Problème SEARCH barre outils

Question

Bonjour à tous,J'ai un problème avec  la barre d'outils SEARCH qui s'est intallée automatiquement.Je n'arrive pas à enlever. J'ai essayé Ad aware, Spybot, CwShredder.Voici mon Hijack. Merci pour votre aide.ThierryLogfile of HijackThis v1.98.2Scan saved at 10:33:31, on 29/01/2005Platform: Windows XP  (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 (6.00.2600.0000)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\Explorer.EXEC:\PROGRA~1\MESSAG~1\StartMessager.exeC:\WINDOWS\System32\atiptaxx.exeC:\Program Files\ahead\InCD\InCD.exeC:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exeC:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exeC:\Program Files\ATI Multimedia\RemCtrl\ATIX10.exeC:\Program Files\Fichiers communs\Real\Update_OBealsched.exeC:\Program Files\Windows ServeAd\WinServAd.exeC:\Program Files\Securitoo\av_fw\Common\FSM32.EXEC:\WINDOWS\System32\ctfmon.exeC:\Documents and Settings\Thierry\Application Data\oedd.exeC:\WINDOWS\System32\w?nlogon.exeC:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exeC:\Program Files\Windows ServeAd\WinServSuit.exeC:\WINDOWS\System32undll32.exeC:\PROGRA~1\SECURI~1\av_fw\backweb\1044199\Program\SERVIC~1.EXEC:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exeC:\Program Files\Securitoo\av_fw\backweb\1044199\program\fsbwsys.exeC:\Program Files\Securitoo\av_fw\Anti-Virus\FSGK32.EXEC:\Program Files\Securitoo\av_fw\Anti-Virus\fssm32.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Securitoo\av_fw\backweb\1044199\Program\BackWeb-1044199.exeC:\Program Files\Securitoo\av_fw\Common\FSMA32.EXEC:\Program Files\Securitoo\av_fw\Common\FSMB32.EXEC:\Program Files\Securitoo\av_fw\Common\FCH32.EXEC:\Program Files\Securitoo\av_fw\Common\FAMEH32.EXEC:\Program Files\Securitoo\av_fw\Anti-Virus\fsav32.exeC:\Program Files\Securitoo\av_fw\DFW\Program\fsdfwd.exeC:\WINDOWS\System32\devldr32.exeC:\WINDOWS\System32\wuauclt.exeC:\Program Files\Windows Media Player\wmplayer.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Documents and Settings\Thierry\Mes documents\Hijack\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer,Search = c:\searchpage.htmlR1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = c:\searchpage.htmlR1 - HKLM\Software\Microsoft\Internet Explorer,Search = c:\searchpage.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\searchpage.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = c:\searchpage.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.richfind.com/ie/R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.richfind.com/ie/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://lookfor.cc?pin=52409R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://lookfor.cc/sp.php?pin=52409R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.richfind.com/ie/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.richfind.com/ie/R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.richfind.com/ie/R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = c:\searchpage.htmlR0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.richfind.com/ie/R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhostR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensR3 - URLSearchHook: Search - {2D13A0CA-D1D5-45E4-ABAA-C5B9AF1F0E46} - C:\WINDOWS\System32\Q2256015.dllO1 - Hosts: 127.0.0.0 localhostO1 - Hosts: 127.0.0.2 auditmypc.comO1 - Hosts: 127.0.0.3 boards.cexx.orgO1 - Hosts: 127.0.0.4 bulletproofsoft.netO1 - Hosts: 127.0.0.5 camtech2000.netO1 - Hosts: 127.0.0.6 cexx.orgO1 - Hosts: 127.0.0.7 computercops.usO1 - Hosts: 127.0.0.8 ct7support.comO1 - Hosts: 127.0.0.9 doxdesk.comO1 - Hosts: 127.0.0.20 kellys-korner-xp.comO1 - Hosts: 127.0.0.21 kephyr.comO1 - Hosts: 127.0.0.22 lavasoft.deO1 - Hosts: 127.0.0.23 lavasoftusa.comO1 - Hosts: 127.0.0.24 lurkhere.comO1 - Hosts: 127.0.0.25 majorgeeks.comO1 - Hosts: 127.0.0.26 merijn.orgO1 - Hosts: 127.0.0.27 mjc1.comO1 - Hosts: 127.0.0.28 moosoft.comO1 - Hosts: 127.0.0.29 mvps.orgO1 - Hosts: 127.0.0.30 net-integration.netO1 - Hosts: 127.0.0.31 noadware.netO1 - Hosts: 127.0.0.32 no-spybot.comO1 - Hosts: 127.0.0.33 onlinepcfix.comO1 - Hosts: 