[troyen] demande d'avis sur log

Est-ce que quelqu'un peut me dire ce qui reste comme troyen sur mon ordi?
merci

Logfile of HijackThis v1.99.1
Scan saved at 10:00:25, on 21/06/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\WINNT\System32\ctfmon.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\HP DeskJet 720C Series v10.3\ereg\Remind32.exe
C:\WINNT\Explorer.exe
C:\Program Files\eMule\emule.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\WINNT\System32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Administrateur\Mes documents\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.begin2search.com/sidesearch.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.begin2search.com/sidesearch.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.begin2search.com/sidesearch.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\WANADOO\SEARCH~1.DLL
F2 - REG:system.ini: Shell=Explorer.exe C:\WINNT\Nail.exe
O1 - Hosts: 216.130.185.143 websearch.com
O1 - Hosts: 216.130.185.143 www.websearch.com
O1 - Hosts: 216.130.185.143 websearch.com
O1 - Hosts: 216.130.185.143 websearch.com
O1 - Hosts: 216.130.185.143 www.adwave.com
O1 - Hosts: 216.130.185.143 adwave.com
O1 - Hosts: 216.130.185.143 www.xzoomy.com
O1 - Hosts: 216.130.185.143 xzoomy.com
O1 - Hosts: 216.130.185.143 www.advnt01.com
O1 - Hosts: 216.130.185.143 advnt01.com
O1 - Hosts: 216.130.185.143 websearch.com
O1 - Hosts: 216.130.185.143 www.adwave.com
O1 - Hosts: 216.130.185.143 adwave.com
O1 - Hosts: 216.130.185.143 www.xzoomy.com
O1 - Hosts: 216.130.185.143 xzoomy.com
O1 - Hosts: 216.130.185.143 www.advnt01.com
O1 - Hosts: 216.130.185.143 advnt01.com
O1 - Hosts: 216.130.185.143 websearch.com
O1 - Hosts: 216.130.185.143 www.adwave.com
O1 - Hosts: 216.130.185.143 adwave.com
O1 - Hosts: 216.130.185.143 www.xzoomy.com
O1 - Hosts: 216.130.185.143 xzoomy.com
O1 - Hosts: 216.130.185.143 www.advnt01.com
O1 - Hosts: 216.130.185.143 advnt01.com
O1 - Hosts: 216.130.185.143 websearch.com
O1 - Hosts: 216.130.185.143 www.adwave.com
O1 - Hosts: 216.130.185.143 adwave.com
O1 - Hosts: 216.130.185.143 www.xzoomy.com
O1 - Hosts: 216.130.185.143 xzoomy.com
O1 - Hosts: 216.130.185.143 www.advnt01.com
O1 - Hosts: 216.130.185.143 advnt01.com
O1 - Hosts: 216.130.185.143 websearch.com
O1 - Hosts: 216.130.185.143 www.adwave.com
O1 - Hosts: 216.130.185.143 www.adwave.com
O1 - Hosts: 216.130.185.143 adwave.com
O1 - Hosts: 216.130.185.143 adwave.com
O1 - Hosts: 216.130.185.143 www.xzoomy.com
O1 - Hosts: 216.130.185.143 xzoomy.com
O1 - Hosts: 216.130.185.143 www.advnt01.com
O1 - Hosts: 216.130.185.143 advnt01.com
