pop up! Résolu

Question

bonjour, je suis equipé de kaspersky antivirus, pare feu windows, google tool bar, et bloquer de fenetre (inclus avec XP).
mais depuis peu de temps jai plusieurs fenetre IE qui souvre avec de la pub! il y en a entre 5 et 10 a chaque fois! je ne les vois pas dans la barre des taches, c'est lorsque je reduit mes applications que je les voit sur le bureau!

comment les supprimer?
merci

jai passer un SPYBOT mais c acontinue toujours!

jacko · Answer

en plus de ceci jai une message qui safiche souvent:votre systeme est infecté de 200 erreur graves........................pour les corriger cliquez ici....et ca

jacko · Answer

en plus de ceci jai une message qui safiche souvent:

votre systeme est infecté de 200 erreur graves...........
....
...
......
pour les corriger cliquez ici....

et ca me fait installer WINFIX2005.... mai je ne peut que analyser mais pas coriger ( c'est payant)

aider moi svp pour ce probleme et celui du message precedent

toto1988 · Answer

Bonjour, je conais un logiciel anti malwares: a² free,il pourrait t'aider.
Tu le trouvera sur ce site www.emsisoft.net,télécharge le puis tu l'instale.
Il est gratuit et en français mais il faut t'inscrire.
Après mais le à jour puis scan ton ordinateur.
Dis moi si il a trouvé(s) quelque(s) chose(s) et quoi s'il te plait.
A plus tard.

funounou · Answer

salut j'avais le meme probleme .je l'ais eleminé comme ceci

fait demarrer
va dans acsessoir
outils systeme
restauration du systeme
cherche une date anterieure (moi je l'ais fait a la date ou j'ais formaté l'ordi apres reinstalation.est ca a marché,jais perdue quelques dossiers mais rien de grave)
lance restoration est attend tous ce fait tout seul

j'espere que ca marchera pour toi aussi.salut

jacko · Answer

voici le rapport:D:\Documents and Settings\J@v0\Cookies\j@v0@247realmedia[1].txt Trace.TrackingCookie D:\Documents and Settings\J@v0\Cookies\j@v0@adtech[2].txt Trace.TrackingCookie D:\Documents and Settings\J@v0\Cookies\j@v0@advertising[1].txt Trace.TrackingCookie D:\Documents and Settings\J@v0\Cookies\j@v0@as-us.falkag[1].txt Trace.TrackingCookie D:\Documents and Settings\J@v0\Cookies\j@v0@as1.falkag[1].txt Trace.TrackingCookie D:\Documents and Settings\J@v0\Cookies\j@v0@atdmt[2].txt Trace.TrackingCookie D:\Documents and Settings\J@v0\Cookies\j@v0@bluestreak[1].txt Trace.TrackingCookie D:\Documents and Settings\J@v0\Cookies\j@v0@bs.serving-sys[1].txt Trace.TrackingCookie D:\Documents and Settings\J@v0\Cookies\j@v0@casalemedia[1].txt Trace.TrackingCookie D:\Documents and Settings\J@v0\Cookies\j@v0@cgi-bin[1].txt Trace.TrackingCookie D:\Documents and Settings\J@v0\Cookies\j@v0@Compteur_cookie[1].txt Trace.TrackingCookie D:\Documents and Settings\J@v0\Cookies\j@v0@doubleclick[1].txt Trace.TrackingCookie D:\Documents and Settings\J@v0\Cookies\j@v0@fl01.ct2.comclick[1].txt Trace.TrackingCookie D:\Documents and Settings\J@v0\Cookies\j@v0@media.publicites[1].txt Trace.TrackingCookie D:\Documents and Settings\J@v0\Cookies\j@v0@media468[2].txt Trace.TrackingCookie D:\Documents and Settings\J@v0\Cookies\j@v0@mediadis[1].txt Trace.TrackingCookie D:\Documents and Settings\J@v0\Cookies\j@v0@mediauk[1].txt Trace.TrackingCookie D:\Documents and Settings\J@v0\Cookies\j@v0@questionmarket[1].txt Trace.TrackingCookie D:\Documents and Settings\J@v0\Cookies\j@v0@realmedia[2].txt Trace.TrackingCookie D:\Documents and Settings\J@v0\Cookies\j@v0@servedby.advertising[2].txt Trace.TrackingCookie D:\Documents and Settings\J@v0\Cookies\j@v0@server.iad.liveperson[2].txt Trace.TrackingCookie D:\Documents and Settings\J@v0\Cookies\j@v0@serving-sys[2].txt Trace.TrackingCookie D:\Documents and Settings\J@v0\Cookies\j@v0@statcounter[1].txt Trace.TrackingCookie D:\Documents and Settings\J@v0\Cookies\j@v0@tradedoubler[2].txt Trace.TrackingCookie D:\Documents and Settings\J@v0\Cookies\j@v0@trafficmp[1].txt Trace.TrackingCookie D:\Documents and Settings\J@v0\Cookies\j@v0@tripod[1].txt Trace.TrackingCookie D:\Documents and Settings\J@v0\Cookies\j@v0@valuead[2].txt Trace.TrackingCookie D:\Documents and Settings\J@v0\Cookies\j@v0@valueclick[1].txt Trace.TrackingCookie D:\Documents and Settings\J@v0\Cookies\j@v0@weborama[2].txt Trace.TrackingCookie D:\Documents and Settings\J@v0\Cookies\j@v0@www.cibleclick[1].txt Trace.TrackingCookie D:\Documents and Settings\J@v0\Cookies\j@v0@zedo[2].txt Trace.TrackingCookie D:\Documents and Settings\J@v0\Local Settings\Temporary Internet Files\Content.IE5\1O8F590P\upd208[1].exe Adware.Look2Me.ag D:\Documents and Settings\J@v0\Local Settings\Temporary Internet Files\Content.IE5\55C2ON5R\ActiveX[1].ocx Adware.Look2Me.ag D:\Documents and Settings\J@v0\Local Settings\Temporary Internet Files\Content.IE5\WPQN4L6R\Installer[1].exe Adware.Look2Me.ag D:\Documents and Settings\Patrick\Local Settings\Temporary Internet Files\Content.IE5\TF3JD1CE\upd209[1].exe Adware.Look2Me.ag D:\WINDOWS\Downloaded Program Files\ActiveX.ocx Adware.Look2Me.ag D:\WINDOWS\system\UpdInst.exe Adware.Look2Me.ag D:\WINDOWS\system32\hkd.dll Adware.Look2Me.ag D:\WINDOWS\system32\igm32.dll Adware.Look2Me.ag D:\WINDOWS\system32\kjdca.dll Adware.Look2Me.ag D:\WINDOWS\system32\kudukx.dll Adware.Look2Me.ag D:\WINDOWS\system32\LfgitCheckControl.dll Adware.Look2Me.ag D:\WINDOWS\system32\mjjetoledb40.dll Adware.Look2Me.ag D:\WINDOWS\system32
diew.dll Adware.Look2Me.ag D:\WINDOWS\system32
hxpnt.dll Adware.Look2Me.ag D:\WINDOWS\system32
wlanui.dll Adware.Look2Me.ag D:\WINDOWS\system32\sqrvdeps.dll Adware.Look2Me.ag D:\WINDOWS\system32\SVLFREG.DLL Adware.Look2Me.ag D:\WINDOWS\Temp\upd208.exe Adware.Look2Me.ag D:\WINDOWS\Temp\upd209.exe Adware.Look2Me.ag

