[about blank et casino] fenetre indésirable

Résolu
fcduo Messages postés 273 Statut Membre -  
 boulepate -
Bonjour,
Je vous envoie un hijack de mon pc qui vient de choper about blank et casino.
Pouvez-vous m'aider à supprimer tout ça ? (impossible de changer la page de démarrage IE par défaut par exemple).
Merci d'avance.

Logfile of HijackThis v1.99.1
Scan saved at 16:31:43, on 14/11/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CommonTime\Cadenza\Cadenza.exe
C:\PROGRA~1\NavNT\DefWatch.exe
C:\WINDOWS\System32\NALNTSRV.EXE
C:\PROGRA~1\AT&TGL~1\NetCfgSv.EXE
C:\PROGRA~1\NavNT\rtvscan.exe
C:\WINDOWS\System32\wm.exe
Z:\clntrust.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\dpmw32.exe
C:\WINDOWS\System32\NWTRAY.EXE
C:\WINDOWS\System32\tp4mon.exe
C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.EXE
C:\WINDOWS\System32\ltmsg.exe
C:\WINDOWS\System32\BESCH.EXE
C:\PROGRA~1\ACDSYS~1\ACDSee\CAMDET~1.EXE
C:\PROGRA~1\NavNT\vptray.exe
C:\WINDOWS\System32\NALDESK.EXE
C:\Program Files\IE Doctor\IEDoctor.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\CommonTime\Cadenza\CdzSvc.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Palm\HOTSYNC.EXE
C:\Lotus\Notes\NLNOTES.EXE
C:\Lotus\Notes\nwrdaemn.EXE
C:\Lotus\Notes\nupdate.EXE
C:\Lotus\Notes\nhldaemn.EXE
C:\Program Files\VANTIVE32\VANTIV32.EXE
C:\Program Files\DevisSol\SOL.exe
D:\documents and Settings\ebax178\My Documents\PERSO\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\Temp\se.dll/space.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = pass
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\Temp\se.dll/space.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://pic.fr.schneider-electric.com:1959/data/proxy.pac
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {2D1B4796-4E07-44B2-9EED-54DF3231F316} - C:\WINDOWS\System32\ncan.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [NDPS] C:\WINDOWS\System32\dpmw32.exe
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKLM\..\Run: [TrackPointSrv] tp4mon.exe
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [TPTRAY] C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.EXE
O4 - HKLM\..\Run: [LTWinModem1] ltmsg.exe 9
O4 - HKLM\..\Run: [BackupExecScheduler] BESCH.EXE
O4 - HKLM\..\Run: [Camera Detector] C:\PROGRA~1\ACDSYS~1\ACDSee\CAMDET~1.EXE
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\NavNT\vptray.exe
O4 - HKLM\..\Run: [Verif Symantec NAV8] "C:\Program Files\Schneider integration\VerifNAV.vbs"
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [IE Doctor] C:\Program Files\IE Doctor\IEDoctor.exe /min
O4 - HKLM\..\Run: [sp] rundll32 C:\Temp\se.dll,DllInstall
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Cadenza] C:\Program Files\CommonTime\Cadenza\CdzSvc.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Reader\reader_sl.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O16 - DPF: {B2CC4BA0-08EB-4AF9-A532-1295DF0C8A07} (WebQuartzX Contrôle) - http://webquartz.fr.schneider-electric.com/ocx/WebQuartz.cab
O16 - DPF: {C470E718-6117-11D7-A1AC-0002A5269C35} (CreditClient.ControlInactif) - file://C:\Temp\CreditClient.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = fr.schneider-electric.com
O17 - HKLM\Software\..\Telephony: DomainName = fr.schneider-electric.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = fr.schneider-electric.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 139.160.77.13 139.160.111.43
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 139.160.77.13 139.160.111.43
O18 - Filter: text/html - {FCE29A2C-462C-43BE-8587-C95F3112DA1A} - C:\WINDOWS\System32\ncan.dll
O18 - Filter: text/plain - {FCE29A2C-462C-43BE-8587-C95F3112DA1A} - C:\WINDOWS\System32\ncan.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: CommonTime mNotes Server (CadenzaServer) - CommonTime Limited - C:\Program Files\CommonTime\Cadenza\Cadenza.exe
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\NavNT\DefWatch.exe
O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\System32\ibmpmsvc.exe
O23 - Service: Novell Application Launcher (NALNTSERVICE) - Novell, Inc. - C:\WINDOWS\System32\NALNTSRV.EXE
O23 - Service: Network Configuration Service (NetCfgSvr) - AT&T - C:\PROGRA~1\AT&TGL~1\NetCfgSv.EXE
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\NavNT\rtvscan.exe
O23 - Service: OracleOraHome92ClientCache - Unknown owner - C:\oracle\BIN\ONRSD.EXE
O23 - Service: ReplService - Unknown owner - C:\Program Files\Trilogy\ReplService\repl.exe
O23 - Service: Novell Workstation Manager (WM) - Novell, Inc. - C:\WINDOWS\System32\wm.exe

