Infecté par MyWebSearch

Résolu
eucharistie -  
Bonjour,

Voila, cela fait 2 jours que je galère, je n'arrive pas a trouver un site qui puisse m'aider!

J'ai fait une analyse avec hijack this et j'ai télécharger zeb help process, qui m'annonce que je suis infecté par plusieurs "malware" mywebsearch.

S.V.P, aidez-moi je suis pas très douée en informatique et j'ai peur d'agraver les choses.

Merci bokou bokou.....
Configuration: Windows Vista Internet Explorer 7.0

37 réponses

Résumé de la discussion

Une infection détectée par HijackThis et des outils tiers, notamment MyWebSearch, vise un ordinateur Windows Vista avec Internet Explorer 7 et déclenche des alertes et des ralentissements. Des solutions évoquées incluent des nettoyages, la désinstallation de programmes indésirables, puis des scans avec MalwareBytes et CCleaner en mode normal puis sans échec pour supprimer les composants malveillants. D'autres conseils préconisent des mises à jour régulières, la vérification des extensions et ActiveX, l'utilisation de Firefox en complément d'IE pour la sécurité, et l'élimination des failles Java et Flash. En complément, l'usage d'un outil de suppression comme MalwareBytes et la génération d'un rapport facilitent le suivi des infections, tandis que la création d'un point de restauration offre une sécurité supplémentaire.

Bobot (l’IA à votre service)
  1. V-X
    Salut,

    ▶ Télécharge random's system information tool (RSIT) et enregistre le sur ton bureau.

    ▶ Double clique sur RSIT.exe pour lancer l'outil.

    ▶ Clique sur ' continue ' à l'écran Disclaimer.

    ▶ Si l'outil HIjackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera et tu devras accepter la licence.

    ▶ Une fois le scan fini , 2 rapports vont apparaitre. Poste le contenu des 2 rapports séparément.
    ( log.txt & info.txt )

    (CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

    Si un rapport ne passe pas faire une alerte à la conciergerie avec le /!\ jaune.
    1. eucharistie Auteur
      Salut,
      ok je vais faire sa et je te le poste aprés, merci d'avoir répondu si vite ^^
      1. eucharistie Auteur
        voici le log txt :
        Logfile of random's system information tool 1.06 (written by random/random)
        Run by francois at 2009-05-26 07:21:05
        Microsoft® Windows Vista™ Édition Familiale Premium Service Pack 1
        System drive C: has 4 GB (13%) free of 30 GB
        Total RAM: 3063 MB (59% free)

        Logfile of Trend Micro HijackThis v2.0.2
        Scan saved at 07:21:24, on 26/05/2009
        Platform: Windows Vista SP1 (WinNT 6.00.1905)
        MSIE: Internet Explorer v7.00 (7.00.6001.18226)
        Boot mode: Normal

        Running processes:
        C:\Windows\system32\Dwm.exe
        C:\Windows\system32\taskeng.exe
        C:\Windows\RtHDVCpl.exe
        C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
        C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
        C:\Windows\System32\hkcmd.exe
        C:\Windows\System32\igfxpers.exe
        C:\Program Files\Lenovo\EnergyCut\utilty.exe
        C:\Program Files\Lenovo\EnergyCut\EnergyCut.exe
        C:\Program Files\Common Files\Symantec Shared\ccApp.exe
        C:\Program Files\Lenovo\ShuttleCenter\PCMService.exe
        C:\Program Files\Lenovo\VeriFace\PManage.exe
        C:\Program Files\Lenovo\VeriFace\RTimeLock.exe
        C:\Program Files\MyWebSearch\bar\1.bin\M3SRCHMN.EXE
        C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
        C:\Program Files\Windows Sidebar\sidebar.exe
        C:\Windows\ehome\ehtray.exe
        C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
        C:\Windows\system32\igfxsrvc.exe
        C:\Windows\ehome\ehmsas.exe
        C:\Windows\explorer.exe
        C:\Program Files\Internet Explorer\ieuser.exe
        C:\Program Files\Google\Google Toolbar\GoogleToolbarUser.exe
        C:\Program Files\Internet Explorer\iexplore.exe
        C:\Program Files\ZebHelpProcess\ZHP2.exe
        C:\Windows\system32\Macromed\Flash\FlashUtil10a.exe
        C:\Windows\system32\SearchFilterHost.exe
        C:\Users\francois\Desktop\RSIT.exe
        C:\Users\francois\Desktop\francois.exe

        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
        R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
        R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
        R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
        R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL
        O1 - Hosts: ::1 localhost
        O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL
        O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
        O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
        O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
        O2 - BHO: (no name) - {2E59498D-7E44-4452-9044-0973B080B9E8} - C:\Windows\System32\winexplorer.dll
        O2 - BHO: Windows Live Call HoverToCall class - {7E853D72-626A-48EC-A868-BA8D5E23E045} - C:\Program Files\Windows Live\Messenger\HTC.DLL
        O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
        O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
        O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
        O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
        O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
        O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
        O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
        O3 - Toolbar: My Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
        O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
        O4 - HKLM\..\Run: [Unattend0000000001{7CE4F652-9E84-4617-9F54-DC8891DFB725}] C:\Windows\test.bat
        O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
        O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
        O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
        O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
        O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
        O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
        O4 - HKLM\..\Run: [EnergyCut_Utility] C:\Program Files\Lenovo\EnergyCut\utilty.exe
        O4 - HKLM\..\Run: [EnergyCut] C:\Program Files\Lenovo\EnergyCut\EnergyCut.exe
        O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
        O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Lenovo\ShuttleCenter\PCMService.exe"
        O4 - HKLM\..\Run: [VeriFacePassManager] C:\Program Files\Lenovo\VeriFace\PManage.exe
        O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
        O4 - HKLM\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALuNotify.exe
        O4 - HKLM\..\Run: [VeriFaceTimeLock] C:\Program Files\Lenovo\VeriFace\RTimeLock.exe
        O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
        O4 - HKLM\..\Run: [MyWebSearch Plugin] rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\M3PLUGIN.DLL,UPF
        O4 - HKLM\..\Run: [My Web Search Bar Search Scope Monitor] "C:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe" /m=2 /w /h
        O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
        O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
        O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
        O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
        O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
        O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
        O4 - HKCU\..\Run: [Speech Recognition] "C:\Windows\Speech\Common\sapisvr.exe" -SpeechUX -Startup
        O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
        O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
        O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
        O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZJxdm301YYGB
        O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
        O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
        O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
        O9 - Extra button: Password Administration Box - {A26ABCF0-1C8F-46e7-A67C-0489DC21B9CC} - C:\Program Files\Lenovo\VeriFace\OpenWnd.exe
        O9 - Extra 'Tools' menuitem: Password Administration Box - {A26ABCF0-1C8F-46e7-A67C-0489DC21B9CC} - C:\Program Files\Lenovo\VeriFace\OpenWnd.exe
        O13 - Gopher Prefix:
        O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei-4/ZwinkyInitialSetup1.0.1.1.cab
        O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
        O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ATK Hotkey\ASLDRSrv.exe
        O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
        O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
        O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Lenovo\ShuttleCenter\Kernel\TV\CLCapSvc.exe
        O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Lenovo\ShuttleCenter\Kernel\TV\CLSched.exe
        O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
        O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
        O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
        O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe
        O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
        O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
        O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
        O23 - Service: My Web Search Service (MyWebSearchService) - MyWebSearch.com - C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwssvc.exe
        O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
        O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
        O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
        O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
        1. eucharistie Auteur
          et le info txt :

