searchdom.net encree dans le regist aide svp

Question

bonjour ce truc (searchdom.net) es implanter dans le registre je vai a la cle j essay de la modifier elle revien tjr comme avt,j essay de la supprime elle revient comme avt que faire?
spybot le detecte mais n arrvie pa a le supprime,ad ware pareil
merci de me donner un truc pour enlever cette saloperie merci.

Afficher la suite

balltrap34 · Answer

salut
Hijackthis : http://209.133.47.200/~merijn/files/ HijackThis.exe
http://pageperso.aol.fr/balltrap34/page%20virus.htm

telecharge le et met le dans son propre dossier ex/c :hj

clik sur do a systeme scan et save a logfile
et copier coller le rapport

la chasse et le balltrap ma vrai passion
voir site perso dans profil

mistral · Answer

bonjour a tous j'ai le meme proLogfile of HijackThis v1.97.7Scan saved at 07:58:06, on 21/01/2005Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exeC:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exeC:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exeC:\WINDOWS\System32	asker32.exeC:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\system32\LEXBCES.EXEC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\LEXPPS.EXEC:\Program Files\Roxio\GoBack\GBPoll.exeC:\Program Files\Norton AntiVirus
avapsvc.exeC:\Program Files\Norton AntiVirus\IWP\NPFMntor.exeC:\Program Files\Advanced Registry Doctor\RegManServ.exeC:\Program Files\Norton AntiVirus\SAVScan.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\Dit.exeC:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeC:\Program Files\Ahead\InCD\InCD.exeC:\WINDOWS\System32\LXSUPMON.EXEC:\WINDOWS\SOUNDMAN.EXEC:\WINDOWS\System32\lssrv.exeC:\WINDOWS\Ocs.exeC:\WINDOWS\DitExp.exeC:\Program Files\Soft4Ever\looknstop\looknstop.exeC:\Program Files\Fichiers communs\Symantec Shared\ccApp.exeC:\Program Files\Olitec\USB ADSL\CnxDslTb.exeC:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exeC:\WINDOWS\System32\ctfmon.exeC:\Program Files\Messenger\msmsgs.exeC:\Program Files\Copernic Desktop Search\CopernicDesktopSearch.exeC:\Program Files\Advanced Registry Doctor\RegDfrgSch.exeC:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exeC:\WINDOWS\System32\wuauclt.exeC:\Program Files\Roxio\GoBack\GBTray.exeC:\Program Files\WinZip\WZQKPICK.EXEC:\Program Files\InterMute\AdSubtract\AdSub.exeC:\Program Files\Antipub\antipub.exeC:\Program Files\Webshots\webshots.scrC:\Program Files\Tiscali\Dialer\Dialer.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Internet Explorer\iexplore.exeC:\unzipped\hjt\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.searchdom.netR1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.searchdom.net/?re= (obfuscated)R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.searchdom.net/?re= (obfuscated)R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:3010R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\userinit.exeO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dllO2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dllO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dllO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO3 - Toolbar: AdSubtract Toolbar - {F14AABDD-0232-4e5a-9B52-4178AC0A62B5} - C:\WINDOWS\System32\adsubtb.dllO4 - HKLM\..\Run: [Dit] Dit.exeO4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeO4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exeO4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exeO4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\printray.exeO4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\System32\LXSUPMON.EXE RUNO4 - HKLM\..\Run: [TiscaliParam] C:\Program Files\Tiscali\Dialer\bootparam.exeO4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXEO4 - HKLM\..\Run: [Microsoft Services] lssrv.exeO4 - HKLM\..\Run: [SCL] C:\WINDOWS\Ocs.exeO4 - HKLM\..\Run: [clfmon.exe] clfmon.exeO4 - HKLM\..