6 réponses

  2.
    fcduo Messages postés 273 Statut Membre 17
     
    Merci,
    J'essaie demain matin et te tiens au courant.
    @+
    0
  3. fcduo Messages postés 273 Statut Membre 17
     
    Bonjour,
    Impossible de tester par activscan (active X bloqué).
    Microsoft antispyware téléchargé et installé, mais tjrs IE dirigé vers about blank avec deux petits tirets verticaux entre about et blank (donc ce n'est pas une feuille blanche !).
    A tout hasard ci-joint hijack:

    Logfile of HijackThis v1.99.1
    Scan saved at 16:51:40, on 15/11/2005
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\System32\ibmpmsvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\CommonTime\Cadenza\Cadenza.exe
    C:\PROGRA~1\NavNT\DefWatch.exe
    C:\WINDOWS\System32\NALNTSRV.EXE
    C:\PROGRA~1\AT&TGL~1\NetCfgSv.EXE
    C:\PROGRA~1\NavNT\rtvscan.exe
    C:\WINDOWS\System32\wm.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\dpmw32.exe
    C:\WINDOWS\System32\NWTRAY.EXE
    C:\WINDOWS\System32\tp4mon.exe
    C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
    C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.EXE
    C:\WINDOWS\System32\ltmsg.exe
    C:\WINDOWS\System32\BESCH.EXE
    C:\PROGRA~1\ACDSYS~1\ACDSee\CAMDET~1.EXE
    C:\PROGRA~1\NavNT\vptray.exe
    C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
    C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
    C:\WINDOWS\System32\rundll32.exe
    C:\WINDOWS\System32\ctfmon.exe
    C:\Program Files\CommonTime\Cadenza\CdzSvc.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\Palm\HOTSYNC.EXE
    C:\Program Files\Internet Explorer\iexplore.exe
    D:\documents and Settings\ebax178\My Documents\PERSO\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\Temp\se.dll/space.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = pass
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\Temp\se.dll/space.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.yahoo.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://pic.fr.schneider-electric.com:1959/data/proxy.pac
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {2D1B4796-4E07-44B2-9EED-54DF3231F316} - C:\WINDOWS\System32\ncan.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O4 - HKLM\..\Run: [NDPS] C:\WINDOWS\System32\dpmw32.exe
    O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
    O4 - HKLM\..\Run: [TrackPointSrv] tp4mon.exe
    O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
    O4 - HKLM\..\Run: [TPTRAY] C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.EXE
    O4 - HKLM\..\Run: [LTWinModem1] ltmsg.exe 9
    O4 - HKLM\..\Run: [BackupExecScheduler] BESCH.EXE
    O4 - HKLM\..\Run: [Camera Detector] C:\PROGRA~1\ACDSYS~1\ACDSee\CAMDET~1.EXE
    O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\NavNT\vptray.exe
    O4 - HKLM\..\Run: [Verif Symantec NAV8] "C:\Program Files\Schneider integration\VerifNAV.vbs"
    O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
    O4 - HKLM\..\Run: [IE Doctor] C:\Program Files\IE Doctor\IEDoctor.exe /min
    O4 - HKLM\..\Run: [sp] rundll32 C:\Temp\se.dll,DllInstall
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
    O4 - HKCU\..\Run: [Cadenza] C:\Program Files\CommonTime\Cadenza\CdzSvc.exe
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE
    O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Reader\reader_sl.exe
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab
    O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
    O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
    O16 - DPF: {B2CC4BA0-08EB-4AF9-A532-1295DF0C8A07} (WebQuartzX Contrôle) - http://webquartz.fr.schneider-electric.com/ocx/WebQuartz.cab
    O16 - DPF: {C470E718-6117-11D7-A1AC-0002A5269C35} (CreditClient.ControlInactif) - file://C:\Temp\CreditClient.cab
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = fr.schneider-electric.com
    O17 - HKLM\Software\..\Telephony: DomainName = fr.schneider-electric.com
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = fr.schneider-electric.com
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 139.160.77.13 139.160.111.43
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 139.160.77.13 139.160.111.43
    O18 - Filter: text/html - {FCE29A2C-462C-43BE-8587-C95F3112DA1A} - C:\WINDOWS\System32\ncan.dll
    O18 - Filter: text/plain - {FCE29A2C-462C-43BE-8587-C95F3112DA1A} - C:\WINDOWS\System32\ncan.dll
    O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
    O23 - Service: CommonTime mNotes Server (CadenzaServer) - CommonTime Limited - C:\Program Files\CommonTime\Cadenza\Cadenza.exe
    O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\NavNT\DefWatch.exe
    O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\System32\ibmpmsvc.exe
    O23 - Service: Novell Application Launcher (NALNTSERVICE) - Novell, Inc. - C:\WINDOWS\System32\NALNTSRV.EXE
    O23 - Service: Network Configuration Service (NetCfgSvr) - AT&T - C:\PROGRA~1\AT&TGL~1\NetCfgSv.EXE
    O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\NavNT\rtvscan.exe
    O23 - Service: OracleOraHome92ClientCache - Unknown owner - C:\oracle\BIN\ONRSD.EXE
    O23 - Service: ReplService - Unknown owner - C:\Program Files\Trilogy\ReplService\repl.exe
    O23 - Service: Novell Workstation Manager (WM) - Novell, Inc. - C:\WINDOWS\System32\wm.exe