O1 - Hosts: 216.130.185.143 websearch.com
O1 - Hosts: 216.130.185.143 www.adwave.com
O1 - Hosts: 216.130.185.143 adwave.com
O1 - Hosts: 216.130.185.143 www.xzoomy.com
O1 - Hosts: 216.130.185.143 xzoomy.com
O1 - Hosts: 216.130.185.143 www.advnt01.com
O1 - Hosts: 216.130.185.143 advnt01.com
O1 - Hosts: 216.130.185.143 websearch.com
O1 - Hosts: 216.130.185.143 www.adwave.com
O1 - Hosts: 216.130.185.143 adwave.com
O1 - Hosts: 216.130.185.143 www.xzoomy.com
O1 - Hosts: 216.130.185.143 xzoomy.com
O1 - Hosts: 216.130.185.143 www.advnt01.com
O1 - Hosts: 216.130.185.143 advnt01.com
O1 - Hosts: 216.130.185.143 websearch.com
O1 - Hosts: 216.130.185.143 www.adwave.com
O1 - Hosts: 216.130.185.143 adwave.com
O1 - Hosts: 216.130.185.143 www.xzoomy.com
O1 - Hosts: 216.130.185.143 xzoomy.com
O1 - Hosts: 216.130.185.143 www.advnt01.com
O1 - Hosts: 216.130.185.143 advnt01.com
O1 - Hosts: 216.130.185.143 www.adwave.com
O1 - Hosts: 216.130.185.143 adwave.com
O1 - Hosts: 216.130.185.143 www.xzoomy.com
O1 - Hosts: 216.130.185.143 xzoomy.com
O1 - Hosts: 216.130.185.143 www.advnt01.com
O1 - Hosts: 216.130.185.143 advnt01.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Saristar - {C68AE9C0-0909-4DDC-B661-C1AFB9F5AE50} - C:\WINNT\System32\saristar.dll (file missing)
O3 - Toolbar: (no name) - {52FE5233-367C-4EFB-BDD7-0BE4D212C107} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NsUpdate] C:\WINNT\NsUpdate.exe UPDATE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [hpfsched] C:\WINNT\hpfsched.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINNT\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Reminder-hpc41001.lnk = C:\Program Files\HP DeskJet 720C Series v10.3\ereg\Remind32.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe (file missing)
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.wanadoo.fr (file missing) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {05D96F71-87C6-11D3-9BE4-00902742D6E0} (QuickPlace Class) - http://ieptice.upmf-grenoble.fr/qp2.cab
O16 - DPF: {2472DCCC-68CE-49DA-AA81-E7E6D83C1DFA} (PackageHTML) - http://acces.blonde.com/package/op/PackageHtmlCab.CAB
O16 - DPF: {31DDC1FD-CEA3-4837-A6DC-87E67015ADC9} - http://akamai.downloadv3.com/binaries/IA/svcsysnet32_FR_XP.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O18 - Filter: text/html - {23A10632-7101-4C25-98DC-A4ADBB25F5C9} - C:\Documents and Settings\Administrateur\Local Settings\Application Data\microsoft\internet explorer\V0.28.dat
O23 - Service: Service Framework McAfee (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINNT\svcproc.exe

