Msn
joluis40 -  
Bonjour a tous!

je pense avoir été infecté par le virus: IS THIS YOU? pouvez vous m'aidez s'il vous plait?
Configuration: Windows Vista
Internet Explorer 7.0

52 réponses

Résumé de la discussion

Le fil porte sur une suspicion d'infection par le malware "IS THIS YOU?" sur un système Windows Vista avec Internet Explorer 7 et la demande d'aide pour diagnostiquer et nettoyer l'ordinateur. Plusieurs éléments de réponse proposent des outils et méthodes techniques: télécharger GenProc ou Ad-Remover, dézipper, exécuter des étapes spécifiques et générer des rapports pour analyser les fichiers infectés et les éléments malveillants. Des retours d'outils d'analyse antivirus indiquent des trojans et des adwares, notamment SweetIM et EoRezo, avec des éléments persistants dans AppData et le registre, et des rapports générés lors d'analyses complètes.

Bobot (l’IA à votre service)
  1. pimprenelle27 Contributeur sécurité
    il est toujours là celui là. bon on va faire autre chose on verra après celui là.

    Fait ceci et poste moi le rapport à la suite de la question êtes vous aider par quelqu'un, répondre oui. Merci.

    Télécharge GenProc sur ton bureau (Attention le fichier est un fichier zip)
    Dézippe le dossier, double-clique sur GenProc.bat
    En final, poste le contenu du rapport qui s'affiche.
    Comment utiliser GenProc

    Pour ceux qui ont vista, ne pas oublier de désactiver Le contrôle des comptes utilisateurs

    IMPORTANT : poste le rapport et ne fais rien d'autre pour l'instant ( souvent il faut ajouter des consignes à la manipe indiquée pour que cela fonctionne parfaitement )
    1
    1. pimprenelle27 Contributeur sécurité
      Télécharge :

      - MSNFix (!aur3n7) et décompresse-le sur le Bureau.

      Regarde bien le Tuto Ici

      Ensuite :

      Redémarre en mode sans échec comme indiqué ici ; Choisis ta session courante.

      Lance le fichier MSNFix.bat qui se trouve dans le dossier MSNfix, sur le bureau.
      - Exécute l'option R.
      - Si l'infection est détectée, exécute l'option N.
      - Sauvegarde ce rapport sur ton bureau.

      Pour ceux qui ont vista, ne pas oublier de désactiver Le contrôle des comptes utilisateurs

      Le rapport sera enregistré dans C:\Windows\ sous le nom de MSNFix

      Mais il n'y aura pas que ça à faire il faudra vérifier s'il n'y a as d'autre infection.

      0
      1. joluis40 Auteur
        j'ai essayé ta méthode mais ça ne marche pas, aurai tu un autre moyen de virer cette m.... tout mon PC commence a bugguer! merci quand meme pour ta 1°réponse.
        0
        1. pimprenelle27 Contributeur sécurité
          As tu désactivé le contrôle des compte utilisateur et redémarré ton ordi?
          0
          2. joluis40 Auteur
            re pimprenelle! j'ai bien desactivé le controle des comptes utilisateur et redemarrer mon PC, je ne suis pas un pro de l'informatique et ce virus m'agace sérieusement! !
            0
            1. pimprenelle27 Contributeur sécurité
              et ça ne marche toujours pas ?

              fait ceci :

              Pour commencer : faire un petit nettoyage de l'ordi et du registre avec Ccleaner, regarde bien le Tuto CCleaner

              Ensuite :

              Télécharge le fichier d'installation d'HijackThis.

              Enregistre HJTInstall.exe sur ton bureau.

              Renomme Hijackthis en Tutu

              Double-clique sur HJTInstall.exe (tutu) pour lancer le programme

              Par défaut, il s'installera là :
              C:\Program Files\Trend Micro\HijackThis

              Accepte la licence en cliquant sur le bouton "I Accept"

              Choisis l'option "Do a system scan and save a log file"

              Clique sur "Save log" pour enregistrer le rapport qui s'ouvrira avec le bloc-note

              Clique sur "Edition -> Sélectionner tout", puis sur "Edition -> Copier" pour copier tout le contenu du rapport

              Colle le rapport que tu viens de copier sur ce forum

              Ne fixe encore AUCUNE ligne, cela pourrait empêcher ton PC de fonctionner correctement

              Tutoriaux (ne fixe rien pour le moment !!)

              Pour ceux qui ont vista, ne pas oublier de désactiver Le contrôle des comptes utilisateurs

              0
              1. joluis40 Auteur
                je pense avoir fais ce qu'il fallait, merci de m'aider ! !

                Logfile of Trend Micro HijackThis v2.0.2
                Scan saved at 23:50:34, on 20/03/2009
                Platform: Windows Vista SP1 (WinNT 6.00.1905)
                MSIE: Internet Explorer v7.00 (7.00.6001.18000)
                Boot mode: Normal

                Running processes:
                C:\Windows\system32\Dwm.exe
                C:\Windows\Explorer.EXE
                C:\Windows\system32\taskeng.exe
                C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
                C:\Windows\System32\rundll32.exe
                C:\Program Files\HP\QuickPlay\QPService.exe
                C:\Program Files\Windows Defender\MSASCui.exe
                C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
                C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
                C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
                C:\Program Files\Java\jre6\bin\jusched.exe
                C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
                C:\Program Files\QuickTime\qttask.exe
                C:\Program Files\SweetIM\Messenger\SweetIM.exe
                C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
                C:\Program Files\Alwil Software\Avast4\ashDisp.exe
                C:\Program Files\Windows Sidebar\sidebar.exe
                C:\Windows\fxsteller.exe
                C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
                C:\Windows\ehome\ehtray.exe
                C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                C:\Program Files\Windows Media Player\wmpnscfg.exe
                C:\Program Files\OpenOffice.org 3\program\soffice.exe
                C:\Program Files\OpenOffice.org 3\program\soffice.bin
                C:\Program Files\Windows Live\Messenger\msnmsgr.exe
                C:\Windows\ehome\ehmsas.exe
                C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE
                C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
                C:\Program Files\Windows Live\Contacts\wlcomm.exe
                C:\Windows\system32\SearchFilterHost.exe
                C:\Program Files\Internet Explorer\iexplore.exe
                C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
                C:\Program Files\Windows Live\Toolbar\wltuser.exe
                c:\Users\Coyote\Downloads\HiJackThis.exe

