Page d'accueil nowfind Fermé

Question

Bonjour,Suite à un virus je ne peux plus avoir d'autre page d'accueilque http://www.nowfind.net/004/index.html, accompagnée de sites pornos hum hum...Voici mon rapport hijackthisLogfile of HijackThis v1.99.0Scan saved at 20:46:58, on 17/01/05Platform: Windows 98 SE (Win9x 4.10.2222A)MSIE: Internet Explorer v5.00 (5.00.2919.6304)Running processes:C:\WINDOWS\SYSTEM\KERNEL32.DLLC:\WINDOWS\SYSTEM\MSGSRV32.EXEC:\WINDOWS\SYSTEM\MPREXE.EXEC:\PROGRAM FILES\FICHIERS COMMUNS\SOFTWIN\BITDEFENDER COMMUNICATOR\XCOMMSVR.EXEC:\PROGRAM FILES\FICHIERS COMMUNS\SOFTWIN\BITDEFENDER SCAN SERVER\BDSS.EXEC:\WINDOWS\SYSTEM\mmtask.tskC:\WINDOWS\RUNDLL32.EXEC:\PROGRAM FILES\IWARE\IWARE MOUSE\3.2\LWBWHEEL.EXEC:\WINDOWS\TASKMON.EXEC:\WINDOWS\SYSTEM\SYSTRAY.EXEC:\PROGRAM FILES\SOFTWIN\BITDEFENDER8\BDMCON.EXEC:\PROGRAM FILES\SOFTWIN\BITDEFENDER8\VSSERV.EXEC:\PROGRAM FILES\SOFTWIN\BITDEFENDER8\BDOESRV.EXEC:\WINDOWS\SYSTEM\WMIEXE.EXEC:\WINDOWS\SYSTEM\TMPF03.EXEC:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXEC:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXEC:\WINDOWS\SYSTEM\PSTORES.EXEC:\WINDOWS\EXPLORER.EXEC:\WINDOWS\SYSTEM\DDHELP.EXEC:\PROGRAM FILES\WINZIP\WINZIP32.EXEC:\WINDOWS\TEMP\HIJACKTHIS.EXER1 - HKCU\Software\Microsoft\Internet Explorer,Search = http://www.nowfind.net/004/index.htmlR1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.nowfind.net/004/index.htmlR1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://www.nowfind.net/004/index.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.nowfind.net/004/index.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.nowfind.net/004/index.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.nowfind.net/004/index.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.nowfind.net/004/index.htmlR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nowfind.net/004/index.htmlR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.fr.msn.comR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.nowfind.net/004/index.htmlR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.nowfind.net/004/index.htmlR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nowfind.net/004/index.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.nowfind.net/004/index.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.nowfind.net/004/index.htmlR0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.nowfind.net/004/index.htmlR0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.nowfind.net/004/index.htmlR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO2 - BHO: BrowserHelper Class - {EBCDDA60-2A68-11D3-8A43-0060083CFB9C} - C:\WINDOWS\SYSTEM\NZDD.DLLO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCXO2 - BHO: Search Toolbar - {9EAC0102-5E61-2312-BC2D-544243544243} - C:\WINDOWS\SYSTEM\TBC.DLL (file missing)O3 - Toolbar: @msdxmLC.dll,-1@1036,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCXO3 - Toolbar: Search Toolbar - {9EAC0102-5E61-2312-BC2D-544243544243} - C:\WINDOWS\SYSTEM\TBC.DLL (file missing)O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exeO4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exeO4 - HKLM\..\Run: [LWBMOUSE] C:\Program Files\iWare\iWare Mouse\3.2\lwbwheel.exeO4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorunO4 - HKLM\..\Run: [TaskMonitor] c:\windows	askmon.exeO4 - HKLM\..\Run: [SystemTray] SysTray.ExeO4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrSchemeO4 - HKLM\..\Run: [BDMCon] C:\Program Files\Softwin\BitDefender8\bdmcon.exeO4 - HKLM\..\Run: [BitDefender Virus Shield] C:\Program Files\Softwin\BitDefender8\vsserv.exeO4 - HKLM\..\Run: [BDOESRV] C:\Program Files\Softwin\BitDefender8\bdoesrv.exeO4 - HKLM\..\Run: [BDNewsAgent] C:\Program Files\Softwin\BitDefender8\bdnagent.exeO4 - HKLM\..\Run: [BDSwitchAgent] C:\Program Files\Softwin\BitDefender8\bdswitch.exeO4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrSchemeO4 - HKLM\..\RunServices: [BitDefender Communicator] C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exeO4 - HKLM\..\RunServices: [BitDefender Scan Server] C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exeO4 - HKLM\..\RunServices: [BitDefender Live! Init] C:\Program Files\Softwin\BitDefender8\bdinit.exeO9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htmO9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htmO13 - DefaultPrefix: http://nowfind.net/rand/gallery.php?url=O13 - WWW Prefix: http://nowfind.net/rand/gallery.php?url=O13 - Home Prefix: http://nowfind.net/rand/gallery.php?url=O13 - Mosaic Prefix: http://nowfind.net/rand/gallery.php?url=O14 - IERESET.INF: SEARCH_PAGE_URL=O14 - IERESET.INF: START_PAGE_URL=O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540006} (CInstall Class) - http://www.errorguard.com/installation/Install.cabO16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/yinst/yinst_current.cabO21 - SSODL: DDE Module - {DABB03E9-AC0D-3740-E3E5-4B37C80837E5} - C:\WINDOWS\SYSTEM\mtwirl.dllO21 - SSODL: eplrr - {17975CC0-60D0-11D9-90BD-0007CB0000FF} - C:\WINDOWS\SYSTEM\eplrr3.dllSi vous pouviez m'aider j'en serai vraiment reconnaissante je me depetre plus de tout ça...