3 réponses

  • Votes
  • Date
  • Date décroissante
  1. Salut amandine j'ai une mauvais nouvelle ton log est pouri lol
    commence par telecharger c programes pour faire un peu de ménage

    (spy bot)
    1/Spybot S&D 1.4 <<nouvelle version
    http://www.safer-networking.org/fr/download/index.html

    (adaware)

    2/Ad-Aware SE 1.06 <<nouvelle version
    http://www.lavasoftusa.com/software/adaware/

    (A2free)
    http://www.emsisoft.net/fr/

    pense a les mettre a jour avant de les lancée c'est tres important

    ensuite supprime vide le cache d'internet explorer generalement c'est la ou les spywares se loge

    ouvre Internet Explorer, clique sur le menu "Outils", puis "internet explorer options", ensuite clique sur "supprimer les fichiers" et coche " suprimé tout le contenu hors connexion" , à la fin clique sur "Supprimer les cookies".

    ensuite refait un hijack et collle le resultat ici

    @++++++
    1. Voila j'ai fait tout ce que tu m'as dit
      alors ça donne quoi?

      Logfile of HijackThis v1.99.1
      Scan saved at 12:21:29, on 21/06/2005
      Platform: Windows XP (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 (6.00.2600.0000)

      Running processes:
      C:\WINNT\System32\smss.exe
      C:\WINNT\system32\winlogon.exe
      C:\WINNT\system32\services.exe
      C:\WINNT\system32\lsass.exe
      C:\WINNT\system32\svchost.exe
      C:\WINNT\System32\svchost.exe
      C:\WINNT\system32\spoolsv.exe
      C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
      C:\Program Files\Network Associates\VirusScan\Mcshield.exe
      C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
      C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
      C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
      C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
      C:\WINNT\System32\svchost.exe
      C:\WINNT\System32\ctfmon.exe
      C:\Program Files\Messenger\msmsgs.exe
      C:\Program Files\WinZip\WZQKPICK.EXE
      C:\Program Files\HP DeskJet 720C Series v10.3\ereg\Remind32.exe
      C:\WINNT\System32\wuauclt.exe
      C:\WINNT\Explorer.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Documents and Settings\Administrateur\Mes documents\HijackThis.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.begin2search.com/sidesearch.html
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.begin2search.com/sidesearch.html
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr/
      R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.begin2search.com/sidesearch.html
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
      R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\WANADOO\SEARCH~1.DLL
      F2 - REG:system.ini: Shell=Explorer.exe C:\WINNT\Nail.exe
      O1 - Hosts: 216.130.185.143 websearch.com
      O1 - Hosts: 216.130.185.143 websearch.com
      O1 - Hosts: 216.130.185.143 websearch.com
      O1 - Hosts: 216.130.185.143 www.adwave.com
      O1 - Hosts: 216.130.185.143 adwave.com
      O1 - Hosts: 216.130.185.143 www.xzoomy.com
      O1 - Hosts: 216.130.185.143 xzoomy.com
      O1 - Hosts: 216.130.185.143 www.advnt01.com
      O1 - Hosts: 216.130.185.143 advnt01.com
      O1 - Hosts: 216.130.185.143 websearch.com
      O1 - Hosts: 216.130.185.143 www.adwave.com
      O1 - Hosts: 216.130.185.143 adwave.com
      O1 - Hosts: 216.130.185.143 www.xzoomy.com
      O1 - Hosts: 216.130.185.143 xzoomy.com
      O1 - Hosts: 216.130.185.143 www.advnt01.com
      O1 - Hosts: 216.130.185.143 advnt01.com
      O1 - Hosts: 216.130.185.143 websearch.com
      O1 - Hosts: 216.130.185.143 www.adwave.com
      O1 - Hosts: 216.130.185.143 adwave.com
      O1 - Hosts: 216.130.185.143 www.xzoomy.com
      O1 - Hosts: 216.130.185.143 xzoomy.com
      O1 - Hosts: 216.130.185.143 www.advnt01.com
      O1 - Hosts: 216.130.185.143 advnt01.com
      O1 - Hosts: 216.130.185.143 websearch.com
