Popup "Lookin at iexplore" ?

Kevin -  
Bonjour, depuis certain temp des popups n'arrête pas d'ouvrir a chaque 1 minute disant " Lookin at iexplore ", (si one ne ferme pas la première des tonnes s'ouvre), et vu que je suis pas un expère en informatique je demande conseil

merci d'avance :D

15 réponses

  1.  Kristopher Contributeur
    Salut,

    Normalement, le problème devrait disparaître après cette manipulation :

    - Fermes toutes les fenêtres d'Internet Explorer.
    - Vas dans démarrer -> Panneau de configuration -> Options Internet -> Supprimer les fichiers... (+ Supprimer tout le contenu hors connexion).

    Subséquemment, télécharges, mets à jour et scannes ton PC avec Ad-Aware et SpyBot Search & Destroy :
    - lien Ad-Aware SE Personal: Ad-aware
    - lien SpyBot - Search & Destroy :
    Spybot Search & Destroy

    Good luck
    0
    1. Kevin
      sa na pas fonctionné est-ce qu'il y a une autre solution?
      0
  2. Utilisateur anonyme
    salut telecharge et execute ces antispywares ( pense a les mettre a jour avant de les lancées)
    (1) ad-aware version 1.06

    (ici) http://www.florensac-chasse-trap.com/ section virus/logiciel de securite
    voir demo
    http://pageperso.aol.fr/balltrap34/adwseflash.zip
    ***
    (2) spybot version 1.4

    (ici) http://www.florensac-chasse-trap.com/ section virus/logiciel de securite

    voir demo d utilisation
    http://pageperso.aol.fr/Balltrap34/demo%20spybot.htm
    ***

    et aussi ceci
    (3) CleanUp40.exe
    http://www.florensac-chasse-trap.com/ section virus/logiciel de securite

    voir demo
    http://pageperso.aol.fr/balltrap34/democleanup.htm
    ***
    (4) a2

    http://www.emsisoft.net/fr/
    penser a le metre a jour avant de scanner le pc
    ***
    ps : un grand merci a balltrap pour les lien :)

    (5) Edwido
    http://download.ewido.net/ewido-setup.exe
    Pendant l'installation, sur la page "Additional Options", décoche les deux options "Install background guard" et "Install scan via context menu Ewido Security Suite. Clique sur mise à jour.

    Clique sur scanner puis sur scan complet du système.

    (6)SmitfraudFix

    http://siri.urz.free.fr/Fix/SmitfraudFix.zip
    Exécute le, Double click sur Smitfraudfix.cmd choisit l’option 1, il va générer un rapport
    Copie/colle le sur le poste stp.

    ensuite telecharge hijackthis et colle le raport ici
    http://www.infos-du-net.com/telecharger/HijackThis.html
    demo :
    http://pageperso.aol.fr/balltrap34/demohijack.htm

    @+++++++
    0
    1. Kevin
      Voici le rapport de Smitfraudfix:

      SmitFraudFix v2.08

      Rapport fait à 19:21:44,89 le 2005-12-13
      Executé à partir de C:\Documents and Settings\Kevin\Bureau\SECURITER MAX !!!\SmitfraudFix
      OS: Microsoft Windows XP [version 5.1.2600]

      »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\

      »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS

      »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system

      »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\Web

      »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system32

      »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\Documents and Settings\Kevin\Application Data

      »»»»»»»»»»»»»»»»»»»»»»»» Recherche Menu Démarrer

      »»»»»»»»»»»»»»»»»»»»»»»» Recherche Bureau

      »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\Program Files

      »»»»»»»»»»»»»»»»»»»»»»»» Recherche présence de clés corrompues

      »»»»»»»»»»»»»»»»»»»»»»»» Recherche éléments du bureau

      [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]

      »»»»»»»»»»»»»»»»»»»»»»»» Recherche Sharedtaskscheduler

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
      "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pr‚-chargeur Browseui"
      "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="D‚mon de cache des cat‚gories de composant"