          info.txt logfile of random's system information tool 1.06 2009-05-26 07:21:32

          ======Uninstall list======

          2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0015-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
          2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0016-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
          2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0018-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
          2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0019-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
          2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001A-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
          2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001B-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
          2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0401-0000-0000000FF1CE} /uninstall {5A2F65A4-808F-4A1E-973E-92E17824982D}
          2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0407-0000-0000000FF1CE} /uninstall {2AB528A5-BB1B-4EBE-8E51-AD0C4CD33CA9}
          2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {3EC77D26-799B-4CD8-914F-C1565E796173}
          2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {430971B1-C31E-45DA-81E0-72C095BAB72C}
          2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0413-0000-0000000FF1CE} /uninstall {B3F4DC34-7F60-4B7C-A79F-1C13012D99D4}
          2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {F7A31780-33C4-4E39-951A-5EC9B91D7BF1}
          2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {BEE75E01-DD3F-4D5F-B96C-609E6538D419}
          2007 Microsoft Office system-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PROHYBRIDR /dll OSETUP.DLL
          Acoustica Effects Pack-->C:\PROGRA~1\ACOUST~2\UNWISE.EXE C:\PROGRA~1\ACOUST~2\INSTALL.LOG
          Activation Assistant for the 2007 Microsoft Office suites-->"C:\ProgramData\{174892B1-CBE7-44F5-86FF-AB555EFD73A3}\Microsoft Office Activation Assistant.exe" REMOVE=TRUE MODIFY=FALSE
          Adobe Flash Player 10 ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
          Adobe Reader 9 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A90000000001}
          AppCore-->MsiExec.exe /I{EFB5B3B5-A280-4E25-BE1C-634EEFE32C1B}
          Assistant de connexion Windows Live-->MsiExec.exe /I{D3116CC7-24DC-4CA3-9CE1-23FED836E9F2}
          ATK Hotkey-->C:\Program Files\InstallShield Installation Information\{3912D529-02BC-4CA8-B5ED-0D0C20EB6003}\setup.exe -runfromtemp -l0x040c -removeonly
          Audacity 1.2.6-->"C:\Program Files\Audacity\unins000.exe"
          AV-->MsiExec.exe /I{F4DB525F-A986-4249-B98B-42A8066251CA}
          Blender (remove only)-->"C:\Blender\uninstall.exe"
          Broadcom Gigabit Integrated Controller-->MsiExec.exe /X{FC57FC53-104C-415C-98D7-B05E659461A9}
          ccCommon-->MsiExec.exe /I{3CCAD2EF-CFF2-4637-82AA-AABF370282D3}
          DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
          EasyCapture-->C:\Program Files\Lenovo\EasyCapture\Uninstall.exe
          EnergyCut-->C:\Program Files\InstallShield Installation Information\{6E127727-CE4B-40E4-9A7D-9D65CDE0A15C}\setup.exe -runfromtemp -l0x040c -removeonly
          Fichiers de prise en charge de l'installation de Microsoft SQL Server (Français)-->MsiExec.exe /X{3380F354-C5F7-4E71-8F51-EEE6C3F06C62}
          Galerie de photos Windows Live-->MsiExec.exe /X{A70FA218-6598-4AC9-813D-63597C5DD068}
          Google Toolbar for Internet Explorer-->"C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarManager_BDA1448D3D255554.exe" /uninstall
          Google Toolbar for Internet Explorer-->MsiExec.exe /I{18455581-E099-4BA8-BC6B-F34B2F06600C}
          GTA2-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2987EE84-C4EE-4FF5-8160-32DE00D6ABC6}\Setup.exe" -l0x9
          Guitar Pro 4 Demo-->MsiExec.exe /X{22C1B575-C746-46F2-80A3-EE9612AF5FAA}
          HijackThis 2.0.2-->"C:\Users\francois\Desktop\HijackThis.exe" /uninstall
          Intel(R) Graphics Media Accelerator Driver-->C:\Windows\system32\igxpun.exe -uninstall
          Internet Worm Protection-->MsiExec.exe /I{2908F0CB-C1D4-447F-97A2-CFC135C9F8D4}
          K-Lite Mega Codec Pack 4.3.4-->"C:\Program Files\K-Lite Codec Pack\unins000.exe"
          Lenovo Easy Camera-->C:\Program Files\InstallShield Installation Information\{4BB1DCED-84D3-47F9-B718-5947E904593E}\SETUP.exe -runfromtemp -l0x040c -removeonly
          lenovo scrnsave-->C:\PROGRA~1\Lenovo\SCREEN~1\UNWISE.EXE C:\PROGRA~1\Lenovo\SCREEN~1\INSTALL.LOG
          LiveUpdate 3.2 (Symantec Corporation)-->"C:\Program Files\Symantec\LiveUpdate\LSETUP.EXE" /U
          LiveUpdate Notice (Symantec Corporation)-->MsiExec.exe /X{DBA4DB9D-EE51-4944-A419-98AB1F1249C8}
          Logiciel Intel(R) PROSet/Wireless-->C:\Windows\Installer\iProInst.exe
          mCore-->MsiExec.exe /I{F5D7FAB5-A1FD-4DD3-983E-4155B09D7102}
          mDriver-->MsiExec.exe /I{A0F925BF-5C55-44C2-A4E7-5A4C59791C29}
          mHelp-->MsiExec.exe /I{8C6BB412-D3A8-4AAE-A01B-35B681789D68}
          Microsoft Office 2003 Web Components-->MsiExec.exe /I{90A4040C-6000-11D3-8CFE-0150048383C9}
          Microsoft Office 2007 Primary Interop Assemblies-->MsiExec.exe /X{50120000-1105-0000-0000-0000000FF1CE}
          Microsoft Office Access MUI (French) 2007-->MsiExec.exe /X{90120000-0015-040C-0000-0000000FF1CE}
          Microsoft Office Excel MUI (French) 2007-->MsiExec.exe /X{90120000-0016-040C-0000-0000000FF1CE}
          Microsoft Office Language Pack 2007 Service Pack 1 (SP1)-->msiexec /package {90120000-006E-040C-0000-0000000FF1CE} /uninstall {EC50B538-CBE1-42E6-B7FE-87AA540AADFB}
          Microsoft Office Outlook MUI (French) 2007-->MsiExec.exe /X{90120000-001A-040C-0000-0000000FF1CE}
          Microsoft Office PowerPoint MUI (French) 2007-->MsiExec.exe /X{90120000-0018-040C-0000-0000000FF1CE}
          Microsoft Office Professional Hybrid 2007-->MsiExec.exe /X{91120000-0031-0000-0000-0000000FF1CE}
          Microsoft Office Proof (Arabic) 2007-->MsiExec.exe /X{90120000-001F-0401-0000-0000000FF1CE}
          Microsoft Office Proof (Dutch) 2007-->MsiExec.exe /X{90120000-001F-0413-0000-0000000FF1CE}
          Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
          Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
          Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
          Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
          Microsoft Office Proofing (French) 2007-->MsiExec.exe /X{90120000-002C-040C-0000-0000000FF1CE}
          Microsoft Office Publisher MUI (French) 2007-->MsiExec.exe /X{90120000-0019-040C-0000-0000000FF1CE}
          Microsoft Office Shared MUI (French) 2007-->MsiExec.exe /X{90120000-006E-040C-0000-0000000FF1CE}
          Microsoft Office Small Business Connectivity Components-->MsiExec.exe /X{A939D341-5A04-4E0A-BB55-3E65B386432D}
          Microsoft Office Word MUI (French) 2007-->MsiExec.exe /X{90120000-001B-040C-0000-0000000FF1CE}
          Microsoft SQL Server 2005 Compact Edition [ENU]-->MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
          Microsoft SQL Server Native Client-->MsiExec.exe /I{1F24E48F-7692-4E89-8784-68DD4D2712A0}
          Microsoft SQL Server VSS Writer-->MsiExec.exe /I{A30179B7-997A-4D47-AA43-57AE59A9C78B}
          Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
          Mise à jour Microsoft Office Excel 2007 Help (KB963678)-->msiexec /package {90120000-0016-040C-0000-0000000FF1CE} /uninstall {B761869A-B85C-40E2-994C-A1CE78AC8F2C}
          Mise à jour Microsoft Office Powerpoint 2007 Help (KB963669)-->msiexec /package {90120000-0018-040C-0000-0000000FF1CE} /uninstall {C3DCA38E-005E-41BA-A52A-7C3429F351C3}
          Mise à jour Microsoft Office Word 2007 Help (KB963665)-->msiexec /package {90120000-001B-040C-0000-0000000FF1CE} /uninstall {81536A04-DBFB-4DB3-978F-0F284590C223}
          mMHouse-->MsiExec.exe /I{F0BFC7EF-9CF8-44EE-91B0-158884CD87C5}
          Motorola SM56 Speakerphone Modem-->rundll32.exe sm56co6a.dll,SM56UnInstaller
          mPfMgr-->MsiExec.exe /I{8B928BA1-EDEC-4227-A2DA-DD83026C36F5}
          MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
          MSXML 4.0 SP2 (KB941833)-->MsiExec.exe /I{C523D256-313D-4866-B36A-F3DE528246EF}
          MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
          My Web Search (Zwinky)-->rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsbar.dll,O
          Norton AntiVirus (Symantec Corporation)-->"C:\Program Files\Common Files\Symantec Shared\SymSetup\{830D8CBD-C668-49e2-A969-C2C2106332E0}_14_2_0_29\{830D8CBD-C668-49e2-A969-C2C2106332E0}.exe" /X
          Norton AntiVirus Help-->MsiExec.exe /I{34EEB1F5-E939-40A1-A6BA-957282A4B2C8}
          Norton AntiVirus Parent MSI-->MsiExec.exe /I{E5EE9939-259F-4DE2-8023-5C49E16A4F43}
          Norton AntiVirus SYMLT MSI-->MsiExec.exe /I{D1FF75E7-DD42-4CFD-B052-20B3FFF4EDB8}
          Norton AntiVirus-->MsiExec.exe /X{830D8CBD-C668-49e2-A969-C2C2106332E0}
          Norton Protection Center-->MsiExec.exe /I{9A129ABC-A53A-4209-A21E-D5DEDFB7CCA8}
          Power2Go 5.0-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{40BF1E83-20EB-11D8-97C5-0009C5020658}\Setup.exe" -uninstall
          Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -l0x40c -removeonly
          Security Update for 2007 Microsoft Office System (KB951550)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {B243E9A5-ED77-4F1B-B338-2486FD82DC85}
          Security Update for 2007 Microsoft Office System (KB951944)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {797AE457-BA17-4BBC-B501-25FB3A0103C7}
          Security Update for 2007 Microsoft Office System (KB960003)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {F04F8702-18D0-458D-921E-146FB7CD38CF}
          Security Update for Microsoft Office Excel 2007 (KB959997)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {9EAC3AEC-5C81-4856-A05B-DE9DC236D740}
          Security Update for Microsoft Office PowerPoint 2007 (KB957789)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {7559E742-FF9F-4FAE-B279-008ED296CB4D}
          Security Update for Microsoft Office Publisher 2007 (KB950114)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {F9C3CDBA-1F00-4D4D-959D-75C9D3ACDD85}
          Security Update for Microsoft Office system 2007 (KB954326)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {5F7F6FFF-395D-480E-8450-64F385D82C5F}
          Security Update for Microsoft Office system 2007 (KB956828)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {885E081B-72BD-4E76-8E98-30B4BE468FAC}
          Security Update for Microsoft Office Word 2007 (KB956358)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {4551666D-0FD6-4C69-8A81-1C6F2E64517C}
          Shuttle Center II-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2637C347-9DAD-11D6-9EA2-00055D0CA761}\Setup.exe" -uninstall
          SPBBC 32bit-->MsiExec.exe /I{77772678-817F-4401-9301-ED1D01A8DA56}
          Symantec-->MsiExec.exe /I{228F6876-A313-40A3-91C0-C3CBE6997D09}
          Synaptics Pointing Device Driver-->rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall
          Update for 2007 Microsoft Office System (KB967642)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {C444285D-5E4F-48A4-91DD-47AAAA68E92D}
          Update for Microsoft Office Outlook 2007 (KB952142)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {4AD3A076-427C-491F-A5B7-7D1DE788A756}
          Update for Microsoft Office Outlook 2007 Help (KB957246)-->msiexec /package {90120000-001A-040C-0000-0000000FF1CE} /uninstall {80E46078-C1C5-4AE8-8744-3EAFC812E118}
          Update for Outlook 2007 Junk Email Filter (kb968503)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {5DD98950-4D10-4B79-8BF6-59726705207D}
          VC80CRTRedist - 8.0.50727.762-->MsiExec.exe /I{767CC44C-9BBC-438D-BAD3-FD4595DD148B}
          VeriFace-->C:\Program Files\Lenovo\VeriFace\Uninstall.exe
          Windows Live installer-->MsiExec.exe /X{FD44E544-E7D0-4DBA-9FA0-8AE1A1300390}
          Windows Live Messenger-->MsiExec.exe /X{BADF6744-3787-48F6-B8C9-4C4995401D65}
          Windows Live Toolbar-->"C:\Program Files\Windows Live Toolbar\UnInstall.exe" {E8A81E1F-665E-4F81-B04D-B6D164A8F360}
          Windows Live Toolbar-->MsiExec.exe /X{E8A81E1F-665E-4F81-B04D-B6D164A8F360}
          WinFlash-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B39AA98E-C966-46C9-ACA2-D2586E300988}\Setup.exe" -l0x9
          WinRAR archiver-->C:\Program Files\WinRAR\uninstall.exe
          ZebHelpProcess 2.33.12-->"C:\Program Files\ZebHelpProcess\unins000.exe"

          ======Security center information======

          AV: Norton AntiVirus (disabled) (outdated)
          FW: Norton AntiVirus
          AS: Windows Defender
          AS: Norton AntiVirus (outdated)

          ======System event log======

          Computer Name: PC-de-francois
          Event Code: 4
          Message: Error loading virus definitions.
          Record Number: 60910
          Source Name: SRTSP
          Time Written: 20090525163920.658652-000
          Event Type: Erreur
          User:

          Computer Name: PC-de-francois
          Event Code: 5
          Message: Error loading Symantec real time Anti-Virus driver.
          Record Number: 60911
          Source Name: SRTSP
          Time Written: 20090525163920.658652-000
          Event Type: Erreur
          User:

          Computer Name: PC-de-francois
          Event Code: 15016
          Message: Impossible d’initialiser le package de sécurité Kerberos pour l’authentification côté serveur. Le champ de données contient le numéro de l’erreur.
          Record Number: 60914
          Source Name: Microsoft-Windows-HttpEvent
          Time Written: 20090525163955.862852-000
          Event Type: Erreur
          User:

          Computer Name: PC-de-francois
          Event Code: 7034
          Message: Le service Enregistreur VSS SQL Server s'est terminé de façon inattendue pour la 1ème fois.
          Record Number: 60991
          Source Name: Service Control Manager
          Time Written: 20090525164108.000000-000
          Event Type: Erreur
          User:

          Computer Name: PC-de-francois
          Event Code: 7026
          Message: Le pilote de démarrage système ou d'amorçage suivant n'a pas pu se charger :
          SRTSP
          Record Number: 60994
          Source Name: Service Control Manager
          Time Written: 20090525164108.000000-000
          Event Type: Erreur
          User:

          =====Application event log=====

          Computer Name: PC-de-francois
          Event Code: 1000
          Message: Application défaillante iexplore.exe, version 7.0.6001.18226, horodatage 0x49ac95d6, module défaillant kernel32.dll, version 6.0.6001.18215, horodatage 0x49953395, code d’exception 0x0eedfade, décalage d’erreur 0x000442eb, ID du processus 0x4dc, heure de début de l’application 0x01c9ddb9a609419b.
          Record Number: 17499
          Source Name: Application Error
          Time Written: 20090526042714.000000-000
          Event Type: Erreur
          User:

