page d'acceuil nowfind impossible a enlever

Question

g depuis quelque tps cette page d'acceuil http://www.nowfind.net/009/index.html. je sais que c'est assez courant d'avoir ce genre de probleme mais j'eprouve pas mal de difficulter a supprimer celle la. je n'arrive pas egalement a entrer une adresse, lorsque j'en rentre une, je reviens sur cette meme page "nowfind"! et pour finir j'ai des "tmpf01,tmpf02,tmpf03..." qui essayent de se connecter sans arret.lorsque je les analyses avec mon antivirus, ils ne les conciderent pas comme etant des virus.ces fichiers se trouvent ds system32.voila mon compte rendu de hijackthisLogfile of HijackThis v1.99.0Scan saved at 19:30:26, on 14/01/2005Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Alwil Software\Avast4\aswUpdSv.exeC:\Program Files\Alwil Software\Avast4\ashServ.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\ZoneLabs\vsmon.exeC:\Program Files\Alwil Software\Avast4\ashMaiSv.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Messenger Plus! 3\MsgPlus.exeC:\Program Files\Java\j2re1.4.2_05\bin\jusched.exeC:\Program Files\Fichiers communs\Real\Update_OBealsched.exeC:\PROGRA~1\SPEEDR~1\speedram.exeC:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeC:\Program Files\Zone Labs\ZoneAlarm\zlclient.exeC:\WINDOWS\system32pcxwinex.exeC:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exeC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exeC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exeC:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exeC:\Program Files\Microsoft Office\Office\OSA.EXEC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exeC:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exeC:\Program Files\Internet Explorer\iexplore.exeC:\WINDOWS\system32	mpf03.exeC:\Program Files\Windows Media Player\wmplayer.exeC:\WINDOWS\system32	mpf04.exeC:\WINDOWS\system32	mpf05.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\WinRAR\WinRAR.exeC:\DOCUME~1\JRME~1\LOCALS~1\Temp\Rar$EX02.094\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer,Search = http://www.nowfind.net/009/index.htmlR1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.nowfind.net/009/index.htmlR1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://www.nowfind.net/009/index.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.nowfind.net/009/index.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.nowfind.net/009/index.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.nowfind.net/009/index.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.nowfind.net/009/index.htmlR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nowfind.net/009/index.htmlR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blankR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.nowfind.net/009/index.htmlR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blankR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.nowfind.net/009/index.htmlR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nowfind.net/009/index.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.nowfind.net/009/index.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.nowfind.net/009/index.htmlR0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.nowfind.net/009/index.htmlR0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.nowfind.net/009/index.htmlR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO1 - Hosts: auto.search.msn.com 127.0.0.1O2 - BHO: CDownCom Class - {031B6D43-CBC4-46A5-8E46-CF8B407C1A33} - C:\WINDOWS\Downloaded Program Files\ipreg32.dllO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dllO2 - BHO: dead less start - {0AA587B6-3948-5B97-2285-6809FB92B50B} - C:\PROGRA~1\KINDVGA\phone sixth.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dllO3 - Toolbar: Barre d'outils MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.1629.0\fr\msntb.dllO3 - Toolbar: thisgramsupport - {397BBA7C-33AD-0F2C-AEEF-03AEA7C09523} - C:\PROGRA~1\KINDVGA\phone sixth.dllO3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dllO4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exeO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osbootO4 - HKLM\..\Run: [SpeedRam2] C:\PROGRA~1\SPEEDR~1\speedram.exeO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [Microsoft Update] aaupdt.exeO4 - HKLM\..