      O1 - Hosts: 216.130.185.143 www.adwave.com
      O1 - Hosts: 216.130.185.143 adwave.com
      O1 - Hosts: 216.130.185.143 www.xzoomy.com
      O1 - Hosts: 216.130.185.143 xzoomy.com
      O1 - Hosts: 216.130.185.143 www.advnt01.com
      O1 - Hosts: 216.130.185.143 advnt01.com
      O1 - Hosts: 216.130.185.143 websearch.com
      O1 - Hosts: 216.130.185.143 www.adwave.com
      O1 - Hosts: 216.130.185.143 www.adwave.com
      O1 - Hosts: 216.130.185.143 adwave.com
      O1 - Hosts: 216.130.185.143 adwave.com
      O1 - Hosts: 216.130.185.143 www.xzoomy.com
      O1 - Hosts: 216.130.185.143 xzoomy.com
      O1 - Hosts: 216.130.185.143 www.advnt01.com
      O1 - Hosts: 216.130.185.143 advnt01.com
      O1 - Hosts: 216.130.185.143 websearch.com
      O1 - Hosts: 216.130.185.143 www.adwave.com
      O1 - Hosts: 216.130.185.143 adwave.com
      O1 - Hosts: 216.130.185.143 www.xzoomy.com
      O1 - Hosts: 216.130.185.143 xzoomy.com
      O1 - Hosts: 216.130.185.143 www.advnt01.com
      O1 - Hosts: 216.130.185.143 advnt01.com
      O1 - Hosts: 216.130.185.143 websearch.com
      O1 - Hosts: 216.130.185.143 www.adwave.com
      O1 - Hosts: 216.130.185.143 adwave.com
      O1 - Hosts: 216.130.185.143 www.xzoomy.com
      O1 - Hosts: 216.130.185.143 xzoomy.com
      O1 - Hosts: 216.130.185.143 www.advnt01.com
      O1 - Hosts: 216.130.185.143 advnt01.com
      O1 - Hosts: 216.130.185.143 www.adwave.com
      O1 - Hosts: 216.130.185.143 adwave.com
      O1 - Hosts: 216.130.185.143 www.xzoomy.com
      O1 - Hosts: 216.130.185.143 xzoomy.com
      O1 - Hosts: 216.130.185.143 www.advnt01.com
      O1 - Hosts: 216.130.185.143 advnt01.com
      O1 - Hosts: 216.130.185.143 www.adwave.com
      O1 - Hosts: 216.130.185.143 adwave.com
      O1 - Hosts: 216.130.185.143 www.xzoomy.com
      O1 - Hosts: 216.130.185.143 xzoomy.com
      O1 - Hosts: 216.130.185.143 www.advnt01.com
      O1 - Hosts: 216.130.185.143 advnt01.com
      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
      O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
      O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
      O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
      O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
      O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
      O4 - HKLM\..\Run: [hpfsched] C:\WINNT\hpfsched.exe
      O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINNT\System32\ctfmon.exe
      O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
      O4 - Startup: Reminder-hpc41001.lnk = C:\Program Files\HP DeskJet 720C Series v10.3\ereg\Remind32.exe
      O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
      O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe (file missing)
      O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.wanadoo.fr (file missing) (HKCU)
      O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
      O16 - DPF: {05D96F71-87C6-11D3-9BE4-00902742D6E0} (QuickPlace Class) - http://ieptice.upmf-grenoble.fr/qp2.cab
      O16 - DPF: {2472DCCC-68CE-49DA-AA81-E7E6D83C1DFA} (PackageHTML) - http://acces.blonde.com/package/op/PackageHtmlCab.CAB
      O16 - DPF: {31DDC1FD-CEA3-4837-A6DC-87E67015ADC9} - http://akamai.downloadv3.com/binaries/IA/svcsysnet32_FR_XP.cab
      O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
      O18 - Filter: text/html - {23A10632-7101-4C25-98DC-A4ADBB25F5C9} - C:\Documents and Settings\Administrateur\Local Settings\Application Data\microsoft\internet explorer\V0.28.dat
      O23 - Service: Service Framework McAfee (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
      O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
      O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
      O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINNT\svcproc.exe (file missing)
      1. Salut lance hijackthis . coche c lignes et clike sur fix checked