          Computer Name: PC-de-francois
          Event Code: 1000
          Message: Application défaillante iexplore.exe, version 7.0.6001.18226, horodatage 0x49ac95d6, module défaillant kernel32.dll, version 6.0.6001.18215, horodatage 0x49953395, code d’exception 0x0eedfade, décalage d’erreur 0x000442eb, ID du processus 0x1908, heure de début de l’application 0x01c9ddb9fcf5647b.
          Record Number: 17500
          Source Name: Application Error
          Time Written: 20090526042852.000000-000
          Event Type: Erreur
          User:

          Computer Name: PC-de-francois
          Event Code: 1000
          Message: Application défaillante iexplore.exe, version 7.0.6001.18226, horodatage 0x49ac95d6, module défaillant kernel32.dll, version 6.0.6001.18215, horodatage 0x49953395, code d’exception 0x0eedfade, décalage d’erreur 0x000442eb, ID du processus 0xe0c, heure de début de l’application 0x01c9ddba7d49523b.
          Record Number: 17501
          Source Name: Application Error
          Time Written: 20090526045411.000000-000
          Event Type: Erreur
          User:

          Computer Name: PC-de-francois
          Event Code: 1000
          Message: Application défaillante iexplore.exe, version 7.0.6001.18226, horodatage 0x49ac95d6, module défaillant kernel32.dll, version 6.0.6001.18215, horodatage 0x49953395, code d’exception 0x0eedfade, décalage d’erreur 0x000442eb, ID du processus 0x1a38, heure de début de l’application 0x01c9ddbcdc49af8b.
          Record Number: 17502
          Source Name: Application Error
          Time Written: 20090526045425.000000-000
          Event Type: Erreur
          User:

          Computer Name: PC-de-francois
          Event Code: 1000
          Message: Application défaillante iexplore.exe, version 7.0.6001.18226, horodatage 0x49ac95d6, module défaillant kernel32.dll, version 6.0.6001.18215, horodatage 0x49953395, code d’exception 0x0eedfade, décalage d’erreur 0x000442eb, ID du processus 0x1e58, heure de début de l’application 0x01c9ddc1e3c25e1b.
          Record Number: 17505
          Source Name: Application Error
          Time Written: 20090526060545.000000-000
          Event Type: Erreur
          User:

          =====Security event log=====

          Computer Name: PC-de-francois
          Event Code: 4634
          Message: Fermeture de session d’un compte.

          Sujet :
          ID de sécurité : S-1-5-7
          Nom du compte : ANONYMOUS LOGON
          Domaine du compte : AUTORITE NT
          ID du compte : 0x170aff54

          Type d’ouverture de session : 3

          Cet événement est généré lorsqu’une session ouverte est supprimée. Il peut être associé à un événement d’ouverture de session en utilisant la valeur ID d’ouverture de session. Les ID d’ouverture de session ne sont uniques qu’entre les redémarrages sur un même ordinateur.
          Record Number: 24552
          Source Name: Microsoft-Windows-Security-Auditing
          Time Written: 20090311073508.741000-000
          Event Type: Succès de l'audit
          User:

          Computer Name: PC-de-francois
          Event Code: 4634
          Message: Fermeture de session d’un compte.

          Sujet :
          ID de sécurité : S-1-5-7
          Nom du compte : ANONYMOUS LOGON
          Domaine du compte : AUTORITE NT
          ID du compte : 0x170b0544

          Type d’ouverture de session : 3

          Cet événement est généré lorsqu’une session ouverte est supprimée. Il peut être associé à un événement d’ouverture de session en utilisant la valeur ID d’ouverture de session. Les ID d’ouverture de session ne sont uniques qu’entre les redémarrages sur un même ordinateur.
          Record Number: 24553
          Source Name: Microsoft-Windows-Security-Auditing
          Time Written: 20090311073508.869000-000
          Event Type: Succès de l'audit
          User:

          Computer Name: PC-de-francois
          Event Code: 4624
          Message: L’ouverture de session d’un compte s’est correctement déroulée.

          Sujet :
          ID de sécurité : S-1-0-0
          Nom du compte : -
          Domaine du compte : -
          ID d’ouverture de session : 0x0

          Type d’ouverture de session : 3

          Nouvelle ouverture de session :
          ID de sécurité : S-1-5-7
          Nom du compte : ANONYMOUS LOGON
          Domaine du compte : AUTORITE NT
          ID d’ouverture de session : 0x17104d5b
          GUID d’ouverture de session : {00000000-0000-0000-0000-000000000000}

          Informations sur le processus :
          ID du processus : 0x0
          Nom du processus : -

          Informations sur le réseau :
          Nom de la station de travail : ROBERT-PC
          Adresse du réseau source : 192.168.0.199
          Port source : 49204

          Informations détaillées sur l’authentification :
          Processus d’ouverture de session : NtLmSsp
          Package d’authentification : NTLM
          Services en transit : -
          Nom du package (NTLM uniquement) : NTLM V1
          Longueur de la clé : 128

          Cet événement est généré lors de la création d’une ouverture de session. Il est généré sur l’ordinateur sur lequel l’ouverture de session a été effectuée.

          Le champ Objet indique le compte sur le système local qui a demandé l’ouverture de session. Il s’agit le plus souvent d’un service, comme le service Serveur, ou un processus local tel que Winlogon.exe ou Services.exe.

          Le champ Type d’ouverture de session indique le type d’ouverture de session qui s’est produit. Les types les plus courants sont 2 (interactif) et 3 (réseau).

          Le champ Nouvelle ouverture de session indique le compte pour lequel la nouvelle ouverture de session a été créée, par exemple, le compte qui s’est connecté.

          Les champs relatifs au réseau indiquent la provenance d’une demande d’ouverture de session à distance. Le nom de la station de travail n’étant pas toujours disponible, peut être laissé vide dans certains cas.

          Les champs relatifs aux informations d’authentification fournissent des détails sur cette demande d’ouverture de session spécifique.
          - Le GUID d’ouverture de session est un identificateur unique pouvant servir à associer cet événement à un événement KDC .
          - Les services en transit indiquent les services intermédiaires qui ont participé à cette demande d’ouverture de session.
          - Nom du package indique quel est le sous-protocole qui a été utilisé parmi les protocoles NTLM.
          - La longueur de la clé indique la longueur de la clé de session générée. Elle a la valeur 0 si aucune clé de session n’a été demandée.
          Record Number: 24554
          Source Name: Microsoft-Windows-Security-Auditing
          Time Written: 20090311074656.776000-000
          Event Type: Succès de l'audit
          User:

          Computer Name: PC-de-francois
          Event Code: 4624
          Message: L’ouverture de session d’un compte s’est correctement déroulée.

          Sujet :
          ID de sécurité : S-1-0-0
          Nom du compte : -
          Domaine du compte : -
          ID d’ouverture de session : 0x0

          Type d’ouverture de session : 3

          Nouvelle ouverture de session :
          ID de sécurité : S-1-5-7
          Nom du compte : ANONYMOUS LOGON
          Domaine du compte : AUTORITE NT
          ID d’ouverture de session : 0x17104d8f
          GUID d’ouverture de session : {00000000-0000-0000-0000-000000000000}

          Informations sur le processus :
          ID du processus : 0x0
          Nom du processus : -

          Informations sur le réseau :
          Nom de la station de travail : ROBERT-PC
          Adresse du réseau source : 192.168.0.199
          Port source : 49205

          Informations détaillées sur l’authentification :
          Processus d’ouverture de session : NtLmSsp
          Package d’authentification : NTLM
          Services en transit : -
          Nom du package (NTLM uniquement) : NTLM V1
          Longueur de la clé : 128

          Cet événement est généré lors de la création d’une ouverture de session. Il est généré sur l’ordinateur sur lequel l’ouverture de session a été effectuée.

          Le champ Objet indique le compte sur le système local qui a demandé l’ouverture de session. Il s’agit le plus souvent d’un service, comme le service Serveur, ou un processus local tel que Winlogon.exe ou Services.exe.

          Le champ Type d’ouverture de session indique le type d’ouverture de session qui s’est produit. Les types les plus courants sont 2 (interactif) et 3 (réseau).

          Le champ Nouvelle ouverture de session indique le compte pour lequel la nouvelle ouverture de session a été créée, par exemple, le compte qui s’est connecté.

          Les champs relatifs au réseau indiquent la provenance d’une demande d’ouverture de session à distance. Le nom de la station de travail n’étant pas toujours disponible, peut être laissé vide dans certains cas.

          Les champs relatifs aux informations d’authentification fournissent des détails sur cette demande d’ouverture de session spécifique.
          - Le GUID d’ouverture de session est un identificateur unique pouvant servir à associer cet événement à un événement KDC .
          - Les services en transit indiquent les services intermédiaires qui ont participé à cette demande d’ouverture de session.
          - Nom du package indique quel est le sous-protocole qui a été utilisé parmi les protocoles NTLM.
          - La longueur de la clé indique la longueur de la clé de session générée. Elle a la valeur 0 si aucune clé de session n’a été demandée.
          Record Number: 24555
          Source Name: Microsoft-Windows-Security-Auditing
          Time Written: 20090311074656.795000-000
          Event Type: Succès de l'audit
          User:

          Computer Name: PC-de-francois
          Event Code: 4634
          Message: Fermeture de session d’un compte.

          Sujet :
          ID de sécurité : S-1-5-7
          Nom du compte : ANONYMOUS LOGON
          Domaine du compte : AUTORITE NT
          ID du compte : 0x17104d5b

          Type d’ouverture de session : 3

          Cet événement est généré lorsqu’une session ouverte est supprimée. Il peut être associé à un événement d’ouverture de session en utilisant la valeur ID d’ouverture de session. Les ID d’ouverture de session ne sont uniques qu’entre les redémarrages sur un même ordinateur.
          Record Number: 24556
          Source Name: Microsoft-Windows-Security-Auditing
          Time Written: 20090311074707.240000-000
          Event Type: Succès de l'audit
          User:

          ======Environment variables======

          "ComSpec"=%SystemRoot%\system32\cmd.exe
          "FP_NO_HOST_CHECK"=NO
          "OS"=Windows_NT
          "Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem
          "PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
          "PROCESSOR_ARCHITECTURE"=x86
          "TEMP"=%SystemRoot%\TEMP
          "TMP"=%SystemRoot%\TEMP
          "USERNAME"=SYSTEM
          "windir"=%SystemRoot%
          "PROCESSOR_LEVEL"=6
          "PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 13, GenuineIntel
          "PROCESSOR_REVISION"=0f0d
          "NUMBER_OF_PROCESSORS"=2
          "configsetroot"=%SystemRoot%\ConfigSetRoot

          -----------------EOF-----------------
          2. V-X
            Re,

            ▶ Désactive le « contrôle des comptes utilisateurs = UAC »
            (tu le réactiveras après ta désinfection): Ne pas oublier !!
            Désactiver l'UAC est nécessaire pour pouvoir faire fonctionner certains programmes sous Vista.
            - Vas dans Démarrer puis panneau de configuration
            - Double Clique sur l'icône "Comptes d'utilisateurs"
            - Clique ensuite sur désactiver et valide.
            comment désactiver L'UAC

            ▶ Télécharge Ad-remover ( de C_XX ) sur ton bureau :

            ! Déconnecte toi et ferme toutes applications en cours !

            ▶ Double clique sur "Ad-R.exe" pour lancer l'installation et laisse les paramètres d'installation par défaut .

            ▶ Double-clique sur le raccourci Ad-remover qui est sur ton bureau pour lancer l'outil .

            ▶ Au menu principal choisis l'option "L" et tape sur [entrée] .

            ▶ Laisse travailler l'outil et ne touche à rien ...

            ▶ Poste le rapport qui apparait à la fin , sur le forum ...

