Aider moi SVP !!!!

Fix -  
 bernie61 -
SVP aider moi pour detruire "home search"
Je vous remercie infiniment.

Logfile of HijackThis v1.98.2
Scan saved at 22:21:05, on 23/11/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe
C:\Appli\Diskeep\DKService.exe
C:\WINNT\System32\svchost.exe
C:\Appli\WS_FTP Pro\ftpsched.exe
C:\PROGRA~1\Iomega\System32\ActivityDisk.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpm.exe
C:\WINNT\system32\sdkwr32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\ZipToA.exe
C:\WINNT\Explorer.EXE
C:\Appli\WS_FTP Pro\ftpqueue.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Appli\Iomega\DriveIcons\ImgIcon.exe
C:\Program Files\Windows AdControl\WinAdCtl.exe
C:\Program Files\Web_Rebates\WebRebates0.exe
C:\Program Files\Windows AdControl\WinAdAlt.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe
C:\temp\salm.exe
C:\WINNT\winnj32.exe
C:\WINNT\system32\internat.exe
C:\Program Files\Web_Rebates\WebRebates1.exe
C:\Documents and Settings\loc-admin\Mes documents\Mes images\HijackThis.exe
C:\WINNT\system32\wuauclt.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\system32\klxmj.dll/sp.html#37680
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\system32\klxmj.dll/sp.html#37680
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINNT\system32\klxmj.dll/sp.html#37680
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\system32\klxmj.dll/sp.html#37680
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\system32\klxmj.dll/sp.html#37680
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\system32\klxmj.dll/sp.html#37680
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\system32\klxmj.dll/sp.html#37680
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/keyword/%s
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ftp=proxy.univ-fcomte.fr:3128;http=proxy.univ-fcomte.fr:3128
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = <local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\appli\acroread\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {06D10056-6884-957B-2428-BA5AD5B0BAA0} - C:\WINNT\system32\javapj.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [ftpqueue] C:\Appli\WS_FTP Pro\ftpqueue.exe -tray
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [Iomega Startup Options] C:\Appli\Iomega\Common\ImgStart.exe
O4 - HKLM\..\Run: [Iomega Drive Icons] C:\Appli\Iomega\DriveIcons\ImgIcon.exe
O4 - HKLM\..\Run: [Windows AdControl] C:\Program Files\Windows AdControl\WinAdCtl.exe
O4 - HKLM\..\Run: [BullsEye Network] C:\Program Files\BullsEye Network\bin\bargains.exe
O4 - HKLM\..\Run: [WebRebates0] "C:\Program Files\Web_Rebates\WebRebates0.exe"
O4 - HKLM\..\Run: [OfficeGuard RegChecker] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\ogrc.exe"
O4 - HKLM\..\Run: [AVPCC] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe" /wait
O4 - HKLM\..\Run: [salm] c:\temp\salm.exe
O4 - HKLM\..\Run: [winnj32.exe] C:\WINNT\winnj32.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - Global Startup: FlowProtector 2005.lnk = C:\Program Files\CheckFlow\FlowProtector\FlowProtector2005.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Pages liées - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Pages similaires - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Web Rebates - file://C:\Program Files\Web_Rebates\Sy1150\Tp1150\scri1150a.htm
O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-B3F6EC39B807} - C:\Program Files\SideFind\sidefind.dll
O16 - DPF: {00000000-0000-0000-0000-000020030000} - http://www.advnt01.com/dialer/france_old.exe
O16 - DPF: {10000000-1000-0000-1000-000000000000} - file://C:\Program Files\Internet Explorer\xstnoqsi.exe
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_file.php?bt=ie&p=9eafaeb2a8e2a9518112bc6e0cedee1552dd4ecb1dd748bcf1cf4d42ced1394245b14c137e17952f3a6abadc3d36297b2b37:b70ac5aa8ec48e2e58a29296baabe1d6
O16 - DPF: {386A771C-E96A-421F-8BA7-32F1B706892F} (Installer Class) - http://www.xxxtoolbar.com/ist/softwares/v4.0/0006_regular.cab
O16 - DPF: {8EC69950-F299-40AC-A004-3BF5176F8F7B} (FlowScan Control) - http://www.checkspy.com/fr/FlowScan.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = mathst.univ-fcomte.fr
O17 - HKLM\System\CCS\Services\Tcpip\..\{02996437-9C10-4C8B-B257-2843FD0A5E70}: NameServer = 194.57.91.201,194.167.45.250
O17 - HKLM\System\CCS\Services\Tcpip\..\{1E6C8E91-8AE8-4433-847A-97FAFE80A6C1}: NameServer = 194.57.91.201,194.57.91.200
O17 - HKLM\System\CCS\Services\Tcpip\..\{6BA6C983-8CEC-4E35-A7E5-30DBDD3BF9A6}: NameServer = 194.57.91.200,194.57.91.201,172.16.2.0
O17 - HKLM\System\CCS\Services\Tcpip\..\{E69845AA-94EB-426D-B58D-357285F819D0}: NameServer = 194.57.91.200,194.57.91.201
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = mathst.univ-fcomte.fr
O17 - HKLM\System\CS1\Services\Tcpip\..\{02996437-9C10-4C8B-B257-2843FD0A5E70}: NameServer = 194.57.91.201,194.167.45.250
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = mathst.univ-fcomte.fr
O17 - HKLM\System\CS2\Services\Tcpip\..\{02996437-9C10-4C8B-B257-2843FD0A5E70}: NameServer = 194.57.91.201,194.167.45.250

1 réponse

bernie61
 
salut
résultat là
http://hijackthis.de/logfiles/59fd7215ebcb02a5092647ef45b0c41d.html

il faut désinstaller 2 pgm
Démarrer/panneauConfig/ajoutSuppressionProgrammes
et là rechercher
- Web_Rebates
- BullsEye Network

et pour chacun cliquer "modifier/supprimer"

ensuite relances HijackThis
toutes les lignes en rouges qui étaient indiquées tu COCHES
puis après avoir tout coché tu fais FIX

pour les oranges à vérifier un à un si tu connais entre autre les O17 est-ce tes connections réseau? oui y a rien à faire si NON tu coches et FIX

a+
0