\Run: [RpcxWindows Extensions] rpcxwinex.exeO4 - HKLM\..\Run: [DeskAd Service] C:\Program Files\DeskAd Service\DeskAdServ.exeO4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeO4 - HKLM\..\Run: [Admanager Controller] C:\Program Files\Admanager Controller\AdManCtl.exeO4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"O4 - HKLM\..\RunServices: [Microsoft Update] aaupdt.exeO4 - HKLM\..\RunServices: [RpcxWindows Extensions] rpcxwinex.exeO4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe" /WinStartO4 - HKCU\..\Run: [Microsoft Update] aaupdt.exeO4 - HKCU\..\Run: [RpcxWindows Extensions] rpcxwinex.exeO4 - HKCU\..\RunServices: [RpcxWindows Extensions] rpcxwinex.exeO4 - Startup: Démarrage d'Office.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXEO4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exeO4 - Global Startup: hp psc 1000 series.lnk = ?O4 - Global Startup: hpoddt01.exe.lnk = ?O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXEO4 - Global Startup: Rappels du Calendrier Microsoft Works.lnk = ?O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.htmlO8 - Extra context menu item: Pages liées - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.htmlO8 - Extra context menu item: Pages similaires - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.htmlO8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.htmlO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin
pjpi142_05.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin
pjpi142_05.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO13 - DefaultPrefix: http://nowfind.net/rand/gallery.php?url=O13 - WWW Prefix: http://nowfind.net/rand/gallery.php?url=O13 - Home Prefix: http://nowfind.net/rand/gallery.php?url=O13 - Mosaic Prefix: http://nowfind.net/rand/gallery.php?url=O14 - IERESET.INF: START_PAGE_URL=http://freebox.free.fr/O15 - Trusted IP range: 206.161.125.149O15 - Trusted IP range:  (HKLM)O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cabO16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab28578.cabO16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cabO16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/194e6740de372a6cf605/netzip/RdxIE601_fr.cabO16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20041101/qtinstall.info.apple.com/pthalo/fr/win/QuickTimeInstaller.exeO16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cabO16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cabO16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab28578.cabO16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cabO16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cabO16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab31267.cabO16 - DPF: {DB893839-10F0-4AF9-92FA-B23528F530AF} - http://deposito.hostance.net/dialer/504737.exeO21 - SSODL: eplrr - {F27CFE15-E7A2-4B94-9D05-37EB680D22BC} - C:\WINDOWS\system32\eplrr3.dllO23 - Service: avast! iAVS4 Control Service - Unknown - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exeO23 - Service: avast! Antivirus - Unknown - C:\Program Files\Alwil Software\Avast4\ashServ.exeO23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exeO23 - Service: Service d'administration du Gestionnaire de disque logique - Unknown - C:\WINDOWS\System32\dmadmin.exeO23 - Service: Journal des événements - Unknown - C:\WINDOWS\system32\services.exeO23 - Service: Service COM de gravage de CD IMAPI - Unknown - C:\WINDOWS\System32\imapi.exeO23 - Service: Partage de Bureau à distance NetMeeting - Unknown - C:\WINDOWS\System32\mnmsrvc.exeO23 - Service: Plug-and-Play - Unknown - C:\WINDOWS\system32\services.exeO23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exeO23 - Service: Gestionnaire de session d'aide sur le Bureau à distance - Unknown - C:\WINDOWS\system32\sessmgr.exeO23 - Service: Carte à puce - Unknown - C:\WINDOWS\System32\SCardSvr.exeO23 - Service: Journaux et alertes de performance - Unknown - C:\WINDOWS\system32\smlogsvc.exeO23 - Service: Telnet - Unknown - C:\WINDOWS\System32	lntsvr.exeO23 - Service: TrueVector Internet Monitor - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exeO23 - Service: Cliché instantané de volume - Unknown - C:\WINDOWS\System32\vssvc.exeO23 - Service: Carte de performance WMI - Unknown - C:\WINDOWS\System32\wbem\wmiapsrv.exeMerci de votre aide