\Run: [Look 'n' Stop] "C:\Program Files\Soft4Ever\looknstop\looknstop.exe" -autoO4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exeO4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SymNetDrv\SNDMon.exeO4 - HKLM\..\Run: [CnxDslTaskBar] C:\Program Files\Olitec\USB ADSL\CnxDslTb.exeO4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exeO4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -kO4 - HKLM\..\RunServices: [Microsoft Services] lssrv.exeO4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exeO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKCU\..\Run: [Copernic Desktop Search] "C:\Program Files\Copernic Desktop Search\CopernicDesktopSearch.exe" /trayO4 - HKCU\..\Run: [RegDfrgSch] C:\Program Files\Advanced Registry Doctor\RegDfrgSch.exe /trayO4 - HKLM\..\RunOnce: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheckO4 - Startup: AdSubtract.lnk = C:\Program Files\InterMute\AdSubtract\AdSub.exeO4 - Startup: Anti-Pub.lnk = C:\Program Files\Antipub\antipub.exeO4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exeO4 - Global Startup: GoBack.lnk = C:\Program Files\Roxio\GoBack\GBTray.exeO4 - Global Startup: SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\SpySub.exeO4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXEO8 - Extra context menu item: AdSubtract: Bypass Site - res://C:\Program Files\interMute\AdSubtract\AdSub.exe/360O8 - Extra context menu item: AdSubtract: Cloak Image - res://C:\Program Files\interMute\AdSubtract\AdSub.exe/361O8 - Extra context menu item: AdSubtract: Report Site - res://C:\Program Files\interMute\AdSubtract\AdSub.exe/359O8 - Extra context menu item: Chercher avec Copernic Agent - res://C:\Program Files\Copernic Agent\CopernicAgentExt.rdl/INTEGRATION_MENU_SEARCHEXTO9 - Extra 'Tools' menuitem: Démarrer Copernic Agent (HKLM)O9 - Extra button: Copernic Agent (HKLM)O13 - DefaultPrefix: http://%77%77%77%2E%73%65%61%72%63%68%64%6F%6D%2E%6E%65%74/?re=O13 - WWW Prefix: http://%77%77%77%2E%73%65%61%72%63%68%64%6F%6D%2E%6E%65%74/?re=O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cabO16 - DPF: {3334504D-9980-0010-8000-00AA00389B71} - http://download.microsoft.com/download/0/C/8/0C8EDFAB-30BC-4792-898E-2DABE27B2C4D/mp43dmo.CABO16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CABO16 - DPF: {3AF4DACE-36ED-42EF-9DFC-ADC34DA30CFF} (PatchInstaller.Installer) - file://E:\content\include\XPPatchInstaller.CABO16 - DPF: {5D9E4B6D-CD17-4D85-99D4-6A52B394EC3B} (WSDownloader Control) - http://www.webshots.com/samplers/WSDownloader.ocxO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1101647985609O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cabO16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a936.g.akamai.net/7/936/537/00000002/housecall.antivirus.com/housecall/xscan53.cabO16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.lelezard.com/scan/Msie/bitdefender.cabO16 - DPF: {8B1BC605-C593-4865-8F5B-05517F0CD0BB} (MSSecurityAdvisorCD Class) - file://E:\Content\include\msSecUcd.cabO16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} - http://www.ravantivirus.com/scan/ravonline.cabO16 - DPF: {A8658086-E6AC-4957-BC8E-7D54A7E8A78E} - http://www.microsoft.com/security/controls/Sasser/20/SassCln.CABO16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{E95916FE-D338-4CE4-B52D-C2285195F2D6}: NameServer = 213.36.80.1 213.36.80.1bleme voici mon log

gregou95 · Answer

ça y est jai trouver en faite vous tapé juste

regedit /e C:\Look.txt "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Image File Execution Options\explorer.exe"

dan executer et c fini plus de merde avec cette page bloqué

mistral · Answer

salut gregou95

afin que les autres gars qui sont infectès par cette saletè puisse s'en dèbarrasser et l'èradiquer lorsque vous etes à explorer.exe il faut repèrer TASKER32.EXE spprimer cette bestiole et plus de SEARCHDOM.NET

bonne chance

Searchdom.net encree dans le regist aide svp

4 réponses

Votre réponse

Discussions similaires

Newsletters