                R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=compaq-notebook.msn.com&ocid=HPDHP&pc=CPNTDF
                R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=compaq-notebook.msn.com&ocid=HPDHP&pc=CPNTDF
                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=compaq-notebook.msn.com&ocid=HPDHP&pc=CPNTDF
                R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
                R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
                O1 - Hosts: ::1 localhost
                O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                O2 - BHO: ShoppingAdsHelper - {2C86C605-6081-D104-96F7-F765C20B22F1} - C:\Program Files\ShoppingAdsHelper\ShoppingAdsHelper-3.dll
                O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
                O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
                O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
                O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
                O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
                O2 - BHO: EoBHO - {C7B76B90-3455-4AE6-A752-EAC4D19689E5} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)
                O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
                O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
                O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
                O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
                O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
                O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
                O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\2.0"
                O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
                O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
                O4 - HKLM\..\Run: [QlbCtrl.exe] C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
                O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
                O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
                O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
                O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
                O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                O4 - HKLM\..\Run: [SweetIM] C:\Program Files\SweetIM\Messenger\SweetIM.exe
                O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
                O4 - HKLM\..\Run: [EoEngine] "C:\Program Files\EoRezo\EoEngine.exe"
                O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                O4 - HKLM\..\Run: [Windows UDP Control Center] fxsteller.exe
                O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
                O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
                O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
                O4 - HKCU\..\Run: [MsnMsgr] ~"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
                O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
                O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                O4 - HKCU\..\Run: [acxzup] "c:\users\coyote\appdata\local\acxzup.exe" acxzup
                O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
                O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
                O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
                O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
                O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
                O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
                O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
                O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
                O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
                O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
                O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
                O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
                O13 - Gopher Prefix:
                O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
                O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/resources/VistaMSNPUpldfr-fr.cab
                O16 - DPF: {588031A3-94BF-4CDD-86D0-939F6F93910F} (FixItClient Class) - https://fixit.support.microsoft.com/ActiveX/FixItClient.CAB
                O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                O23 - Service: Com4QLBEx - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
                O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
                O23 - Service: Service Google Update (gupdate1c9911b63c96fa0) (gupdate1c9911b63c96fa0) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
                O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
                O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
                O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
                O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
                O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
                O23 - Service: Recovery Service for Windows - Unknown owner - C:\Windows\SMINST\BLService.exe
                O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
                O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
                O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
                0
                1. joluis40 Auteur
                  je pense avoir fais ce qu'il fallait, merci de m'aider ! !

                  Logfile of Trend Micro HijackThis v2.0.2
                  Scan saved at 23:50:34, on 20/03/2009
                  Platform: Windows Vista SP1 (WinNT 6.00.1905)
                  MSIE: Internet Explorer v7.00 (7.00.6001.18000)
                  Boot mode: Normal

                  Running processes:
                  C:\Windows\system32\Dwm.exe
                  C:\Windows\Explorer.EXE
                  C:\Windows\system32\taskeng.exe
                  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
                  C:\Windows\System32\rundll32.exe
                  C:\Program Files\HP\QuickPlay\QPService.exe
                  C:\Program Files\Windows Defender\MSASCui.exe
                  C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
                  C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
                  C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
                  C:\Program Files\Java\jre6\bin\jusched.exe
                  C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
                  C:\Program Files\QuickTime\qttask.exe
                  C:\Program Files\SweetIM\Messenger\SweetIM.exe
                  C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
                  C:\Program Files\Alwil Software\Avast4\ashDisp.exe
                  C:\Program Files\Windows Sidebar\sidebar.exe
                  C:\Windows\fxsteller.exe
                  C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
                  C:\Windows\ehome\ehtray.exe
                  C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                  C:\Program Files\Windows Media Player\wmpnscfg.exe
                  C:\Program Files\OpenOffice.org 3\program\soffice.exe
                  C:\Program Files\OpenOffice.org 3\program\soffice.bin
                  C:\Program Files\Windows Live\Messenger\msnmsgr.exe
                  C:\Windows\ehome\ehmsas.exe
                  C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE
                  C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
                  C:\Program Files\Windows Live\Contacts\wlcomm.exe
                  C:\Windows\system32\SearchFilterHost.exe
                  C:\Program Files\Internet Explorer\iexplore.exe
                  C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
                  C:\Program Files\Windows Live\Toolbar\wltuser.exe
                  c:\Users\Coyote\Downloads\HiJackThis.exe

                  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/...
                  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/...
                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
                  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/...
                  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
                  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
                  O1 - Hosts: ::1 localhost
                  O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                  O2 - BHO: ShoppingAdsHelper - {2C86C605-6081-D104-96F7-F765C20B22F1} - C:\Program Files\ShoppingAdsHelper\ShoppingAdsHelper-3.dll
                  O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
                  O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
                  O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
                  O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
                  O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                  O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
                  O2 - BHO: EoBHO - {C7B76B90-3455-4AE6-A752-EAC4D19689E5} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)
                  O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
                  O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
                  O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
                  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
                  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
                  O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
                  O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\2.0"
                  O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
                  O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
                  O4 - HKLM\..\Run: [QlbCtrl.exe] C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
                  O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
                  O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
                  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
                  O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
                  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                  O4 - HKLM\..\Run: [SweetIM] C:\Program Files\SweetIM\Messenger\SweetIM.exe
                  O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
                  O4 - HKLM\..\Run: [EoEngine] "C:\Program Files\EoRezo\EoEngine.exe"
                  O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                  O4 - HKLM\..\Run: [Windows UDP Control Center] fxsteller.exe
                  O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
                  O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
                  O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
                  O4 - HKCU\..\Run: [MsnMsgr] ~"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
                  O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
                  O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                  O4 - HKCU\..\Run: [acxzup] "c:\users\coyote\appdata\local\acxzup.exe" acxzup
                  O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
                  O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
                  O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
                  O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
                  O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
                  O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
                  O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
                  O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                  O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                  O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
                  O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
                  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
                  O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
                  O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
                  O13 - Gopher Prefix:
                  O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
                  O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/resources/VistaMSNPUpldfr-fr.cab
                  O16 - DPF: {588031A3-94BF-4CDD-86D0-939F6F93910F} (FixItClient Class) - https://fixit.support.microsoft.com/ActiveX/FixItClient.CAB
                  O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                  O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                  O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                  O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                  O23 - Service: Com4QLBEx - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
                  O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
                  O23 - Service: Service Google Update (gupdate1c9911b63c96fa0) (gupdate1c9911b63c96fa0) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
                  O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                  O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
                  O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
                  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
                  O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
                  O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
                  O23 - Service: Recovery Service for Windows - Unknown owner - C:\Windows\SMINST\BLService.exe
                  O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
                  O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
                  O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
                  0
                  1. pimprenelle27 Contributeur sécurité
                    Alors d'abords ceci infection eozero :