        R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.begin2search.com/sidesearch.html
        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.begin2search.com/sidesearch.html
        R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.begin2search.com/sidesearch.html

        F2 - REG:system.ini: Shell=Explorer.exe C:\WINNT\Nail.exe
        O1 - Hosts: 216.130.185.143 websearch.com
        O1 - Hosts: 216.130.185.143 www.websearch.com
        O1 - Hosts: 216.130.185.143 websearch.com
        O1 - Hosts: 216.130.185.143 websearch.com
        O1 - Hosts: 216.130.185.143 www.adwave.com
        O1 - Hosts: 216.130.185.143 adwave.com
        O1 - Hosts: 216.130.185.143 www.xzoomy.com
        O1 - Hosts: 216.130.185.143 xzoomy.com
        O1 - Hosts: 216.130.185.143 www.advnt01.com
        O1 - Hosts: 216.130.185.143 advnt01.com
        O1 - Hosts: 216.130.185.143 websearch.com
        O1 - Hosts: 216.130.185.143 www.adwave.com
        O1 - Hosts: 216.130.185.143 adwave.com
        O1 - Hosts: 216.130.185.143 www.xzoomy.com
        O1 - Hosts: 216.130.185.143 xzoomy.com
        O1 - Hosts: 216.130.185.143 www.advnt01.com
        O1 - Hosts: 216.130.185.143 advnt01.com
        O1 - Hosts: 216.130.185.143 websearch.com
        O1 - Hosts: 216.130.185.143 www.adwave.com
        O1 - Hosts: 216.130.185.143 adwave.com
        O1 - Hosts: 216.130.185.143 www.xzoomy.com
        O1 - Hosts: 216.130.185.143 xzoomy.com
        O1 - Hosts: 216.130.185.143 www.advnt01.com
        O1 - Hosts: 216.130.185.143 advnt01.com
        O1 - Hosts: 216.130.185.143 websearch.com
        O1 - Hosts: 216.130.185.143 www.adwave.com
        O1 - Hosts: 216.130.185.143 adwave.com
        O1 - Hosts: 216.130.185.143 www.xzoomy.com
        O1 - Hosts: 216.130.185.143 xzoomy.com
        O1 - Hosts: 216.130.185.143 www.advnt01.com
        O1 - Hosts: 216.130.185.143 advnt01.com
        O1 - Hosts: 216.130.185.143 websearch.com
        O1 - Hosts: 216.130.185.143 www.adwave.com
        O1 - Hosts: 216.130.185.143 www.adwave.com
        O1 - Hosts: 216.130.185.143 adwave.com
        O1 - Hosts: 216.130.185.143 adwave.com
        O1 - Hosts: 216.130.185.143 www.xzoomy.com
        O1 - Hosts: 216.130.185.143 xzoomy.com
        O1 - Hosts: 216.130.185.143 www.advnt01.com
        O1 - Hosts: 216.130.185.143 advnt01.com
        O1 - Hosts: 216.130.185.143 websearch.com
        O1 - Hosts: 216.130.185.143 www.adwave.com
        O1 - Hosts: 216.130.185.143 adwave.com
        O1 - Hosts: 216.130.185.143 www.xzoomy.com
        O1 - Hosts: 216.130.185.143 xzoomy.com
        O1 - Hosts: 216.130.185.143 www.advnt01.com
        O1 - Hosts: 216.130.185.143 advnt01.com
        O1 - Hosts: 216.130.185.143 websearch.com
        O1 - Hosts: 216.130.185.143 www.adwave.com
        O1 - Hosts: 216.130.185.143 adwave.com
        O1 - Hosts: 216.130.185.143 www.xzoomy.com
        O1 - Hosts: 216.130.185.143 xzoomy.com
        O1 - Hosts: 216.130.185.143 www.advnt01.com
        O1 - Hosts: 216.130.185.143 advnt01.com
        O1 - Hosts: 216.130.185.143 websearch.com
        O1 - Hosts: 216.130.185.143 www.adwave.com
        O1 - Hosts: 216.130.185.143 adwave.com
        O1 - Hosts: 216.130.185.143 www.xzoomy.com
        O1 - Hosts: 216.130.185.143 xzoomy.com
        O1 - Hosts: 216.130.185.143 www.advnt01.com
        O1 - Hosts: 216.130.185.143 advnt01.com
        O1 - Hosts: 216.130.185.143 www.adwave.com
        O1 - Hosts: 216.130.185.143 adwave.com
        O1 - Hosts: 216.130.185.143 www.xzoomy.com
        O1 - Hosts: 216.130.185.143 xzoomy.com
        O1 - Hosts: 216.130.185.143 www.advnt01.com
        O1 - Hosts: 216.130.185.143 advnt01.com

        O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe (file missing)
        O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.wanadoo.fr (file missing) (HKCU)
        O16 - DPF: {2472DCCC-68CE-49DA-AA81-E7E6D83C1DFA} (PackageHTML) - http://acces.blonde.com/package/op/PackageHtmlCab.CAB
        O16 - DPF: {31DDC1FD-CEA3-4837-A6DC-87E67015ADC9} - http://akamai.downloadv3.com/binaries/IA/svcsysnet32_FR_XP.cab
        O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINNT\svcproc.exe (file missing)

        @+++++