    Merci de votre aide.
    0
    1. boulepate
       
      Salut,
      tu peux fixer ceci :

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\Temp\se.dll/space.html
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = pass
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\Temp\se.dll/space.html
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
      R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
      R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://pic.fr.schneider-electric.com:1959/data/proxy.pac
      O2 - BHO: (no name) - {2D1B4796-4E07-44B2-9EED-54DF3231F316} - C:\WINDOWS\System32\ncan.dll
      O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
      O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

      Ensuite fait ceci:
      clique droit sur poste de travail, propriété, choisis l'onglet
      restauration du systeme, desactive le puis ok.
      Ensuite lance spybot fait un scan même si tu la fait hier.
      Apres telecharge ad-aware si tu ne la pas:
      Ad-Aware SE Personal:(en anglais)
      Ad-aware
      -Le patch pour le faire fonctionner en français:
      Patch FR pour Ad-aware

      Puis telecharge a²free si tu ne la pas puis fait un scan:
      a² free: Question Contre les trojans et malware.
      Arrow a² free

      Redemarre ton ordi puis remet un rapport hijack this s'il te plait.
      0
    2. fcduo Messages postés 273 Statut Membre 17
       
      En fait il y afallu que je supprime c:\windows\system32\ncan.dll en mode sans échec (il voulait sans arrêt me changer l'adresse IE).
      Voici hijack.
      Tout va bien ?
      Merci d'avance.
      Logfile of HijackThis v1.99.1
      Scan saved at 22:09:24, on 15/11/2005
      Platform: Windows XP SP1 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\System32\ibmpmsvc.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\CommonTime\Cadenza\Cadenza.exe
      C:\PROGRA~1\NavNT\DefWatch.exe
      C:\WINDOWS\System32\NALNTSRV.EXE
      C:\PROGRA~1\AT&TGL~1\NetCfgSv.EXE
      C:\PROGRA~1\NavNT\rtvscan.exe
      C:\WINDOWS\System32\wm.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\System32\dpmw32.exe
      C:\WINDOWS\System32\NWTRAY.EXE
      C:\WINDOWS\System32\tp4mon.exe
      C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
      C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.EXE
      C:\WINDOWS\System32\ltmsg.exe
      C:\WINDOWS\System32\BESCH.EXE
      C:\PROGRA~1\ACDSYS~1\ACDSee\CAMDET~1.EXE
      C:\PROGRA~1\NavNT\vptray.exe
      C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
      C:\Program Files\IE Doctor\IEDoctor.exe
      C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
      C:\WINDOWS\System32\ctfmon.exe
      C:\Program Files\CommonTime\Cadenza\CdzSvc.exe
      C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
      C:\Palm\HOTSYNC.EXE
      C:\Program Files\AT&T Global Network Client\NetClient.exe
      D:\documents and Settings\ebax178\My Documents\PERSO\HijackThis.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://pass/
      R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.yahoo.com
      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://pic.fr.schneider-electric.com:1959/data/proxy.pac
      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\ActiveX\AcroIEHelper.dll
      O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
      O4 - HKLM\..\Run: [NDPS] C:\WINDOWS\System32\dpmw32.exe
      O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
      O4 - HKLM\..\Run: [TrackPointSrv] tp4mon.exe
      O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