127.0.0.34 pchell.comO1 - Hosts: 127.0.0.35 pestpatrol.comO1 - Hosts: 127.0.0.36 safer-networking.orgO1 - Hosts: 127.0.0.37 secure.spykiller.comO1 - Hosts: 127.0.0.38 secureie.comO1 - Hosts: 127.0.0.39 security.kolla.deO1 - Hosts: 127.0.0.40 spybot.infoO1 - Hosts: 127.0.0.41 spychecker.comO1 - Hosts: 127.0.0.42 spychecker.comO1 - Hosts: 127.0.0.43 spycop.comO1 - Hosts: 127.0.0.44 spyguard.comO1 - Hosts: 127.0.0.45 spykiller.comO1 - Hosts: 127.0.0.46 spyware.co.ukO1 - Hosts: 127.0.0.47 spyware-cop.comO1 - Hosts: 127.0.0.48 spywareinfo.comO1 - Hosts: 127.0.0.49 spywarenuker.comO1 - Hosts: 127.0.0.50 spywareremove.comO1 - Hosts: 127.0.0.51 spywareremove.comO1 - Hosts: 127.0.0.52 stopzillapro.comO1 - Hosts: 127.0.0.53 sunbelt-software.comO1 - Hosts: 127.0.0.54 thiefware.comO1 - Hosts: 127.0.0.55 tomcoyote.orgO1 - Hosts: 127.0.0.56 unwantedlinks.comO1 - Hosts: 127.0.0.57 webattack.comO1 - Hosts: 127.0.0.58 wilders.orgO1 - Hosts: 127.0.0.59 www.auditmypc.comO1 - Hosts: 127.0.0.60 www.bulletproofsoft.netO1 - Hosts: 127.0.0.61 www.cexx.orgO1 - Hosts: 127.0.0.62 www.computercops.usO1 - Hosts: 127.0.0.63 www.ct7support.comO1 - Hosts: 127.0.0.64 www.doxdesk.comO1 - Hosts: 127.0.0.65 www.eblocs.comO1 - Hosts: 127.0.0.66 www.enigmasoftwaregroup.comO1 - Hosts: 127.0.0.67 www.free-spyware-scan.comO1 - Hosts: 127.0.0.68 www.free-web-browsers.comO1 - Hosts: 127.0.0.69 www.grc.comO1 - Hosts: 127.0.0.70 www.grisoft.comO1 - Hosts: 127.0.0.71 www.hackfaq.orgO1 - Hosts: 127.0.0.72 www.hazeleger.netO1 - Hosts: 127.0.0.73 www.javacoolsoftware.comO1 - Hosts: 127.0.0.74 www.kellys-korner-xp.comO1 - Hosts: 127.0.0.75 www.kephyr.comO1 - Hosts: 127.0.0.76 www.lavasoft.deO1 - Hosts: 127.0.0.77 www.lavasoftusa.comO1 - Hosts: 127.0.0.78 www.lurkhere.comO1 - Hosts: 127.0.0.79 www.majorgeeks.comO1 - Hosts: 127.0.0.80 www.merijn.orgO1 - Hosts: 127.0.0.81 www.mjc1.comO1 - Hosts: 127.0.0.82 www.moosoft.comO1 - Hosts: 127.0.0.83 www.mvps.orgO1 - Hosts: 127.0.0.84 www.net-integration.netO1 - Hosts: 127.0.0.85 www.noadware.netO1 - Hosts: 127.0.0.86 www.no-spybot.comO1 - Hosts: 127.0.0.87 www.onlinepcfix.comO1 - Hosts: 127.0.0.88 www.pchell.comO1 - Hosts: 127.0.0.89 www.pestpatrol.comO1 - Hosts: 127.0.0.90 www.safer-networking.orgO1 - Hosts: 127.0.0.91 www.secureie.comO1 - Hosts: 127.0.0.92 www.security.kolla.deO1 - Hosts: 127.0.0.93 www.spybot.infoO1 - Hosts: 127.0.0.94 www.spychecker.comO1 - Hosts: 127.0.0.95 www.spychecker.comO1 - Hosts: 127.0.0.96 www.spycop.comO1 - Hosts: 127.0.0.97 www.spyguard.comO1 - Hosts: 127.0.0.98 www.spykiller.comO1 - Hosts: 127.0.0.99 www.spyware.co.ukO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocxO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: Search - {5EACD631-CB25-49E3-9C78-10D1ADE03AC4} - C:\WINDOWS\System32\Q2256015.dllO2 - BHO: (no name) - {6928C1AF-7898-40BB-9530-1C83C6912CE7} - C:\WINDOWS\System32\ilpjbb.dll (file missing)O2 - BHO: (no name) - {9F704262-80F1-8E29-D93A-8D4DFFAF2CC1} - C:\WINDOWS\System32\vvxmlsc.dllO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocxO3 - Toolbar: Search - {28EF6FA1-C04C-4FCE-901E-6D3A0D633184} - C:\WINDOWS\System32\Q2256015.dllO4 - HKLM\..\Run: [MessagerStarter Wanadoo] C:\PROGRA~1\MESSAG~1\StartMessager.exe Messager WanadooO4 - HKLM\..\Run: [AtiPTA] atiptaxx.exeO4 - HKLM\..\Run: [InCD] C:\Program Files\ahead\InCD\InCD.exeO4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exeO4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exeO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [Regx10EXE] C:\Program Files\ATI Multimedia\RemCtrl\ATIX10.exeO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osbootO4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [Connector] C:\WINDOWS\System32\ShellExt\ATX001.EXE -nO4 - HKLM\..\Run: [Windows ServeAd] C:\Program Files\Windows ServeAd\WinServAd.exeO4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Securitoo\av_fw\Common\FSM32.EXE" /splashO4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Securitoo\av_fw\TNB\TNBUtil.exe" /CHECKALLO4 - HKLM\..\Run: [xshwh] C:\WINDOWS\xshwh.exeO4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exeO4 - HKCU\..\Run: [Microsoft Works Update Detection] \WkDetect.exeO4 - HKCU\..