      »»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

      »»»»»»»»»»»»»»»»»»»»»»»» Fin du rapport
      0
      1. Kevin
        Et voici Hijack this:

        Logfile of HijackThis v1.99.1
        Scan saved at 19:26:05, on 2005-12-13
        Platform: Windows XP SP2 (WinNT 5.01.2600)
        MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\System32\Ati2evxx.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\spoolsv.exe
        C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
        C:\Program Files\Norton AntiVirus\navapsvc.exe
        C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
        C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
        C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
        C:\WINDOWS\System32\svchost.exe
        C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
        C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
        C:\Program Files\Stardock\Object Desktop\ThemeManager\wbload.exe
        C:\WINDOWS\Explorer.EXE
        C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
        C:\windows\system\hpsysdrv.exe
        C:\WINDOWS\System32\hphmon05.exe
        C:\HP\KBD\KBD.EXE
        C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
        C:\WINDOWS\system32\VTTimer.exe
        C:\WINDOWS\LTMSG.exe
        C:\Program Files\Multimedia Card Reader\shwicon2k.exe
        C:\WINDOWS\ALCXMNTR.EXE
        C:\Program Files\iTunes\iTunesHelper.exe
        C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
        C:\WINDOWS\VM_STI.EXE
        C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
        C:\WINDOWS\system32\myqaaaaa.exe
        C:\Program Files\iPod\bin\iPodService.exe
        C:\Program Files\MSN Messenger\msnmsgr.exe
        C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
        C:\Program Files\Fichiers communs\Real\Update_OB\rnathchk.exe
        C:\Program Files\Logitech\SetPoint\KEM.exe
        C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE
        C:\Program Files\Internet Explorer\iexplore.exe
        C:\Program Files\Internet Explorer\iexplore.exe
        C:\Program Files\Messenger\msmsgs.exe
        C:\Documents and Settings\Kevin\Bureau\SECURITER MAX !!!\HijackThis.exe