Teddy-Bear · Answer

Fixe les lignes suivantes

R1 - HKCU\Software\Microsoft\Internet Explorer,Search = http://www.nowfind.net/009/index.html Nasty
Nasty This entry should be fixed by HijackThis! This entry should be fixed by HijackThis!

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.nowfind.net/009/index.html Nasty
Nasty This entry should be fixed by HijackThis! This entry should be fixed by HijackThis!

R1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://www.nowfind.net/009/index.html Nasty
Nasty This entry should be fixed by HijackThis! This entry should be fixed by HijackThis!

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.nowfind.net/009/index.html Nasty
Nasty This entry should be fixed by HijackThis! This entry should be fixed by HijackThis!

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.nowfind.net/009/index.html Nasty
Nasty This entry should be fixed by HijackThis! This entry should be fixed by HijackThis!

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.nowfind.net/009/index.html Nasty
Nasty This entry should be fixed by HijackThis! This entry should be fixed by HijackThis!

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.nowfind.net/009/index.html Nasty
Nasty This entry should be fixed by HijackThis! This entry should be fixed by HijackThis!

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nowfind.net/009/index.html Nasty
Nasty This entry should be fixed by HijackThis! This entry should be fixed by HijackThis!

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.nowfind.net/009/index.html Nasty
Nasty This entry should be fixed by HijackThis! This entry should be fixed by HijackThis!

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.nowfind.net/009/index.html Nasty
Nasty This entry should be fixed by HijackThis! This entry should be fixed by HijackThis!

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nowfind.net/009/index.html Nasty
Nasty This entry should be fixed by HijackThis! This entry should be fixed by HijackThis!

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.nowfind.net/009/index.html Nasty
Nasty This entry should be fixed by HijackThis! This entry should be fixed by HijackThis!

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.nowfind.net/009/index.html Nasty
Nasty This entry should be fixed by HijackThis! This entry should be fixed by HijackThis!

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.nowfind.net/009/index.html Nasty
Nasty This entry should be fixed by HijackThis! This entry should be fixed by HijackThis!

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.nowfind.net/009/index.html Nasty
Nasty This entry should be fixed by HijackThis! This entry should be fixed by HijackThis!

O1 - Hosts: auto.search.msn.com 127.0.0.1 Nasty
Nasty This entry should be fixed immediately! Must be fixed!

O13 - DefaultPrefix: http://nowfind.net/rand/gallery.php?url= Nasty
Nasty Such entries should be fixed as a general rule. To be fixed immediately!

O13 - WWW Prefix: http://nowfind.net/rand/gallery.php?url= Nasty
Nasty Such entries should be fixed as a general rule. To be fixed immediately!

O13 - Home Prefix: http://nowfind.net/rand/gallery.php?url= Nasty
Nasty Such entries should be fixed as a general rule. To be fixed immediately!

O13 - Mosaic Prefix: http://nowfind.net/rand/gallery.php?url= Nasty
Nasty Such entries should be fixed as a general rule.

O16 - DPF: {DB893839-10F0-4AF9-92FA-B23528F530AF} - http://deposito.hostance.net/dialer/504737.exe Nasty
Nasty This entry is possibly nasty. Should be fixed.

O4 - HKLM\..\Run: [DeskAd Service] C:\Program Files\DeskAd Service\DeskAdServ.exe

eradiquer manuellement ce qui est en gras

________________________________
Un Bon Troyen Est Un Troyen M O R T

S!Ri · Answer

Salut

Il faut aussi enlever ces virus/trojan:

Redemarre en mode sans echec (tapote F5 ou F8 dès le demarrage de l'odinateur)
Lance HijackThis, coche et fixe les lignes suivantes:

O2 - BHO: CDownCom Class - {031B6D43-CBC4-46A5-8E46-CF8B407C1A33} - C:\WINDOWS\Downloaded Program Files\ipreg32.dll
O2 - BHO: dead less start - {0AA587B6-3948-5B97-2285-6809FB92B50B} - C:\PROGRA~1\KINDVGA\phone sixth.dll
O3 - Toolbar: thisgramsupport - {397BBA7C-33AD-0F2C-AEEF-03AEA7C09523} - C:\PROGRA~1\KINDVGA\phone sixth.dll
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O4 - HKLM\..\Run: [Microsoft Update] aaupdt.exe
O4 - HKLM\..\Run: [RpcxWindows Extensions] rpcxwinex.exe
O4 - HKLM\..\RunServices: [Microsoft Update] aaupdt.exe
O4 - HKLM\..\RunServices: [RpcxWindows Extensions] rpcxwinex.exe
O4 - HKCU\..\Run: [Microsoft Update] aaupdt.exe
O4 - HKCU\..\Run: [RpcxWindows Extensions] rpcxwinex.exe
O4 - HKCU\..\RunServices: [RpcxWindows Extensions] rpcxwinex.exe
O21 - SSODL: eplrr - {F27CFE15-E7A2-4B94-9D05-37EB680D22BC} - C:\WINDOWS\system32\eplrr3.dll

Affiche tous les fichiers et dossiers :
Clique sur démarrer, paramètres, panneau de configuration, option des dossiers, affichage:
Coche "Afficher les fichiers et dossiers cachés"
Décoche "Masquer les extensions dont le type est connu"
Décoche "Masquer les fichiers protégés du système d'exploitation (recommandé)"
Valide par "Ok"

Efface les fichiers en gras:

C:\WINDOWS\system32\aaupdt.exe
C:\WINDOWS\system32\rpcxwinex.exe
C:\WINDOWS\system32\eplrr3.dll

et vide la corbeille

Teddy-Bear · Answer

J'ai completement oublie les Unknow de la liste .....pauvre de moi_____________________________Un Bon Troyen Est Un Troyen M O R T

S!Ri · Answer

;-)ggsupastar, poste un nouveau log après tout ca, histoire de voir si on n'a rien oublié... Ton log était bien fournit.