                    AD-Remover : recherche

                    * Sous Vista : ▶ Désactive le contrôle des comptes utilisateurs (tu le réactiveras après ta désinfection):

                    * Clique sur Démarrer puis sur panneau de configuration
                    * Double Clique sur l'icône "Comptes d'utilisateurs"
                    * Clique ensuite sur désactiver et valide.
                    * Redémarre le PC

                    ▶ Télécharge et enregistre le fichier d installation sur ton bureau :

                    http://sd-1.archive-host.com/membres/up/16506160323759868/AD-R.exe

                    ▶ Double clique sur le programme d'installation , et installe le dans son emplacement par défaut. ( le bureau )

                    ▶ Ouvre le dossier Ad-remover présent sur ton bureau

                    ▶ Double clique sur Ad-remover.bat.

                    * Sous Vista : clic droit sur AD-Remover et sélectionner "Exécuter en tant qu'administrateur"

                    ▶ Au menu principal choisi l'option "A"

                    ▶ Poste le rapport qui apparait à la fin.

                    ( le rapport est sauvegardé aussi sous C:\Ad-report.log )

                    (CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

                    Note :

                    Process.exe est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
                    Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
                    Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.
                    0
                    1. joluis40 Auteur
                      VOILA CE QUI L'EN RESSORT :

                      ------- LOGFILE OF AD-REMOVER 1.1.1.9 | ONLY XP/VISTA -------

                      Updated by C_XX on 18/03/2009 at 21:20 - AdRemover.contact@gmail.com

                      Start at: 0:21:12, Sat 21/03/2009 | Boot mode: Normal Boot
                      Option: SCAN | Executed from: C:\Program Files\Ad-remover\Ad-remover.bat
                      Operating System: Microsoft® Windows Vista™ Home Premium Service Pack 1 (version 6.0.6001)
                      Computer Name: PC-DE-COYOTE
                      Current User: Coyote - Administrator
                      Drive(s):
                      - C:\ (File System: NTFS)
                      - D:\ (File System: NTFS)
                      System Drive: C:\
                      Windows Directory: C:\Windows\
                      System Directory: C:\Windows\System32\

                      --- Running Processes: 81

                      +-----------------| Boonty/Boonty Games Elements Found:

                      .
                      .

                      +-----------------| Eorezo Elements Found:

                      HKCR\AppID\{362A53B2-2913-4F8A-82F5-7E0A23FDC6F9}
                      HKCR\AppID\EoRezoBHO.DLL
                      HKCR\CLSID\{C7B76B90-3455-4AE6-A752-EAC4D19689E5}
                      HKCR\EoRezoBHO.EoBho
                      HKCR\EoRezoBHO.EoBho.1
                      HKCR\Typelib\{B6ACB3F1-6A83-432C-B854-3E1056F87F4E}
                      HKCU\Software\EoRezo
                      HKLM\Software\EoRezo
                      HKLM\Software\Classes\AppID\{362A53B2-2913-4F8A-82F5-7E0A23FDC6F9}
                      HKLM\Software\Classes\AppID\EoRezoBHO.DLL
                      HKLM\Software\Classes\CLSID\{C7B76B90-3455-4AE6-A752-EAC4D19689E5}
                      HKLM\Software\Classes\EoRezoBHO.EoBho
                      HKLM\Software\Classes\EoRezoBHO.EoBho.1
                      HKLM\Software\Classes\TypeLib\{B6ACB3F1-6A83-432C-B854-3E1056F87F4E}
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C7B76B90-3455-4AE6-A752-EAC4D19689E5}
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\Eoengine
                      .
                      C:\Users\Coyote\AppData\Roaming\EoRezo

                      +-----------------| Infected Poker Softwares Elements Found:

                      .

                      +-----------------| FunWebProducts/MyWay/MyWebSearch Elements Found:

                      .
                      .

                      +-----------------| It's TV Elements Found:

                      .

                      +-----------------| Sweetim Elements Found:

                      HKCR\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}
                      HKCR\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064}
                      HKCR\MediaPlayer.GraphicsUtils
                      HKCR\MediaPlayer.GraphicsUtils.1
                      HKCR\MgMediaPlayer.GifAnimator
                      HKCR\MgMediaPlayer.GifAnimator.1
                      HKCR\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}
                      HKCU\Software\SweetIM
                      HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
                      HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
                      HKLM\Software\Classes\MediaPlayer.GraphicsUtils
                      HKLM\Software\Classes\MediaPlayer.GraphicsUtils.1
                      HKLM\Software\Classes\MgMediaPlayer.GifAnimator
                      HKLM\Software\Classes\MgMediaPlayer.GifAnimator.1
                      HKLM\Software\Classes\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}
                      HKLM\Software\Classes\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}
                      HKLM\Software\Classes\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064}
                      HKLM\Software\Classes\Interface\{A439801C-961D-452C-AB42-7848E9CBD289}
                      HKLM\Software\Classes\Interface\{F4EBB1E2-21F3-4786-8CF4-16EC5925867F}
                      HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe
                      HKLM\Software\SweetIM
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\Sweetim
                      HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EEE6C35B-6118-11DC-9C72-001320C79847}
                      HKCU\Software\Microsoft\Internet Explorer\InternetRegistry\Registry\User\S-1-5-21-3160323180-1118315530-3963894545-1000\Software\Sweetim
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\07D5290CDBDAE4242926B8E6CA650501
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\08E33F7B61DEFF24BB9673ED7D467636
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\0E3D8A5B48622A445A7DF73FEFF32C3F
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\1AC67655DD68F8240B2860F2D511EBD8
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\34EDDB1BFB3A2D448845F3EFD0F15A43
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\427EA997C413D1D47907CBFC7B2DB432
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\4318DF19719275242801CBE292063A4C
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\45FC115D1FEAEF849A4E1610D6EC8BF0
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\46A5861A389ADB844AF89E31BC9DF0A1
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\49B0E1A6FF50BBE4289E4E23DE6EA0C7
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\4CCCAC049F34D0540AAC13011398BEDB
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5C4389D0BFB302C479DE4178BD5D9EBA
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5D19F074C042AD34BAB463D4175A062E
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5D2B09BDEF4FE54418E6F3373CDBC7AC
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\61B65D3397A1FBF4CB1571B5E4F6B5B0
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\68E8A05C60DD9254591DBD16C94EDDBF
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\697E782CF574CC34CBB9566440BA12BC
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\6AE27A8613CF7EA4782F2886F67295E5
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\7CE172051F585E04187BCB97570BFA74
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\86A901BA5265452499DCBF719C378EE3
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\88ABD1CD5C40EC84789A7F6EF86DAC5E
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\980289C22F80A7C4BB9323DC61255E4E
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\9A4B7EF3789F871419D9302583B20C15
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\A6C53B0F76C44004A8F36716213017DB
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\B59F2D8189784CC46A4597F2842480B0
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\BD746FB95FB8E5B45BF66BE54D5FD91F
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\CCF399FCD6D2D3F46BF02A1378654FC9
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D149C1355C98DE24E82CEFBD996FE06A
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\DB59FDB786388EA4D897F3EE715683AC
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\DB8DAD19CFBCC2049A4477183787E8C5
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E1C820A74ED67374BA048B52CB3C3804
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E337925F629CF4C4FB08F3D9674DD839
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\EC65F200D112357449C8B1BC3CFA03D0
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\F327D0C73C0973644A21E8CC852267A0
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\FA96423FE2B98E248A3B23548D1E22D9
                      .
                      C:\Windows\Installer\2b7f8c0.msi
                      C:\Program Files\SweetIM
                      C:\ProgramData\SweetIM