            ( Le rapport est sauvegardé aussi sous C:\Ad-report.log )
            ( CTRL+A Pour tout sélectionner , CTRL+C pour copier et CTRL+V pour coller )

            Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
            Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
            Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.
            1. eucharistie Auteur
              bon, sa a mis du temps, mais sa y est!

              ------ RAPPORT D'AD-REMOVER 1.1.4.3 | UNIQUEMENT XP/VISTA -------

              Mit à jour part C_XX le 24/05/2009 à 15:20
              Contact: AdRemover.contact@gmail.com
              Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html

              Lancé à: 7:53:48, 26/05/2009 | Mode Normal
              Exécuté de: C:\Program Files\Ad-remover\
              Système d'exploitation: Microsoft® Windows Vista™ Home Premium Service Pack 1 v6.0.6001
              Nom du PC: PC-DE-FRANCOIS
              Utilisateur actuel: francois - Administrator

              .
              ============== ÉLÉMENT(S) NEUTRALISÉ(S) ==============
              .
              Service: "MyWebSearchService"
              .
              HKCR\FunWebProducts.DataControl
              HKCR\FunWebProducts.DataControl.1
              HKCR\FunWebProducts.HistoryKillerScheduler
              HKCR\FunWebProducts.HistoryKillerScheduler.1
              HKCR\FunWebProducts.HistorySwatterControlBar
              HKCR\FunWebProducts.HistorySwatterControlBar.1
              HKCR\FunWebProducts.HTMLMenu
              HKCR\FunWebProducts.HTMLMenu.1
              HKCR\FunWebProducts.HTMLMenu.2
              HKCR\FunWebProducts.IECookiesManager
              HKCR\FunWebProducts.IECookiesManager.1
              HKCR\FunWebProducts.KillerObjManager
              HKCR\FunWebProducts.KillerObjManager.1
              HKCR\FunWebProducts.PopSwatterBarButton
              HKCR\FunWebProducts.PopSwatterBarButton.1
              HKCR\FunWebProducts.PopSwatterSettingsControl
              HKCR\FunWebProducts.PopSwatterSettingsControl.1
              HKCR\MyWebSearch.ChatSessionPlugin
              HKCR\MyWebSearch.ChatSessionPlugin.1
              HKCR\MyWebSearch.HTMLPanel
              HKCR\MyWebSearch.HTMLPanel.1
              HKCR\MyWebSearch.OutlookAddin
              HKCR\MyWebSearch.OutlookAddin.1
              HKCR\MyWebSearch.PseudoTransparentPlugin
              HKCR\MyWebSearch.PseudoTransparentPlugin.1
              HKCR\MyWebSearchToolBar.SettingsPlugin
              HKCR\MyWebSearchToolBar.SettingsPlugin.1
              HKCR\MyWebSearchToolBar.ToolbarPlugin
              HKCR\MyWebSearchToolBar.ToolbarPlugin.1
              HKCR\screensavercontrol.screensaverinstaller
              HKCR\screensavercontrol.screensaverinstaller.1
              HKCU\Software\AppDataLow\Software\MyWebSearch
              HKCU\Software\FunWebProducts
              HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0}
              HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF1-072E-44CF-8957-5838F569A31D}
              HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
              HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
              HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EAB-A523-4961-B6BB-170DE4475CCA}
              HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB}
              HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8}
              HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C}
              HKCU\Software\MyWebSearch
              HKLM\Software\FocusInteractive
              HKLM\Software\Fun Web Products
              HKLM\Software\FunWebProducts
              HKLM\Software\Microsoft\Code Store Database\Distribution Units\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB}
              HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59C7FC09-1C83-4648-B3E6-003D2BBC7481}
              HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68AF847F-6E91-45DD-9B68-D6A12C30E5D7}
              HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170B96C-28D4-4626-8358-27E6CAEEF907}
              HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D1A71FA0-FF48-48DD-9B6D-7A13A3E42127}
              HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DDB1968E-EAD6-40FD-8DAE-FF14757F60C7}
              HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F138D901-86F0-4383-99B6-9CDD406036DA}
              HKLM\Software\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll
              HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0}
              HKLM\Software\Microsoft\Multimedia\WMPlayer\Schemes\f3pss
              HKLM\Software\Microsoft\Office\Outlook\Addins\MyWebSearch.OutlookAddin
              HKLM\Software\Microsoft\Office\Word\Addins\MyWebSearch.OutlookAddin
              HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{07B18EAB-A523-4961-B6BB-170DE4475CCA}
              HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{25560540-9571-4D7B-9389-0F166788785A}
              HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8}
              HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3E720452-B472-4954-B7AA-33069EB53906}
              HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C}
              HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7473d294-b7bb-4f24-ae82-7e2ce94bb6a9}
              HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{98D9753D-D73B-42D5-8C85-4469CDA897AB}
              HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9FF05104-B030-46FC-94B8-81276E4E27DF}
              HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{E79DFBCA-5697-4FBD-94E5-5B2A9C7C1612}
              HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\MyWebSearch bar Uninstall
              HKLM\Software\MyWebSearch
              HKLM\SYSTEM\ControlSet002\Services\MyWebSearchService
              HKU\S-1-5-21-660324954-2617743974-2655421058-1004\Software\Appdatalow\Software\Fun Web Products
              HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform\\FunWebProducts
              HKLM\Software\Microsoft\Windows Media\Wmsdk\Sources\\F3PopularScreenSavers
              HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\MyWebSearch Email Plugin
              HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\My Web Search Bar Search Scope Monitor
              HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\MyWebSearch Email Plugin
              HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\MyWebSearch Plugin
              HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\\{00A6FAF6-072E-44CF-8957-5838F569A31D}
              HKLM\Software\Microsoft\Internet Explorer\Toolbar\\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
              HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
              HKLM\Software\Classes\CLSID\{00A6FAF1-072E-44cf-8957-5838F569A31D}
              HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00A6FAF1-072E-44cf-8957-5838F569A31D}
              HKLM\Software\Classes\CLSID\{00A6FAF6-072E-44cf-8957-5838F569A31D}
              HKLM\Software\Classes\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
              HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
              HKLM\Software\Classes\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
              HKLM\Software\Classes\CLSID\{07B18EAB-A523-4961-B6BB-170DE4475CCA}
              HKLM\Software\Classes\CLSID\{0F8ECF4F-3646-4C3A-8881-8E138FFCAF70}
              HKLM\Software\Classes\CLSID\{25560540-9571-4D7B-9389-0F166788785A}
              HKLM\Software\Classes\CLSID\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8}
              HKLM\Software\Classes\CLSID\{3E720452-B472-4954-B7AA-33069EB53906}
              HKLM\Software\Classes\CLSID\{53CED2D0-5E9A-4761-9005-648404E6F7E5}
              HKLM\Software\Classes\CLSID\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C}
              HKLM\Software\Classes\CLSID\{7473D292-B7BB-4f24-AE82-7E2CE94BB6A9}
              HKLM\Software\Classes\CLSID\{7473D294-B7BB-4f24-AE82-7E2CE94BB6A9}
              HKLM\Software\Classes\CLSID\{7473D296-B7BB-4f24-AE82-7E2CE94BB6A9}
              HKLM\Software\Classes\CLSID\{84DA4FDF-A1CF-4195-8688-3E961F505983}
              HKLM\Software\Classes\CLSID\{8E6F1832-9607-4440-8530-13BE7C4B1D14}
              HKLM\Software\Classes\CLSID\{938AA51A-996C-4884-98CE-80DD16A5C9DA}
              HKLM\Software\Classes\CLSID\{98D9753D-D73B-42D5-8C85-4469CDA897AB}
              HKLM\Software\Classes\CLSID\{9FF05104-B030-46FC-94B8-81276E4E27DF}
              HKLM\Software\Classes\CLSID\{A9571378-68A1-443d-B082-284F960C6D17}
              HKLM\Software\Classes\CLSID\{ADB01E81-3C79-4272-A0F1-7B2BE7A782DC}
              HKLM\Software\Classes\CLSID\{B813095C-81C0-4E40-AA14-67520372B987}
              HKLM\Software\Classes\CLSID\{C9D7BE3E-141A-4C85-8CD6-32461F3DF2C7}
              HKLM\Software\Classes\CLSID\{CFF4CE82-3AA2-451F-9B77-7165605FB835}
              HKLM\Software\Classes\CLSID\{D9FFFB27-D62A-4D64-8CEC-1FF006528805}
              HKLM\Software\Classes\CLSID\{E79DFBCA-5697-4fbd-94E5-5B2A9C7C1612}
              .
              C:\Users\francois\Appdata\LocalLow\FunWebProducts\Data
              C:\Users\francois\Appdata\LocalLow\FunWebProducts\Installr
              C:\Users\francois\Appdata\LocalLow\FunWebProducts\PopSwatr
              C:\Users\francois\Appdata\LocalLow\FunWebProducts\Shared
              C:\Users\francois\Appdata\LocalLow\FunWebProducts\Data\avatar.dat
              C:\Users\francois\Appdata\LocalLow\FunWebProducts\Data\zbucks.dat
              C:\Users\francois\Appdata\LocalLow\FunWebProducts\Installr\Cache
              C:\Users\francois\Appdata\LocalLow\FunWebProducts\Installr\Cache\00191BCA.exe
              C:\Users\francois\Appdata\LocalLow\FunWebProducts\Installr\Cache\files.ini
              C:\Users\francois\Appdata\LocalLow\FunWebProducts\PopSwatr\History
              C:\Users\francois\Appdata\LocalLow\FunWebProducts\PopSwatr\History\allowed
              C:\Users\francois\Appdata\LocalLow\FunWebProducts\PopSwatr\History\notallow
              C:\Users\francois\Appdata\LocalLow\FunWebProducts\Shared\Cache
              C:\Users\francois\Appdata\LocalLow\FunWebProducts\Shared\Cache\CursorManiaBtn.html
              C:\Users\francois\Appdata\LocalLow\FunWebProducts\Shared\Cache\MyFunCardsIMBtn.html
              C:\Users\francois\Appdata\LocalLow\FunWebProducts\Shared\Cache\SmileyCentralBtn.html
              C:\Users\francois\Appdata\LocalLow\FunWebProducts\Shared\Cache\WebfettiBtn.html
              C:\Users\francois\Appdata\LocalLow\FunWebProducts
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Cache
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\History
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Settings
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\avatar.htm
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\bgfadel.gif
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\bgfader.gif
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\common-x.css
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\common.css
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\cornerbl.gif
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\cornerbr.gif
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\ext_def.gif
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\ext_roll.gif
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\include.js
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\index.htm
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\loader.htm
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\loading.gif
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\logo.gif
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\max_def.gif
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\max_roll.gif
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\min_def.gif
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\min_roll.gif
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\noflash.htm
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\res_def.gif
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\res_roll.gif
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\spacer.gif
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\spacer.swf
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\topgrad.gif
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\window.ico
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Cache\001BC60C
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Cache\001BC966.bin
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Cache\001BCBC7.bin
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Cache\001BCF5F.bin
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Cache\001BD181.bin
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Cache\001BD3A3.bin
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Cache\001BDB70
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Cache\003E977F.bin
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Cache\003E9924.bin
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Cache\003E9AD9.bin
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Cache\003E9C6E.bin
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Cache\0132D3A9
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Cache\files.ini
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\History\search3
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON\ask_logo.gif
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON\autoup.gif
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON\autoup.htm
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON\center.htm
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON\index.htm
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON\mid_dots.gif
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON\mws_logo.gif
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON\protect.htm
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON\shocked.gif
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON\stop.gif
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON\systray.htm
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON\systrayp.htm
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON\tp_grad.gif
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON\warn.gif
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Settings\prevcfg2.htm
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Settings\setting2.htm
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Settings\setting2.htm.bak
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Settings\settings.dat
              C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Settings\settings.dat.bak
              C:\Users\francois\Appdata\LocalLow\MyWebSearch
              C:\Program Files\FunWebProducts\ScreenSaver
              C:\Program Files\FunWebProducts\ScreenSaver\Images
              C:\Program Files\FunWebProducts
              /!\ NON SUPPRIMÉ: C:\Program Files\MyWebSearch\bar
              /!\ NON SUPPRIMÉ: C:\Program Files\MyWebSearch\bar\1.bin
              C:\Program Files\MyWebSearch\bar\Avatar
              C:\Program Files\MyWebSearch\bar\Game
              C:\Program Files\MyWebSearch\bar\History
              C:\Program Files\MyWebSearch\bar\icons
              C:\Program Files\MyWebSearch\bar\Message
              C:\Program Files\MyWebSearch\bar\Notifier
              C:\Program Files\MyWebSearch\bar\Settings
              C:\Program Files\MyWebSearch\bar\1.bin\F3BKGERR.JPG
              C:\Program Files\MyWebSearch\bar\1.bin\F3CJPEG.DLL
              C:\Program Files\MyWebSearch\bar\1.bin\F3DTACTL.DLL
              C:\Program Files\MyWebSearch\bar\1.bin\F3HISTSW.DLL
              /!\ NON SUPPRIMÉ: C:\Program Files\MyWebSearch\bar\1.bin\F3HKSTUB.DLL
              C:\Program Files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL
              C:\Program Files\MyWebSearch\bar\1.bin\F3HTTPCT.DLL
              C:\Program Files\MyWebSearch\bar\1.bin\F3POPSWT.DLL
              C:\Program Files\MyWebSearch\bar\1.bin\F3PSSAVR.SCR
              C:\Program Files\MyWebSearch\bar\1.bin\F3REGHK.DLL
              C:\Program Files\MyWebSearch\bar\1.bin\F3REPROX.DLL
              C:\Program Files\MyWebSearch\bar\1.bin\F3RESTUB.DLL
              C:\Program Files\MyWebSearch\bar\1.bin\F3SCHMON.EXE
              C:\Program Files\MyWebSearch\bar\1.bin\F3SCRCTR.DLL
              C:\Program Files\MyWebSearch\bar\1.bin\F3SPACER.WMV
              C:\Program Files\MyWebSearch\bar\1.bin\F3WALLPP.DAT
              C:\Program Files\MyWebSearch\bar\1.bin\F3WPHOOK.DLL
              C:\Program Files\MyWebSearch\bar\1.bin\FWPBUDDY.PNG
              C:\Program Files\MyWebSearch\bar\1.bin\M3FFXTBR.JAR
              C:\Program Files\MyWebSearch\bar\1.bin\M3FFXTBR.MANIFEST
              C:\Program Files\MyWebSearch\bar\1.bin\M3HIGHIN.EXE
              C:\Program Files\MyWebSearch\bar\1.bin\M3HTML.DLL
              C:\Program Files\MyWebSearch\bar\1.bin\M3IDLE.DLL
              C:\Program Files\MyWebSearch\bar\1.bin\M3IMPIPE.EXE
              C:\Program Files\MyWebSearch\bar\1.bin\M3MEDINT.EXE
              C:\Program Files\MyWebSearch\bar\1.bin\M3MSG.DLL
              C:\Program Files\MyWebSearch\bar\1.bin\M3NTSTBR.JAR
              C:\Program Files\MyWebSearch\bar\1.bin\M3NTSTBR.MANIFEST
              C:\Program Files\MyWebSearch\bar\1.bin\M3OUTLCN.DLL
              C:\Program Files\MyWebSearch\bar\1.bin\M3PLUGIN.DLL
              C:\Program Files\MyWebSearch\bar\1.bin\M3SKIN.DLL
              C:\Program Files\MyWebSearch\bar\1.bin\M3SKPLAY.EXE
              C:\Program Files\MyWebSearch\bar\1.bin\M3SLSRCH.EXE
              C:\Program Files\MyWebSearch\bar\1.bin\M3SRCHMN.EXE
              C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
              C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
              C:\Program Files\MyWebSearch\bar\1.bin\MWSOEPLG.DLL
              /!\ NON SUPPRIMÉ: C:\Program Files\MyWebSearch\bar\1.bin\MWSOESTB.DLL
              /!\ NON SUPPRIMÉ: C:\Program Files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL
              C:\Program Files\MyWebSearch\bar\1.bin\MWSSVC.EXE
              C:\Program Files\MyWebSearch\bar\1.bin\NPMYWEBS.DLL
              C:\Program Files\MyWebSearch\bar\Avatar\COMMON.F3S
              C:\Program Files\MyWebSearch\bar\Game\CHECKERS.F3S
              C:\Program Files\MyWebSearch\bar\Game\CHESS.F3S
              C:\Program Files\MyWebSearch\bar\Game\REVERSI.F3S
              C:\Program Files\MyWebSearch\bar\icons\CM.ICO
              C:\Program Files\MyWebSearch\bar\icons\MFC.ICO
              C:\Program Files\MyWebSearch\bar\icons\PSS.ICO
              C:\Program Files\MyWebSearch\bar\icons\SMILEY.ICO
              C:\Program Files\MyWebSearch\bar\icons\WB.ICO
              C:\Program Files\MyWebSearch\bar\icons\ZWINKY.ICO
              C:\Program Files\MyWebSearch\bar\Message\COMMON.F3S
              C:\Program Files\MyWebSearch\bar\Notifier\COMMON.F3S
              C:\Program Files\MyWebSearch\bar\Notifier\DOG.F3S
              C:\Program Files\MyWebSearch\bar\Notifier\FISH.F3S
              C:\Program Files\MyWebSearch\bar\Notifier\KUNGFU.F3S
              C:\Program Files\MyWebSearch\bar\Notifier\LIFEGARD.F3S
              C:\Program Files\MyWebSearch\bar\Notifier\MAID.F3S
              C:\Program Files\MyWebSearch\bar\Notifier\MAILBOX.F3S
              C:\Program Files\MyWebSearch\bar\Notifier\OPERA.F3S
              C:\Program Files\MyWebSearch\bar\Notifier\ROBOT.F3S
              C:\Program Files\MyWebSearch\bar\Notifier\SEDUCT.F3S
              C:\Program Files\MyWebSearch\bar\Notifier\SURFER.F3S
              C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat
              /!\ NON SUPPRIMÉ: C:\Program Files\MyWebSearch
              C:\Windows\System32\f3PSSavr.scr
              C:\Program Files\Windows Live\Messenger\riched20.dll
              C:\Program Files\Windows Live\Messenger\msimg32.dll