toto1988 · Answer

Le rapport dis que tu adwares et cookies.
Les cookies ne sont pas dangereux et ni embétant mais tu peut les sans aucun risque.
Par contre les adwares ne sont dangereux mais sont très embétant car ces eux ton problème de pub,suprimme les avec a² free.
Une fois suprimmer normalement,les pub devraient arrêté de s'affiché.
Sil te plait répond moi dans tous les cas.

jacko · Answer

merci beaucoup pour ton aide, il reste juste une fenetre qui saffiche toujours:http://www.winantivirus.com/landing/winav_pro.php?aid=wfx5_wa5p&lid=uwfx5comment lenlever?merci encore

Utilisateur anonyme · Answer

télécharge hijackthis ici:
http://www.hijackthis.de/downloads/hijackthis_199.zip

Dézippe le dans un dossier prévu a cet effet.
Par exemple C:\hijackthis < Enregistre le bien dans c : !
Lancez le puis:
clic sur "do a system scan and save logfile" (cf demo)
faire un copier coller du log entier sur le forum

Démo : (merci a balltrap34 pour cette réalisation)
http://pageperso.aol.fr/balltrap34/demohijack.htm

Bon courage

A+

jacko · Answer

Logfile of HijackThis v1.99.1Scan saved at 13:56:12, on 06/08/2005Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:D:\WINDOWS\System32\smss.exeD:\WINDOWS\system32\winlogon.exeD:\WINDOWS\system32\services.exeD:\WINDOWS\system32\lsass.exeD:\WINDOWS\system32\svchost.exeD:\WINDOWS\System32\svchost.exeD:\WINDOWS\system32\spoolsv.exeD:\WINDOWS\System32
vsvc32.exeD:\WINDOWS\System32\svchost.exeD:\WINDOWS\system32undll32.exeD:\WINDOWS\Explorer.EXED:\Program Files\MessengerPlus! 3\MsgPlus.exeD:\WINDOWS\system32\ctfmon.exeD:\Program Files\MSN Messenger\msnmsgr.exeD:\Program Files\Internet Explorer\iexplore.exeD:\Program Files\Internet Explorer\iexplore.exeD:\Program Files\Internet Explorer\iexplore.exeD:\Program Files\Internet Explorer\iexplore.exeD:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exeD:\Program Files\Internet Explorer\iexplore.exeD:\Documents and Settings\J@v0\Mes documents\Ma musique\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.free.fr/R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\program files\google\googletoolbar1.dllO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar1.dllO4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXEO4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [KAV Blacklist Killer] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro 5\KAV Blacklist Killer.exe"O4 - HKLM\..\Run: [MessengerPlus3] "D:\Program Files\MessengerPlus! 3\MsgPlus.exe"O4 - HKLM\..\Run: [KAVPersonal50] "D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe" /minimizeO4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [msnmsgr] "D:\Program Files\MSN Messenger\msnmsgr.exe" /backgroundO4 - HKCU\..\Run: [a-squared] "D:\Program Files\a2\a2guard.exe"O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXEO8 - Extra context menu item: &Add animation to IncrediMail Style Box - D:\PROGRA~1\INCRED~1\binesources\WebMenuImg.htmO8 - Extra context menu item: &Traduire à partir de l'anglais - res://D:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.htmlO8 - Extra context menu item: Pages liées - res://D:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.htmlO8 - Extra context menu item: Pages similaires - res://D:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.htmlO8 - Extra context menu item: Recherche &Google - res://D:\Program Files\Google\GoogleToolbar1.dll/cmsearch.htmlO8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://D:\Program Files\Google\GoogleToolbar1.dll/cmcache.htmlO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_04\bin
pjpi150_04.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_04\bin
pjpi150_04.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exeO16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cabO16 - DPF: {4208FB4D-4E53-4F5A-BF7A-3E047DDB5281} (ActiveX Control) - http://www.icannnews.com/app/ST/ActiveX.ocxO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1116074835816O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cabO16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cabO16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cabO20 - AppInit_DLLs: MsgPlusLoader.dllO20 - Winlogon Notify: Dynamic Directory - D:\WINDOWS\system32\mautb.dllO23 - Service: kavsvc - Kaspersky Lab - D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exeO23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\System32
vsvc32.exe