\Run: [ixplore] "C:\Program Files\Internet Explorer\ixplore.exe"O4 - HKCU\..\Run: [Aout] C:\Documents and Settings\Thierry\Application Data\oedd.exeO4 - HKCU\..\Run: [Qqe] C:\WINDOWS\System32\w?nlogon.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXEO4 - Global Startup: Rappels du Calendrier Microsoft Works.lnk = ?O9 - Extra button: Search - {28EF6FA1-C04C-4FCE-901E-6D3A0D633184} - C:\WINDOWS\System32\Q2256015.dllO9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\TV\EXPLBAR.DLLO9 - Extra button: (no name) - {869EE607-5376-486d-8DAC-EDC8E239AD5F} - (no file)O9 - Extra button: Organise-notes - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Program Files\Fichiers communs\Microsoft Shared\Reference 2001\EROProj.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO9 - Extra button: (no name) - {869EE607-5376-486d-8DAC-EDC8E239AD5F} - (no file) (HKCU)O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS
pqtplugin2.dllO12 - Plugin for .mpg: C:\Program Files\Internet Explorer\PLUGINS
pqtplugin3.dllO13 - DefaultPrefix: O13 - WWW Prefix: O13 - Home Prefix: c:\searchpage.html?page=O13 - Mosaic Prefix: c:\searchpage.html?page=O15 - Trusted Zone: www.master69.bizO15 - Trusted Zone: www.sgrunt.bizO15 - Trusted Zone: www.yeak.netO16 - DPF: {00000000-0000-0000-0000-000020030000} - http://www.advnt01.com/dialer/france_new.exeO16 - DPF: {0594AF7E-573B-40DF-8165-E47AB2EAEFE8} (EGEGAUTH Class) - http://akamai.downloadv3.com/binaries/P2EClient/EGAUTH_1022_FR_XP.cabO16 - DPF: {093F9CF8-0DE1-491C-95D5-5EC257BD4CA3} - http://akamai.downloadv3.com/binaries/IA/dtc32_FR_XP.cabO16 - DPF: {0F9B4CA4-A30F-480A-841D-69B45C50A8F8} (SekureL0gin.SekureKontrol) - http://secure2.comned.com/signuptemplates/AktiveSekurity.cabO16 - DPF: {10000000-1000-0000-1000-000000000000} - file://C:\Program Files\Internet Explorerimmfeww.exeO16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/AgeVerifier/ie/bridge-c24.cabO16 - DPF: {2472DCCC-68CE-49DA-AA81-E7E6D83C1DFA} (PackageHTML) - http://acces.blonde.com/package/op/PackageHtmlCab.CABO16 - DPF: {469C7080-8EC8-43A6-AD97-45848113743C} - http://akamai.downloadv3.com/binaries/IA/nethv32_FR_XP.cabO16 - DPF: {50AD557E-3426-41FD-AFDD-2AF39BB1C387} - http://akamai.downloadv3.com/binaries/LiveService/LiveService_5_FR_XP.cabO16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/223678d8d5321e48c420/netzip/RdxIE601_fr.cabO16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20030625/qtinstall.info.apple.com/abarth/fr/win/QuickTimeInstaller.exeO16 - DPF: {79849612-A98F-45B8-95E9-4D13C7B6B35C} (Loader2 Control) - http://static.topconverting.com/activex/loader2.ocxO16 - DPF: {7DBFDA8E-D33B-11D4-9269-00600868E56E} (WWWInstall Class) - http://www.edipole.fr/kits/WebInstall.dllO16 - DPF: {9EAC0186-5F5A-4362-B120-15C312CE012D} - http://www.awmdabest.com/cabl/319/tb.cabO16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} (MediaTicketsInstaller Control) - http://www.mt-download.com/MediaTicketsInstaller.cabO16 - DPF: {A7F82252-EF7F-4E46-8595-84AE76D5FE03} (InstControl Class) - http://neo-toolbar.com/Inst.cabO16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cabO16 - DPF: {B5F016CF-23D9-40BC-B16A-2919C0886DD8} (NavolX Contrôle) - http://nsol.nordnet.fr/navol/navol.cabO16 - DPF: {C40F8F85-3FC3-4C0C-AD91-6A204FAAD59F} (UCInstall Class) - http://ultimatecleaner.com/install/UCInst.cabO16 - DPF: {C40F8F85-3FC3-4C0C-AD91-6A204FAAD5FF} (UCInstall Class) - http://ultimatecleaner.com/install_trial/UCInst_trial.cabO16 - DPF: {D1B80EBF-1A26-4FEC-B0B9-DCB934C6507E} - http://dialup.carpediem.fr/CABS/cd/1,0,3,8/fr/AccesMembre.cabO16 - DPF: {DDF44FD9-749F-4761-89BB-E8A59339E459} - http://akamai.downloadv3.com/binaries/LiveService/LiveService_9_FR_XP.cabO16 - DPF: {F57D17AE-CE37-4BC8-B232-EA57747BE5E7} - http://66.230.146.53/EPlugin.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{2BFF800F-B075-49E1-AC64-0D0D9CF6426D}: NameServer = 80.10.246.2,80.10.246.129O18 - Filter: text/html - {A40AF1AB-09A6-429A-8911-513102932D63} - C:\WINDOWS\System32\Q2256015.dllO18 - Filter: text/plain - {A40AF1AB-09A6-429A-8911-513102932D63} - C:\WINDOWS\System32\Q2256015.dll