      O4 - HKLM\..\Run: [TPTRAY] C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.EXE
      O4 - HKLM\..\Run: [LTWinModem1] ltmsg.exe 9
      O4 - HKLM\..\Run: [BackupExecScheduler] BESCH.EXE
      O4 - HKLM\..\Run: [Camera Detector] C:\PROGRA~1\ACDSYS~1\ACDSee\CAMDET~1.EXE
      O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\NavNT\vptray.exe
      O4 - HKLM\..\Run: [Verif Symantec NAV8] "C:\Program Files\Schneider integration\VerifNAV.vbs"
      O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
      O4 - HKLM\..\Run: [IE Doctor] C:\Program Files\IE Doctor\IEDoctor.exe /min
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
      O4 - HKCU\..\Run: [Cadenza] C:\Program Files\CommonTime\Cadenza\CdzSvc.exe
      O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
      O4 - HKCU\..\RunOnce: [NetSP - restore database] "C:\Program Files\AT&T Global Network Client\NetSP.exe" -show
      O4 - Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE
      O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Reader\reader_sl.exe
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
      O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab
      O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
      O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
      O16 - DPF: {B2CC4BA0-08EB-4AF9-A532-1295DF0C8A07} (WebQuartzX Contrôle) - http://webquartz.fr.schneider-electric.com/ocx/WebQuartz.cab
      O16 - DPF: {C470E718-6117-11D7-A1AC-0002A5269C35} (CreditClient.ControlInactif) - file://C:\Temp\CreditClient.cab
      O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = fr.schneider-electric.com
      O17 - HKLM\Software\..\Telephony: DomainName = fr.schneider-electric.com
      O17 - HKLM\System\CCS\Services\Tcpip\..\{116C0743-BFC3-48ED-B11A-19E8AC390D3B}: Domain = fr.schneider-electric.com
      O17 - HKLM\System\CCS\Services\Tcpip\..\{116C0743-BFC3-48ED-B11A-19E8AC390D3B}: NameServer = 139.160.77.13,10.195.20.30
      O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = fr.schneider-electric.com
      O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = fr.schneider-electric.com
      O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 139.160.77.13 139.160.111.43
      O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = fr.schneider-electric.com
      O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 139.160.77.13 139.160.111.43
      O18 - Filter: text/html - {920E720B-29C4-44BA-A403-BD54CE57B374} - C:\WINDOWS\System32\ncan.dll
      O18 - Filter: text/plain - {920E720B-29C4-44BA-A403-BD54CE57B374} - C:\WINDOWS\System32\ncan.dll
      O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
      O23 - Service: CommonTime mNotes Server (CadenzaServer) - CommonTime Limited - C:\Program Files\CommonTime\Cadenza\Cadenza.exe
      O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\NavNT\DefWatch.exe
      O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\System32\ibmpmsvc.exe
      O23 - Service: Novell Application Launcher (NALNTSERVICE) - Novell, Inc. - C:\WINDOWS\System32\NALNTSRV.EXE
      O23 - Service: Network Configuration Service (NetCfgSvr) - AT&T - C:\PROGRA~1\AT&TGL~1\NetCfgSv.EXE
      O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\NavNT\rtvscan.exe
      O23 - Service: OracleOraHome92ClientCache - Unknown owner - C:\oracle\BIN\ONRSD.EXE
      O23 - Service: ReplService - Unknown owner - C:\Program Files\Trilogy\ReplService\repl.exe
      O23 - Service: Novell Workstation Manager (WM) - Novell, Inc. - C:\WINDOWS\System32\wm.exe
      0
  4. boulepate
     
    Re,
    fixe ceci en mode sans echec.