              (!) -- Fichiers temporaires supprimés.

              .
              +-----------------| Scan additionnel:
              .
              .
              .

              ---- Internet Explorer Version 7.0.6001.18000 ----

              [HKEY_CURRENT_USER\..\Internet Explorer\Main]

              Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
              Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
              Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
              Search Page: hxxp://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR
              Start Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

              [HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

              Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
              Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
              Search bar: hxxp://search.msn.com/spbasic.htm
              Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
              Start Page: hxxp://fr.msn.com/

              [HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

              Tabs: res://ieframe.dll/tabswelcome.htm

              =========== Suspect (Cracks, Serials ... ) ==========

              .

              +---------------------------------------------------------------------------+

              19555 Octet(s) - C:\Ad-Report-26.05.2009.log

              19 Fichier(s) - C:\Program Files\Ad-remover\BACKUP
              11 Fichier(s) - C:\Program Files\Ad-remover\QUARANTINE

              Fin à: 8:25:21 | 26/05/2009
              .
              +-----------------| E.O.F
              .
              1. eucharistie Auteur
                ------ RAPPORT D'AD-REMOVER 1.1.4.3 | UNIQUEMENT XP/VISTA -------

                Mit à jour part C_XX le 24/05/2009 à 15:20
                Contact: AdRemover.contact@gmail.com
                Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html

                Lancé à: 7:53:48, 26/05/2009 | Mode Normal
                Exécuté de: C:\Program Files\Ad-remover\
                Système d'exploitation: Microsoft® Windows Vista™ Home Premium Service Pack 1 v6.0.6001
                Nom du PC: PC-DE-FRANCOIS
                Utilisateur actuel: francois - Administrator

