Banniere/virus resiste a ad-aware et autres
axel
-
gbinforme Messages postés 14930 Date d'inscription Statut Contributeur Dernière intervention -
gbinforme Messages postés 14930 Date d'inscription Statut Contributeur Dernière intervention -
salut all
http://540.scmg.net/randomsites/banner.aspx
Voila deske je lance internet explorer, une page s'ouvre sous ce nom en plus de ma page de démarage.C'est souvent une page x (free6) ou un site ( ki ma l air bidon) de ebay.Ces pages se lancent régulièrement, quasiment a chaque fois que je change de site.
Jai essayé antivirus, anti trojans en ligne, netoyer temporary internet files , historiques , regedit ..etc.
La seul soloution ke qui semble marcher je lai vu sur uns ite américain mais jai pas tro compris vu que les instructions s'appliquent pour la versione n anglais de windows.
Il s'agissait d'utiliser hijackthis et denlever certaines lignes au check : vu ke jetai pas tro sur d emon coup jai préféré pa y toucher/
merci de maider, je vou donne si dessous la page oujaitrouvé une aide :
lemec kidemandai aide:
Hi there Simon,
I installed the latest version of Ad-Aware and ran it to clean up a few things. I got the latest version of HijackThis and ran it giving me the following logfile
Logfile of HijackThis v1.98.2
Scan saved at 21:39:47, on 29/11/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\atievxx.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe
C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
C:\Program Files\iRiver\iHP100\iHPDetect.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Dell AIO Printer A920\dlbkbmon.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_server.exe
C:\WINDOWS\system32\qttask.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\MMDiag.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Homer\Desktop\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://home.oceanfree.net
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ie/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = http://localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [Dell AIO Printer A920] "C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe"
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [iHP-100] C:\Program Files\iRiver\iHP100\iHPDetect.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [mm_server] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_server.exe
O4 - HKLM\..\Run: [QuickTime Task] C:\WINDOWS\system32\qttask.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/...bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/...n/bin/cabsa.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{75E74DD1-B5A2-4E0A-838B-C4740462C26A}: NameServer = 157.190.100.10
O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34545} - C:\WINDOWS\System32\vbsys2 (file missing)
le mec ki la aidé
Hi again, sorry it took so long to get back to you, my internet was playing up the other night! (crazy)
Make sure that you're system restore is still turned off.
Print these instructions, or copy them to notepad and save. This will make the job of cleaning up a lot easier.
You will need to reset your homepage in “Internet Options” after completing this procedure. This is normal
Open the “Task Manager” (ctrl + alt + del) and end these processes:
vbsys2.exe (if running)
Now run “HijackThis!” and put a check by these entries. Be careful not to check the wrong box:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = <http://home.oceanfree.net>
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = <http://www.google.ie/>
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = <http://localhost>
O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34545} - C:\WINDOWS\System32\vbsys2 (file missing)
Now, restart your computer.
Click start,
right click 'internet explorer and select 'internet properties'
Now, reset your homepage to whatever you want,
and hit the buttons: "delete cookies..." and "delete files..."
Restart your computer again, and that should have resolved the prob!
Run "MSconfig" again,
to do this, click "Start" >> "Run" and type “msconfig”.
Select "normal startup" then go to these tabs: "services" and "startup", and make sure that all the boxes are checked.
Restart your system and post another log, so I can make sure we got everything.
I hope this kills the problem! (flame)
http://540.scmg.net/randomsites/banner.aspx
Voila deske je lance internet explorer, une page s'ouvre sous ce nom en plus de ma page de démarage.C'est souvent une page x (free6) ou un site ( ki ma l air bidon) de ebay.Ces pages se lancent régulièrement, quasiment a chaque fois que je change de site.
Jai essayé antivirus, anti trojans en ligne, netoyer temporary internet files , historiques , regedit ..etc.
La seul soloution ke qui semble marcher je lai vu sur uns ite américain mais jai pas tro compris vu que les instructions s'appliquent pour la versione n anglais de windows.
Il s'agissait d'utiliser hijackthis et denlever certaines lignes au check : vu ke jetai pas tro sur d emon coup jai préféré pa y toucher/
merci de maider, je vou donne si dessous la page oujaitrouvé une aide :
lemec kidemandai aide:
Hi there Simon,
I installed the latest version of Ad-Aware and ran it to clean up a few things. I got the latest version of HijackThis and ran it giving me the following logfile
Logfile of HijackThis v1.98.2
Scan saved at 21:39:47, on 29/11/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\atievxx.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe
C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
C:\Program Files\iRiver\iHP100\iHPDetect.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Dell AIO Printer A920\dlbkbmon.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_server.exe
C:\WINDOWS\system32\qttask.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\MMDiag.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Homer\Desktop\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://home.oceanfree.net
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ie/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = http://localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [Dell AIO Printer A920] "C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe"
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [iHP-100] C:\Program Files\iRiver\iHP100\iHPDetect.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [mm_server] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_server.exe
O4 - HKLM\..\Run: [QuickTime Task] C:\WINDOWS\system32\qttask.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/...bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/...n/bin/cabsa.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{75E74DD1-B5A2-4E0A-838B-C4740462C26A}: NameServer = 157.190.100.10
O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34545} - C:\WINDOWS\System32\vbsys2 (file missing)
le mec ki la aidé
Hi again, sorry it took so long to get back to you, my internet was playing up the other night! (crazy)
Make sure that you're system restore is still turned off.