Utilisateur anonyme · Answer

salut jacko
tu peux verifier cela stp
• Démarrer
• Panneau de configuration
• Outil d’administration
• Services
• Cherche Affichage des Messages
• Clique droit dessus puis propriété
• Dans le menu déroulant, Mettre « Désactivé », Plus bas dans la fenêtre tu mets « Arrêter »
• Applique

a+

jacko · Answer

salut, merci de maider c super sympa :)le pb c'est que c'etait deja comme ca, desactivé et arreter .... :(

Utilisateur anonyme · Answer

salut
fix ceci
O16 - DPF: {4208FB4D-4E53-4F5A-BF7A-3E047DDB5281} (ActiveX Control) - http://www.icannnews.com/app/ST/ActiveX.ocx
et celle ci me parait suspecte, tre suspecte
O20 - Winlogon Notify: Dynamic Directory - D:\WINDOWS\system32\mautb.dll

et remet un log, presices tes soucis

jacko · Answer

jai moins de pop-up mais encore quelque uns ... :-(voici le dernier rapportLogfile of HijackThis v1.99.1Scan saved at 22:35:31, on 06/08/2005Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:D:\WINDOWS\System32\smss.exeD:\WINDOWS\system32\winlogon.exeD:\WINDOWS\system32\services.exeD:\WINDOWS\system32\lsass.exeD:\WINDOWS\system32\svchost.exeD:\WINDOWS\System32\svchost.exeD:\WINDOWS\system32\spoolsv.exeD:\WINDOWS\System32
vsvc32.exeD:\WINDOWS\System32\svchost.exeD:\WINDOWS\Explorer.EXED:\Program Files\MessengerPlus! 3\MsgPlus.exeD:\WINDOWS\system32\ctfmon.exeD:\Program Files\MSN Messenger\msnmsgr.exeD:\Program Files\Internet Explorer\iexplore.exeD:\Documents and Settings\J@v0\Mes documents\Ma musique\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.free.fr/R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\program files\google\googletoolbar1.dllO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar1.dllO4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXEO4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [KAV Blacklist Killer] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro 5\KAV Blacklist Killer.exe"O4 - HKLM\..\Run: [MessengerPlus3] "D:\Program Files\MessengerPlus! 3\MsgPlus.exe"O4 - HKLM\..\Run: [KAVPersonal50] "D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe" /minimizeO4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [msnmsgr] "D:\Program Files\MSN Messenger\msnmsgr.exe" /backgroundO4 - HKCU\..\Run: [a-squared] "D:\Program Files\a2\a2guard.exe"O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXEO8 - Extra context menu item: &Add animation to IncrediMail Style Box - D:\PROGRA~1\INCRED~1\binesources\WebMenuImg.htmO8 - Extra context menu item: &Traduire à partir de l'anglais - res://D:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.htmlO8 - Extra context menu item: Pages liées - res://D:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.htmlO8 - Extra context menu item: Pages similaires - res://D:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.htmlO8 - Extra context menu item: Recherche &Google - res://D:\Program Files\Google\GoogleToolbar1.dll/cmsearch.htmlO8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://D:\Program Files\Google\GoogleToolbar1.dll/cmcache.htmlO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_04\bin
pjpi150_04.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_04\bin
pjpi150_04.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exeO16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cabO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1116074835816O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cabO16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cabO16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cabO20 - AppInit_DLLs: MsgPlusLoader.dllO20 - Winlogon Notify: ShellServiceObjectDelayLoad - D:\WINDOWS\system32\mautb.dllO23 - Service: kavsvc - Kaspersky Lab - D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exeO23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\System32
vsvc32.exemerci

lakota · Answer

En utilisant Mozilla firefox au lieu d'I.E. beaucoup de problèmes de sécurité seraient évités.http://frenchmozilla.sourceforge.net/

balltrap34 · Answer

salut
relance hijack coche et fix ceci
O20 - Winlogon Notify: ShellServiceObjectDelayLoad - D:\WINDOWS\system32\mautb.dll

-------------
clik sur Démarrer--->Exécuter--->taper
regsvr32.exe -u D:\WINDOWS\system32\mautb.dll
puis cliquer sur OK

ensuite recherche et suppr cette dll
D:\WINDOWS\system32\mautb.dll

jacko · Answer

jai bien fixer cette ligne mais elle revient a chaque fois....Logfile of HijackThis v1.99.1Scan saved at 10:25:57, on 07/08/2005Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:D:\WINDOWS\System32\smss.exeD:\WINDOWS\system32\winlogon.exeD:\WINDOWS\system32\services.exeD:\WINDOWS\system32\lsass.exeD:\WINDOWS\system32\svchost.exeD:\WINDOWS\System32\svchost.exeD:\WINDOWS\system32\spoolsv.exeD:\WINDOWS\System32
vsvc32.exeD:\WINDOWS\System32\svchost.exeD:\WINDOWS\system32undll32.exeD:\WINDOWS\Explorer.EXED:\Program Files\MessengerPlus! 3\MsgPlus.exeD:\WINDOWS\system32\ctfmon.exeD:\Program Files\MSN Messenger\msnmsgr.exeD:\Program Files\a2\a2guard.exeD:\WINDOWS\system32\wuauclt.exeD:\Program Files\Internet Explorer\iexplore.exeD:\Program Files\Internet Explorer\iexplore.exeD:\Program Files\Internet Explorer\iexplore.exeD:\Program Files\Internet Explorer\iexplore.exeD:\Documents and Settings\J@v0\Mes documents\Ma musique\HijackThis.exeD:\WINDOWS\system32\NOTEPAD.EXER0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.free.fr/R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\program files\google\googletoolbar1.dllO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar1.dllO4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXEO4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [KAV Blacklist Killer] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro 5\KAV Blacklist Killer.exe"O4 - HKLM\..\Run: [MessengerPlus3] "D:\Program Files\MessengerPlus! 3\MsgPlus.exe"O4 - HKLM\..\Run: [KAVPersonal50] "D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe" /minimizeO4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [msnmsgr] "D:\Program Files\MSN Messenger\msnmsgr.exe" /backgroundO4 - HKCU\..\Run: [a-squared] "D:\Program Files\a2\a2guard.exe"O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXEO8 - Extra context menu item: &Add animation to IncrediMail Style Box - D:\PROGRA~1\INCRED~1\binesources\WebMenuImg.htmO8 - Extra context menu item: &Traduire à partir de l'anglais - res://D:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.htmlO8 - Extra context menu item: Pages liées - res://D:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.htmlO8 - Extra context menu item: Pages similaires - res://D:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.htmlO8 - Extra context menu item: Recherche &Google - res://D:\Program Files\Google\GoogleToolbar1.dll/cmsearch.htmlO8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://D:\Program Files\Google\GoogleToolbar1.dll/cmcache.htmlO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_04\bin
pjpi150_04.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_04\bin
pjpi150_04.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exeO16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cabO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1116074835816O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cabO16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cabO16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cabO20 - AppInit_DLLs: MsgPlusLoader.dllO20 - Winlogon Notify: Telephony - D:\WINDOWS\system32\mautb.dllO23 - Service: kavsvc - Kaspersky Lab - D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exeO23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\System32
vsvc32.exe

