/MyWay/MyWebsearch
                    5. Suppression It's TV
                    6. Suppression Sweetim
                    7. Suppression autres adwares

                    ● Tape le chiffre correspondant à la suppression demandée et valide par ENTER pour le cocher.

                    ● Puis choisi "S" , le programme va travailler,

                    ● Postes le rapport qui apparait à la fin.

                    ( le rapport est sauvegardé aussi sous C:\Ad-report(date).log )

                    (CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

                    /!\ Si le Bureau ne réapparait pas presse Ctrl + Alt + Suppr , Onglet "Fichier" , "Nouvelle tâche" , tapes explorer.exe et valides)

                    PS : ne mettre que les suppressions nécessaires !!
                    0
                    1. joluis40 Auteur
                      VOILA :
                      ------- LOGFILE OF AD-REMOVER 1.1.1.9 | ONLY XP/VISTA -------

                      Updated by C_XX on 18/03/2009 at 21:20 - AdRemover.contact@gmail.com

                      **** LIMITED TO ****

                      Boonty/BoontyGames
                      Eorezo
                      Infected Poker Softwares
                      FunWebProduct/MyWay/MyWebSearch
                      It's TV
                      Sweetim
                      Other Adwares

                      ********************

                      Start at: 0:55:21, Sat 21/03/2009 | Boot mode: Normal Boot
                      Option: CLEAN | Executed from: C:\Program Files\Ad-remover\Ad-remover.bat
                      Operating System: Microsoft® Windows Vista™ Home Premium Service Pack 1 (version 6.0.6001)
                      Computer Name: PC-DE-COYOTE
                      Current User: Coyote - Administrator
                      Drive(s):
                      - C:\ (File System: NTFS)
                      - D:\ (File System: NTFS)
                      System Drive: C:\
                      Windows Directory: C:\Windows\
                      System Directory: C:\Windows\System32\

                      --- Running Processes: 75

                      (!) ---- IE start pages/Tabs reset

                      +-----------------| Boonty/Boonty Games Elements Deleted :

                      .
                      .

                      +-----------------| Eorezo Elements Deleted :

                      HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\Eoengine
                      HKCR\AppID\{362A53B2-2913-4F8A-82F5-7E0A23FDC6F9}
                      HKCR\AppID\EoRezoBHO.DLL
                      HKCR\CLSID\{C7B76B90-3455-4AE6-A752-EAC4D19689E5}
                      HKCR\EoRezoBHO.EoBho
                      HKCR\EoRezoBHO.EoBho.1
                      HKCR\Typelib\{B6ACB3F1-6A83-432C-B854-3E1056F87F4E}
                      HKCU\Software\EoRezo
                      HKLM\Software\EoRezo
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C7B76B90-3455-4AE6-A752-EAC4D19689E5}
                      .
                      C:\Users\Coyote\AppData\Roaming\EoRezo

                      +-----------------| Infected Poker Softwares Elements Deleted :

                      .

                      +-----------------| FunWebProducts/MyWay/MyWebSearch Elements Deleted :

                      .
                      .

                      +-----------------| It's TV Elements Deleted :

                      .

                      +-----------------| Sweetim Elements Deleted :