                .
                ============== ÉLÉMENT(S) NEUTRALISÉ(S) ==============
                .
                Service: "MyWebSearchService"
                .
                HKCR\FunWebProducts.DataControl
                HKCR\FunWebProducts.DataControl.1
                HKCR\FunWebProducts.HistoryKillerScheduler
                HKCR\FunWebProducts.HistoryKillerScheduler.1
                HKCR\FunWebProducts.HistorySwatterControlBar
                HKCR\FunWebProducts.HistorySwatterControlBar.1
                HKCR\FunWebProducts.HTMLMenu
                HKCR\FunWebProducts.HTMLMenu.1
                HKCR\FunWebProducts.HTMLMenu.2
                HKCR\FunWebProducts.IECookiesManager
                HKCR\FunWebProducts.IECookiesManager.1
                HKCR\FunWebProducts.KillerObjManager
                HKCR\FunWebProducts.KillerObjManager.1
                HKCR\FunWebProducts.PopSwatterBarButton
                HKCR\FunWebProducts.PopSwatterBarButton.1
                HKCR\FunWebProducts.PopSwatterSettingsControl
                HKCR\FunWebProducts.PopSwatterSettingsControl.1
                HKCR\MyWebSearch.ChatSessionPlugin
                HKCR\MyWebSearch.ChatSessionPlugin.1
                HKCR\MyWebSearch.HTMLPanel
                HKCR\MyWebSearch.HTMLPanel.1
                HKCR\MyWebSearch.OutlookAddin
                HKCR\MyWebSearch.OutlookAddin.1
                HKCR\MyWebSearch.PseudoTransparentPlugin
                HKCR\MyWebSearch.PseudoTransparentPlugin.1
                HKCR\MyWebSearchToolBar.SettingsPlugin
                HKCR\MyWebSearchToolBar.SettingsPlugin.1
                HKCR\MyWebSearchToolBar.ToolbarPlugin
                HKCR\MyWebSearchToolBar.ToolbarPlugin.1
                HKCR\screensavercontrol.screensaverinstaller
                HKCR\screensavercontrol.screensaverinstaller.1
                HKCU\Software\AppDataLow\Software\MyWebSearch
                HKCU\Software\FunWebProducts
                HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0}
                HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF1-072E-44CF-8957-5838F569A31D}
                HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
                HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
                HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EAB-A523-4961-B6BB-170DE4475CCA}
                HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB}
                HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8}
                HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C}
                HKCU\Software\MyWebSearch
                HKLM\Software\FocusInteractive
                HKLM\Software\Fun Web Products
                HKLM\Software\FunWebProducts
                HKLM\Software\Microsoft\Code Store Database\Distribution Units\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB}
                HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59C7FC09-1C83-4648-B3E6-003D2BBC7481}
                HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68AF847F-6E91-45DD-9B68-D6A12C30E5D7}
                HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170B96C-28D4-4626-8358-27E6CAEEF907}
                HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D1A71FA0-FF48-48DD-9B6D-7A13A3E42127}
                HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DDB1968E-EAD6-40FD-8DAE-FF14757F60C7}
                HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F138D901-86F0-4383-99B6-9CDD406036DA}
                HKLM\Software\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll
                HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0}
                HKLM\Software\Microsoft\Multimedia\WMPlayer\Schemes\f3pss
                HKLM\Software\Microsoft\Office\Outlook\Addins\MyWebSearch.OutlookAddin
                HKLM\Software\Microsoft\Office\Word\Addins\MyWebSearch.OutlookAddin
                HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{07B18EAB-A523-4961-B6BB-170DE4475CCA}
                HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{25560540-9571-4D7B-9389-0F166788785A}
                HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8}
                HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3E720452-B472-4954-B7AA-33069EB53906}
                HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C}
                HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7473d294-b7bb-4f24-ae82-7e2ce94bb6a9}
                HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{98D9753D-D73B-42D5-8C85-4469CDA897AB}
                HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9FF05104-B030-46FC-94B8-81276E4E27DF}
                HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{E79DFBCA-5697-4FBD-94E5-5B2A9C7C1612}
                HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\MyWebSearch bar Uninstall
                HKLM\Software\MyWebSearch
                HKLM\SYSTEM\ControlSet002\Services\MyWebSearchService
                HKU\S-1-5-21-660324954-2617743974-2655421058-1004\Software\Appdatalow\Software\Fun Web Products
                HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform\\FunWebProducts
                HKLM\Software\Microsoft\Windows Media\Wmsdk\Sources\\F3PopularScreenSavers
                HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\MyWebSearch Email Plugin
                HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\My Web Search Bar Search Scope Monitor
                HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\MyWebSearch Email Plugin
                HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\MyWebSearch Plugin
                HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\\{00A6FAF6-072E-44CF-8957-5838F569A31D}
                HKLM\Software\Microsoft\Internet Explorer\Toolbar\\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
                HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
                HKLM\Software\Classes\CLSID\{00A6FAF1-072E-44cf-8957-5838F569A31D}
                HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00A6FAF1-072E-44cf-8957-5838F569A31D}
                HKLM\Software\Classes\CLSID\{00A6FAF6-072E-44cf-8957-5838F569A31D}
                HKLM\Software\Classes\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
                HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
                HKLM\Software\Classes\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
                HKLM\Software\Classes\CLSID\{07B18EAB-A523-4961-B6BB-170DE4475CCA}
                HKLM\Software\Classes\CLSID\{0F8ECF4F-3646-4C3A-8881-8E138FFCAF70}
                HKLM\Software\Classes\CLSID\{25560540-9571-4D7B-9389-0F166788785A}
                HKLM\Software\Classes\CLSID\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8}
                HKLM\Software\Classes\CLSID\{3E720452-B472-4954-B7AA-33069EB53906}
                HKLM\Software\Classes\CLSID\{53CED2D0-5E9A-4761-9005-648404E6F7E5}
                HKLM\Software\Classes\CLSID\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C}
                HKLM\Software\Classes\CLSID\{7473D292-B7BB-4f24-AE82-7E2CE94BB6A9}
                HKLM\Software\Classes\CLSID\{7473D294-B7BB-4f24-AE82-7E2CE94BB6A9}
                HKLM\Software\Classes\CLSID\{7473D296-B7BB-4f24-AE82-7E2CE94BB6A9}
                HKLM\Software\Classes\CLSID\{84DA4FDF-A1CF-4195-8688-3E961F505983}
                HKLM\Software\Classes\CLSID\{8E6F1832-9607-4440-8530-13BE7C4B1D14}
                HKLM\Software\Classes\CLSID\{938AA51A-996C-4884-98CE-80DD16A5C9DA}
                HKLM\Software\Classes\CLSID\{98D9753D-D73B-42D5-8C85-4469CDA897AB}
                HKLM\Software\Classes\CLSID\{9FF05104-B030-46FC-94B8-81276E4E27DF}
                HKLM\Software\Classes\CLSID\{A9571378-68A1-443d-B082-284F960C6D17}
                HKLM\Software\Classes\CLSID\{ADB01E81-3C79-4272-A0F1-7B2BE7A782DC}
                HKLM\Software\Classes\CLSID\{B813095C-81C0-4E40-AA14-67520372B987}
                HKLM\Software\Classes\CLSID\{C9D7BE3E-141A-4C85-8CD6-32461F3DF2C7}
                HKLM\Software\Classes\CLSID\{CFF4CE82-3AA2-451F-9B77-7165605FB835}
                HKLM\Software\Classes\CLSID\{D9FFFB27-D62A-4D64-8CEC-1FF006528805}
                HKLM\Software\Classes\CLSID\{E79DFBCA-5697-4fbd-94E5-5B2A9C7C1612}
                .
                C:\Users\francois\Appdata\LocalLow\FunWebProducts\Data
                C:\Users\francois\Appdata\LocalLow\FunWebProducts\Installr
                C:\Users\francois\Appdata\LocalLow\FunWebProducts\PopSwatr
                C:\Users\francois\Appdata\LocalLow\FunWebProducts\Shared
                C:\Users\francois\Appdata\LocalLow\FunWebProducts\Data\avatar.dat
                C:\Users\francois\Appdata\LocalLow\FunWebProducts\Data\zbucks.dat
                C:\Users\francois\Appdata\LocalLow\FunWebProducts\Installr\Cache
                C:\Users\francois\Appdata\LocalLow\FunWebProducts\Installr\Cache\00191BCA.exe
                C:\Users\francois\Appdata\LocalLow\FunWebProducts\Installr\Cache\files.ini
                C:\Users\francois\Appdata\LocalLow\FunWebProducts\PopSwatr\History
                C:\Users\francois\Appdata\LocalLow\FunWebProducts\PopSwatr\History\allowed
                C:\Users\francois\Appdata\LocalLow\FunWebProducts\PopSwatr\History\notallow
                C:\Users\francois\Appdata\LocalLow\FunWebProducts\Shared\Cache
                C:\Users\francois\Appdata\LocalLow\FunWebProducts\Shared\Cache\CursorManiaBtn.html
                C:\Users\francois\Appdata\LocalLow\FunWebProducts\Shared\Cache\MyFunCardsIMBtn.html
                C:\Users\francois\Appdata\LocalLow\FunWebProducts\Shared\Cache\SmileyCentralBtn.html
                C:\Users\francois\Appdata\LocalLow\FunWebProducts\Shared\Cache\WebfettiBtn.html
                C:\Users\francois\Appdata\LocalLow\FunWebProducts
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Cache
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\History
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Settings
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\avatar.htm
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\bgfadel.gif
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\bgfader.gif
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\common-x.css
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\common.css
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\cornerbl.gif
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\cornerbr.gif
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\ext_def.gif
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\ext_roll.gif
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\include.js
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\index.htm
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\loader.htm
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\loading.gif
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\logo.gif
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\max_def.gif
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\max_roll.gif
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\min_def.gif
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\min_roll.gif
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\noflash.htm
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\res_def.gif
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\res_roll.gif
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\spacer.gif
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\spacer.swf
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\topgrad.gif
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Avatar\COMMON\window.ico
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Cache\001BC60C
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Cache\001BC966.bin
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Cache\001BCBC7.bin
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Cache\001BCF5F.bin
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Cache\001BD181.bin
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Cache\001BD3A3.bin
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Cache\001BDB70
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Cache\003E977F.bin
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Cache\003E9924.bin
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Cache\003E9AD9.bin
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Cache\003E9C6E.bin
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Cache\0132D3A9
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Cache\files.ini
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\History\search3
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON\ask_logo.gif
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON\autoup.gif
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON\autoup.htm
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON\center.htm
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON\index.htm
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON\mid_dots.gif
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON\mws_logo.gif
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON\protect.htm
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON\shocked.gif
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON\stop.gif
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON\systray.htm
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON\systrayp.htm
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON\tp_grad.gif
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Message\COMMON\warn.gif
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Settings\prevcfg2.htm
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Settings\setting2.htm
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Settings\setting2.htm.bak
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Settings\settings.dat
                C:\Users\francois\Appdata\LocalLow\MyWebSearch\bar\Settings\settings.dat.bak
                C:\Users\francois\Appdata\LocalLow\MyWebSearch
                C:\Program Files\FunWebProducts\ScreenSaver
                C:\Program Files\FunWebProducts\ScreenSaver\Images
                C:\Program Files\FunWebProducts
                /!\ NON SUPPRIMÉ: C:\Program Files\MyWebSearch\bar
                /!\ NON SUPPRIMÉ: C:\Program Files\MyWebSearch\bar\1.bin
                C:\Program Files\MyWebSearch\bar\Avatar
                C:\Program Files\MyWebSearch\bar\Game
                C:\Program Files\MyWebSearch\bar\History
                C:\Program Files\MyWebSearch\bar\icons
                C:\Program Files\MyWebSearch\bar\Message
                C:\Program Files\MyWebSearch\bar\Notifier
                C:\Program Files\MyWebSearch\bar\Settings
                C:\Program Files\MyWebSearch\bar\1.bin\F3BKGERR.JPG
                C:\Program Files\MyWebSearch\bar\1.bin\F3CJPEG.DLL
                C:\Program Files\MyWebSearch\bar\1.bin\F3DTACTL.DLL
                C:\Program Files\MyWebSearch\bar\1.bin\F3HISTSW.DLL
                /!\ NON SUPPRIMÉ: C:\Program Files\MyWebSearch\bar\1.bin\F3HKSTUB.DLL
                C:\Program Files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL
                C:\Program Files\MyWebSearch\bar\1.bin\F3HTTPCT.DLL
                C:\Program Files\MyWebSearch\bar\1.bin\F3POPSWT.DLL
                C:\Program Files\MyWebSearch\bar\1.bin\F3PSSAVR.SCR
                C:\Program Files\MyWebSearch\bar\1.bin\F3REGHK.DLL
                C:\Program Files\MyWebSearch\bar\1.bin\F3REPROX.DLL
                C:\Program Files\MyWebSearch\bar\1.bin\F3RESTUB.DLL
                C:\Program Files\MyWebSearch\bar\1.bin\F3SCHMON.EXE
                C:\Program Files\MyWebSearch\bar\1.bin\F3SCRCTR.DLL
                C:\Program Files\MyWebSearch\bar\1.bin\F3SPACER.WMV
                C:\Program Files\MyWebSearch\bar\1.bin\F3WALLPP.DAT
                C:\Program Files\MyWebSearch\bar\1.bin\F3WPHOOK.DLL
                C:\Program Files\MyWebSearch\bar\1.bin\FWPBUDDY.PNG
                C:\Program Files\MyWebSearch\bar\1.bin\M3FFXTBR.JAR
                C:\Program Files\MyWebSearch\bar\1.bin\M3FFXTBR.MANIFEST
                C:\Program Files\MyWebSearch\bar\1.bin\M3HIGHIN.EXE
                C:\Program Files\MyWebSearch\bar\1.bin\M3HTML.DLL
                C:\Program Files\MyWebSearch\bar\1.bin\M3IDLE.DLL
                C:\Program Files\MyWebSearch\bar\1.bin\M3IMPIPE.EXE
                C:\Program Files\MyWebSearch\bar\1.bin\M3MEDINT.EXE
                C:\Program Files\MyWebSearch\bar\1.bin\M3MSG.DLL
                C:\Program Files\MyWebSearch\bar\1.bin\M3NTSTBR.JAR
                C:\Program Files\MyWebSearch\bar\1.bin\M3NTSTBR.MANIFEST
                C:\Program Files\MyWebSearch\bar\1.bin\M3OUTLCN.DLL
                C:\Program Files\MyWebSearch\bar\1.bin\M3PLUGIN.DLL
                C:\Program Files\MyWebSearch\bar\1.bin\M3SKIN.DLL
                C:\Program Files\MyWebSearch\bar\1.bin\M3SKPLAY.EXE
                C:\Program Files\MyWebSearch\bar\1.bin\M3SLSRCH.EXE
                C:\Program Files\MyWebSearch\bar\1.bin\M3SRCHMN.EXE
                C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
                C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
                C:\Program Files\MyWebSearch\bar\1.bin\MWSOEPLG.DLL
                /!\ NON SUPPRIMÉ: C:\Program Files\MyWebSearch\bar\1.bin\MWSOESTB.DLL
                /!\ NON SUPPRIMÉ: C:\Program Files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL
                C:\Program Files\MyWebSearch\bar\1.bin\MWSSVC.EXE
                C:\Program Files\MyWebSearch\bar\1.bin\NPMYWEBS.DLL
                C:\Program Files\MyWebSearch\bar\Avatar\COMMON.F3S
                C:\Program Files\MyWebSearch\bar\Game\CHECKERS.F3S
                C:\Program Files\MyWebSearch\bar\Game\CHESS.F3S
                C:\Program Files\MyWebSearch\bar\Game\REVERSI.F3S
                C:\Program Files\MyWebSearch\bar\icons\CM.ICO
                C:\Program Files\MyWebSearch\bar\icons\MFC.ICO
                C:\Program Files\MyWebSearch\bar\icons\PSS.ICO
                C:\Program Files\MyWebSearch\bar\icons\SMILEY.ICO
                C:\Program Files\MyWebSearch\bar\icons\WB.ICO
                C:\Program Files\MyWebSearch\bar\icons\ZWINKY.ICO
                C:\Program Files\MyWebSearch\bar\Message\COMMON.F3S
                C:\Program Files\MyWebSearch\bar\Notifier\COMMON.F3S
                C:\Program Files\MyWebSearch\bar\Notifier\DOG.F3S
                C:\Program Files\MyWebSearch\bar\Notifier\FISH.F3S
                C:\Program Files\MyWebSearch\bar\Notifier\KUNGFU.F3S
                C:\Program Files\MyWebSearch\bar\Notifier\LIFEGARD.F3S
                C:\Program Files\MyWebSearch\bar\Notifier\MAID.F3S
                C:\Program Files\MyWebSearch\bar\Notifier\MAILBOX.F3S
                C:\Program Files\MyWebSearch\bar\Notifier\OPERA.F3S
                C:\Program Files\MyWebSearch\bar\Notifier\ROBOT.F3S
                C:\Program Files\MyWebSearch\bar\Notifier\SEDUCT.F3S
                C:\Program Files\MyWebSearch\bar\Notifier\SURFER.F3S
                C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat
                /!\ NON SUPPRIMÉ: C:\Program Files\MyWebSearch
                C:\Windows\System32\f3PSSavr.scr
                C:\Program Files\Windows Live\Messenger\riched20.dll
                C:\Program Files\Windows Live\Messenger\msimg32.dll