        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sympatico.msn.ca/
        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://sympatico.msn.ca/
        R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
        R3 - Default URLSearchHook is missing
        O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
        O2 - BHO: CIEPl Object - {F85E86D8-F796-4C97-AAA2-26664A98A42C} - C:\WINDOWS\system32\service.dll
        O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr-ca\msntb.dll (file missing)
        O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
        O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll (file missing)
        O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
        O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
        O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
        O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
        O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
        O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r
        O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
        O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
        O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
        O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
        O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
        O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
        O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
        O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
        O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
        O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
        O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
        O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE USB PC Camera 301P
        O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
        O4 - HKLM\..\Run: [websx] C:\Program Files\websx\int280595.exe -auto
        O4 - HKLM\..\Run: [Uninstall_TBPS] C:\WINDOWS\Temp\TBuninst.exe /remove
        O4 - HKLM\..\Run: [Windows Mouse Utilities] mouseutils.exe
        O4 - HKLM\..\Run: [FX] C:\WINDOWS\Downloaded Program Files\CONFLICT.1\ieloader.exe
        O4 - HKLM\..\Run: [rbenh ml310e] "C:\Program Files\RBEnhance\rbenh.exe"
        O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
        O4 - HKLM\..\Run: [rb32 ml310e] "C:\Program Files\RapidBlaster\rb32.exe"
        O4 - HKLM\..\Run: [Microsoft Windows System] myqaaaaa.exe
        O4 - HKLM\..\RunServices: [Windows Mouse Utilities] mouseutils.exe
        O4 - HKLM\..\RunServices: [Microsoft Windows System] myqaaaaa.exe
        O4 - HKLM\..\RunOnce: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
        O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
        O4 - HKCU\..\Run: [Steam] "c:\valve\steam\steam.exe" -silent
        O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
        O4 - HKCU\..\Run: [a-squared] "C:\Program Files\a-squared\a2guard.exe"
        O4 - Global Startup: Compaq Connections.lnk = C:\Program Files\Compaq Connections\1940576\Program\BackWeb-1940576.exe
        O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
        O4 - Global Startup: KVG.exe
        O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
        O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe
        O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
        O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
        O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
        O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
        O8 - Extra context menu item: Shorten URL - http://www.cjb.net/menuext.html
        O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
        O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
        O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
        O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
        O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/hamsterball/raptisoftgameloader.cab
        O16 - DPF: {01347765-1965-426B-91A4-AA6BB342B9A3} (InstallerObj Class) - http://www.1-click.com/common/files/installer-hidden-test.cab
        O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/MediaAccessVerisign/ie/bridge-c18.cab
        O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
        O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F99} (CR64Loader Object) - http://www.miniclip.com/puzzlepirates/miniclipGameLoader.dll
        O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst0401.cab
        O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
        O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://www.miniclip.com/ricochet/ReflexiveWebGameLoader.cab
        O16 - DPF: {469C7080-8EC8-43A6-AD97-45848113743C} - http://akamai.downloadv3.com/binaries/IA/nethv32_FR_XP.cab
        O16 - DPF: {511F9316-771B-4953-A268-1C36DA667FE9} - http://ip.sponsoradulto.com/cab/3/fr/SysWebTelecomInt.cab
        O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
        O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game15.zylomgames.com/activex/zylomgamesplayer.cab
        O18 - Protocol: bw+0 - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bw+0s - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bw-0 - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bw-0s - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bw00 - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bw00s - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bw10 - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bw10s - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bw20 - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bw20s - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bw30 - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bw30s - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bw40 - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bw40s - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bw50 - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bw50s - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bw60 - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bw60s - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bw70 - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bw70s - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bw80 - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bw80s - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bw90 - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bw90s - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwa0 - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwa0s - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwb0 - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwb0s - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwc0 - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwc0s - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwd0 - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwd0s - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwe0 - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwe0s - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwf0 - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwf0s - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
        O18 - Protocol: bwg0 - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwg0s - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwh0 - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwh0s - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwi0 - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwi0s - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwj0 - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwj0s - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwk0 - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwk0s - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwl0 - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwl0s - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwm0 - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwm0s - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwn0 - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwn0s - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwo0 - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwo0s - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwp0 - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwp0s - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwq0 - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwq0s - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwr0 - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwr0s - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bws0 - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bws0s - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwt0 - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwt0s - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwu0 - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwu0s - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwv0 - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwv0s - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bww0 - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bww0s - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwx0 - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwx0s - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwy0 - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwy0s - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwz0 - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: bwz0s - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
        O18 - Protocol: offline-8876480 - {C623731A-0F21-4E79-B006-695C69DF2885} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
        O20 - AppInit_DLLs: C:\WINDOWS\system32\elfbuoil.dll
        O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
        O20 - Winlogon Notify: service - C:\WINDOWS\SYSTEM32\service.dll
        O20 - Winlogon Notify: WB - C:\Program Files\Stardock\Object Desktop\ThemeManager\fastload.dll
        O21 - SSODL: SysTray.Exgr - {5368D1FC-4F5C-4f1b-B134-E67214FC78E9} - C:\WINDOWS\system32\jfdflfai.dll (file missing)
        O21 - SSODL: IEFilter - {5C954172-55EB-4D57-A71A-9DAB5A8BD9D4} - C:\WINDOWS\system32\IEFilter.dll
        O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
        O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
        O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
        O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
        O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
        O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
        O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
        O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
        O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
        O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
        O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
        O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
        O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
        O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
        O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
        0
        2. Utilisateur anonyme
          salut fix ceci avec hijack