                      HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\Sweetim
                      HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EEE6C35B-6118-11DC-9C72-001320C79847}
                      HKCU\Software\Microsoft\Internet Explorer\Internetregistry\Registry\User\S-1-5-21-3160323180-1118315530-3963894545-1000\Software\Sweetim
                      HKCR\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}
                      HKCR\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064}
                      HKCR\MediaPlayer.GraphicsUtils
                      HKCR\MediaPlayer.GraphicsUtils.1
                      HKCR\MgMediaPlayer.GifAnimator
                      HKCR\MgMediaPlayer.GifAnimator.1
                      HKCR\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}
                      HKCU\Software\SweetIM
                      HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
                      HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
                      HKLM\Software\Classes\Interface\{A439801C-961D-452C-AB42-7848E9CBD289}
                      HKLM\Software\Classes\Interface\{F4EBB1E2-21F3-4786-8CF4-16EC5925867F}
                      HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe
                      HKLM\Software\SweetIM
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\07D5290CDBDAE4242926B8E6CA650501
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\08E33F7B61DEFF24BB9673ED7D467636
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\0E3D8A5B48622A445A7DF73FEFF32C3F
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\1AC67655DD68F8240B2860F2D511EBD8
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\34EDDB1BFB3A2D448845F3EFD0F15A43
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\427EA997C413D1D47907CBFC7B2DB432
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\4318DF19719275242801CBE292063A4C
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\45FC115D1FEAEF849A4E1610D6EC8BF0
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\46A5861A389ADB844AF89E31BC9DF0A1
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\49B0E1A6FF50BBE4289E4E23DE6EA0C7
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\4CCCAC049F34D0540AAC13011398BEDB
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5C4389D0BFB302C479DE4178BD5D9EBA
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5D19F074C042AD34BAB463D4175A062E
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5D2B09BDEF4FE54418E6F3373CDBC7AC
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\61B65D3397A1FBF4CB1571B5E4F6B5B0
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\68E8A05C60DD9254591DBD16C94EDDBF
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\697E782CF574CC34CBB9566440BA12BC
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\6AE27A8613CF7EA4782F2886F67295E5
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\7CE172051F585E04187BCB97570BFA74
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\86A901BA5265452499DCBF719C378EE3
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\88ABD1CD5C40EC84789A7F6EF86DAC5E
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\980289C22F80A7C4BB9323DC61255E4E
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\9A4B7EF3789F871419D9302583B20C15
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\A6C53B0F76C44004A8F36716213017DB
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\B59F2D8189784CC46A4597F2842480B0
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\BD746FB95FB8E5B45BF66BE54D5FD91F
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\CCF399FCD6D2D3F46BF02A1378654FC9
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D149C1355C98DE24E82CEFBD996FE06A
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\DB59FDB786388EA4D897F3EE715683AC
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\DB8DAD19CFBCC2049A4477183787E8C5
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E1C820A74ED67374BA048B52CB3C3804
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E337925F629CF4C4FB08F3D9674DD839
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\EC65F200D112357449C8B1BC3CFA03D0
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\F327D0C73C0973644A21E8CC852267A0
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\FA96423FE2B98E248A3B23548D1E22D9
                      .
                      C:\Windows\Installer\2b7f8c0.msi
                      /!\ NOT DELETED - C:\Program Files\SweetIM
                      /!\ NOT DELETED - C:\Program Files\SweetIM\Messenger
                      /!\ NOT DELETED - C:\Program Files\SweetIM\Messenger\mgAdaptersProxy.dll
                      /!\ NOT DELETED - C:\Program Files\SweetIM\Messenger\msvcr71.dll
                      C:\ProgramData\SweetIM

                      ============ Other Adwares Deleted ============

                      .
                      HKCR\AppID\ShoppingAdsHelper.DLL
                      HKCR\AppID\{647D5A4E-78B5-53ED-7E75-1940D1DFFEA4}
                      HKCR\CLSID\{AF56FD81-28A2-0159-4922-1211155898A9}
                      HKCR\CLSID\{2C86C605-6081-D104-96F7-F765C20B22F1}
                      HKCR\CLSID\{913E9215-EB81-7E43-76E6-FC26E50E264C}
                      HKCR\Interface\{2003E25F-91DA-7AC2-239B-A263B7D2441B}
                      HKCR\Interface\{8DC03F36-EFED-89C0-3C14-469B513E5651}
                      HKCR\Interface\{B00F1048-6A9F-DAA3-5103-5DCFA3E4719A}
                      HKCR\ShoppingAdsHelper.BrowserWatcher
                      HKCR\ShoppingAdsHelper.BrowserWatcher.1
                      HKCR\ShoppingAdsHelper.PornPro_BHO
                      HKCR\ShoppingAdsHelper.PornPro_BHO.1
                      HKCR\ShoppingAdsHelper.PrecacheBrowserHost
                      HKCR\ShoppingAdsHelper.PrecacheBrowserHost.1
                      HKCR\TypeLib\{A9FC1C11-B511-D9B9-0E29-01A8D05AE107}
                      HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2C86C605-6081-D104-96f7-F765C20b22F1}
                      HKCU\Software\ShoppingAdsHelper
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2C86C605-6081-D104-96F7-F765C20B22F1}
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\PlayMP3
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\ShoppingAdsHelper
                      .
                      C:\Program Files\ShoppingAdsHelper

                      (!) ---- Temp files deleted.
                      (!) ---- Recycle bin emptied in all drives.