                      ============ Other Adwares Found ============

                      .
                      HKCR\AppID\ShoppingAdsHelper.DLL
                      HKCR\AppID\{647D5A4E-78B5-53ED-7E75-1940D1DFFEA4}
                      HKCR\CLSID\{AF56FD81-28A2-0159-4922-1211155898A9}
                      HKCR\CLSID\{2C86C605-6081-D104-96F7-F765C20B22F1}
                      HKCR\CLSID\{913E9215-EB81-7E43-76E6-FC26E50E264C}
                      HKCR\Interface\{2003E25F-91DA-7AC2-239B-A263B7D2441B}
                      HKCR\Interface\{8DC03F36-EFED-89C0-3C14-469B513E5651}
                      HKCR\Interface\{B00F1048-6A9F-DAA3-5103-5DCFA3E4719A}
                      HKCR\ShoppingAdsHelper.BrowserWatcher
                      HKCR\ShoppingAdsHelper.BrowserWatcher.1
                      HKCR\ShoppingAdsHelper.PornPro_BHO
                      HKCR\ShoppingAdsHelper.PornPro_BHO.1
                      HKCR\ShoppingAdsHelper.PrecacheBrowserHost
                      HKCR\ShoppingAdsHelper.PrecacheBrowserHost.1
                      HKCR\TypeLib\{A9FC1C11-B511-D9B9-0E29-01A8D05AE107}
                      HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2C86C605-6081-D104-96f7-F765C20b22F1}
                      HKCU\Software\ShoppingAdsHelper
                      HKLM\Software\Classes\AppID\ShoppingAdsHelper.DLL
                      HKLM\Software\Classes\AppID\{647D5A4E-78B5-53ED-7E75-1940D1DFFEA4}
                      HKLM\Software\Classes\CLSID\{AF56FD81-28A2-0159-4922-1211155898A9}
                      HKLM\Software\Classes\CLSID\{2C86C605-6081-D104-96F7-F765C20B22F1}
                      HKLM\Software\Classes\CLSID\{913E9215-EB81-7E43-76E6-FC26E50E264C}
                      HKLM\Software\Classes\Interface\{2003E25F-91DA-7AC2-239B-A263B7D2441B}
                      HKLM\Software\Classes\Interface\{8DC03F36-EFED-89C0-3C14-469B513E5651}
                      HKLM\Software\Classes\Interface\{B00F1048-6A9F-DAA3-5103-5DCFA3E4719A}
                      HKLM\Software\Classes\ShoppingAdsHelper.BrowserWatcher
                      HKLM\Software\Classes\ShoppingAdsHelper.BrowserWatcher.1
                      HKLM\Software\Classes\ShoppingAdsHelper.PornPro_BHO
                      HKLM\Software\Classes\ShoppingAdsHelper.PornPro_BHO.1
                      HKLM\Software\Classes\ShoppingAdsHelper.PrecacheBrowserHost
                      HKLM\Software\Classes\ShoppingAdsHelper.PrecacheBrowserHost.1
                      HKLM\Software\Classes\TypeLib\{A9FC1C11-B511-D9B9-0E29-01A8D05AE107}
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2C86C605-6081-D104-96F7-F765C20B22F1}
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\PlayMP3
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\ShoppingAdsHelper
                      .
                      C:\Program Files\ShoppingAdsHelper

                      +-----------------| Added Scan:

                      ---- Internet Explorer Version 7.0.6001.18000 ----

                      +-[HKEY_CURRENT_USER\..\Internet Explorer\Main]

                      Default_Page_URL: hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fr_fr&c=83&bd=Presario&pf=cnnb
                      Default_Search_URL: hxxp://www.google.com/ie
                      Search bar: hxxp://www.google.com/ie
                      Search Page: hxxp://www.google.com
                      Start page: hxxp://www.google.fr/

                      +-[HKEY_USERS\S-1-5-21-3160323180-1118315530-3963894545-1000\..\Internet Explorer\Main]

                      Default_Page_URL: hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fr_fr&c=83&bd=Presario&pf=cnnb
                      Default_Search_URL: hxxp://www.google.com/ie
                      Search bar: hxxp://www.google.com/ie
                      Search Page: hxxp://www.google.com
                      Start page: hxxp://www.google.fr/

                      +-[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

                      Default_Page_URL: hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fr_fr&c=83&bd=Presario&pf=cnnb
                      Default_Search_URL: hxxp://go.microsoft.com/fwlink/?LinkId=54896
                      Search Page: hxxp://go.microsoft.com/fwlink/?LinkId=54896
                      Start page: hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fr_fr&c=83&bd=Presario&pf=cnnb

                      +-[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

                      Tabs: hxxp://y.lo.st

                      +---------------------------------------------------------------------------+

                      11119 Byte(s) - C:\Ad-Report-Scan-21.03.2009.log

                      0 File(s) - C:\Program Files\Ad-remover\TOOLS\BACKUP
                      0 File(s) - C:\Program Files\Ad-remover\TOOLS\QUARANTINE

                      End at: 0:25:19 | 21/03/2009
                      .
                      +-----------------| E.O.F - 169 Lines
                      .
                      0
                      1. x-file
                        ok,relance adremover et choisis option b (nettoiage) ensuite coche 2 et 6 ensuite s pour suprime
                        0
                    2. pimprenelle27 Contributeur sécurité
                      Merci de ton aide mais pas besoin.