          R3 - Default URLSearchHook is missing
          O2 - BHO: CIEPl Object - {F85E86D8-F796-4C97-AAA2-26664A98A42C} - C:\WINDOWS\system32\service.dll
          O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr-ca\msntb.dll (file missing)
          O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll (file missing)
          O4 - HKLM\..\Run: [websx] C:\Program Files\websx\int280595.exe -auto
          O4 - HKLM\..\Run: [Uninstall_TBPS] C:\WINDOWS\Temp\TBuninst.exe /remove
          O4 - HKLM\..\Run: [Windows Mouse Utilities] mouseutils.exe
          O4 - HKLM\..\Run: [FX] C:\WINDOWS\Downloaded Program Files\CONFLICT.1\ieloader.exe
          O4 - HKLM\..\Run: [rbenh ml310e] "C:\Program Files\RBEnhance\rbenh.exe"
          O4 - HKLM\..\Run: [rb32 ml310e] "C:\Program Files\RapidBlaster\rb32.exe
          O4 - HKLM\..\Run: [Microsoft Windows System] myqaaaaa.exe
          O4 - HKLM\..\RunServices: [Windows Mouse Utilities] mouseutils.exe
          O4 - HKLM\..\RunServices: [Microsoft Windows System] myqaaaaa.exe
          O4 - Global Startup: KVG.exe

          O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/hamsterball/raptisoftgameloader.cab
          O16 - DPF: {01347765-1965-426B-91A4-AA6BB342B9A3} (InstallerObj Class) - http://www.1-click.com/common/files/installer-hidden-test.cab
          O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/MediaAccessVerisign/ie/bridge-c18.cab
          O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F99} (CR64Loader Object) - http://www.miniclip.com/puzzlepirates/miniclipGameLoader.dll
          O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F99} (CR64Loader Object) - http://www.miniclip.com/puzzlepirates/miniclipGameLoader.dll
          O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://www.miniclip.com/ricochet/ReflexiveWebGameLoader.cab
          O16 - DPF: {469C7080-8EC8-43A6-AD97-45848113743C} - http://akamai.downloadv3.com/binaries/IA/nethv32_FR_XP.cab
          O16 - DPF: {511F9316-771B-4953-A268-1C36DA667FE9} - http://ip.sponsoradulto.com/cab/3/fr/SysWebTelecomInt.cab

          1.redemarre en mode sans echec (redemarage + tapotte sans arret sur F8 desque l'ordi s'allume)

          2. desactive ta restauration (pour win xp ) comme ceci :
          clike droit sur post de travaille/proprietes/restauration system et la tu coche desactiver la restauration du systeme tu applique

          3. affiche les fichier cacher comme ceci :
          clicker sur demarrer/panneau de configuration/option des dossiers/affichage
          Cocher afficher les dossiers cacher
          Décoche la case "Masquer les fichiers protégés du système d'exploitation (recommandé)"
          Puis fais «Ok» pour valider les changements.
          Decocher masquer les extentions dont le type est connues

          4.ensuite va dans demarrer/rechercher et tape:
          int280595.exe -auto
          TBuninst.exe
          mouseutils.exe
          ieloader.exe
          rbenh.exe"
          rb32.exe
          myqaaaaa.exe
          mouseutils.exe
          KVG.exe

          suprime les et vide ta corebeille
          reactive la restauration et masque les fichiers caché en suivant le meme chemin

          redemare en mode normal

          lance les antispyware ( adaware /spybot /cleanup...ect )
          refait un hijack et colle le resultat ici

          @++++++
          0
          1. Kevin
            :S dsl mais mon père a peté un plomb hier et a reformater l'ordi lol merci qu'en même pour votre aide
            0
            1. Gwinoo
              J'ai exactement le même problème....que faire??
              0
              1. Utilisateur anonyme
                salut ben fait exactement ce que j'ai conseiller a kevin

                ensuite post le scan hijack et smitfraud ici
                @++++++++++
                0
                1. Gwinoo
                  Voici un rapport Ewido:

                  ---------------------------------------------------------
                  ewido security suite - Rapport de scan
                  ---------------------------------------------------------

                  + Créé le: 15:38:00, 2005-12-16
                  + Somme de contrôle: FC55EF18

                  + Résultats du scan:

                  HKLM\SOFTWARE\Classes\CLSID\{00A6FAF1-072E-44cf-8957-5838F569A31D} -> Spyware.MyWebSearch : Nettoyer et sauvegarder
                  HKLM\SOFTWARE\Classes\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA} -> Spyware.MyWebSearch : Nettoyer et sauvegarder
                  HKLM\SOFTWARE\Classes\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA} -> Spyware.MyWebSearch : Nettoyer et sauvegarder
                  HKLM\SOFTWARE\Classes\CLSID\{869EE607-5376-486d-8DAC-EDC8E239AD5F} -> Not-A-Virus.Exploit.CHM : Nettoyer et sauvegarder
                  HKLM\SOFTWARE\Classes\Interface\{53B95210-7D77-11D2-9F81-00104B107C96} -> Spyware.CoolWebSearch : Nettoyer et sauvegarder
                  HKLM\SOFTWARE\Classes\TypeLib\{53B95204-7D77-11D2-9F81-00104B107C96} -> Spyware.CoolWebSearch : Nettoyer et sauvegarder
                  HKLM\SOFTWARE\Classes\TypeLib\{C89E0F84-3C34-43D1-A72C-AF1A160A7C07} -> Spyware.CoolWebSearch : Nettoyer et sauvegarder
                  HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\AMeOpt -> Spyware.InternetOptimizer : Nettoyer et sauvegarder
                  HKLM\SOFTWARE\SearchRelevancy -> Spyware.SearchRelevancy : Nettoyer et sauvegarder
                  HKLM\SOFTWARE\SearchRelevancy\Update -> Spyware.SearchRelevancy : Nettoyer et sauvegarder
                  C:\Documents and Settings\Julie Rivard\Application Data\Explorer\winit500.dll -> Backdoor.PPdoor.bp : Nettoyer et sauvegarder
                  C:\Documents and Settings\Julie Rivard\Application Data\Explorer\__delete_on_reboot__evensurf.exe -> Backdoor.PPdoor.bq : Nettoyer et sauvegarder
                  C:\Documents and Settings\Julie Rivard\Cookies\julie rivard@e-2dj6wgkiemc5oho.stats.esomniture[1].txt -> Spyware.Cookie.Esomniture : Nettoyer et sauvegarder
                  C:\Program Files\MyGlobalSearch\bar\1.bin\M9PLUGIN.DLL -> Spyware.MyWebSearch : Nettoyer et sauvegarder
                  C:\Program Files\MyGlobalSearch\bar\1.bin\NPMYGLSH.DLL -> Spyware.MyWebSearch : Nettoyer et sauvegarder
                  C:\Program Files\Need2Find -> Spyware.Need2Find : Nettoyer et sauvegarder
                  C:\Program Files\Need2Find\bar -> Spyware.Need2Find : Nettoyer et sauvegarder
                  C:\Program Files\Need2Find\bar\History -> Spyware.Need2Find : Nettoyer et sauvegarder
                  C:\Program Files\Need2Find\bar\History\search -> Spyware.Need2Find : Nettoyer et sauvegarder
                  C:\Program Files\Need2Find\bar\Settings -> Spyware.Need2Find : Nettoyer et sauvegarder
                  C:\WINDOWS\Downloaded Program Files\miniclipGameLoader.dll -> Downloader.Small : Nettoyer et sauvegarder
                  C:\WINDOWS\system32\aepijrxi.exe -> Backdoor.Rbot : Nettoyer et sauvegarder
                  C:\WINDOWS\system32\dhrxsdjs.dll -> Trojan.Crypt.o : Nettoyer et sauvegarder
                  C:\WINDOWS\system32\djxvaaaa.exe -> Backdoor.Rbot : Nettoyer et sauvegarder
                  C:\WINDOWS\system32\dnomqggb.exe -> Backdoor.Rbot : Nettoyer et sauvegarder
                  C:\WINDOWS\system32\dnxkirua.exe -> Backdoor.Rbot : Nettoyer et sauvegarder
                  C:\WINDOWS\system32\gafnhhdx.exe -> Backdoor.Rbot : Nettoyer et sauvegarder
                  C:\WINDOWS\system32\jkjbaaaa.exe -> Backdoor.Rbot : Nettoyer et sauvegarder
                  C:\WINDOWS\system32\pumdsnkr.exe -> Backdoor.Rbot : Nettoyer et sauvegarder
                  C:\WINDOWS\system32\sisbli32.dll -> Backdoor.PPdoor.bp : Nettoyer et sauvegarder
                  C:\WINDOWS\system32\sydaaaaa.exe -> Backdoor.Rbot : Nettoyer et sauvegarder
                  C:\WINDOWS\system32\winl0gon.exe -> Dropper.Small.na : Nettoyer et sauvegarder
                  C:\WINDOWS\system32\__delete_on_reboot__anhiiikh.dll -> Proxy.Wopla.n : Nettoyer et sauvegarder
                  C:\WINDOWS\system32\__delete_on_reboot__pyluvuyt.exe -> Backdoor.Rbot : Nettoyer et sauvegarder
                  C:\WINDOWS\system32\__delete_on_reboot__syufnfnu.exe -> Proxy.Agent.hw : Nettoyer et sauvegarder
                  C:\WINDOWS\system32\__delete_on_reboot__ylaakqol.dll -> Trojan.Crypt.o : Nettoyer et sauvegarder