ggsupastar · Answer

merci bcp pour vos explications,g bien fait tout ce que vous avez ecris mais certaines lignes quez je fixe reviennelorsque je redemarre. comment faire pour les supprimer definitivement?Voici les lignes qui reviennent en redemarrant :R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.nowfind.net/009/index.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.nowfind.net/009/index.htmlR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.nowfind.net/009/index.htmlR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.nowfind.net/009/index.htmlR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nowfind.net/009/index.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.nowfind.net/009/index.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.nowfind.net/009/index.htmlR0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.nowfind.net/009/index.htmlR0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.nowfind.net/009/index.htmlvoici le bilan hijackthis en entier :Logfile of HijackThis v1.99.0Scan saved at 14:14:04, on 15/01/2005Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\csrss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Alwil Software\Avast4\aswUpdSv.exeC:\Program Files\Alwil Software\Avast4\ashServ.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\wdfmgr.exeC:\WINDOWS\system32\ZoneLabs\vsmon.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Messenger Plus! 3\MsgPlus.exeC:\Program Files\Java\j2re1.4.2_05\bin\jusched.exeC:\Program Files\Fichiers communs\Real\Update_OBealsched.exeC:\PROGRA~1\SPEEDR~1\speedram.exeC:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeC:\Program Files\Zone Labs\ZoneAlarm\zlclient.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Webroot\Spy Sweeper\SpySweeper.exeC:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exeC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exeC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exeC:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exeC:\Program Files\Microsoft Office\Office\OSA.EXEC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exeC:\Program Files\Alwil Software\Avast4\ashMaiSv.exeC:\WINDOWS\System32\HPZipm12.exeC:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exeC:\Program Files\WinRAR\WinRAR.exeC:\Program Files\Internet Explorer\iexplore.exeC:\DOCUME~1\JRME~1\LOCALS~1\Temp\Rar$EX34.953\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.nowfind.net/009/index.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.nowfind.net/009/index.htmlR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blankR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.nowfind.net/009/index.htmlR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blankR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.nowfind.net/009/index.htmlR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nowfind.net/009/index.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.nowfind.net/009/index.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.nowfind.net/009/index.htmlR0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.nowfind.net/009/index.htmlR0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.nowfind.net/009/index.htmlR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dllO3 - Toolbar: Barre d'outils MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.1629.0\fr\msntb.dllO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dllO4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exeO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osbootO4 - HKLM\..\Run: [SpeedRam2] C:\PROGRA~1\SPEEDR~1\speedram.exeO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeO4 - HKLM\..\Run: [Admanager Controller] C:\Program Files\Admanager Controller\AdManCtl.exeO4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe" /WinStartO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0O4 - Startup: Démarrage d'Office.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXEO4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exeO4 - Global Startup: hp psc 1000 series.lnk = ?O4 - Global Startup: hpoddt01.exe.lnk = ?O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXEO4 - Global Startup: Rappels du Calendrier Microsoft Works.lnk = ?O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.htmlO8 - Extra context menu item: Pages liées - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.htmlO8 - Extra context menu item: Pages similaires - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.htmlO8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.htmlO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin
pjpi142_05.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin
pjpi142_05.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO14 - IERESET.INF: START_PAGE_URL=http://freebox.free.fr/O15 - Trusted IP range: 206.161.125.149O15 - Trusted IP range:  (HKLM)O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cabO16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab28578.cabO16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cabO16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/194e6740de372a6cf605/netzip/RdxIE601_fr.cabO16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20041101/qtinstall.info.apple.com/pthalo/fr/win/QuickTimeInstaller.exeO16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cabO16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cabO16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab28578.cabO16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cabO16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cabO16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab31267.cabO21 - SSODL: eplrr - {B58B27D2-5153-476F-B6F2-E2F10A738381} - C:\WINDOWS\system32\eplrr3.dllO23 - Service: avast! iAVS4 Control Service - Unknown - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exeO23 - Service: avast! Antivirus - Unknown - C:\Program Files\Alwil Software\Avast4\ashServ.exeO23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exeO23 - Service: Service d'administration du Gestionnaire de disque logique - Unknown - C:\WINDOWS\System32\dmadmin.exeO23 - Service: Journal des événements - Unknown - C:\WINDOWS\system32\services.exeO23 - Service: Service COM de gravage de CD IMAPI - Unknown - C:\WINDOWS\System32\imapi.exeO23 - Service: Partage de Bureau à distance NetMeeting - Unknown - C:\WINDOWS\System32\mnmsrvc.exeO23 - Service: Plug-and-Play - Unknown - C:\WINDOWS\system32\services.exeO23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exeO23 - Service: Gestionnaire de session d'aide sur le Bureau à distance - Unknown - C:\WINDOWS\system32\sessmgr.exeO23 - Service: Carte à puce - Unknown - C:\WINDOWS\System32\SCardSvr.exeO23 - Service: Journaux et alertes de performance - Unknown - C:\WINDOWS\system32\smlogsvc.exeO23 - Service: Telnet - Unknown - C:\WINDOWS\System32	lntsvr.exeO23 - Service: TrueVector Internet Monitor - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exeO23 - Service: Cliché instantané de volume - Unknown - C:\WINDOWS\System32\vssvc.exeO23 - Service: Carte de performance WMI - Unknown - C:\WINDOWS\System32\wbem\wmiapsrv.exe

S!Ri · Answer

Salut,

Redemarre en mode sans echec (tapote F5 ou F8 dès le demarrage de l'odinateur)
Lance HijackThis, coche et fixe les lignes suivantes:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.nowfind.net/009/index.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.nowfind.net/009/index.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.nowfind.net/009/index.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.nowfind.net/009/index.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nowfind.net/009/index.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.nowfind.net/009/index.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.nowfind.net/009/index.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.nowfind.net/009/index.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.nowfind.net/009/index.html
O15 - Trusted IP range: 206.161.125.149
O15 - Trusted IP range: (HKLM)
O21 - SSODL: eplrr - {B58B27D2-5153-476F-B6F2-E2F10A738381} - C:\WINDOWS\system32\eplrr3.dll