                      ************* /!\ FILE(S)/FOLDER(S) NOT DELETED /!\ *************

                      "C:\Program Files\SweetIM\Messenger"
                      "C:\Program Files\SweetIM\Messenger\mgAdaptersProxy.dll"
                      "C:\Program Files\SweetIM\Messenger\msvcr71.dll"

                      Second run ...

                      /!\ RESIST ! - "C:\Program Files\SweetIM\Messenger"
                      /!\ RESIST ! - "C:\Program Files\SweetIM\Messenger\mgAdaptersProxy.dll"
                      /!\ RESIST ! - "C:\Program Files\SweetIM\Messenger\msvcr71.dll"

                      +-----------------| Added Scan :

                      ---- Internet Explorer Version 7.0.6001.18000 ----

                      +-[HKEY_CURRENT_USER\..\Internet Explorer\Main]

                      Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
                      Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                      Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
                      Search Page: hxxp://www.google.com
                      Start page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

                      +-[HKEY_USERS\S-1-5-21-3160323180-1118315530-3963894545-1000\..\Internet Explorer\Main]

                      Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
                      Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                      Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
                      Search Page: hxxp://www.google.com
                      Start page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

                      +-[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

                      Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
                      Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                      Search bar: hxxp://search.msn.com/spbasic.htm
                      Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                      Start page: hxxp://fr.msn.com/

                      +-[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

                      Tabs: hxxp://ieframe.dll/tabswelcome.htm

                      +---------------------------------------------------------------------------+

                      10538 Byte(s) - C:\Ad-Report-Clean-21.03.2009.log
                      11361 Byte(s) - C:\Ad-Report-Scan-21.03.2009.log

                      0 File(s) - C:\Program Files\Ad-remover\TOOLS\BACKUP
                      1 File(s) - C:\Program Files\Ad-remover\TOOLS\QUARANTINE

                      End at: 0:59:35 | 21/03/2009
                      .
                      +-----------------| E.O.F - 165 Lines
                      .
                      0
                      1. pimprenelle27 Contributeur sécurité
                        Il faut que tu refasse l'option b et que tu sélectionne SweetIM car il n'a pas été supprimé.

                        /!\ NOT DELETED - C:\Program Files\SweetIM
                        /!\ NOT DELETED - C:\Program Files\SweetIM\Messenger
                        /!\ NOT DELETED - C:\Program Files\SweetIM\Messenger\mgAdaptersProxy.dll
                        /!\ NOT DELETED - C:\Program Files\SweetIM\Messenger\msvcr71.dll
                        0
                        1. joluis40 Auteur
                          JE VIENS DE SUPRIMER SWEETIM.

                          ------- LOGFILE OF AD-REMOVER 1.1.1.9 | ONLY XP/VISTA -------

                          Updated by C_XX on 18/03/2009 at 21:20 - AdRemover.contact@gmail.com

                          **** LIMITED TO ****

                          Sweetim

                          ********************

                          Start at: 10:53:30, Sat 21/03/2009 | Boot mode: Normal Boot
                          Option: CLEAN | Executed from: C:\Program Files\Ad-remover\Ad-remover.bat
                          Operating System: Microsoft® Windows Vista™ Home Premium Service Pack 1 (version 6.0.6001)
                          Computer Name: PC-DE-COYOTE
                          Current User: Coyote - Administrator
                          Drive(s):
                          - C:\ (File System: NTFS)
                          - D:\ (File System: NTFS)
                          System Drive: C:\
                          Windows Directory: C:\Windows\
                          System Directory: C:\Windows\System32\

                          --- Running Processes: 79

                          (!) ---- IE start pages/Tabs reset

                          +-----------------| Sweetim Elements Deleted :

                          .
                          /!\ NOT DELETED - C:\Program Files\SweetIM
                          /!\ NOT DELETED - C:\Program Files\SweetIM\Messenger
                          /!\ NOT DELETED - C:\Program Files\SweetIM\Messenger\mgAdaptersProxy.dll
                          /!\ NOT DELETED - C:\Program Files\SweetIM\Messenger\msvcr71.dll

                          (!) ---- Temp files deleted.
                          (!) ---- Recycle bin emptied in all drives.

                          ************* /!\ FILE(S)/FOLDER(S) NOT DELETED /!\ *************

                          "C:\Program Files\SweetIM\Messenger"
                          "C:\Program Files\SweetIM\Messenger\mgAdaptersProxy.dll"
                          "C:\Program Files\SweetIM\Messenger\msvcr71.dll"

                          Second run ...