S!Ri · Answer

Salut,Redemarre en mode sans echec (tapote F5 ou F8 dès le démarrage de l'odinateur)Lance HijackThis, coche et fixe les lignes suivantes:R1 - HKCU\Software\Microsoft\Internet Explorer,Search = http://www.nowfind.net/004/index.htmlR1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.nowfind.net/004/index.htmlR1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://www.nowfind.net/004/index.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.nowfind.net/004/index.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.nowfind.net/004/index.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.nowfind.net/004/index.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.nowfind.net/004/index.htmlR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nowfind.net/004/index.htmlR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.nowfind.net/004/index.htmlR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.nowfind.net/004/index.htmlR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nowfind.net/004/index.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.nowfind.net/004/index.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.nowfind.net/004/index.htmlR0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.nowfind.net/004/index.htmlR0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.nowfind.net/004/index.htmlO2 - BHO: Search Toolbar - {9EAC0102-5E61-2312-BC2D-544243544243} - C:\WINDOWS\SYSTEM\TBC.DLL (file missing)O3 - Toolbar: Search Toolbar - {9EAC0102-5E61-2312-BC2D-544243544243} - C:\WINDOWS\SYSTEM\TBC.DLL (file missing)O13 - WWW Prefix: http://nowfind.net/rand/gallery.php?url=O13 - Home Prefix: http://nowfind.net/rand/gallery.php?url=O13 - Mosaic Prefix: http://nowfind.net/rand/gallery.php?url=O14 - IERESET.INF: SEARCH_PAGE_URL=O14 - IERESET.INF: START_PAGE_URL=O21 - SSODL: DDE Module - {DABB03E9-AC0D-3740-E3E5-4B37C80837E5} - C:\WINDOWS\SYSTEM\mtwirl.dllO21 - SSODL: eplrr - {17975CC0-60D0-11D9-90BD-0007CB0000FF} - C:\WINDOWS\SYSTEM\eplrr3.dllAffiche tous les fichiers et dossiers :Clique sur démarrer, paramètres, panneau de configuration, option des dossiers, affichage:Coche "Afficher les fichiers et dossiers cachés"Décoche "Masquer les extensions dont le type est connu"Décoche "Masquer les fichiers protégés du système d'exploitation (recommandé)"Valide par "Ok"Efface les fichiers en gras:C:\WINDOWS\system32\eplrr3.dllC:\WINDOWS\system32	mpf??.exe où ?? sont 2 chiffres.Fait une recherche et supprime les fichiers suivants:lsd_f3.dll, cidft.dll, cidpoq32.dll, gupd.dll, icnfe.dll, icqrt.dll, icvbr.dll, shelper.dll, mtjpgb.dll, mtjpgh.dll, mtwcnl32.dll, mtwirl.dll, thst32.dll, sdfup.dll, wecxg32.dll, xcwer32.dll, TBC.dll, spm1316.dll, zxmsn.dllet vide la corbeille

Page d'accueil nowfind

1 réponse

Discussions similaires