Print these instructions, or copy them to notepad and save. This will make the job of cleaning up a lot easier.
You will need to reset your homepage in “Internet Options” after completing this procedure. This is normal
Open the “Task Manager” (ctrl + alt + del) and end these processes:
vbsys2.exe (if running)
Now run “HijackThis!” and put a check by these entries. Be careful not to check the wrong box:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = <http://home.oceanfree.net>
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = <http://www.google.ie/>
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = <http://localhost>
O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34545} - C:\WINDOWS\System32\vbsys2 (file missing)
Now, restart your computer.
Click start,
right click 'internet explorer and select 'internet properties'
Now, reset your homepage to whatever you want,
and hit the buttons: "delete cookies..." and "delete files..."
Restart your computer again, and that should have resolved the prob!
Run "MSconfig" again,
to do this, click "Start" >> "Run" and type “msconfig”.
Select "normal startup" then go to these tabs: "services" and "startup", and make sure that all the boxes are checked.
Restart your system and post another log, so I can make sure we got everything.
I hope this kills the problem! (flame)
6 réponses
-
ah aufait voila cke deonne mon hijack
ogfile of HijackThis v1.98.2
Scan saved at 23:39:13, on 04/12/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINXP\System32\smss.exe
C:\WINXP\system32\winlogon.exe
C:\WINXP\system32\services.exe
C:\WINXP\system32\lsass.exe
C:\WINXP\system32\svchost.exe
C:\WINXP\System32\svchost.exe
C:\WINXP\system32\spoolsv.exe
C:\PROGRA~1\SECURI~1\av_fw\backweb\1044199\Program\SERVIC~1.EXE
C:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exe
C:\Program Files\Securitoo\av_fw\backweb\1044199\program\fsbwsys.exe
C:\Program Files\Securitoo\av_fw\Anti-Virus\FSGK32.EXE
C:\Program Files\Securitoo\av_fw\Anti-Virus\fssm32.exe
C:\Program Files\Securitoo\av_fw\Common\FSMA32.EXE
C:\Program Files\Securitoo\av_fw\Common\FSMB32.EXE
C:\Program Files\Securitoo\av_fw\Common\FCH32.EXE
C:\Program Files\Securitoo\av_fw\Common\FAMEH32.EXE
C:\Program Files\Securitoo\av_fw\Anti-Virus\fsav32.exe
C:\WINXP\Explorer.EXE
C:\Program Files\Securitoo\av_fw\DFW\Program\fsdfwd.exe
C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\WINXP\SOUNDMAN.EXE
C:\PROGRA~1\WANADOO\CnxMon.exe
C:\PROGRA~1\MESSAG~1\StartMessager.exe
C:\PROGRA~1\WANADOO\TaskbarIcon.exe
C:\Program Files\Securitoo\av_fw\Common\FSM32.EXE
C:\Program Files\Panicware\Pop-Up Stopper\dpps2.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Securitoo\av_fw\backweb\1044199\Program\BackWeb-1044199.exe
C:\Program Files\Wanadoo\EspaceWanadoo.exe
C:\Program Files\Wanadoo\ComComp.exe
C:\Program Files\Wanadoo\Watch.exe
C:\Program Files\Starcraft\StarCraft.exe
C:\Program Files\BWScanner\BWScanner.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Administrateur.TIPI\Bureau\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.wanadoo.fr/go/page_recherche/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL (file missing)
O2 - BHO: (no name) - {021BB032-80A8-4FB6-B3D5-CF27B1553B95} - C:\WINXP\mslagent\4b_1,0,1,0_mslagent.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat Reader\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: REALBAR - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\FICHIE~1\Real\Toolbar\realbar.dll (file missing)
O2 - BHO: Cls - {CF021F40-3E14-23A5-CBA2-717765721306} - C:\WINXP\System32\wer1306.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINXP\System32\msdxm.ocx
O3 - Toolbar: REALBAR - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\FICHIE~1\Real\Toolbar\realbar.dll (file missing)
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroCheck] C:\WINXP\system32\NeroCheck.exe
O4 - HKLM\..\Run: [winupd] C:\WINXP\System32\winupd.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\WANADOO\CnxMon.exe
O4 - HKLM\..\Run: [MessagerStarter Wanadoo] C:\PROGRA~1\MESSAG~1\StartMessager.exe Messager Wanadoo