balltrap34 · Answer

oki mais a tu fait cela aussi
clik sur Démarrer--->Exécuter--->taper
regsvr32.exe -u D:\WINDOWS\system32\mautb.dll
puis cliquer sur OK

ensuite recherche et suppr cette dll
D:\WINDOWS\system32\mautb.dll

jacko · Answer

il me dit qu'elle est utilisée par un autre processus quans je la supprime... ou quand je tape la commande

balltrap34 · Answer

redemarre en mode sans echec et tente a nouveau cette manip

jacko · Answer

ca fait pa

jacko · Answer

(dsl)ca fait pareil :(

Utilisateur anonyme · Answer

sltTelecharge: Pocket Killbox ici http://www.downloads.subratam.org/KillBox.exeDouble clic sur killbox.exe (Pocket Killbox) - coche: delete on reboot - Dans "Full Path of File to Delete" copie et colle: D:\WINDOWS\system32\mautb.dll - clic sur la croix rouge - une fenetre va apparaitre pour confirmation clic sur YES - une seconde fenetre te demande si tu veux redemarrer clic sur YES Laisse le pc redemarrer et après reposte un log hijackthis. A+

jacko · Answer

je dois vraiment etre nul... lolquand je valide pr redemarrer il me met un msg derreur:pending file rename operations registry data has been removed by external processca redemarre pas et il est tj dan le log.remyremy@hotmail.com (si tu as msn c plu facile^^)

balltrap34 · Answer

tu as redemarrer manuellement

jacko · Answer

oui, tj pareil

balltrap34 · Answer

peuteter une vx2fait cecitelecharge cecihttp://www.downloads.subratam.org/l2mfix.exedecompresse le double clik sur l2mfix.bat appuie sur n importe quelle touche et ensuite choisi l option 2met le rapport et aussi essaie de suppr a nouveau la dll si elle est toujours dans hijack

jacko · Answer

c bon ca  a marcher!Logfile of HijackThis v1.99.1Scan saved at 16:45:05, on 07/08/2005Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:D:\WINDOWS\System32\smss.exeD:\WINDOWS\system32\winlogon.exeD:\WINDOWS\system32\services.exeD:\WINDOWS\system32\lsass.exeD:\WINDOWS\system32\svchost.exeD:\WINDOWS\System32\svchost.exeD:\WINDOWS\system32\spoolsv.exeD:\WINDOWS\SOUNDMAN.EXED:\Program Files\MessengerPlus! 3\MsgPlus.exeD:\WINDOWS\system32\ctfmon.exeD:\Program Files\MSN Messenger\msnmsgr.exeD:\Program Files\a2\a2guard.exeD:\WINDOWS\System32
vsvc32.exeD:\WINDOWS\System32\svchost.exeD:\WINDOWS\system32\wuauclt.exeD:\Program Files\Internet Explorer\iexplore.exeD:\WINDOWS\explorer.exeD:\Documents and Settings\J@v0\Mes documents\Ma musique\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.free.fr/R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\program files\google\googletoolbar1.dllO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar1.dllO4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXEO4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [KAV Blacklist Killer] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro 5\KAV Blacklist Killer.exe"O4 - HKLM\..\Run: [MessengerPlus3] "D:\Program Files\MessengerPlus! 3\MsgPlus.exe"O4 - HKLM\..\Run: [KAVPersonal50] "D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe" /minimizeO4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [msnmsgr] "D:\Program Files\MSN Messenger\msnmsgr.exe" /backgroundO4 - HKCU\..\Run: [a-squared] "D:\Program Files\a2\a2guard.exe"O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXEO8 - Extra context menu item: &Add animation to IncrediMail Style Box - D:\PROGRA~1\INCRED~1\binesources\WebMenuImg.htmO8 - Extra context menu item: &Traduire à partir de l'anglais - res://D:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.htmlO8 - Extra context menu item: Pages liées - res://D:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.htmlO8 - Extra context menu item: Pages similaires - res://D:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.htmlO8 - Extra context menu item: Recherche &Google - res://D:\Program Files\Google\GoogleToolbar1.dll/cmsearch.htmlO8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://D:\Program Files\Google\GoogleToolbar1.dll/cmcache.htmlO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_04\bin
pjpi150_04.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_04\bin
pjpi150_04.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exeO16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cabO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1116074835816O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cabO16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cabO16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cabO20 - AppInit_DLLs: MsgPlusLoader.dllO23 - Service: kavsvc - Kaspersky Lab - D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exeO23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\System32
vsvc32.exepour l'instant jai plus de pub et il nest plus ds le rapport!je remettrais un message ici pour confirmer si jai plus de pub! ;-)merci merci beaucoup A TOUS c'est super sympa d'aider les debutants comme moi! merci encore!