bernie61 · Answer

salut
vu ceci http://www.liutilities.com/products/wintaskspro/processlibrary/winservad/
commence par désinstaller WinServAd complètement

redémarre ordi
repasse SpybotS&D
puis refais un HijackThis que l'on voie ce qui reste
a+

thierry · Answer

Bonjour Bernie61Je te remercie pour l'aide que tu m'apportes.J'ai désinstallé WinServAd.Après avoir redémarrer l'avoir, j'ai relancé Spybot : j'ai fixé 4 fichiers DSO Exploit et 2 Common Hijacker, mais qui reviennent systématiquement dès que je lance Spybot (?).Et voici mon nouvel HijackThis.a+ThierryLogfile of HijackThis v1.98.2Scan saved at 11:50:48, on 29/01/2005Platform: Windows XP  (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 (6.00.2600.0000)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\Explorer.EXEC:\PROGRA~1\MESSAG~1\StartMessager.exeC:\WINDOWS\System32\atiptaxx.exeC:\Program Files\ahead\InCD\InCD.exeC:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exeC:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exeC:\Program Files\ATI Multimedia\RemCtrl\ATIX10.exeC:\Program Files\Fichiers communs\Real\Update_OBealsched.exeC:\Program Files\Securitoo\av_fw\Common\FSM32.EXEC:\WINDOWS\System32\ctfmon.exeC:\Documents and Settings\Thierry\Application Data\oedd.exeC:\WINDOWS\System32\w?nlogon.exeC:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exeC:\WINDOWS\System32undll32.exeC:\PROGRA~1\SECURI~1\av_fw\backweb\1044199\Program\SERVIC~1.EXEC:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exeC:\Program Files\Securitoo\av_fw\Anti-Virus\FSGK32.EXEC:\Program Files\Securitoo\av_fw\backweb\1044199\program\fsbwsys.exeC:\Program Files\Securitoo\av_fw\Anti-Virus\fssm32.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Securitoo\av_fw\Common\FSMA32.EXEC:\Program Files\Securitoo\av_fw\Common\FSMB32.EXEC:\Program Files\Securitoo\av_fw\backweb\1044199\Program\BackWeb-1044199.exeC:\Program Files\Securitoo\av_fw\Common\FCH32.EXEC:\Program Files\Securitoo\av_fw\Common\FAMEH32.EXEC:\Program Files\Securitoo\av_fw\Anti-Virus\fsav32.exeC:\Program Files\Securitoo\av_fw\DFW\Program\fsdfwd.exeC:\WINDOWS\System32\wuauclt.exeC:\Documents and Settings\Thierry\Mes documents\Hijack\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer,Search = c:\searchpage.htmlR1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = c:\searchpage.htmlR1 - HKLM\Software\Microsoft\Internet Explorer,Search = c:\searchpage.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\searchpage.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = c:\searchpage.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.richfind.com/ie/R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.richfind.com/ie/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://lookfor.cc?pin=52409R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://lookfor.cc/sp.php?pin=52409R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.richfind.com/ie/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.richfind.com/ie/R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.richfind.com/ie/R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = c:\searchpage.htmlR0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.richfind.com/ie/R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhostR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensR3 - URLSearchHook: Search - {2D13A0CA-D1D5-45E4-ABAA-C5B9AF1F0E46} - C:\WINDOWS\System32\Q2256015.dllO1 - Hosts: 127.0.0.0 localhostO1 - Hosts: 127.0.0.2 auditmypc.comO1 - Hosts: 127.0.0.3 boards.cexx.orgO1 - Hosts: 127.0.0.4 bulletproofsoft.netO1 - Hosts: 127.0.0.5 camtech2000.netO1 - Hosts: 127.0.0.6 cexx.orgO1 - Hosts: 127.0.0.7 computercops.usO1 - Hosts: 127.0.0.8 ct7support.comO1 - Hosts: 127.0.0.9 doxdesk.comO1 - Hosts: 127.0.0.20 kellys-korner-xp.comO1 - Hosts: 127.0.0.21 kephyr.comO1 - Hosts: 127.0.0.22 lavasoft.deO1 - Hosts: 127.0.0.23 lavasoftusa.comO1 - Hosts: 127.0.0.24 lurkhere.comO1 - Hosts: 127.0.0.25 majorgeeks.comO1 - Hosts: 127.0.0.26 merijn.orgO1 - Hosts: 127.0.0.27 mjc1.comO1 - Hosts: 127.0.0.28 moosoft.comO1 - Hosts: 127.0.0.29 mvps.orgO1 - Hosts: 127.0.0.30 net-integration.netO1 - Hosts: 127.0.0.31 noadware.netO1 - Hosts: 127.0.0.32 no-spybot.comO1 - Hosts: 127.0.0.33 onlinepcfix.comO1 - Hosts: 127.0.0.34 pchell.comO1 - Hosts: 127.0.0.35 pestpatrol.comO1 - Hosts: 127.0.0.36 safer-networking.orgO1 - Hosts: 127.0.0.37 secure.spykiller.comO1 - Hosts: 127.0.0.38 secureie.comO1 - Hosts: 127.0.0.39 security.kolla.deO1 - Hosts: 127.0.0.40 spybot.infoO1 - Hosts: 127.0.0.41 spychecker.comO1 - Hosts: 127.0.0.42 spychecker.comO1 - Hosts: 127.0.0.43 spycop.comO1 - Hosts: 127.0.0.44 spyguard.comO1 - Hosts: 127.0.0.45 spykiller.comO1 - Hosts: 127.0.0.46 spyware.co.ukO1 - Hosts: 127.0.0.47 spyware-cop.comO1 - Hosts: 127.0.0.48 spywareinfo.comO1 - Hosts: 127.0.0.49 spywarenuker.comO1 - Hosts: 127.0.0.50 spywareremove.comO1 - Hosts: 127.0.0.51 spywareremove.comO1 - Hosts: 127.0.0.52 stopzillapro.comO1 - Hosts: 127.0.0.53 sunbelt-software.comO1 - Hosts: 127.0.0.54 thiefware.comO1 - Hosts: 127.0.0.55 tomcoyote.orgO1 - Hosts: 127.0.0.56 unwantedlinks.comO1 - Hosts: 127.0.0.57 webattack.comO1 - Hosts: 127.0.0.58 wilders.orgO1 - Hosts: 127.0.0.59 www.auditmypc.comO1 - Hosts: 127.0.0.60 www.bulletproofsoft.netO1 - Hosts: 127.0.0.61 www.cexx.orgO1 - Hosts: 127.0.0.62 www.computercops.usO1 - Hosts: 127.0.0.63 www.ct7support.comO1 - Hosts: 127.0.0.64 www.doxdesk.comO1 - Hosts: 127.0.0.65 www.eblocs.comO1 - Hosts: 127.0.0.66 www.enigmasoftwaregroup.comO1 - Hosts: 127.0.0.67 www.free-spyware-scan.comO1 - Hosts: 127.0.0.68 www.free-web-browsers.comO1 - Hosts: 127.0.0.69 www.grc.comO1 - Hosts: 127.0.0.70 www.grisoft.comO1 - Hosts: 127.0.0.71 www.hackfaq.orgO1 - Hosts: 127.0.0.72 www.hazeleger.netO1 - Hosts: 127.0.0.73 www.javacoolsoftware.comO1 - Hosts: 127.0.0.74 www.kellys-korner-xp.comO1 - Hosts: 127.0.0.75 www.kephyr.comO1 - Hosts: 127.0.0.76 www.lavasoft.deO1 - Hosts: 127.0.0.77 www.lavasoftusa.comO1 - Hosts: 127.0.0.78 www.lurkhere.comO1 - Hosts: 127.0.0.79 www.majorgeeks.comO1 - Hosts: 127.0.0.80 www.merijn.orgO1 - Hosts: 127.0.0.81 www.mjc1.comO1 - Hosts: 127.0.0.82 www.moosoft.comO1 - Hosts: 127.0.0.83 www.mvps.orgO1 - Hosts: 127.0.0.84 www.net-integration.netO1 - Hosts: 127.0.0.85 www.noadware.netO1 - Hosts: 127.0.0.86 www.no-spybot.comO1 - Hosts: 127.0.0.87 www.onlinepcfix.comO1 - Hosts: 127.0.0.88 www.pchell.comO1 - Hosts: 127.0.0.89 www.pestpatrol.comO1 - Hosts: 127.0.0.90 www.safer-networking.orgO1 - Hosts: 127.0.0.91 www.secureie.comO1 - Hosts: 127.0.0.92 www.security.kolla.deO1 - Hosts: 127.0.0.93 www.spybot.infoO1 - Hosts: 127.0.0.94 www.spychecker.comO1 - Hosts: 127.0.0.95 www.spychecker.comO1 - Hosts: 127.0.0.96 www.spycop.comO1 - Hosts: 127.0.0.97 www.spyguard.comO1 - Hosts: 127.0.0.98 www.spykiller.comO1 - Hosts: 127.0.0.99 www.spyware.co.ukO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocxO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: Search - {5EACD631-CB25-49E3-9C78-10D1ADE03AC4} - C:\WINDOWS\System32\Q2256015.dllO2 - BHO: (no name) - {6928C1AF-7898-40BB-9530-1C83C6912CE7} - C:\WINDOWS\System32\ilpjbb.dll (file missing)O2 - BHO: (no name) - {9F704262-80F1-8E29-D93A-8D4DFFAF2CC1} - C:\WINDOWS\System32\vvxmlsc.dllO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocxO3 - Toolbar: Search - {28EF6FA1-C04C-4FCE-901E-6D3A0D633184} - C:\WINDOWS\System32\Q2256015.dllO4 - HKLM\..\Run: [MessagerStarter Wanadoo] C:\PROGRA~1\MESSAG~1\StartMessager.exe Messager WanadooO4 - HKLM\..\Run: [AtiPTA] atiptaxx.exeO4 - HKLM\..\Run: [InCD] C:\Program Files\ahead\InCD\InCD.exeO4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exeO4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exeO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [Regx10EXE] C:\Program Files\ATI Multimedia\RemCtrl\ATIX10.exeO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osbootO4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [Connector] C:\WINDOWS\System32\ShellExt\ATX001.EXE -nO4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Securitoo\av_fw\Common\FSM32.EXE" /splashO4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Securitoo\av_fw\TNB\TNBUtil.exe" /CHECKALLO4 - HKLM\..\Run: [xshwh] C:\WINDOWS\xshwh.exeO4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exeO4 - HKCU\..\Run: [Microsoft Works Update Detection] \WkDetect.exeO4 - HKCU\..