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\WANADOO\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\WANADOO\TaskbarIcon.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Securitoo\av_fw\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Securitoo\av_fw\TNB\TNBUtil.exe" /CHECKALL
O4 - HKLM\..\Run: [Pop-Up Stopper] "C:\Program Files\Panicware\Pop-Up Stopper\dpps2.exe"
O4 - HKCU\..\Run: [APMLIVE] C:\Documents and Settings\Administrateur.TIPI\Bureau\bw chart et utili\apmlive.exe -auto
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BWCoach] C:\Temp\Rar$EX00.078\bwcoach.exe -auto
O4 - HKCU\..\Run: [SpyKiller] C:\Program Files\SpyKiller\spykiller.exe /startup
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Steam] C:\Program Files\Steam\Steam.exe -silent
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.wanadoo.fr (file missing) (HKCU)
O12 - Plugin for .wwg: C:\Program Files\Internet Explorer\Plugins\npwwg.dll
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://ppupdates.ca.com/downloads/scanner/axscanner.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1096074568515
O16 - DPF: {E15111B0-95AE-4C05-B91F-F4564057990C} (MovieSystem WAY) - http://servicesv4.moviesystem.com/cabs/msway.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{5CF99CD4-B821-445A-B2BE-09164D61E9E1}: NameServer = 192.168.0.254
O17 - HKLM\System\CCS\Services\Tcpip\..\{8F19A813-8351-49F3-8111-8CD225C0888E}: NameServer = 80.10.246.130 80.10.246.3
O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34545} - C:\WINXP\System32\vbsys2 (file missing) -
bonsoir
après avoir arrété les programmes en question,
avec hijackthis, tu peux "fixer" les lignes suivantes :
O4 - HKLM\..\Run: [winupd] C:\WINXP\System32\winupd.exe
O4 - HKCU\..\Run: [BWCoach] C:\Temp\Rar$EX00.078\bwcoach.exe
et supprimer les programmes:
C:\WINXP\System32\winupd.exe
C:\Temp\Rar$EX00.078\bwcoach.exe
toujours zen -
bwcoach c pa un virus c un prog dont je me ser et je sai aps kellignes enlever de hijackthis , c pas exactemen les mem que celles dan le post.
-
bonjour
je veux bien que "bwcoach" soit utilisé
mais il n'a rien à faire dans un répertoire temporaire
où cela sent la récupération internet :
il faudrait l'installer correctement.
par contre il faut arrêter ce process et le fixer :
O4 - HKLM\..\Run: [winupd] C:\WINXP\System32\winupd.exe
car c'est l'espion qui te crée les problèmes : " trojan dropper win32 delf.z"
toujours zen -
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question -
Bonjour
Sauf erreur de ma part tu as mslagent sur tonPC fait une recherche Google
Bonne journée @+ -
b'jour tt le monde
oui tu dois fixer aussi
O2 - BHO: (no name) - {021BB032-80A8-4FB6-B3D5-CF27B1553B95} - C:\WINXP\mslagent\4b_1,0,1,0_mslagent.dll (file missing)
O2 - BHO: Cls - {CF021F40-3E14-23A5-CBA2-717765721306} - C:\WINXP\System32\wer1306.dll (file missing)<--spy CWS
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
pour cette ligne uniquement :
1) ctrl+alt+supp (clic/arrêter dans le gestionnaire des tâches)
2) tu repasses sur l'hijack et tu fixes
O4 - HKLM\..\Run: [winupd] C:\WINXP\System32\winupd.exe
et surtout celle-là
O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34545} - C:\WINXP\System32\vbsys2 (file missing)
*fixe les lignes trouvées dans l'hijack
*ferme l'hijack
*reboot ton ordi
*nettoie le cache internet (options internet : supprimer cookies et temps) vide ta corbeille
*effectue un nettoyage de disque (démarrer/program./accessoires/outils système/répondre OK à TOUT)
supprime absolument ce programme 1) ajout/suppression ensuite va enlever les lignes dans ton 2) fichier Hosts
O4 - HKCU\..\Run: [SpyKiller] C:\Program Files\SpyKiller\spykiller.exe /startup
http://assiste.free.fr/p/faux_utilitaires/faux_utilitaires_frameset.php
télécharger Ad-aware.SE/ Spybot.s&d 1.3 <--ceux-là oui! (les 2 please)
http://telechargement.zebulon.fr/36-Ad-Aware-SE-Personal-edition-1.03.html
http://telechargement.zebulon.fr/79-Spybot---Search-&-Destroy.html
* le tuto ad-aware :
**http://41822.aceboard.net/41822-232-6216-0-Tutorial-Aware-Personal.htm
* les tutos spybot 1.3 : http://tomcoyote.com/SPYBOT/indexfr.php
**http://assiste.free.fr/p/internet_utilitaires/spybot_search_destroy.php
*Devise : Je m'intéresse à l'avenir parceque
c'est là que je vais passer le reste de ma vie*