                  ::Fin du rapport
                  0
                  1. Gwinoo
                    SmitFraudFix v2.08

                    Rapport fait à 17:34:34,34 le 2005-12-16
                    Executé à partir de C:\Documents and Settings\Julie Rivard\Bureau\Outils antivirus\SmitfraudFix\SmitfraudFix\SmitfraudFix
                    OS: Microsoft Windows XP [version 5.1.2600]

                    »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\

                    »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS

                    »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system

                    »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\Web

                    »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system32

                    »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\Documents and Settings\Julie Rivard\Application Data

                    »»»»»»»»»»»»»»»»»»»»»»»» Recherche Menu Démarrer

                    »»»»»»»»»»»»»»»»»»»»»»»» Recherche Bureau

                    »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\Program Files

                    »»»»»»»»»»»»»»»»»»»»»»»» Recherche présence de clés corrompues

                    »»»»»»»»»»»»»»»»»»»»»»»» Recherche éléments du bureau

                    »»»»»»»»»»»»»»»»»»»»»»»» Recherche Sharedtaskscheduler

                    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
                    "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pr‚-chargeur Browseui"
                    "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="D‚mon de cache des cat‚gories de composant"

                    »»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

                    »»»»»»»»»»»»»»»»»»»»»»»» Fin du rapport
                    0
                    1. Gwinoo
                      Logfile of HijackThis v1.99.1
                      Scan saved at 17:36:32, on 2005-12-16
                      Platform: Windows XP SP2 (WinNT 5.01.2600)
                      MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

                      Running processes:
                      C:\WINDOWS\System32\smss.exe
                      C:\WINDOWS\system32\winlogon.exe
                      C:\WINDOWS\system32\services.exe
                      C:\WINDOWS\system32\lsass.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\WINDOWS\System32\svchost.exe
                      C:\WINDOWS\system32\spoolsv.exe
                      C:\Program Files\QuickTime\qttask.exe
                      C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                      C:\Program Files\ewido\security suite\ewidoctrl.exe
                      C:\Program Files\ewido\security suite\ewidoguard.exe
                      C:\WINDOWS\System32\svchost.exe
                      C:\Program Files\MSN Messenger\msnmsgr.exe
                      C:\WINDOWS\explorer.exe
                      C:\Program Files\Internet Explorer\iexplore.exe
                      C:\Program Files\Internet Explorer\iexplore.exe
                      C:\Hijackthis\HijackThis.exe