                (!) -- Fichiers temporaires supprimés.

                .
                +-----------------| Scan additionnel:
                .
                .
                .

                ---- Internet Explorer Version 7.0.6001.18000 ----

                [HKEY_CURRENT_USER\..\Internet Explorer\Main]

                Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
                Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
                Search Page: hxxp://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR
                Start Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

                [HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

                Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
                Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                Search bar: hxxp://search.msn.com/spbasic.htm
                Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                Start Page: hxxp://fr.msn.com/

                [HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

                Tabs: res://ieframe.dll/tabswelcome.htm

                =========== Suspect (Cracks, Serials ... ) ==========

                .

                +---------------------------------------------------------------------------+

                19555 Octet(s) - C:\Ad-Report-26.05.2009.log

                19 Fichier(s) - C:\Program Files\Ad-remover\BACKUP
                11 Fichier(s) - C:\Program Files\Ad-remover\QUARANTINE

                Fin à: 8:25:21 | 26/05/2009
                .
                +-----------------| E.O.F
                .
                3. eucharistie Auteur
                  voila, et excuse moi, merci de me consacré du temps!

                  Logfile of random's system information tool 1.06 (written by random/random)
                  Run by francois at 2009-05-26 08:35:26
                  Microsoft® Windows Vista™ Édition Familiale Premium Service Pack 1
                  System drive C: has 5 GB (16%) free of 30 GB
                  Total RAM: 3063 MB (59% free)

                  Logfile of Trend Micro HijackThis v2.0.2
                  Scan saved at 08:35:36, on 26/05/2009
                  Platform: Windows Vista SP1 (WinNT 6.00.1905)
                  MSIE: Internet Explorer v7.00 (7.00.6001.18226)
                  Boot mode: Normal

                  Running processes:
                  C:\Windows\system32\Dwm.exe
                  C:\Windows\system32\taskeng.exe
                  C:\Windows\RtHDVCpl.exe
                  C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
                  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
                  C:\Windows\System32\hkcmd.exe
                  C:\Windows\System32\igfxpers.exe
                  C:\Program Files\Lenovo\EnergyCut\utilty.exe
                  C:\Program Files\Lenovo\EnergyCut\EnergyCut.exe
                  C:\Program Files\Common Files\Symantec Shared\ccApp.exe
                  C:\Program Files\Lenovo\ShuttleCenter\PCMService.exe
                  C:\Program Files\Lenovo\VeriFace\PManage.exe
                  C:\Program Files\Lenovo\VeriFace\RTimeLock.exe
                  C:\Program Files\Windows Sidebar\sidebar.exe
                  C:\Windows\ehome\ehtray.exe
                  C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                  C:\Windows\system32\igfxsrvc.exe
                  C:\Windows\ehome\ehmsas.exe
                  C:\Windows\explorer.exe
                  C:\Windows\system32\conime.exe
                  C:\Program Files\Internet Explorer\ieuser.exe
                  C:\Program Files\Internet Explorer\iexplore.exe
                  C:\Program Files\Google\Google Toolbar\GoogleToolbarUser.exe
                  C:\Users\francois\Desktop\RSIT.exe
                  C:\Users\francois\Desktop\francois.exe

                  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
                  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
                  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
                  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
                  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
                  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
                  R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)
                  O1 - Hosts: ::1 localhost
                  O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
                  O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
                  O2 - BHO: (no name) - {2E59498D-7E44-4452-9044-0973B080B9E8} - C:\Windows\System32\winexplorer.dll
                  O2 - BHO: Windows Live Call HoverToCall class - {7E853D72-626A-48EC-A868-BA8D5E23E045} - C:\Program Files\Windows Live\Messenger\HTC.DLL
                  O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
                  O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
                  O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                  O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
                  O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                  O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
                  O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
                  O4 - HKLM\..\Run: [Unattend0000000001{7CE4F652-9E84-4617-9F54-DC8891DFB725}] C:\Windows\test.bat
                  O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
                  O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
                  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
                  O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
                  O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
                  O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
                  O4 - HKLM\..\Run: [EnergyCut_Utility] C:\Program Files\Lenovo\EnergyCut\utilty.exe
                  O4 - HKLM\..\Run: [EnergyCut] C:\Program Files\Lenovo\EnergyCut\EnergyCut.exe
                  O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
                  O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Lenovo\ShuttleCenter\PCMService.exe"
                  O4 - HKLM\..\Run: [VeriFacePassManager] C:\Program Files\Lenovo\VeriFace\PManage.exe
                  O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
                  O4 - HKLM\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALuNotify.exe
                  O4 - HKLM\..\Run: [VeriFaceTimeLock] C:\Program Files\Lenovo\VeriFace\RTimeLock.exe
                  O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
                  O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
                  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
                  O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
                  O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                  O4 - HKCU\..\Run: [Speech Recognition] "C:\Windows\Speech\Common\sapisvr.exe" -SpeechUX -Startup
                  O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
                  O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
                  O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
                  O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
                  O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
                  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
                  O9 - Extra button: Password Administration Box - {A26ABCF0-1C8F-46e7-A67C-0489DC21B9CC} - C:\Program Files\Lenovo\VeriFace\OpenWnd.exe
                  O9 - Extra 'Tools' menuitem: Password Administration Box - {A26ABCF0-1C8F-46e7-A67C-0489DC21B9CC} - C:\Program Files\Lenovo\VeriFace\OpenWnd.exe
                  O13 - Gopher Prefix:
                  O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
                  O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ATK Hotkey\ASLDRSrv.exe
                  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
                  O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
                  O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Lenovo\ShuttleCenter\Kernel\TV\CLCapSvc.exe
                  O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Lenovo\ShuttleCenter\Kernel\TV\CLSched.exe
                  O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
                  O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
                  O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                  O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe
                  O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
                  O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
                  O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
                  O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
                  O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
                  O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
                  O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
                  1. V-X
                    Re,

                    Télécharge Toolbar-S&D (Team IDN) sur ton Bureau

                    !! Déconnectes toi et fermes toute tes applications en cours le temps de la manipe !!

                    ▶ Double-cliques sur l'.exe pour lancer l'installe et laisses toi guider ...

                    ▶ Une fois fait, cliques sur le raccourci créé sur ton bureau pour lancer l'outil .

                    ▶ Choisis l'option 1 ( "recherche") et tapes "entrée" .

                    ▶Une fois le scan finit , un rapport va apparaître, copie/colles l'intégralité
                    de son contenu dans ta prochaine réponse ...

                    ( le rapport est en outre sauvegardé ici -> C:\TB.txt )

                    Tutoriel Toolbard-S&D

                    Si un rapport ne passe pas faire une alerte à la conciergerie avec le /!\ jaune.
                    1. eucharistie Auteur
                      ----------\\ ToolBar S&D 1.2.8 XP/Vista

                      Microsoft® Windows Vista™ Édition Familiale Premium ( v6.0.6001 ) Service Pack 1
                      X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) Dual CPU T2390 @ 1.86GHz )
                      BIOS : Default System BIOS
                      USER : francois ( Administrator )
                      BOOT : Normal boot
                      Antivirus : Norton AntiVirus 2007 (Not Activated)
                      Firewall : Norton AntiVirus 2007 (Activated)
                      C:\ (Local Disk) - NTFS - Total:29 Go (Free:4 Go)
                      D:\ (Local Disk) - NTFS - Total:186 Go (Free:186 Go)
                      E:\ (CD or DVD)

                      "C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
                      Option : [1] ( 26/05/2009| 8:57 )

                      [ UAC => 1 ]

                      -----------\\ Recherche de Fichiers / Dossiers ...

                      C:\Program Files\MyWebSearch
                      C:\Program Files\MyWebSearch\bar
                      C:\Program Files\MyWebSearch\bar\1.bin
                      C:\Program Files\MyWebSearch\bar\1.bin\F3HKSTUB.DLL
                      C:\Program Files\MyWebSearch\bar\1.bin\MWSOESTB.DLL
                      C:\Program Files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL

                      -----------\\ [..\Internet Explorer\Main]

                      [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
                      "Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
                      "Local Page"="C:\\Windows\\system32\\blank.htm"
                      "Search Page"="https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC"
                      "Search Bar"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
                      "Default_search_url"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
                      "Default_page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"

                      [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
                      "Start Page"="https://www.msn.com/fr-fr"
                      "Default_Page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
                      "Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
                      "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
                      "Search bar"="http://www.bing.com/spresults.aspx"

                      --------------------\\ Recherche d'autres infections

                      Aucune autre infection trouvée !

                      [ UAC => 1 ]

                      1 - "C:\ToolBar SD\TB_1.txt" - 26/05/2009| 8:57 - Option : [1]

                      -----------\\ Fin du rapport a 8:57:46,73
                      1. V-X
                        Re,

                        Fais ceci maintenant :

                        ▶ Nettoyage avec ToolBar S&D :

                        !! Déconnectes toi et fermes toute tes applications en cours le temps de la manipe !!

                        ▶Relances Toolbar-S&D en double-cliquant sur le raccourci.

                        ▶ Tapes sur l'option 2 ( "nettoyage" ) puis tapes sur "Entrée".

                        Note : Ne touches à rien lors de la suppression !!