    O16 - DPF: {C470E718-6117-11D7-A1AC-0002A5269C35} (CreditClient.ControlInactif) - file://C:\Temp\CreditClient.cab
    O16 - DPF: {B2CC4BA0-08EB-4AF9-A532-1295DF0C8A07} (WebQuartzX Contrôle) - http://webquartz.fr.schneider-electric.com/ocx/WebQuartz.cab
    O18 - Filter: text/html - {920E720B-29C4-44BA-A403-BD54CE57B374} - C:\WINDOWS\System32\ncan.dll
    O18 - Filter: text/plain - {920E720B-29C4-44BA-A403-BD54CE57B374} - C:\WINDOWS\System32\ncan.dll

    Clique sur demarrer, executer, tape msconfig, và dans l'onglet demarrage et desactive ceci si tu le vois ou processus ayant le même nom:
    O18 - Filter: text/plain - {920E720B-29C4-44BA-A403-BD54CE57B374} - C:\WINDOWS\System32\ncan.dll

    Redemarre clique droit sur poste de travail, propriétés, onglet restauration du systeme, puis decoche la case, appliquer, puis ok.
    A tu utilisais les programmes que je t'ai donné ?! (a²free et ad-aware)

    Ensuite telecharge ceci, un pare feu, puisque tu en à pas:
    ZoneAlarm:
    firewall gratuit et simple d'utilisation
    Zone Alarm

    Puis fait ceci:
    télécharge SmitfraudFix
    http://siri.urz.free.fr/Fix/SmitfraudFix.zip
    -Lance SmitfraudFix, et choisir l’option 1 copie le rapport ici
    0

  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. fcduo Messages postés 273 Statut Membre 17
     
    Bonsoir,
    C'est mon pc du boulot et je ne l'ai pas sous la main !
    J'ai spybot et adware, par contre, impossible de m'enregistrer sur a².
    Quant à la protection réseau, je ne sais pas si je pourrai l'installer sans problème....
    Je te tiens au courant mais pas avant la semaine prochaine, je suis en déplacement.
    Merci encore.
    @+
    0
  7. fcduo Messages postés 273 Statut Membre 17
     
    Bonjour,
    J'ai fini par détruire ncan.dll, et depuis plus de soucis.
    Je viens de supprimer les deux lignes 018.
    Je joins un hijack à tout hasard, mais tout va bien !
    Merci encore de ton aide boulepate !
    @+