balltrap34 · Answer

l2mfix a du te faire un rapport j aurais bien aimer le voirpour etude lol

jacko · Answer

accroche toi c long ;)L2Mfix 1.03a Running From:D:\Documents and Settings\J@v0\Mes documents\Ma musique\l2mfix  RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and aboveCopyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)This program is Freeware, use it on your own risk!Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:(NI)    ALLOW  Full access 	AUTORITE NT\SYSTEM(IO)    ALLOW  Full access 	AUTORITE NT\SYSTEM(ID-NI) ALLOW  Read        	BUILTIN\Utilisateurs(ID-IO) ALLOW  Read        	BUILTIN\Utilisateurs(ID-NI) ALLOW  Read        	BUILTIN\Utilisateurs avec pouvoir(ID-IO) ALLOW  Read        	BUILTIN\Utilisateurs avec pouvoir(ID-NI) ALLOW  Full access 	BUILTIN\Administrateurs(ID-IO) ALLOW  Full access 	BUILTIN\Administrateurs(ID-NI) ALLOW  Full access 	AUTORITE NT\SYSTEM(ID-IO) ALLOW  Full access 	AUTORITE NT\SYSTEM(ID-IO) ALLOW  Full access 	CREATEUR PROPRIETAIRE Setting registry permissions: RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and aboveCopyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)This program is Freeware, use it on your own risk!Denying C(CI) access for predefined group "Administrators" - adding new ACCESS DENY entry Registry Permissions set too:RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and aboveCopyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)This program is Freeware, use it on your own risk!Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:(CI)    DENY   --C-------   	BUILTIN\Administrateurs(NI)    ALLOW  Full access 	AUTORITE NT\SYSTEM(IO)    ALLOW  Full access 	AUTORITE NT\SYSTEM(ID-NI) ALLOW  Read        	BUILTIN\Utilisateurs(ID-IO) ALLOW  Read        	BUILTIN\Utilisateurs(ID-NI) ALLOW  Read        	BUILTIN\Utilisateurs avec pouvoir(ID-IO) ALLOW  Read        	BUILTIN\Utilisateurs avec pouvoir(ID-NI) ALLOW  Full access 	BUILTIN\Administrateurs(ID-IO) ALLOW  Full access 	BUILTIN\Administrateurs(ID-NI) ALLOW  Full access 	AUTORITE NT\SYSTEM(ID-IO) ALLOW  Full access 	AUTORITE NT\SYSTEM(ID-IO) ALLOW  Full access 	CREATEUR PROPRIETAIRE Setting up for Reboot  Starting Reboot! D:\Documents and Settings\J@v0\Mes documents\Ma musique\l2mfix System Rebooted!  Running From:D:\Documents and Settings\J@v0\Mes documents\Ma musique\l2mfix killing explorer and rundll32.exe Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.orgKilling PID 1736 'explorer.exe'Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.orgKilling PID 1844 'rundll32.exe' Scanning First Pass. Please Wait! First Pass Completed  Second Pass Scanning  Second pass Completed!Backing Up: D:\WINDOWS\system32\cagmgr32.dll        1 fichier(s) copi‚(s).Backing Up: D:\WINDOWS\system32\cagmgr32.dll        1 fichier(s) copi‚(s).Backing Up: D:\WINDOWS\system32\cqrtcli.dll        1 fichier(s) copi‚(s).Backing Up: D:\WINDOWS\system32\cqrtcli.dll        1 fichier(s) copi‚(s).Backing Up: D:\WINDOWS\system32\cxmres.dll        1 fichier(s) copi‚(s).Backing Up: D:\WINDOWS\system32\cxmres.dll        1 fichier(s) copi‚(s).Backing Up: D:\WINDOWS\system32\dcvxdec_0407.dll        1 fichier(s) copi‚(s).Backing Up: D:\WINDOWS\system32\dcvxdec_0407.dll        1 fichier(s) copi‚(s).Backing Up: D:\WINDOWS\system32\ddvoice.dll        1 fichier(s) copi‚(s).Backing Up: D:\WINDOWS\system32\ddvoice.dll        1 fichier(s) copi‚(s).Backing Up: D:\WINDOWS\system32\marapi.dll        1 fichier(s) copi‚(s).Backing Up: D:\WINDOWS\system32\marapi.dll        1 fichier(s) copi‚(s).Backing Up: D:\WINDOWS\system32\mautb.dll        1 fichier(s) copi‚(s).Backing Up: D:\WINDOWS\system32\mautb.dll        1 fichier(s) copi‚(s).Backing Up: D:\WINDOWS\system32\mgc40u.dll        1 fichier(s) copi‚(s).Backing Up: D:\WINDOWS\system32\mgc40u.dll        1 fichier(s) copi‚(s).Backing Up: D:\WINDOWS\system32\mpsystem.dll        1 fichier(s) copi‚(s).Backing Up: D:\WINDOWS\system32\mpsystem.dll        1 fichier(s) copi‚(s).Backing Up: D:\WINDOWS\system32\muimsg.dll        1 fichier(s) copi‚(s).Backing Up: D:\WINDOWS\system32\muimsg.dll        1 fichier(s) copi‚(s).Backing Up: D:\WINDOWS\system32\mxaudite.dll        1 fichier(s) copi‚(s).Backing Up: D:\WINDOWS\system32\mxaudite.dll        1 fichier(s) copi‚(s).Backing Up: D:\WINDOWS\system32\ovmanage.dll        1 fichier(s) copi‚(s).Backing Up: D:\WINDOWS\system32\ovmanage.dll        1 fichier(s) copi‚(s).Backing Up: D:\WINDOWS\system32\sacur32.dll        1 fichier(s) copi‚(s).Backing Up: D:\WINDOWS\system32\sacur32.dll        1 fichier(s) copi‚(s).Backing Up: D:\WINDOWS\system32\wips.dll        1 fichier(s) copi‚(s).Backing Up: D:\WINDOWS\system32\wips.dll        1 fichier(s) copi‚(s).Backing Up: D:\WINDOWS\system32\wqhbth.dll        1 fichier(s) copi‚(s).Backing Up: D:\WINDOWS\system32\wqhbth.dll        1 fichier(s) copi‚(s).Backing Up: D:\WINDOWS\system32\xwsp1res.dll        1 fichier(s) copi‚(s).Backing Up: D:\WINDOWS\system32\xwsp1res.dll        1 fichier(s) copi‚(s).Backing Up: D:\WINDOWS\system32\guard.tmp        1 fichier(s) copi‚(s).Backing Up: D:\WINDOWS\system32\guard.tmp        1 fichier(s) copi‚(s).deleting: D:\WINDOWS\system32\cagmgr32.dll  Successfully Deleted: D:\WINDOWS\system32\cagmgr32.dlldeleting: D:\WINDOWS\system32\cagmgr32.dll  Successfully Deleted: D:\WINDOWS\system32\cagmgr32.dlldeleting: D:\WINDOWS\system32\cqrtcli.dll  Successfully Deleted: D:\WINDOWS\system32\cqrtcli.dlldeleting: D:\WINDOWS\system32\cqrtcli.dll  Successfully Deleted: D:\WINDOWS\system32\cqrtcli.dlldeleting: D:\WINDOWS\system32\cxmres.dll  Successfully Deleted: D:\WINDOWS\system32\cxmres.dlldeleting: D:\WINDOWS\system32\cxmres.dll  Successfully Deleted: D:\WINDOWS\system32\cxmres.dlldeleting: D:\WINDOWS\system32\dcvxdec_0407.dll  Successfully Deleted: D:\WINDOWS\system32\dcvxdec_0407.dlldeleting: D:\WINDOWS\system32\dcvxdec_0407.dll  Successfully Deleted: D:\WINDOWS\system32\dcvxdec_0407.dlldeleting: D:\WINDOWS\system32\ddvoice.dll  Successfully Deleted: D:\WINDOWS\system32\ddvoice.dlldeleting: D:\WINDOWS\system32\ddvoice.dll  Successfully Deleted: D:\WINDOWS\system32\ddvoice.dlldeleting: D:\WINDOWS\system32\marapi.dll  Successfully Deleted: D:\WINDOWS\system32\marapi.dlldeleting: D:\WINDOWS\system32\marapi.dll  Successfully Deleted: D:\WINDOWS\system32\marapi.dlldeleting: D:\WINDOWS\system32\mautb.dll  Successfully Deleted: D:\WINDOWS\system32\mautb.dlldeleting: D:\WINDOWS\system32\mautb.dll  Successfully Deleted: D:\WINDOWS\system32\mautb.dlldeleting: D:\WINDOWS\system32\mgc40u.dll  Successfully Deleted: D:\WINDOWS\system32\mgc40u.dlldeleting: D:\WINDOWS\system32\mgc40u.dll  Successfully Deleted: D:\WINDOWS\system32\mgc40u.dlldeleting: D:\WINDOWS\system32\mpsystem.dll  Successfully Deleted: D:\WINDOWS\system32\mpsystem.dlldeleting: D:\WINDOWS\system32\mpsystem.dll  Successfully Deleted: D:\WINDOWS\system32\mpsystem.dlldeleting: D:\WINDOWS\system32\muimsg.dll  Successfully Deleted: D:\WINDOWS\system32\muimsg.dlldeleting: D:\WINDOWS\system32\muimsg.dll  Successfully Deleted: D:\WINDOWS\system32\muimsg.dlldeleting: D:\WINDOWS\system32\mxaudite.dll  Successfully Deleted: D:\WINDOWS\system32\mxaudite.dlldeleting: D:\WINDOWS\system32\mxaudite.dll  Successfully Deleted: D:\WINDOWS\system32\mxaudite.dlldeleting: D:\WINDOWS\system32\ovmanage.dll  Successfully Deleted: D:\WINDOWS\system32\ovmanage.dlldeleting: D:\WINDOWS\system32\ovmanage.dll  Successfully Deleted: D:\WINDOWS\system32\ovmanage.dlldeleting: D:\WINDOWS\system32\sacur32.dll  Successfully Deleted: D:\WINDOWS\system32\sacur32.dlldeleting: D:\WINDOWS\system32\sacur32.dll  Successfully Deleted: D:\WINDOWS\system32\sacur32.dlldeleting: D:\WINDOWS\system32\wips.dll  Successfully Deleted: D:\WINDOWS\system32\wips.dlldeleting: D:\WINDOWS\system32\wips.dll  Successfully Deleted: D:\WINDOWS\system32\wips.dlldeleting: D:\WINDOWS\system32\wqhbth.dll  Successfully Deleted: D:\WINDOWS\system32\wqhbth.dlldeleting: D:\WINDOWS\system32\wqhbth.dll  Successfully Deleted: D:\WINDOWS\system32\wqhbth.dlldeleting: D:\WINDOWS\system32\xwsp1res.dll  Successfully Deleted: D:\WINDOWS\system32\xwsp1res.dlldeleting: D:\WINDOWS\system32\xwsp1res.dll  Successfully Deleted: D:\WINDOWS\system32\xwsp1res.dlldeleting: D:\WINDOWS\system32\guard.tmp  Successfully Deleted: D:\WINDOWS\system32\guard.tmpdeleting: D:\WINDOWS\system32\guard.tmp  Successfully Deleted: D:\WINDOWS\system32\guard.tmp  Zipping up files for submission:  adding: cagmgr32.dll (164 bytes security) (deflated 48%)  adding: cqrtcli.dll (164 bytes security) (deflated 48%)  adding: cxmres.dll (164 bytes security) (deflated 48%)  adding: dcvxdec_0407.dll (164 bytes security) (deflated 48%)  adding: ddvoice.dll (164 bytes security) (deflated 48%)  adding: marapi.dll (164 bytes security) (deflated 48%)  adding: mautb.dll (164 bytes security) (deflated 48%)  adding: mgc40u.dll (164 bytes security) (deflated 48%)  adding: mpsystem.dll (164 bytes security) (deflated 48%)  adding: muimsg.dll (164 bytes security) (deflated 48%)  adding: mxaudite.dll (164 bytes security) (deflated 48%)  adding: ovmanage.dll (164 bytes security) (deflated 48%)  adding: sacur32.dll (164 bytes security) (deflated 48%)  adding: wips.dll (164 bytes security) (deflated 48%)  adding: wqhbth.dll (164 bytes security) (deflated 48%)  adding: xwsp1res.dll (164 bytes