                          /!\ RESIST ! - "C:\Program Files\SweetIM\Messenger"
                          /!\ RESIST ! - "C:\Program Files\SweetIM\Messenger\mgAdaptersProxy.dll"
                          /!\ RESIST ! - "C:\Program Files\SweetIM\Messenger\msvcr71.dll"

                          +-----------------| Added Scan :

                          ---- Internet Explorer Version 7.0.6001.18000 ----

                          +-[HKEY_CURRENT_USER\..\Internet Explorer\Main]

                          Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
                          Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                          Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
                          Search Page: hxxp://www.google.com
                          Start page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

                          +-[HKEY_USERS\S-1-5-21-3160323180-1118315530-3963894545-1000\..\Internet Explorer\Main]

                          Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
                          Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                          Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
                          Search Page: hxxp://www.google.com
                          Start page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

                          +-[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

                          Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
                          Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                          Search bar: hxxp://search.msn.com/spbasic.htm
                          Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                          Start page: hxxp://fr.msn.com/

                          +-[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

                          Tabs: hxxp://ieframe.dll/tabswelcome.htm

                          +---------------------------------------------------------------------------+

                          2995 Byte(s) - C:\Ad-Report-Clean-21.03.2009.log
                          11361 Byte(s) - C:\Ad-Report-Scan-21.03.2009.log

                          0 File(s) - C:\Program Files\Ad-remover\TOOLS\BACKUP
                          1 File(s) - C:\Program Files\Ad-remover\TOOLS\QUARANTINE

                          End at: 10:55:19 | 21/03/2009
                          .
                          +-----------------| E.O.F - 57 Lines
                          .
                          0
                          1. pimprenelle27 Contributeur sécurité
                            Toujours /!\ NOT DELETED - C:\Program Files\SweetIM
                            /!\ NOT DELETED - C:\Program Files\SweetIM\Messenger
                            /!\ NOT DELETED - C:\Program Files\SweetIM\Messenger\mgAdaptersProxy.dll
                            /!\ NOT DELETED - C:\Program Files\SweetIM\Messenger\msvcr71.dll

                            Je comprend pas refait moi un scan option A. Merci.
                            0
                            1. joluis40 Auteur
                              Voila le rapport du scan :
                              ------- LOGFILE OF AD-REMOVER 1.1.1.9 | ONLY XP/VISTA -------

                              Updated by C_XX on 18/03/2009 at 21:20 - AdRemover.contact@gmail.com

                              Start at: 11:01:26, Sat 21/03/2009 | Boot mode: Normal Boot
                              Option: SCAN | Executed from: C:\Program Files\Ad-remover\Ad-remover.bat
                              Operating System: Microsoft® Windows Vista™ Home Premium Service Pack 1 (version 6.0.6001)
                              Computer Name: PC-DE-COYOTE
                              Current User: Coyote - Administrator
                              Drive(s):
                              - C:\ (File System: NTFS)
                              - D:\ (File System: NTFS)
                              System Drive: C:\
                              Windows Directory: C:\Windows\
                              System Directory: C:\Windows\System32\

                              --- Running Processes: 78

                              +-----------------| Boonty/Boonty Games Elements Found:

                              .
                              .

                              +-----------------| Eorezo Elements Found:

                              .

                              +-----------------| Infected Poker Softwares Elements Found:

                              .

                              +-----------------| FunWebProducts/MyWay/MyWebSearch Elements Found:

                              .
                              .

                              +-----------------| It's TV Elements Found:

                              .

                              +-----------------| Sweetim Elements Found:

                              .
                              C:\Program Files\SweetIM

                              ============ Other Adwares Found ============

                              .
                              .
                              C:\Users\Coyote\AppData\Roaming\Microsoft\Windows\Cookies\coyote@atdmt[2].txt
                              C:\Users\Coyote\AppData\Roaming\Microsoft\Windows\Cookies\coyote@bs.serving-sys[1].txt

                              +-----------------| Added Scan:

                              ---- Internet Explorer Version 7.0.6001.18000 ----

                              +-[HKEY_CURRENT_USER\..\Internet Explorer\Main]

                              Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
                              Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                              Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
                              Search Page: hxxp://www.google.com
                              Start page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

                              +-[HKEY_USERS\S-1-5-21-3160323180-1118315530-3963894545-1000\..\Internet Explorer\Main]