                      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
                      F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\msvcatch.exe,C:\Documents and Settings\Julie Rivard\Application Data\Explorer\evensurf.exe,C:\WINDOWS\system32\evensurf.exe,C:\WINDOWS\system32\m?iesapi.exe
                      O2 - BHO: CIEPl Object - {F85E86D8-F796-4C97-AAA2-26664A98A42C} - C:\WINDOWS\system32\tdev.dll
                      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                      O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                      O4 - HKLM\..\Run: [Address Security] C:\WINDOWS\system32\evensurf.exe
                      O4 - HKCU\..\Run: [Address Security] C:\WINDOWS\system32\evensurf.exe
                      O4 - HKCU\..\Run: [srshost.exe] C:\WINDOWS\system32\srshost.exe
                      O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
                      O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
                      O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
                      O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
                      O20 - Winlogon Notify: tdev - C:\WINDOWS\SYSTEM32\tdev.dll
                      O21 - SSODL: IEFilter - {99CA4B06-5D65-482D-BAD4-60FCFFBF3F55} - C:\WINDOWS\system32\IEFilter.dll
                      O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
                      O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
                      0
                      1. fatfreddy
                        J'ai moi aussi ce mème problème, j'ai fait tous ce que tu ma dit de faire, sans succé. Ce maudit message est toujour la.
                        0
                        1. Utilisateur anonyme
                          salut lance hijack /coche et fix ces lignes :

                          F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\msvcatch.exe,C:\Do cuments and Settings\Julie Rivard\Application Data\Explorer\evensurf.exe,C:\WINDOWS\system32\evensurf.exe,C:\WINDOWS\system32\ m?iesapi.exe
                          O2 - BHO: CIEPl Object - {F85E86D8-F796-4C97-AAA2-26664A98A42C} - C:\WINDOWS\system32\tdev.dll
                          O4 - HKLM\..\Run: [Address Security] C:\WINDOWS\system32\evensurf.exe
                          O4 - HKCU\..\Run: [Address Security] C:\WINDOWS\system32\evensurf.exe
                          O4 - HKCU\..\Run: [srshost.exe] C:\WINDOWS\system32\srshost.exe
                          O21 - SSODL: IEFilter - {99CA4B06-5D65-482D-BAD4-60FCFFBF3F55} - C:\WINDOWS\system32\IEFilter.dll

                          1.redemarre en mode sans echec (redemarage + tapotte sans arret sur F8 desque l'ordi s'allume)

                          2. desactive ta restauration (pour win xp ) comme ceci :
                          clike droit sur post de travaille/proprietes/restauration system et la tu coche desactiver la restauration du systeme tu applique

                          3. affiche les fichier cacher comme ceci :
                          clicker sur demarrer/panneau de configuration/option des dossiers/affichage
                          Cocher afficher les dossiers cacher
                          Décoche la case "Masquer les fichiers protégés du système d'exploitation (recommandé)"
                          Puis fais «Ok» pour valider les changements.
                          Decocher masquer les extentions dont le type est connues

                          4.ensuite va dans demarrer/rechercher et tape:
                          evensurf.exe
                          srshost.exe
                          IEFilter.dll
                          tdev.dll

                          suprime les et vide ta corebeille

                          reactive la restauration et masque les fichiers caché en suivant le meme chemin

                          redemare en mode normal refait un hijack et colle le resultat ici
                          @++++++++
                          0
                          1. Gwinoo
                            evensurf.exe (L'ordi ne le trouve pas!)
                            srshost.exe (L'ordi ne le trouve pas!)
                            IEFilter.dll (Trouvé et effacé)
                            tdev.dll (Trouvé mais ne s'efface pas)