security) (deflated 48%)  adding: guard.tmp (164 bytes security) (deflated 48%)  adding: clear.reg (164 bytes security) (deflated 55%)  adding: echo.reg (164 bytes security) (deflated 14%)  adding: direct.txt (164 bytes security) (deflated 6%)  adding: lo2.txt (164 bytes security) (deflated 87%)  adding: readme.txt (164 bytes security) (deflated 49%)  adding: test.txt (164 bytes security) (deflated 88%)  adding: test2.txt (164 bytes security) (deflated 36%)  adding: test3.txt (164 bytes security) (deflated 36%)  adding: test5.txt (164 bytes security) (deflated 36%)  adding: xfind.txt (164 bytes security) (deflated 85%)  adding: backregs/09C16CA7-FC50-4894-91E8-75DC0205EE5C.reg (164 bytes security) (deflated 70%)  adding: backregs/104EB31E-03E9-471C-9112-D75C120E477E.reg (164 bytes security) (deflated 70%)  adding: backregs/1D44F68B-17D9-4FBD-B284-8305B76B3FA9.reg (164 bytes security) (deflated 69%)  adding: backregs/4556C666-9FB4-4E25-B087-24806C42222A.reg (164 bytes security) (deflated 70%)  adding: backregs/98A134C1-1E3B-4C1E-8D42-529745594227.reg (164 bytes security) (deflated 70%)  adding: backregs/shell.reg (164 bytes security) (deflated 73%) Restoring Registry Permissions:  RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and aboveCopyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)This program is Freeware, use it on your own risk!Revoking access for predefined group "Administrators"Inherited ACE can not be revoked here!Inherited ACE can not be revoked here! Registry permissions set too:RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and aboveCopyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)This program is Freeware, use it on your own risk!Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:(NI)    ALLOW  Full access 	AUTORITE NT\SYSTEM(IO)    ALLOW  Full access 	AUTORITE NT\SYSTEM(NI)    ALLOW  Full access 	AUTORITE NT\SYSTEM(IO)    ALLOW  Full access 	AUTORITE NT\SYSTEM(ID-NI) ALLOW  Read        	BUILTIN\Utilisateurs(ID-IO) ALLOW  Read        	BUILTIN\Utilisateurs(ID-NI) ALLOW  Read        	BUILTIN\Utilisateurs avec pouvoir(ID-IO) ALLOW  Read        	BUILTIN\Utilisateurs avec pouvoir(ID-NI) ALLOW  Full access 	BUILTIN\Administrateurs(ID-IO) ALLOW  Full access 	BUILTIN\Administrateurs(ID-NI) ALLOW  Full access 	AUTORITE NT\SYSTEM(ID-IO) ALLOW  Full access 	AUTORITE NT\SYSTEM(ID-IO) ALLOW  Full access 	CREATEUR PROPRIETAIRERestoring Sedebugprivilege:  Granting SeDebugPrivilege to Administrators   ... failed (GetAccountSid(Administrators)=1332  deleting local copy: cagmgr32.dll   deleting local copy: cagmgr32.dll   deleting local copy: cqrtcli.dll   deleting local copy: cqrtcli.dll   deleting local copy: cxmres.dll   deleting local copy: cxmres.dll   deleting local copy: dcvxdec_0407.dll   deleting local copy: dcvxdec_0407.dll   deleting local copy: ddvoice.dll   deleting local copy: ddvoice.dll   deleting local copy: marapi.dll   deleting local copy: marapi.dll   deleting local copy: mautb.dll   deleting local copy: mautb.dll   deleting local copy: mgc40u.dll   deleting local copy: mgc40u.dll   deleting local copy: mpsystem.dll   deleting local copy: mpsystem.dll   deleting local copy: muimsg.dll   deleting local copy: muimsg.dll   deleting local copy: mxaudite.dll   deleting local copy: mxaudite.dll   deleting local copy: ovmanage.dll   deleting local copy: ovmanage.dll   deleting local copy: sacur32.dll   deleting local copy: sacur32.dll   deleting local copy: wips.dll   deleting local copy: wips.dll   deleting local copy: wqhbth.dll   deleting local copy: wqhbth.dll   deleting local copy: xwsp1res.dll   deleting local copy: xwsp1res.dll   deleting local copy: guard.tmp   deleting local copy: guard.tmp    The following Is the Current Export of the Winlogon notify key:****************************************************************************Windows Registry Editor Version 5.00[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify][HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]"Asynchronous"=dword:00000000"Impersonate"=dword:00000000"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\  6c,00,00,00"Logoff"="ChainWlxLogoffEvent"[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]"Asynchronous"=dword:00000000"Impersonate"=dword:00000000"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\  