                        ▶ Un rapport sera généré à la fin du processus : postes son contenu dans ta prochaine réponse

                        Si un rapport ne passe pas faire une alerte à la conciergerie avec le /!\ jaune.
                        1. eucharistie Auteur
                          -----------\\ ToolBar S&D 1.2.8 XP/Vista

                          Microsoft® Windows Vista™ Édition Familiale Premium ( v6.0.6001 ) Service Pack 1
                          X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) Dual CPU T2390 @ 1.86GHz )
                          BIOS : Default System BIOS
                          USER : francois ( Administrator )
                          BOOT : Normal boot
                          Antivirus : Norton AntiVirus 2007 (Not Activated)
                          Firewall : Norton AntiVirus 2007 (Activated)
                          C:\ (Local Disk) - NTFS - Total:29 Go (Free:4 Go)
                          D:\ (Local Disk) - NTFS - Total:186 Go (Free:186 Go)
                          E:\ (CD or DVD)

                          "C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
                          Option : [2] ( 26/05/2009| 9:09 )

                          [ UAC => 1 ]

                          -----------\\ SUPPRESSION

                          Echec ! - C:\Program Files\MyWebSearch\bar
                          Echec ! - C:\Program Files\MyWebSearch\bar\1.bin
                          Echec ! - C:\Program Files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL
                          Echec ! - C:\Program Files\MyWebSearch

                          -----------\\ DEUXIEME PASSAGE

                          Echec ! - C:\Program Files\MyWebSearch\bar
                          Echec ! - C:\Program Files\MyWebSearch\bar\1.bin
                          Echec ! - C:\Program Files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL
                          Echec ! - C:\Program Files\MyWebSearch

                          -----------\\ Recherche de Fichiers / Dossiers ...

                          C:\Program Files\MyWebSearch
                          C:\Program Files\MyWebSearch\bar
                          C:\Program Files\MyWebSearch\bar\1.bin
                          C:\Program Files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL

                          -----------\\ [..\Internet Explorer\Main]

                          [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
                          "Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
                          "Local Page"="C:\\Windows\\system32\\blank.htm"
                          "Search Page"="https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC"
                          "Search Bar"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
                          "Default_search_url"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
                          "Default_page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"

                          [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
                          "Start Page"="https://www.msn.com/fr-fr/"
                          "Default_Page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
                          "Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
                          "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
                          "Search bar"="http://www.bing.com/spresults.aspx"

                          --------------------\\ Recherche d'autres infections

                          Aucune autre infection trouvée !

                          [ UAC => 1 ]

                          1 - "C:\ToolBar SD\TB_1.txt" - 26/05/2009| 8:57 - Option : [1]
                          2 - "C:\ToolBar SD\TB_2.txt" - 26/05/2009| 9:10 - Option : [2]

                          -----------\\ Fin du rapport a 9:10:59,04
                          1. V-X
                            Re,

                            ---> Télécharge OTM (OldTimer) sur ton Bureau :
                            http://oldtimer.geekstogo.com/OTMoveIt3.exe

                            ---> Double-clique sur OTMoveIt3.exe afin de le lancer.

                            ---> Copie (Ctrl+C) le texte suivant en gras ci-dessous :

                            :processes
                            explorer.exe

                            :files
                            C:\Program Files\MyWebSearch
                            C:\Program Files\MyWebSearch\bar
                            C:\Program Files\MyWebSearch\bar\1.bin
                            C:\Program Files\MyWebSearch\bar\1.bin\F3HKSTUB.DLL
                            C:\Program Files\MyWebSearch\bar\1.bin\MWSOESTB.DLL
                            C:\Program Files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL

                            :commands
                            [emptytemp]
                            [start explorer]


                            ---> Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved.

                            ---> Clique maintenant sur le bouton MoveIt! puis ferme OTMoveIt3.

                            Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer.
                            Accepte en cliquant sur YES.

                            ---> Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\
                            Le nom du rapport correspond au moment de sa création : date_heure.log
                            1. eucharistie Auteur
                              ========== PROCESSES ==========
                              Process explorer.exe killed successfully.
                              ========== FILES ==========
                              Folder move failed. C:\Program Files\MyWebSearch\bar\1.bin scheduled to be moved on reboot.
                              Folder move failed. C:\Program Files\MyWebSearch\bar scheduled to be moved on reboot.
                              Folder move failed. C:\Program Files\MyWebSearch scheduled to be moved on reboot.
                              Folder move failed. C:\Program Files\MyWebSearch\bar\1.bin scheduled to be moved on reboot.
                              Folder move failed. C:\Program Files\MyWebSearch\bar scheduled to be moved on reboot.
                              Folder move failed. C:\Program Files\MyWebSearch\bar\1.bin scheduled to be moved on reboot.
                              File/Folder C:\Program Files\MyWebSearch\bar\1.bin\F3HKSTUB.DLL not found.
                              File/Folder C:\Program Files\MyWebSearch\bar\1.bin\MWSOESTB.DLL not found.
                              C:\Program Files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL unregistered successfully.
                              File move failed. C:\Program Files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL scheduled to be moved on reboot.
                              ========== COMMANDS ==========
                              User's Temp folder emptied.
                              User's Internet Explorer cache folder emptied.
                              Windows Temp folder emptied.
                              Temp folders emptied.
                              Explorer started successfully

                              OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 05262009_094041
                              2. eucharistie Auteur
                                Logfile of random's system information tool 1.06 (written by random/random)
                                Run by francois at 2009-05-26 09:54:20
                                Microsoft® Windows Vista™ Édition Familiale Premium Service Pack 1
                                System drive C: has 5 GB (15%) free of 30 GB
                                Total RAM: 3063 MB (69% free)

                                Logfile of Trend Micro HijackThis v2.0.2
                                Scan saved at 09:54:35, on 26/05/2009
                                Platform: Windows Vista SP1 (WinNT 6.00.1905)
                                MSIE: Internet Explorer v7.00 (7.00.6001.18226)
                                Boot mode: Normal

                                Running processes:
                                C:\Windows\system32\Dwm.exe
                                C:\Windows\Explorer.EXE
                                C:\Windows\system32\taskeng.exe
                                C:\Windows\system32\taskeng.exe
                                C:\Windows\RtHDVCpl.exe
                                C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
                                C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
                                C:\Windows\System32\hkcmd.exe
                                C:\Windows\System32\igfxpers.exe
                                C:\Program Files\Lenovo\EnergyCut\utilty.exe
                                C:\Program Files\Lenovo\EnergyCut\EnergyCut.exe
                                C:\Program Files\Common Files\Symantec Shared\ccApp.exe
                                C:\Program Files\Lenovo\ShuttleCenter\PCMService.exe
                                C:\Program Files\Lenovo\VeriFace\PManage.exe
                                C:\Program Files\Lenovo\VeriFace\RTimeLock.exe
                                C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe
                                C:\Program Files\Windows Sidebar\sidebar.exe
                                C:\Windows\ehome\ehtray.exe
                                C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                                C:\Windows\system32\igfxsrvc.exe
                                C:\Windows\system32\wbem\unsecapp.exe
                                C:\Windows\ehome\ehmsas.exe
                                C:\Windows\system32\SearchFilterHost.exe
                                C:\Users\francois\Desktop\RSIT.exe
                                C:\Users\francois\Desktop\francois.exe

                                R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.microsoft.com/fwlink/?linkid=54896
                                R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR
                                R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
                                R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
                                R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR
                                R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
                                R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)
                                O1 - Hosts: ::1 localhost
                                O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
                                O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
                                O2 - BHO: (no name) - {2E59498D-7E44-4452-9044-0973B080B9E8} - C:\Windows\System32\winexplorer.dll
                                O2 - BHO: Windows Live Call HoverToCall class - {7E853D72-626A-48EC-A868-BA8D5E23E045} - C:\Program Files\Windows Live\Messenger\HTC.DLL
                                O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                                O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
                                O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
                                O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                                O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
                                O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                                O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
                                O4 - HKLM\..\Run: [Unattend0000000001{7CE4F652-9E84-4617-9F54-DC8891DFB725}] C:\Windows\test.bat
                                O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
                                O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
                                O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
                                O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
                                O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
                                O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
                                O4 - HKLM\..\Run: [EnergyCut_Utility] C:\Program Files\Lenovo\EnergyCut\utilty.exe
                                O4 - HKLM\..\Run: [EnergyCut] C:\Program Files\Lenovo\EnergyCut\EnergyCut.exe
                                O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
                                O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Lenovo\ShuttleCenter\PCMService.exe"
                                O4 - HKLM\..\Run: [VeriFacePassManager] C:\Program Files\Lenovo\VeriFace\PManage.exe
                                O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
                                O4 - HKLM\..\Run: [VeriFaceTimeLock] C:\Program Files\Lenovo\VeriFace\RTimeLock.exe
                                O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
                                O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
                                O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
                                O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
                                O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                                O4 - HKCU\..\Run: [Speech Recognition] "C:\Windows\Speech\Common\sapisvr.exe" -SpeechUX -Startup
                                O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
                                O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
                                O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
                                O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
                                O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
                                O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
                                O9 - Extra button: Password Administration Box - {A26ABCF0-1C8F-46e7-A67C-0489DC21B9CC} - C:\Program Files\Lenovo\VeriFace\OpenWnd.exe
                                O9 - Extra 'Tools' menuitem: Password Administration Box - {A26ABCF0-1C8F-46e7-A67C-0489DC21B9CC} - C:\Program Files\Lenovo\VeriFace\OpenWnd.exe
                                O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)
                                O13 - Gopher Prefix:
                                O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
                                O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ATK Hotkey\ASLDRSrv.exe
                                O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
                                O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
                                O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Lenovo\ShuttleCenter\Kernel\TV\CLCapSvc.exe
                                O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Lenovo\ShuttleCenter\Kernel\TV\CLSched.exe
                                O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
                                O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
                                O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                                O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe
                                O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
                                O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
                                O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
                                O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
                                O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
                                O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
                                O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
                                1. V-X
                                  Re,

                                  ---> Télécharge OTM (OldTimer) sur ton Bureau :
                                  http://oldtimer.geekstogo.com/OTMoveIt3.exe

                                  ---> Double-clique sur OTMoveIt3.exe afin de le lancer.

                                  ---> Copie (Ctrl+C) le texte suivant en gras ci-dessous :

                                  :processes
                                  explorer.exe

                                  :files
                                  C:\Program Files\MyWebSearch

                                  :Reg
                                  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks]
                                  "{00A6FAF6-072E-44cf-8957-5838F569A31D}"=-

                                  :commands
                                  [emptytemp]
                                  [start explorer]
                                  [reboot]


                                  ---> Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved.

                                  ---> Clique maintenant sur le bouton MoveIt! puis ferme OTMoveIt3.

                                  Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer.
                                  Accepte en cliquant sur YES.

                                  ---> Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\
                                  Le nom du rapport correspond au moment de sa création : date_heure.log
                                  1. eucharistie Auteur
                                    ========== PROCESSES ==========
                                    Process explorer.exe killed successfully.
                                    ========== FILES ==========
                                    Folder move failed. C:\Program Files\MyWebSearch\bar\1.bin scheduled to be moved on reboot.
                                    Folder move failed. C:\Program Files\MyWebSearch\bar scheduled to be moved on reboot.
                                    Folder move failed. C:\Program Files\MyWebSearch scheduled to be moved on reboot.
                                    ========== REGISTRY ==========
                                    Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{00A6FAF6-072E-44cf-8957-5838F569A31D} not found.
                                    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00A6FAF6-072E-44cf-8957-5838F569A31D}\ not found.
                                    ========== COMMANDS ==========
                                    User's Temp folder emptied.
                                    User's Internet Explorer cache folder emptied.
                                    Windows Temp folder emptied.
                                    Temp folders emptied.
                                    Explorer started successfully

                                    OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 05262009_100403
                                    • 1
                                    • 2

                                    Discussions similaires

                                    Infecte par un virus
                                    sapard

                                    3 réponses
                                    Mon ordinateur a été infecté par un virus ou
                                    henry4002

                                    6 réponses
                                    Supprimer Mywebsearch
                                    cram

                                    32 réponses
                                    infecté par InstantAccess
                                    mimi22

                                    22 réponses
                                    infecté par brontok
                                    yannick

                                    27 réponses