                              Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
                              Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                              Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
                              Search Page: hxxp://www.google.com
                              Start page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

                              +-[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

                              Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
                              Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                              Search bar: hxxp://search.msn.com/spbasic.htm
                              Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                              Start page: hxxp://fr.msn.com/

                              +-[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

                              Tabs: hxxp://ieframe.dll/tabswelcome.htm

                              +---------------------------------------------------------------------------+

                              3286 Byte(s) - C:\Ad-Report-Clean-21.03.2009.log
                              2764 Byte(s) - C:\Ad-Report-Scan-21.03.2009.log

                              0 File(s) - C:\Program Files\Ad-remover\TOOLS\BACKUP
                              1 File(s) - C:\Program Files\Ad-remover\TOOLS\QUARANTINE

                              End at: 11:08:47 | 21/03/2009
                              .
                              +-----------------| E.O.F - 57 Lines
                              .
                              0
                              1. pimprenelle27 Contributeur sécurité
                                il est toujours là C:\Program Files\SweetIM

                                Tu peux refaire une dernière fois l'option b.
                                0
                                1. joluis40 Auteur
                                  Voila le dernier rapport :

                                  ------- LOGFILE OF AD-REMOVER 1.1.1.9 | ONLY XP/VISTA -------

                                  Updated by C_XX on 18/03/2009 at 21:20 - AdRemover.contact@gmail.com

                                  **** LIMITED TO ****

                                  Other Adwares

                                  ********************

                                  Start at: 11:37:05, Sat 21/03/2009 | Boot mode: Normal Boot
                                  Option: CLEAN | Executed from: C:\Program Files\Ad-remover\Ad-remover.bat
                                  Operating System: Microsoft® Windows Vista™ Home Premium Service Pack 1 (version 6.0.6001)
                                  Computer Name: PC-DE-COYOTE
                                  Current User: Coyote - Administrator
                                  Drive(s):
                                  - C:\ (File System: NTFS)
                                  - D:\ (File System: NTFS)
                                  System Drive: C:\
                                  Windows Directory: C:\Windows\
                                  System Directory: C:\Windows\System32\

                                  --- Running Processes: 75

                                  (!) ---- IE start pages/Tabs reset

                                  ============ Other Adwares Deleted ============

                                  .
                                  .
                                  C:\Users\Coyote\AppData\Roaming\Microsoft\Windows\Cookies\coyote@atdmt[2].txt
                                  C:\Users\Coyote\AppData\Roaming\Microsoft\Windows\Cookies\coyote@bs.serving-sys[1].txt

                                  (!) ---- Temp files deleted.
                                  (!) ---- Recycle bin emptied in all drives.

                                  +-----------------| Added Scan :

                                  ---- Internet Explorer Version 7.0.6001.18000 ----

                                  +-[HKEY_CURRENT_USER\..\Internet Explorer\Main]

                                  Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
                                  Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                                  Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
                                  Search Page: hxxp://www.google.com
                                  Start page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

                                  +-[HKEY_USERS\S-1-5-21-3160323180-1118315530-3963894545-1000\..\Internet Explorer\Main]

                                  Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
                                  Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                                  Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
                                  Search Page: hxxp://www.google.com
                                  Start page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

                                  +-[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

                                  Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
                                  Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                                  Search bar: hxxp://search.msn.com/spbasic.htm
                                  Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                                  Start page: hxxp://fr.msn.com/

                                  +-[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

                                  Tabs: hxxp://ieframe.dll/tabswelcome.htm

                                  +---------------------------------------------------------------------------+

                                  2501 Byte(s) - C:\Ad-Report-Clean-21.03.2009.log
                                  3004 Byte(s) - C:\Ad-Report-Scan-21.03.2009.log

                                  0 File(s) - C:\Program Files\Ad-remover\TOOLS\BACKUP
                                  3 File(s) - C:\Program Files\Ad-remover\TOOLS\QUARANTINE

                                  End at: 11:42:26 | 21/03/2009
                                  .
                                  +-----------------| E.O.F - 48 Lines
                                  .
                                  0
                                  1. pimprenelle27 Contributeur sécurité
                                    tu as bien sélectionné sweetim? refait moi le scan option A pour voir si c'est ok.
                                    0
                                    1. joluis40 Auteur
                                      VOILA,
                                      ------- LOGFILE OF AD-REMOVER 1.1.1.9 | ONLY XP/VISTA -------