                      AD-Remover : nettoyage

                      ! Déconnectes toi et fermes toutes applications en cours !

                      ● Relances "Ad-remover" : au menu principal choisi l'option "B" .

                      ● Coche à l'écran de sélection :

                      1. Suppression Boonty/BoontyGames
                      2. Suppression Eorezo
                      3. Suppression Everest Poker
                      4. Suppression Funwebproduct/MyWay/MyWebsearch
                      5. Suppression It's TV
                      6. Suppression Sweetim
                      7. Suppression autres adwares

                      ● Tape le chiffre correspondant à la suppression demandée et valide par ENTER pour le cocher.

                      ● Puis choisi "S" , le programme va travailler,

                      ● Postes le rapport qui apparait à la fin.

                      ( le rapport est sauvegardé aussi sous C:\Ad-report(date).log )

                      (CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

                      /!\ Si le Bureau ne réapparait pas presse Ctrl + Alt + Suppr , Onglet "Fichier" , "Nouvelle tâche" , tapes explorer.exe et valides)

                      PS : ne mettre que les suppressions nécessaires !!
                      0
                      1. joluis40 Auteur
                        VOILA :
                        ------- LOGFILE OF AD-REMOVER 1.1.1.9 | ONLY XP/VISTA -------

                        Updated by C_XX on 18/03/2009 at 21:20 - AdRemover.contact@gmail.com

                        **** LIMITED TO ****

                        Boonty/BoontyGames
                        Eorezo
                        Infected Poker Softwares
                        FunWebProduct/MyWay/MyWebSearch
                        It's TV
                        Sweetim
                        Other Adwares

                        ********************

                        Start at: 0:55:21, Sat 21/03/2009 | Boot mode: Normal Boot
                        Option: CLEAN | Executed from: C:\Program Files\Ad-remover\Ad-remover.bat
                        Operating System: Microsoft® Windows Vista™ Home Premium Service Pack 1 (version 6.0.6001)
                        Computer Name: PC-DE-COYOTE
                        Current User: Coyote - Administrator
                        Drive(s):
                        - C:\ (File System: NTFS)
                        - D:\ (File System: NTFS)
                        System Drive: C:\
                        Windows Directory: C:\Windows\
                        System Directory: C:\Windows\System32\

                        --- Running Processes: 75

                        (!) ---- IE start pages/Tabs reset

                        +-----------------| Boonty/Boonty Games Elements Deleted :

                        .
                        .

                        +-----------------| Eorezo Elements Deleted :

                        HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\Eoengine
                        HKCR\AppID\{362A53B2-2913-4F8A-82F5-7E0A23FDC6F9}
                        HKCR\AppID\EoRezoBHO.DLL
                        HKCR\CLSID\{C7B76B90-3455-4AE6-A752-EAC4D19689E5}
                        HKCR\EoRezoBHO.EoBho
                        HKCR\EoRezoBHO.EoBho.1
                        HKCR\Typelib\{B6ACB3F1-6A83-432C-B854-3E1056F87F4E}
                        HKCU\Software\EoRezo
                        HKLM\Software\EoRezo
                        HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C7B76B90-3455-4AE6-A752-EAC4D19689E5}
                        .
                        C:\Users\Coyote\AppData\Roaming\EoRezo

                        +-----------------| Infected Poker Softwares Elements Deleted :

                        .

                        +-----------------| FunWebProducts/MyWay/MyWebSearch Elements Deleted :

                        .
                        .

                        +-----------------| It's TV Elements Deleted :

                        .

                        +-----------------| Sweetim Elements Deleted :

                        HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\Sweetim
                        HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EEE6C35B-6118-11DC-9C72-001320C79847}
                        HKCU\Software\Microsoft\Internet Explorer\Internetregistry\Registry\User\S-1-5-21-3160323180-1118315530-3963894545-1000\Software\Sweetim
                        HKCR\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}
                        HKCR\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064}
                        HKCR\MediaPlayer.GraphicsUtils
                        HKCR\MediaPlayer.GraphicsUtils.1
                        HKCR\MgMediaPlayer.GifAnimator
                        HKCR\MgMediaPlayer.GifAnimator.1
                        HKCR\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}
                        HKCU\Software\SweetIM
                        HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
                        HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
                        HKLM\Software\Classes\Interface\{A439801C-961D-452C-AB42-7848E9CBD289}
                        HKLM\Software\Classes\Interface\{F4EBB1E2-21F3-4786-8CF4-16EC5925867F}
                        HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe
                        HKLM\Software\SweetIM
                        HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\07D5290CDBDAE4242926B8E6CA650501
                        HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\08E33F7B61DEFF24BB9673ED7D467636
                        HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\0E3D8A5B48622A445A7DF73FEFF32C3F
                        HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\1AC67655DD68F8240B2860F2D511EBD8
                        HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536
                        HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\34EDDB1BFB3A2D448845F3EFD0F15A43
                        HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\427EA997C413D1D47907CBFC7B2DB432
                        HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\4318DF19719275242801CBE292063A4C
                        HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\45FC115D1FEAEF849A4E1610D6EC8BF0
                        HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\46A5861A389ADB844AF89E31BC9DF0A1
                        HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\49B0E1A6FF50BBE4289E4E23DE6EA0C7
                        HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\4CCCAC049F34D0540AAC13011398BEDB
                        HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5C4389D0BFB302C479DE4178BD5D9EBA
                        HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5D19F074C042AD34BAB463D4175A062E
                        HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5D2B09BDEF4FE54418E6F3373CDBC7AC
                        HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\61B65D3397A1FBF4CB1571B5E4F6B5B0
                        HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\68E8A05C60DD9254591DBD16C94EDDBF
                        HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\697E782CF574CC34CBB9566440BA12BC
                        HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\6AE27A8613CF7EA4782F2886F67295E5
                        HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\7CE172051F585E04187BCB97570BFA74
                        HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\86A901BA5265452499DCBF719C378EE3
                        HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\88ABD1CD5C40EC84789A7F6EF86DAC5E
                        HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\980289C22F80A7C4BB9323DC61255E4E
                        HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\9A4B7EF3789F871419D9302583B20C15
                        HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\A6C53B0F76C44004A8F36716213017DB
                        HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\B59F2D8189784CC46A4597F2842480B0
                        HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\BD746FB95FB8E5B45BF66BE54D5FD91F
                        HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\CCF399FCD6D2D3F46BF02A1378654FC9
                        HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D149C1355C98DE24E82CEFBD996FE06A
                        HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\DB59FDB786388EA4D897F3EE715683AC
                        HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\DB8DAD19CFBCC2049A4477183787E8C5
                        HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E1C820A74ED67374BA048B52CB3C3804
                        HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E337925F629CF4C4FB08F3D9674DD839
                        HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\EC65F200D112357449C8B1BC3CFA03D0
                        HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\F327D0C73C0973644A21E8CC852267A0
                        HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\FA96423FE2B98E248A3B23548D1E22D9
                        .
                        C:\Windows\Installer\2b7f8c0.msi
                        /!\ NOT DELETED - C:\Program Files\SweetIM
                        /!\ NOT DELETED - C:\Program Files\SweetIM\Messenger
                        /!\ NOT DELETED - C:\Program Files\SweetIM\Messenger\mgAdaptersProxy.dll
                        /!\ NOT DELETED - C:\Program Files\SweetIM\Messenger\msvcr71.dll
                        C:\ProgramData\SweetIM