\Run: [ixplore] "C:\Program Files\Internet Explorer\ixplore.exe"O4 - HKCU\..\Run: [Aout] C:\Documents and Settings\Thierry\Application Data\oedd.exeO4 - HKCU\..\Run: [Qqe] C:\WINDOWS\System32\w?nlogon.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXEO4 - Global Startup: Rappels du Calendrier Microsoft Works.lnk = ?O9 - Extra button: Search - {28EF6FA1-C04C-4FCE-901E-6D3A0D633184} - C:\WINDOWS\System32\Q2256015.dllO9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\TV\EXPLBAR.DLLO9 - Extra button: (no name) - {869EE607-5376-486d-8DAC-EDC8E239AD5F} - (no file)O9 - Extra button: Organise-notes - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Program Files\Fichiers communs\Microsoft Shared\Reference 2001\EROProj.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO9 - Extra button: (no name) - {869EE607-5376-486d-8DAC-EDC8E239AD5F} - (no file) (HKCU)O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS
pqtplugin2.dllO12 - Plugin for .mpg: C:\Program Files\Internet Explorer\PLUGINS
pqtplugin3.dllO13 - DefaultPrefix: O13 - WWW Prefix: O13 - Home Prefix: c:\searchpage.html?page=O13 - Mosaic Prefix: c:\searchpage.html?page=O15 - Trusted Zone: www.master69.bizO15 - Trusted Zone: www.sgrunt.bizO15 - Trusted Zone: www.yeak.netO16 - DPF: {00000000-0000-0000-0000-000020030000} - http://www.advnt01.com/dialer/france_new.exeO16 - DPF: {0594AF7E-573B-40DF-8165-E47AB2EAEFE8} (EGEGAUTH Class) - http://akamai.downloadv3.com/binaries/P2EClient/EGAUTH_1022_FR_XP.cabO16 - DPF: {093F9CF8-0DE1-491C-95D5-5EC257BD4CA3} - http://akamai.downloadv3.com/binaries/IA/dtc32_FR_XP.cabO16 - DPF: {0F9B4CA4-A30F-480A-841D-69B45C50A8F8} (SekureL0gin.SekureKontrol) - http://secure2.comned.com/signuptemplates/AktiveSekurity.cabO16 - DPF: {10000000-1000-0000-1000-000000000000} - file://C:\Program Files\Internet Explorerimmfeww.exeO16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/AgeVerifier/ie/bridge-c24.cabO16 - DPF: {2472DCCC-68CE-49DA-AA81-E7E6D83C1DFA} (PackageHTML) - http://acces.blonde.com/package/op/PackageHtmlCab.CABO16 - DPF: {469C7080-8EC8-43A6-AD97-45848113743C} - http://akamai.downloadv3.com/binaries/IA/nethv32_FR_XP.cabO16 - DPF: {50AD557E-3426-41FD-AFDD-2AF39BB1C387} - http://akamai.downloadv3.com/binaries/LiveService/LiveService_5_FR_XP.cabO16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/223678d8d5321e48c420/netzip/RdxIE601_fr.cabO16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20030625/qtinstall.info.apple.com/abarth/fr/win/QuickTimeInstaller.exeO16 - DPF: {79849612-A98F-45B8-95E9-4D13C7B6B35C} (Loader2 Control) - http://static.topconverting.com/activex/loader2.ocxO16 - DPF: {7DBFDA8E-D33B-11D4-9269-00600868E56E} (WWWInstall Class) - http://www.edipole.fr/kits/WebInstall.dllO16 - DPF: {9EAC0186-5F5A-4362-B120-15C312CE012D} - http://www.awmdabest.com/cabl/319/tb.cabO16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} (MediaTicketsInstaller Control) - http://www.mt-download.com/MediaTicketsInstaller.cabO16 - DPF: {A7F82252-EF7F-4E46-8595-84AE76D5FE03} (InstControl Class) - http://neo-toolbar.com/Inst.cabO16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cabO16 - DPF: {B5F016CF-23D9-40BC-B16A-2919C0886DD8} (NavolX Contrôle) - http://nsol.nordnet.fr/navol/navol.cabO16 - DPF: {C40F8F85-3FC3-4C0C-AD91-6A204FAAD59F} (UCInstall Class) - http://ultimatecleaner.com/install/UCInst.cabO16 - DPF: {C40F8F85-3FC3-4C0C-AD91-6A204FAAD5FF} (UCInstall Class) - http://ultimatecleaner.com/install_trial/UCInst_trial.cabO16 - DPF: {D1B80EBF-1A26-4FEC-B0B9-DCB934C6507E} - http://dialup.carpediem.fr/CABS/cd/1,0,3,8/fr/AccesMembre.cabO16 - DPF: {DDF44FD9-749F-4761-89BB-E8A59339E459} - http://akamai.downloadv3.com/binaries/LiveService/LiveService_9_FR_XP.cabO16 - DPF: {F57D17AE-CE37-4BC8-B232-EA57747BE5E7} - http://66.230.146.53/EPlugin.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{2BFF800F-B075-49E1-AC64-0D0D9CF6426D}: NameServer = 80.10.246.2,80.10.246.129O18 - Filter: text/html - {A40AF1AB-09A6-429A-8911-513102932D63} - C:\WINDOWS\System32\Q2256015.dllO18 - Filter: text/plain - {A40AF1AB-09A6-429A-8911-513102932D63} - C:\WINDOWS\System32\Q2256015.dll