    Logfile of HijackThis v1.99.1
    Scan saved at 12:15:49, on 21/11/2005
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\System32\ibmpmsvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\CommonTime\Cadenza\Cadenza.exe
    C:\PROGRA~1\NavNT\DefWatch.exe
    C:\WINDOWS\System32\NALNTSRV.EXE
    C:\PROGRA~1\AT&TGL~1\NetCfgSv.EXE
    C:\PROGRA~1\NavNT\rtvscan.exe
    C:\WINDOWS\System32\wm.exe
    Z:\clntrust.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\dpmw32.exe
    C:\WINDOWS\System32\NWTRAY.EXE
    C:\WINDOWS\System32\tp4mon.exe
    C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
    C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.EXE
    C:\WINDOWS\System32\ltmsg.exe
    C:\WINDOWS\System32\BESCH.EXE
    C:\WINDOWS\System32\NALDESK.EXE
    C:\PROGRA~1\ACDSYS~1\ACDSee\CAMDET~1.EXE
    C:\PROGRA~1\NavNT\vptray.exe
    C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
    C:\Program Files\IE Doctor\IEDoctor.exe
    C:\WINDOWS\System32\ctfmon.exe
    C:\Program Files\CommonTime\Cadenza\CdzSvc.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\Palm\HOTSYNC.EXE
    C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
    C:\Lotus\Notes\NLNOTES.EXE
    C:\Lotus\Notes\nwrdaemn.EXE
    C:\Lotus\Notes\nupdate.EXE
    C:\Lotus\Notes\nhldaemn.EXE
    C:\Program Files\VANTIVE32\VANTIV32.EXE
    C:\Program Files\DevisSol\SOL.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    D:\documents and Settings\ebax178\My Documents\PERSO\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.yahoo.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://pass.fr.schneider-electric.com/FR/DCF/Cialsitemgr.nsf/HomePage?ReadForm
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.yahoo.com
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://pass/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.yahoo.com
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.yahoo.com
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://pic.fr.schneider-electric.com:1959/data/proxy.pac
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O4 - HKLM\..\Run: [NDPS] C:\WINDOWS\System32\dpmw32.exe
    O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
    O4 - HKLM\..\Run: [TrackPointSrv] tp4mon.exe
    O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
    O4 - HKLM\..\Run: [TPTRAY] C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.EXE
    O4 - HKLM\..\Run: [LTWinModem1] ltmsg.exe 9
    O4 - HKLM\..\Run: [BackupExecScheduler] BESCH.EXE
    O4 - HKLM\..\Run: [Camera Detector] C:\PROGRA~1\ACDSYS~1\ACDSee\CAMDET~1.EXE
    O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\NavNT\vptray.exe
    O4 - HKLM\..\Run: [Verif Symantec NAV8] "C:\Program Files\Schneider integration\VerifNAV.vbs"
    O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
    O4 - HKLM\..\Run: [IE Doctor] C:\Program Files\IE Doctor\IEDoctor.exe /min
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
    O4 - HKCU\..\Run: [Cadenza] C:\Program Files\CommonTime\Cadenza\CdzSvc.exe
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE
    O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Reader\reader_sl.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab
    O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
    O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
    O16 - DPF: {B2CC4BA0-08EB-4AF9-A532-1295DF0C8A07} (WebQuartzX Contrôle) - http://webquartz.fr.schneider-electric.com/ocx/WebQuartz.cab
    O16 - DPF: {C470E718-6117-11D7-A1AC-0002A5269C35} (CreditClient.ControlInactif) - file://C:\Temp\CreditClient.cab
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = fr.schneider-electric.com
    O17 - HKLM\Software\..\Telephony: DomainName = fr.schneider-electric.com
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = fr.schneider-electric.com
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 139.160.77.13 139.160.111.43
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 139.160.77.13 139.160.111.43
    O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
    O23 - Service: CommonTime mNotes Server (CadenzaServer) - CommonTime Limited - C:\Program Files\CommonTime\Cadenza\Cadenza.exe
    O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\NavNT\DefWatch.exe
    O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\System32\ibmpmsvc.exe
    O23 - Service: Novell Application Launcher (NALNTSERVICE) - Novell, Inc. - C:\WINDOWS\System32\NALNTSRV.EXE
    O23 - Service: Network Configuration Service (NetCfgSvr) - AT&T - C:\PROGRA~1\AT&TGL~1\NetCfgSv.EXE
    O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\NavNT\rtvscan.exe
    O23 - Service: OracleOraHome92ClientCache - Unknown owner - C:\oracle\BIN\ONRSD.EXE
    O23 - Service: ReplService - Unknown owner - C:\Program Files\Trilogy\ReplService\repl.exe
    O23 - Service: Novell Workstation Manager (WM) - Novell, Inc. - C:\WINDOWS\System32\wm.exe
    0
    1. boulepate
       
      Salut Fcduo,

      ton rapport me semble correct fait un scan avec a²free ça serait pas mal si tu la toujours pas fait.
      Puis installe un pare-feu, car là avec proxy ça ne suffit pas malheuresement ..
      Ensuite telecharge ceci, un pare feu, puisque tu en à pas:
      ZoneAlarm:
      firewall gratuit et simple d'utilisation
      Zone Alarm

      Voilà bon Surf" :)
      0

Discussions similaires

Cresus casino à fuir
Juanito0101 -
Richegars -

32 réponses
Une solution pour about:blank
baissaoui -
baissaoui -

0 réponse
Cresus Casino , vos avis ?
jojo130166 -
dailybet -

16 réponses
Cresus Casino : retrait
Pedrito400 -
alex -

116 réponses
Cresus casino avis
Abdela0101 -
bazfile -

1 réponse