                        ============ Other Adwares Deleted ============

                        .
                        HKCR\AppID\ShoppingAdsHelper.DLL
                        HKCR\AppID\{647D5A4E-78B5-53ED-7E75-1940D1DFFEA4}
                        HKCR\CLSID\{AF56FD81-28A2-0159-4922-1211155898A9}
                        HKCR\CLSID\{2C86C605-6081-D104-96F7-F765C20B22F1}
                        HKCR\CLSID\{913E9215-EB81-7E43-76E6-FC26E50E264C}
                        HKCR\Interface\{2003E25F-91DA-7AC2-239B-A263B7D2441B}
                        HKCR\Interface\{8DC03F36-EFED-89C0-3C14-469B513E5651}
                        HKCR\Interface\{B00F1048-6A9F-DAA3-5103-5DCFA3E4719A}
                        HKCR\ShoppingAdsHelper.BrowserWatcher
                        HKCR\ShoppingAdsHelper.BrowserWatcher.1
                        HKCR\ShoppingAdsHelper.PornPro_BHO
                        HKCR\ShoppingAdsHelper.PornPro_BHO.1
                        HKCR\ShoppingAdsHelper.PrecacheBrowserHost
                        HKCR\ShoppingAdsHelper.PrecacheBrowserHost.1
                        HKCR\TypeLib\{A9FC1C11-B511-D9B9-0E29-01A8D05AE107}
                        HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2C86C605-6081-D104-96f7-F765C20b22F1}
                        HKCU\Software\ShoppingAdsHelper
                        HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2C86C605-6081-D104-96F7-F765C20B22F1}
                        HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\PlayMP3
                        HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\ShoppingAdsHelper
                        .
                        C:\Program Files\ShoppingAdsHelper

                        (!) ---- Temp files deleted.
                        (!) ---- Recycle bin emptied in all drives.

                        ************* /!\ FILE(S)/FOLDER(S) NOT DELETED /!\ *************

                        "C:\Program Files\SweetIM\Messenger"
                        "C:\Program Files\SweetIM\Messenger\mgAdaptersProxy.dll"
                        "C:\Program Files\SweetIM\Messenger\msvcr71.dll"

                        Second run ...

                        /!\ RESIST ! - "C:\Program Files\SweetIM\Messenger"
                        /!\ RESIST ! - "C:\Program Files\SweetIM\Messenger\mgAdaptersProxy.dll"
                        /!\ RESIST ! - "C:\Program Files\SweetIM\Messenger\msvcr71.dll"

                        +-----------------| Added Scan :

                        ---- Internet Explorer Version 7.0.6001.18000 ----

                        +-[HKEY_CURRENT_USER\..\Internet Explorer\Main]

                        Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
                        Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                        Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
                        Search Page: hxxp://www.google.com
                        Start page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

                        +-[HKEY_USERS\S-1-5-21-3160323180-1118315530-3963894545-1000\..\Internet Explorer\Main]

                        Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
                        Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                        Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
                        Search Page: hxxp://www.google.com
                        Start page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

                        +-[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

                        Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
                        Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                        Search bar: hxxp://search.msn.com/spbasic.htm
                        Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                        Start page: hxxp://fr.msn.com/

                        +-[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

                        Tabs: hxxp://ieframe.dll/tabswelcome.htm

                        +---------------------------------------------------------------------------+

                        10538 Byte(s) - C:\Ad-Report-Clean-21.03.2009.log
                        11361 Byte(s) - C:\Ad-Report-Scan-21.03.2009.log

                        0 File(s) - C:\Program Files\Ad-remover\TOOLS\BACKUP
                        1 File(s) - C:\Program Files\Ad-remover\TOOLS\QUARANTINE

                        End at: 0:59:35 | 21/03/2009
                        .
                        +-----------------| E.O.F - 165 Lines
                        .
                        0
                        1. pimprenelle27 Contributeur sécurité
                          Il faut que tu refasse l'option b et que tu sélectionne SweetIM car il n'a pas été supprimé.

                          /!\ NOT DELETED - C:\Program Files\SweetIM
                          /!\ NOT DELETED - C:\Program Files\SweetIM\Messenger
                          /!\ NOT DELETED - C:\Program Files\SweetIM\Messenger\mgAdaptersProxy.dll
                          /!\ NOT DELETED - C:\Program Files\SweetIM\Messenger\msvcr71.dll
                          0
                          1. joluis40 Auteur
                            JE VIENS DE SUPRIMER SWEETIM.

                            ------- LOGFILE OF AD-REMOVER 1.1.1.9 | ONLY XP/VISTA -------

                            Updated by C_XX on 18/03/2009 at 21:20 - AdRemover.contact@gmail.com

                            **** LIMITED TO ****

                            Sweetim

                            ********************

                            Start at: 10:53:30, Sat 21/03/2009 | Boot mode: Normal Boot
                            Option: CLEAN | Executed from: C:\Program Files\Ad-remover\Ad-remover.bat
                            Operating System: Microsoft® Windows Vista™ Home Premium Service Pack 1 (version 6.0.6001)
                            Computer Name: PC-DE-COYOTE
                            Current User: Coyote - Administrator
                            Drive(s):
                            - C:\ (File System: NTFS)
                            - D:\ (File System: NTFS)
                            System Drive: C:\
                            Windows Directory: C:\Windows\
                            System Directory: C:\Windows\System32\

                            --- Running Processes: 79

                            (!) ---- IE start pages/Tabs reset

                            +-----------------| Sweetim Elements Deleted :

                            .
                            /!\ NOT DELETED - C:\Program Files\SweetIM
                            /!\ NOT DELETED - C:\Program Files\SweetIM\Messenger
                            /!\ NOT DELETED - C:\Program Files\SweetIM\Messenger\mgAdaptersProxy.dll
                            /!\ NOT DELETED - C:\Program Files\SweetIM\Messenger\msvcr71.dll

                            (!) ---- Temp files deleted.
                            (!) ---- Recycle bin emptied in all drives.