6c,00,6c,00,00,00"Logoff"="CryptnetWlxLogoffEvent"[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]"DLLName"="cscdll.dll""Logon"="WinlogonLogonEvent""Logoff"="WinlogonLogoffEvent""ScreenSaver"="WinlogonScreenSaverEvent""Startup"="WinlogonStartupEvent""Shutdown"="WinlogonShutdownEvent""StartShell"="WinlogonStartShellEvent""Impersonate"=dword:00000000"Asynchronous"=dword:00000001[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]"DLLName"="wlnotify.dll""Logon"="SCardStartCertProp""Logoff"="SCardStopCertProp""Lock"="SCardSuspendCertProp""Unlock"="SCardResumeCertProp""Enabled"=dword:00000001"Impersonate"=dword:00000001"Asynchronous"=dword:00000001[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]"Asynchronous"=dword:00000000"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\  6c,00,6c,00,00,00"Impersonate"=dword:00000000"StartShell"="SchedStartShell""Logoff"="SchedEventLogOff"[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]"Logoff"="WLEventLogoff""Impersonate"=dword:00000000"Asynchronous"=dword:00000001"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\  6c,00,6c,00,00,00[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]"DLLName"="WlNotify.dll""Lock"="SensLockEvent""Logon"="SensLogonEvent""Logoff"="SensLogoffEvent""Safe"=dword:00000001"MaxWait"=dword:00000258"StartScreenSaver"="SensStartScreenSaverEvent""StopScreenSaver"="SensStopScreenSaverEvent""Startup"="SensStartupEvent""Shutdown"="SensShutdownEvent""StartShell"="SensStartShellEvent""PostShell"="SensPostShellEvent""Disconnect"="SensDisconnectEvent""Reconnect"="SensReconnectEvent""Unlock"="SensUnlockEvent""Impersonate"=dword:00000001"Asynchronous"=dword:00000001[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	ermsrv]"Asynchronous"=dword:00000000"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\  6c,00,6c,00,00,00"Impersonate"=dword:00000000"Logoff"="TSEventLogoff""Logon"="TSEventLogon""PostShell"="TSEventPostShell""Shutdown"="TSEventShutdown""StartShell"="TSEventStartShell""Startup"="TSEventStartup""MaxWait"=dword:00000258"Reconnect"="TSEventReconnect""Disconnect"="TSEventDisconnect"[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]"DLLName"="wlnotify.dll""Logon"="RegisterTicketExpiredNotificationEvent""Logoff"="UnregisterTicketExpiredNotificationEvent""Impersonate"=dword:00000001"Asynchronous"=dword:00000001 The following are the files found: ****************************************************************************D:\WINDOWS\system32\cagmgr32.dll D:\WINDOWS\system32\cagmgr32.dll D:\WINDOWS\system32\cqrtcli.dll D:\WINDOWS\system32\cqrtcli.dll D:\WINDOWS\system32\cxmres.dll D:\WINDOWS\system32\cxmres.dll D:\WINDOWS\system32\dcvxdec_0407.dll D:\WINDOWS\system32\dcvxdec_0407.dll D:\WINDOWS\system32\ddvoice.dll D:\WINDOWS\system32\ddvoice.dll D:\WINDOWS\system32\marapi.dll D:\WINDOWS\system32\marapi.dll D:\WINDOWS\system32\mautb.dll D:\WINDOWS\system32\mautb.dll D:\WINDOWS\system32\mgc40u.dll D:\WINDOWS\system32\mgc40u.dll D:\WINDOWS\system32\mpsystem.dll D:\WINDOWS\system32\mpsystem.dll D:\WINDOWS\system32\muimsg.dll D:\WINDOWS\system32\muimsg.dll D:\WINDOWS\system32\mxaudite.dll D:\WINDOWS\system32\mxaudite.dll D:\WINDOWS\system32\ovmanage.dll D:\WINDOWS\system32\ovmanage.dll D:\WINDOWS\system32\sacur32.dll D:\WINDOWS\system32\sacur32.dll D:\WINDOWS\system32\wips.dll D:\WINDOWS\system32\wips.dll D:\WINDOWS\system32\wqhbth.dll D:\WINDOWS\system32\wqhbth.dll D:\WINDOWS\system32\xwsp1res.dll D:\WINDOWS\system32\xwsp1res.dll D:\WINDOWS\system32\guard.tmp D:\WINDOWS\system32\guard.tmp  Registry Entries that were Deleted: Please verify that the listing looks ok.  If there was something deleted wrongly there are backups in the backreg folder. ****************************************************************************REGEDIT4[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]"{4556C666-9FB4-4E25-B087-24806C42222A}"=-"{1D44F68B-17D9-4FBD-B284-8305B76B3FA9}"=-"{98A134C1-1E3B-4C1E-8D42-529745594227}"=-"{09C16CA7-FC50-4894-91E8-75DC0205EE5C}"=-"{104EB31E-03E9-471C-9112-D75C120E477E}"=-[-HKEY_CLASSES_ROOT\CLSID\{4556C666-9FB4-4E25-B087-24806C42222A}][-HKEY_CLASSES_ROOT\CLSID\{1D44F68B-17D9-4FBD-B284-8305B76B3FA9}][-HKEY_CLASSES_ROOT\CLSID\{98A134C1-1E3B-4C1E-8D42-529745594227}][-HKEY_CLASSES_ROOT\CLSID\{09C16CA7-FC50-4894-91E8-75DC0205EE5C}][-HKEY_CLASSES_ROOT\CLSID\{104EB31E-03E9-471C-9112-D75C120E477E}]REGEDIT4[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]"SV1"=""****************************************************************************Desktop.ini Contents: ********************************************************************************************************************************************************

balltrap34 · Answer

merci tu avais la dose lol

jacko · Answer

en effet!je confirme donc que c'etait bien ca! plus aucune pub! cest formidable!!encore merci a tous ;-)bon dimanche

balltrap34 · Answer

content pour toia++ sans soucis j espere

Pop up!

32 réponses

Discussions similaires

Newsletters