                            Logfile of HijackThis v1.99.1
                            Scan saved at 10:34:40, on 2005-12-17
                            Platform: Windows XP SP2 (WinNT 5.01.2600)
                            MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

                            Running processes:
                            C:\WINDOWS\System32\smss.exe
                            C:\WINDOWS\system32\winlogon.exe
                            C:\WINDOWS\system32\services.exe
                            C:\WINDOWS\system32\lsass.exe
                            C:\WINDOWS\system32\svchost.exe
                            C:\WINDOWS\System32\svchost.exe
                            C:\WINDOWS\Explorer.EXE
                            C:\WINDOWS\system32\spoolsv.exe
                            C:\Program Files\QuickTime\qttask.exe
                            C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                            C:\Program Files\ewido\security suite\ewidoctrl.exe
                            C:\Program Files\ewido\security suite\ewidoguard.exe
                            C:\WINDOWS\system32\Service.exe
                            C:\WINDOWS\System32\svchost.exe
                            C:\Program Files\Internet Explorer\iexplore.exe
                            C:\Hijackthis\HijackThis.exe

                            R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
                            O2 - BHO: CIEPl Object - {F85E86D8-F796-4C97-AAA2-26664A98A42C} - C:\WINDOWS\system32\tdev.dll
                            O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                            O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                            O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
                            O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
                            O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
                            O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
                            O20 - Winlogon Notify: tdev - C:\WINDOWS\SYSTEM32\tdev.dll
                            O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
                            O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
                            0
                            1. Utilisateur anonyme
                              salut telechage VundoFix ici : http://www.atribune.org/downloads/VundoFix.exe

                              redemarre en mode sans echec , dezippe le fichier puis double clike sur le dossier KillVundo ensuite ouvre KillVundo.bat

                              tu va avoir ce message : 

                              By using VundoFix you agree that you are doing so at your own risk
Press enter to continue....


                              donc tape sur la touche entrée

                              apres tu vas avoir ce message : 

                              Please Type in the filepath as instructed by the forum staff
and then press enter:


                              copie colle :

                              C:\WINDOWS\SYSTEM32\tdev.dll

                              appuis sur entrée

                              ensuite tu vas avoir ce message 

                              Please type in the second filepath as instructed by the forum
staff then press enter:


                              tape :

                              C:\WINDOWS\SYSTEM32\vedt.*

                              appuis sur entrée

                              appres noramalement hijack s'ouvre tout seul si il s'ouvre pas alors tout simplement lance le manuelement,

                              fix ces lignes :

                              O2 - BHO: CIEPl Object - {F85E86D8-F796-4C97-AAA2-26664A98A42C} - C:\WINDOWS\system32\tdev.dll
                              O20 - Winlogon Notify: tdev - C:\WINDOWS\SYSTEM32\tdev.dll

                              installe un antivirus je te conseille avast il est gratuit . met le ajour et scan ton pc avec

                              http://www.clubic.com/telecharger-fiche11113-avast-.html

                              tutorial :
                              http://www.pcentraide.com/index.php?showtopic=120

                              installe un parfeu je te conseille kerio :

                              http://www.clubic.com/telecharger-fiche11071-kerio-personal-firewall.html
                              tutorial :
                              http://www.pcentraide.com/index.php?showtopic=110

                              refait un hijack et colle le resultat ici

                              @+++++++++
                              0

                              Discussions similaires

                              [AT] dans une adresse de messagerie
                              oracle3810

                              1 réponse
                              Remplacer @ par [at], efficace contre le spam?
                              ned55

                              1 réponse
                              bouton "at" du mail
                              coheran

                              1 réponse
                              Adresse de messagerie finissant pat .AT
                              jag72

                              4 réponses
                              Probleme colis
                              Hyt

                              16 réponses