bernie61 · Answer

salut
Fais rechercher puis vérifier Propriétés de ceux-ci, si inconnu (de toi ou non placé par toi) à Zipper (comprimer avec WinZip ou WinRar) puis effacer le .exe

C:\Documents and Settings\Thierry\Application Data\oedd.exe
C:\WINDOWS\xshwh.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Reference 2001\EROProj.dll

A effacer
C:\WINDOWS\System32\w?nlogon.exe
C:\WINDOWS\System32\Q2256015.dll
C:\WINDOWS\System32\vvxmlsc.dll
C:\Program Files\Internet Explorer\ixplore.exe"

Relances HijackThis et cocher toutes ces lignes, puis FIX :
R1 - HKCU\Software\Microsoft\Internet Explorer,Search = c:\searchpage.html
Et coche aussi TOUTES autres lignes R1

R3 - URLSearchHook: Search - {2D13A0CA-D1D5-45E4-ABAA-C5B9AF1F0E46} - C:\WINDOWS\System32\Q2256015.dll
O1 - Hosts: 127.0.0.0 localhost et TOUTES autres lignes O1 aussi à cocher

O2 - BHO: Search - {5EACD631-CB25-49E3-9C78-10D1ADE03AC4} - C:\WINDOWS\System32\Q2256015.dll
O2 - BHO: (no name) - {6928C1AF-7898-40BB-9530-1C83C6912CE7} - C:\WINDOWS\System32\ilpjbb.dll (file missing)
O2 - BHO: (no name) - {9F704262-80F1-8E29-D93A-8D4DFFAF2CC1} - C:\WINDOWS\System32\vvxmlsc.dll
O3 - Toolbar: Search - {28EF6FA1-C04C-4FCE-901E-6D3A0D633184} - C:\WINDOWS\System32\Q2256015.dll
O4 - HKLM\..\Run: [xshwh] C:\WINDOWS\xshwh.exe
O4 - HKCU\..\Run: [ixplore] "C:\Program Files\Internet Explorer\ixplore.exe"
O4 - HKCU\..\Run: [Aout] C:\Documents and Settings\Thierry\Application Data\oedd.exe > si inconnu
O4 - HKCU\..\Run: [Qqe] C:\WINDOWS\System32\w?nlogon.exe
O9 - Extra button: Search - {28EF6FA1-C04C-4FCE-901E-6D3A0D633184} - C:\WINDOWS\System32\Q2256015.dll