                            ************* /!\ FILE(S)/FOLDER(S) NOT DELETED /!\ *************

                            "C:\Program Files\SweetIM\Messenger"
                            "C:\Program Files\SweetIM\Messenger\mgAdaptersProxy.dll"
                            "C:\Program Files\SweetIM\Messenger\msvcr71.dll"

                            Second run ...

                            /!\ RESIST ! - "C:\Program Files\SweetIM\Messenger"
                            /!\ RESIST ! - "C:\Program Files\SweetIM\Messenger\mgAdaptersProxy.dll"
                            /!\ RESIST ! - "C:\Program Files\SweetIM\Messenger\msvcr71.dll"

                            +-----------------| Added Scan :

                            ---- Internet Explorer Version 7.0.6001.18000 ----

                            +-[HKEY_CURRENT_USER\..\Internet Explorer\Main]

                            Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
                            Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                            Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
                            Search Page: hxxp://www.google.com
                            Start page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

                            +-[HKEY_USERS\S-1-5-21-3160323180-1118315530-3963894545-1000\..\Internet Explorer\Main]

                            Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
                            Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                            Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
                            Search Page: hxxp://www.google.com
                            Start page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

                            +-[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

                            Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
                            Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                            Search bar: hxxp://search.msn.com/spbasic.htm
                            Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                            Start page: hxxp://fr.msn.com/

                            +-[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

                            Tabs: hxxp://ieframe.dll/tabswelcome.htm

                            +---------------------------------------------------------------------------+

                            2995 Byte(s) - C:\Ad-Report-Clean-21.03.2009.log
                            11361 Byte(s) - C:\Ad-Report-Scan-21.03.2009.log

                            0 File(s) - C:\Program Files\Ad-remover\TOOLS\BACKUP
                            1 File(s) - C:\Program Files\Ad-remover\TOOLS\QUARANTINE

                            End at: 10:55:19 | 21/03/2009
                            .
                            +-----------------| E.O.F - 57 Lines
                            .
                            0
                            1. pimprenelle27 Contributeur sécurité
                              Toujours /!\ NOT DELETED - C:\Program Files\SweetIM
                              /!\ NOT DELETED - C:\Program Files\SweetIM\Messenger
                              /!\ NOT DELETED - C:\Program Files\SweetIM\Messenger\mgAdaptersProxy.dll
                              /!\ NOT DELETED - C:\Program Files\SweetIM\Messenger\msvcr71.dll

                              Je comprend pas refait moi un scan option A. Merci.
                              0
                              1. joluis40 Auteur
                                Voila le rapport du scan :
                                ------- LOGFILE OF AD-REMOVER 1.1.1.9 | ONLY XP/VISTA -------

                                Updated by C_XX on 18/03/2009 at 21:20 - AdRemover.contact@gmail.com

                                Start at: 11:01:26, Sat 21/03/2009 | Boot mode: Normal Boot
                                Option: SCAN | Executed from: C:\Program Files\Ad-remover\Ad-remover.bat
                                Operating System: Microsoft® Windows Vista™ Home Premium Service Pack 1 (version 6.0.6001)
                                Computer Name: PC-DE-COYOTE
                                Current User: Coyote - Administrator
                                Drive(s):
                                - C:\ (File System: NTFS)
                                - D:\ (File System: NTFS)
                                System Drive: C:\
                                Windows Directory: C:\Windows\
                                System Directory: C:\Windows\System32\

                                --- Running Processes: 78

                                +-----------------| Boonty/Boonty Games Elements Found:

                                .
                                .

                                +-----------------| Eorezo Elements Found:

                                .

                                +-----------------| Infected Poker Softwares Elements Found:

                                .

                                +-----------------| FunWebProducts/MyWay/MyWebSearch Elements Found:

                                .
                                .

                                +-----------------| It's TV Elements Found:

                                .

                                +-----------------| Sweetim Elements Found:

                                .
                                C:\Program Files\SweetIM

                                ============ Other Adwares Found ============

                                .
                                .
                                C:\Users\Coyote\AppData\Roaming\Microsoft\Windows\Cookies\coyote@atdmt[2].txt
                                C:\Users\Coyote\AppData\Roaming\Microsoft\Windows\Cookies\coyote@bs.serving-sys[1].txt

                                +-----------------| Added Scan:

                                ---- Internet Explorer Version 7.0.6001.18000 ----

                                +-[HKEY_CURRENT_USER\..\Internet Explorer\Main]

                                Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
                                Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                                Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
                                Search Page: hxxp://www.google.com
                                Start page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

                                +-[HKEY_USERS\S-1-5-21-3160323180-1118315530-3963894545-1000\..\Internet Explorer\Main]

                                Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
                                Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                                Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
                                Search Page: hxxp://www.google.com
                                Start page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

                                +-[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

                                Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
                                Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                                Search bar: hxxp://search.msn.com/spbasic.htm
                                Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                                Start page: hxxp://fr.msn.com/

                                +-[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

                                Tabs: hxxp://ieframe.dll/tabswelcome.htm

                                +---------------------------------------------------------------------------+

                                3286 Byte(s) - C:\Ad-Report-Clean-21.03.2009.log
                                2764 Byte(s) - C:\Ad-Report-Scan-21.03.2009.log

                                0 File(s) - C:\Program Files\Ad-remover\TOOLS\BACKUP
                                1 File(s) - C:\Program Files\Ad-remover\TOOLS\QUARANTINE

                                End at: 11:08:47 | 21/03/2009
                                .
                                +-----------------| E.O.F - 57 Lines
                                .
                                0
                                1. pimprenelle27 Contributeur sécurité
                                  il est toujours là C:\Program Files\SweetIM

                                  Tu peux refaire une dernière fois l'option b.
                                  0
                                  1. joluis40 Auteur
                                    Voila le dernier rapport :