                                      Updated by C_XX on 18/03/2009 at 21:20 - AdRemover.contact@gmail.com

                                      Start at: 11:50:07, Sat 21/03/2009 | Boot mode: Normal Boot
                                      Option: SCAN | Executed from: C:\Program Files\Ad-remover\Ad-remover.bat
                                      Operating System: Microsoft® Windows Vista™ Home Premium Service Pack 1 (version 6.0.6001)
                                      Computer Name: PC-DE-COYOTE
                                      Current User: Coyote - Administrator
                                      Drive(s):
                                      - C:\ (File System: NTFS)
                                      - D:\ (File System: NTFS)
                                      System Drive: C:\
                                      Windows Directory: C:\Windows\
                                      System Directory: C:\Windows\System32\

                                      --- Running Processes: 80

                                      +-----------------| Boonty/Boonty Games Elements Found:

                                      .
                                      .

                                      +-----------------| Eorezo Elements Found:

                                      .

                                      +-----------------| Infected Poker Softwares Elements Found:

                                      .

                                      +-----------------| FunWebProducts/MyWay/MyWebSearch Elements Found:

                                      .
                                      .

                                      +-----------------| It's TV Elements Found:

                                      .

                                      +-----------------| Sweetim Elements Found:

                                      .
                                      C:\Program Files\SweetIM

                                      ============ Other Adwares Found ============

                                      .
                                      .
                                      C:\Users\Coyote\AppData\Local\Temp\TMP738C.tmp
                                      C:\Users\Coyote\AppData\Roaming\Microsoft\Windows\Cookies\coyote@atdmt[2].txt
                                      C:\Users\Coyote\AppData\Roaming\Microsoft\Windows\Cookies\coyote@bs.serving-sys[1].txt

                                      +-----------------| Added Scan:

                                      ---- Internet Explorer Version 7.0.6001.18000 ----

                                      +-[HKEY_CURRENT_USER\..\Internet Explorer\Main]

                                      Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
                                      Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                                      Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
                                      Search Page: hxxp://www.google.com
                                      Start page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

                                      +-[HKEY_USERS\S-1-5-21-3160323180-1118315530-3963894545-1000\..\Internet Explorer\Main]

                                      Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
                                      Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                                      Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
                                      Search Page: hxxp://www.google.com
                                      Start page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

                                      +-[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

                                      Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
                                      Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                                      Search bar: hxxp://search.msn.com/spbasic.htm
                                      Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                                      Start page: hxxp://fr.msn.com/

                                      +-[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

                                      Tabs: hxxp://ieframe.dll/tabswelcome.htm

                                      +---------------------------------------------------------------------------+

                                      2791 Byte(s) - C:\Ad-Report-Clean-21.03.2009.log
                                      2813 Byte(s) - C:\Ad-Report-Scan-21.03.2009.log

                                      0 File(s) - C:\Program Files\Ad-remover\TOOLS\BACKUP
                                      3 File(s) - C:\Program Files\Ad-remover\TOOLS\QUARANTINE

                                      End at: 11:57:27 | 21/03/2009
                                      .
                                      +-----------------| E.O.F - 58 Lines
                                      .
                                      0
                                      1. pimprenelle27 Contributeur sécurité
                                        il est toujours là celui là. bon on va faire autre chose on verra après celui là.

                                        Fait ceci et poste moi le rapport à la suite de la question êtes vous aider par quelqu'un, répondre oui. Merci.

                                        Télécharge GenProc sur ton bureau (Attention le fichier est un fichier zip)
                                        Dézippe le dossier, double-clique sur GenProc.bat
                                        En final, poste le contenu du rapport qui s'affiche.
                                        Comment utiliser GenProc

                                        Pour ceux qui ont vista, ne pas oublier de désactiver Le contrôle des comptes utilisateurs

                                        IMPORTANT : poste le rapport et ne fais rien d'autre pour l'instant ( souvent il faut ajouter des consignes à la manipe indiquée pour que cela fonctionne parfaitement )
                                        1
                                        • 1
                                        • 2
                                        • 3

                                        Discussions similaires

                                        symboles et écritures pour nick msn
                                        Pando

                                        20 réponses
                                        msn + ☺(symbole)
                                        m0ii

                                        19 réponses
                                        Comment insérer correctement des caractères spéciaux ou émojis ?
                                        Lia

                                        45 réponses