Affiche tous les fichiers et dossiers :
Clique sur démarrer, paramètres, panneau de configuration, option des dossiers, affichage:
Coche "Afficher les fichiers et dossiers cachés"
Décoche "Masquer les extensions dont le type est connu"
Décoche "Masquer les fichiers protégés du système d'exploitation (recommandé)"
Valide par "Ok"

Efface les fichiers en gras:

C:\WINDOWS\system32\lsd_f3.dll
C:\WINDOWS\system32\eplrr3.dll
C:\WINDOWS\system32\tmpf??.exe où ?? sont 2 chiffres.

et vide la corbeille

S!Ri · Answer

're

Coche aussi ca si tu ne connais pas:
O4 - HKLM\..\Run: [Admanager Controller] C:\Program Files\Admanager Controller\AdManCtl.exe

et efface le fichier:

C:\Program Files\Admanager Controller\AdManCtl.exe

jouk · Answer

salut,
Passe ad -aware,scanne avec escan.Supprime les fichiers infectés
Ces fichiers posent des problemes:cifdt.dll;cidpoq32.dll;gupd.dll;icnfe.dll;icrqt.dll;ccvbr.dll;mshelper.dll; mtrwil.dll;mthst32.dll;sdfup.dll;wecxg32.dll;xcwer32.dll;tbc.dll;spm1316.dll;eplrr3.dll;zxmsn.dll
Donc à effacer .(regarde si ces fichiers sont present sur ton ordi)
mtwirl lui meme en mode sans echec ne peut etre effacé donc l'effacer en invite de commande sans echec
(Escan detecte mtrwil.dll)
Je pense qu'une fois ces fichiers effacés ,tu n'aura plus de probléme.
Tiens nous au courant

Picvert · Answer

Salut à tous
Attention à C:\Program Files\Admanager Controller\AdManCtl.exe,
il a un petit fère qui s'appelle
C:\Program Files\Admanager Controller\AdManKeep.exe
Les deux se lancent au démarrage de Windows et l'un protège l'autre, on ne peut ni les stopper au niveau du gestionnaire de tâches - onglet processus, ni effacer le directory en mode normal.
Il faut lancer Windows en mode sans erreur (F8 au démarrage), puis supprimer (pas la corbeille, suppression complète) le répertoire
C:\Program Files\Admanager Controller
avec tout ce qu'il contient.
Ensuite dans la base de registre, aller dans
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
y supprimer la clé AMan, valeur C:\Program Files\Admanager Controller\AdManCtl.exe
redémarrer en mode normal et vérifier dans le gestionnaire de tâches, il doit être parti.

Bon débarras

Un conseil: sous Windows XP, installez le SP2, sinon vous êtes mal.

Marre des c...ries qu'Internet Explorer va ramasser partout ? Utilisez Mozilla ou Firefox.
C'est gratuit et c'est tellement plus sûr.
Ou passez en Linux, là c'est le top.

Salut et restez couverts.

Teddy-Bear · Answer

J'abonde dans ton sens pour Firefoxe..........plus d'explorer....plus de probleme_____________________________Un Bon Troyen Est Un Troyen M O R T

ggsupastar · Answer

voila g fait tous ce que vous m'avez conseillé! et je remercie picvert pour avoir conseillé firefox. je l'ai installé et il est vraiment genial, plus de bug,plus rapide! à chi*** explorer!
Je vous remercies tous pour vos reponses qui m'on bcp aidé.
et surtout je conseille a tous Firefox, au chiotte Explorer!

merci a tous

Page d'acceuil nowfind impossible a enlever

11 réponses

Discussions similaires

Newsletters