                                    ------- LOGFILE OF AD-REMOVER 1.1.1.9 | ONLY XP/VISTA -------

                                    Updated by C_XX on 18/03/2009 at 21:20 - AdRemover.contact@gmail.com

                                    **** LIMITED TO ****

                                    Other Adwares

                                    ********************

                                    Start at: 11:37:05, Sat 21/03/2009 | Boot mode: Normal Boot
                                    Option: CLEAN | Executed from: C:\Program Files\Ad-remover\Ad-remover.bat
                                    Operating System: Microsoft® Windows Vista™ Home Premium Service Pack 1 (version 6.0.6001)
                                    Computer Name: PC-DE-COYOTE
                                    Current User: Coyote - Administrator
                                    Drive(s):
                                    - C:\ (File System: NTFS)
                                    - D:\ (File System: NTFS)
                                    System Drive: C:\
                                    Windows Directory: C:\Windows\
                                    System Directory: C:\Windows\System32\

                                    --- Running Processes: 75

                                    (!) ---- IE start pages/Tabs reset

                                    ============ Other Adwares Deleted ============

                                    .
                                    .
                                    C:\Users\Coyote\AppData\Roaming\Microsoft\Windows\Cookies\coyote@atdmt[2].txt
                                    C:\Users\Coyote\AppData\Roaming\Microsoft\Windows\Cookies\coyote@bs.serving-sys[1].txt

                                    (!) ---- Temp files deleted.
                                    (!) ---- Recycle bin emptied in all drives.

                                    +-----------------| Added Scan :

                                    ---- Internet Explorer Version 7.0.6001.18000 ----

                                    +-[HKEY_CURRENT_USER\..\Internet Explorer\Main]

                                    Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
                                    Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                                    Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
                                    Search Page: hxxp://www.google.com
                                    Start page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

                                    +-[HKEY_USERS\S-1-5-21-3160323180-1118315530-3963894545-1000\..\Internet Explorer\Main]

                                    Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
                                    Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                                    Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
                                    Search Page: hxxp://www.google.com
                                    Start page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

                                    +-[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

                                    Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
                                    Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                                    Search bar: hxxp://search.msn.com/spbasic.htm
                                    Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                                    Start page: hxxp://fr.msn.com/

                                    +-[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

                                    Tabs: hxxp://ieframe.dll/tabswelcome.htm

                                    +---------------------------------------------------------------------------+

                                    2501 Byte(s) - C:\Ad-Report-Clean-21.03.2009.log
                                    3004 Byte(s) - C:\Ad-Report-Scan-21.03.2009.log

                                    0 File(s) - C:\Program Files\Ad-remover\TOOLS\BACKUP
                                    3 File(s) - C:\Program Files\Ad-remover\TOOLS\QUARANTINE

                                    End at: 11:42:26 | 21/03/2009
                                    .
                                    +-----------------| E.O.F - 48 Lines
                                    .
                                    0
                                    1. pimprenelle27 Contributeur sécurité
                                      tu as bien sélectionné sweetim? refait moi le scan option A pour voir si c'est ok.
                                      0
                                      1. joluis40 Auteur
                                        VOILA,
                                        ------- LOGFILE OF AD-REMOVER 1.1.1.9 | ONLY XP/VISTA -------

                                        Updated by C_XX on 18/03/2009 at 21:20 - AdRemover.contact@gmail.com

                                        Start at: 11:50:07, Sat 21/03/2009 | Boot mode: Normal Boot
                                        Option: SCAN | Executed from: C:\Program Files\Ad-remover\Ad-remover.bat
                                        Operating System: Microsoft® Windows Vista™ Home Premium Service Pack 1 (version 6.0.6001)
                                        Computer Name: PC-DE-COYOTE
                                        Current User: Coyote - Administrator
                                        Drive(s):
                                        - C:\ (File System: NTFS)
                                        - D:\ (File System: NTFS)
                                        System Drive: C:\
                                        Windows Directory: C:\Windows\
                                        System Directory: C:\Windows\System32\

                                        --- Running Processes: 80

                                        +-----------------| Boonty/Boonty Games Elements Found:

                                        .
                                        .

                                        +-----------------| Eorezo Elements Found:

                                        .

                                        +-----------------| Infected Poker Softwares Elements Found:

                                        .

                                        +-----------------| FunWebProducts/MyWay/MyWebSearch Elements Found:

                                        .
                                        .

                                        +-----------------| It's TV Elements Found:

                                        .

                                        +-----------------| Sweetim Elements Found:

                                        .
                                        C:\Program Files\SweetIM

                                        ============ Other Adwares Found ============

                                        .
                                        .
                                        C:\Users\Coyote\AppData\Local\Temp\TMP738C.tmp
                                        C:\Users\Coyote\AppData\Roaming\Microsoft\Windows\Cookies\coyote@atdmt[2].txt
                                        C:\Users\Coyote\AppData\Roaming\Microsoft\Windows\Cookies\coyote@bs.serving-sys[1].txt

                                        +-----------------| Added Scan:

                                        ---- Internet Explorer Version 7.0.6001.18000 ----

                                        +-[HKEY_CURRENT_USER\..\Internet Explorer\Main]

                                        Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
                                        Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                                        Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
                                        Search Page: hxxp://www.google.com
                                        Start page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

                                        +-[HKEY_USERS\S-1-5-21-3160323180-1118315530-3963894545-1000\..\Internet Explorer\Main]

                                        Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
                                        Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                                        Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
                                        Search Page: hxxp://www.google.com
                                        Start page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

                                        +-[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

                                        Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
                                        Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                                        Search bar: hxxp://search.msn.com/spbasic.htm
                                        Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                                        Start page: hxxp://fr.msn.com/

                                        +-[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

                                        Tabs: hxxp://ieframe.dll/tabswelcome.htm

                                        +---------------------------------------------------------------------------+

                                        2791 Byte(s) - C:\Ad-Report-Clean-21.03.2009.log
                                        2813 Byte(s) - C:\Ad-Report-Scan-21.03.2009.log

                                        0 File(s) - C:\Program Files\Ad-remover\TOOLS\BACKUP
                                        3 File(s) - C:\Program Files\Ad-remover\TOOLS\QUARANTINE

                                        End at: 11:57:27 | 21/03/2009
                                        .
                                        +-----------------| E.O.F - 58 Lines
                                        .
                                        0
                                        • 1
                                        • 2
                                        • 3

                                        Discussions similaires

                                        symboles et écritures pour nick msn
                                        Pando

                                        20 réponses
                                        msn + ☺(symbole)
                                        m0ii

                                        19 réponses
                                        Comment insérer correctement des caractères spéciaux ou émojis ?
                                        Lia

                                        45 réponses