O9 - Extra button: (no name) - {869EE607-5376-486d-8DAC-EDC8E239AD5F} - (no file)

O9 - Extra button: Organise-notes - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Program Files\Fichiers communs\Microsoft Shared\Reference 2001\EROProj.dll > si inconnu
O9 - Extra button: (no name) - {869EE607-5376-486d-8DAC-EDC8E239AD5F} - (no file) (HKCU)
O13 - DefaultPrefix: > à cocher et TOUTES autres O13 et O15 aussi

O16 - DPF: {00000000-0000-0000-0000-000020030000} - http://www.advnt01.com/dialer/france_new.exe
O16 - DPF: {0594AF7E-573B-40DF-8165-E47AB2EAEFE8} (EGEGAUTH Class) - http://akamai.downloadv3.com/binaries/P2EClient/EGAUTH_1022_FR_XP.cab

O16 - DPF: {2472DCCC-68CE-49DA-AA81-E7E6D83C1DFA} (PackageHTML) - http://acces.blonde.com/package/op/PackageHtmlCab.CAB
O16 - DPF: {10000000-1000-0000-1000-000000000000} - file://C:\Program Files\Internet Explorer\rimmfeww.exe
O16 - DPF: {7DBFDA8E-D33B-11D4-9269-00600868E56E} (WWWInstall Class) - http://www.edipole.fr/kits/WebInstall.dll
O16 - DPF: {F57D17AE-CE37-4BC8-B232-EA57747BE5E7} - http://66.230.146.53/EPlugin.cab
O18 - Filter: text/html - {A40AF1AB-09A6-429A-8911-513102932D63} - C:\WINDOWS\System32\Q2256015.dll
O18 - Filter: text/plain - {A40AF1AB-09A6-429A-8911-513102932D63} - C:\WINDOWS\System32\Q2256015.dll

ensuite redémarre et refais un HijackThis
a+

stifleur · Answer

pour les pb de barre ,cherche sur le forum c'est un sujet courant que j'ai egalement deja traité je vais pas le repeté a chacun.merci

bernie61 · Answer

re salut
Fais rechercher puis vérifier Propriétés de ceux-ci, si inconnu (de toi ou non placé par toi) à Zipper (comprimer avec WinZip ou WinRar) puis effacer le .exe
C:\WINDOWS\System32\ShellExt\ATX001.EXE –n > car suspect

Relances HijackThis et cocher toutes ces lignes, puis FIX :

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.richfind.com/ie/
O4 - HKLM\..\Run: [Connector] C:\WINDOWS\System32\ShellExt\ATX001.EXE –n >> si inconnnu

O16 - DPF: {9EAC0186-5F5A-4362-B120-15C312CE012D} - http://www.awmdabest.com/cabl/319/tb.cab
O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} (MediaTicketsInstaller Control) - http://www.mt-download.com/MediaTicketsInstaller.cab

O16 - DPF: {D1B80EBF-1A26-4FEC-B0B9-DCB934C6507E} - http://dialup.carpediem.fr/CABS/cd/1,0,3,8/fr/AccesMembre.cab

a+

moe · Answer

salut thierry, bernie61

Tu peux fixer tous les 016
sauf ces 3 qui sont cleans.

O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/223678d8d5321e48c420/netzip/RdxIE601_fr.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20030625/qtinstall.info.apple.com/abarth/fr/win/QuickTimeInstaller.exe

Refais un scan apres un redemarrage , pour vérifier si tout et ok

Installe aussi un firewall:
http://www.firewall-net.com/fr/
et lis ceci:
http://sebsauvage.net/safehex.html

Logfile of HijackThis v1.98.2
Scan saved at 21:17:25, on 29/01/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000) <= va d'urgence faire tes mises à jours windows.

Tu peux aussi télécharger une version +récente d'hijackthis ici:
http://telechargement.zebulon.fr/138-HijackThis-1.99.html
L'aide est ici:
http://www.zebulon.fr/articles/HijackThis.php

a+

moe · Answer

salut pierreApparement, ton log est pas mal.Reste plus qu'a faire tes mises a jours windowsa+

moe · Answer

salut thierry

Désolé pour la confusion..

Tu peux réessayer d'installer le sp2.
Crée un point de restauration système avant, en cas de plantage ca peut toujours aider.
http://www.microsoft.com/france/windows/xp/sp2/sp2_whattoknow.mspx

a+

Problème SEARCH barre outils

8 réponses

Discussions similaires

Newsletters