[barre d'outil Lop] comment l'enlever

Résolu
cmdt Messages postés 12 Statut Membre -  
cmdt Messages postés 12 Statut Membre -
Bonjour, j'aimerais savoir comment enlevé la barre d'outil Lop qui apparait sans cesse au bas de mon écran dans interner explorer.

J'ai lu certains message de ce forum et j'ai downloader le programme Hijack this. Je vous fais parvenir le fichier log.

J'aimerais savoir si quelqu'un pourrais m'aider à résoudre ce problème.

Je vous remerci à l'avance pour votre aide.

PS: Mon système d'exploitation est windows xp pro

Logfile of HijackThis v1.99.1
Scan saved at 12:26:02, on 2006-02-04
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\ZoneLabs\isafe.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe
C:\WINDOWS\system32\carpserv.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Fellowes\MediaFACE 4.0\SetHook.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\Druide\Antidote\Antidote\Gestionnaire Antidote.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\ATnotes\ATnotes.exe
C:\Program Files\Palm\HOTSYNC.EXE
C:\Program Files\Pixoria\Konfabulator\Konfabulator.exe
C:\Program Files\Webshots\WebshotsTray.exe
C:\Program Files\Pixoria\Konfabulator\Konfabulator.exe
C:\Program Files\Pixoria\Konfabulator\Konfabulator.exe
C:\Program Files\Pixoria\Konfabulator\Konfabulator.exe
C:\Program Files\Pixoria\Konfabulator\Konfabulator.exe
C:\Program Files\Pixoria\Konfabulator\Konfabulator.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Systran\4_0\Premium\SYSTRA~1.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.eccawpcvfibrnuoufpe.com/GLC9u1KdBrrUoE7i4gcOm87mwsC5HXhO0D6bH73cDo8AH8uN8vOkpjLsv8I9cRia.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/intl/fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O1 - Hosts: 212.33.69.3 js1.hitbox.com
O1 - Hosts: 212.33.69.3 stats.hitbox.com
O1 - Hosts: 212.33.69.3 pagead2.googlesyndication.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {35E78239-811E-4c3f-B37D-F339AC16C2C0} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: (no name) - {B4853465-75CE-BAD1-FC9D-37B355460299} - C:\DOCUME~1\JEAN-G~1\APPLIC~1\SHIMDA~1\MixManager.exe
O2 - BHO: (no name) - {CA356D79-679B-4b4c-8E49-5AF97014F4C1} - (no file)
O3 - Toolbar: (no name) - {B1E741E7-1E77-40D4-9FD8-51949B9CCBD0} - (no file)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Systran40premi.IEPlugIn - {CFB25594-4D5F-11D6-AB7B-00B0D094B576} - C:\Program Files\Systran\4_0\Premium\IEPlugIn.dll
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [AWMON] "C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe"
O4 - HKLM\..\Run: [Ayxdc] C:\Program Files\Qvljy\Dzxj.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [ccApp] C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [ccRegVfy] C:\Program Files\Fichiers communs\Symantec Shared\ccRegVfy.exe
O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run
O4 - HKLM\..\Run: [ElbyCheckElbyCDFL] "C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [MediaFace Integration] C:\Program Files\Fellowes\MediaFACE 4.0\SetHook.exe
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr-ca\msnappau.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [update] winis.exe
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [win32] winhost.exe
O4 - HKLM\..\Run: [Windows AdStatus] C:\Program Files\Windows AdStatus\WinStat.exe
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [Copy Amok Load Bows] C:\Documents and Settings\All Users\Application Data\thunk dumb copy amok\team grid.exe
O4 - HKLM\..\Run: [BlockChecker] C:\Program Files\Block Checker\block-checker.exe
O4 - HKLM\..\RunServices: [update] winis.exe
O4 - HKLM\..\RunServices: [win32] winhost.exe
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [Gestionnaire Antidote.exe] C:\PROGRA~1\Druide\Antidote\Antidote\Gestionnaire Antidote.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Axis Wait] C:\DOCUME~1\JEAN-G~1\APPLIC~1\INSIDE~1\curbbaitbows.exe
O4 - Startup: ATnotes.lnk = C:\Program Files\ATnotes\ATnotes.exe
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE
O4 - Startup: Konfabulator.lnk = C:\Program Files\Pixoria\Konfabulator\Konfabulator.exe
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\WebshotsTray.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Assistant d'Acrobat.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Assistant Internet.lnk = C:\Program Files\Assistant Internet\bin\matcli.exe
O4 - Global Startup: DataViz Inc Messenger.lnk = C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Correcteur - {F7C8E5F6-B6D1-45db-8D91-2BCFA5DF11A9} - C:\PROGRA~1\Druide\Antidote\Antidote\Internet Explorer\6\Antidote K - IE 6.htm (HKCU)
O9 - Extra button: Dictionnaire - {FB4AE6A3-EE20-442c-9189-251885352358} - C:\PROGRA~1\Druide\Antidote\Antidote\Internet Explorer\6\Antidote D - IE 6.htm (HKCU)
O9 - Extra button: Synonymes - {FDD637F8-2693-49ce-817E-1AD59574900C} - C:\PROGRA~1\Druide\Antidote\Antidote\Internet Explorer\6\Antidote S - IE 6.htm (HKCU)
O9 - Extra button: Conjugueur - {FF229BEC-9E1F-48c1-99A6-AF34ABEFAB0A} - C:\PROGRA~1\Druide\Antidote\Antidote\Internet Explorer\6\Antidote C - IE 6.htm (HKCU)
O9 - Extra button: Grammaire - {FFB5EE7F-726F-423e-83C2-572FE7CEB3F0} - C:\PROGRA~1\Druide\Antidote\Antidote\Internet Explorer\6\Antidote G - IE 6.htm (HKCU)
O16 - DPF: Interface Chat Voila - http://chat15.x-echo.com/version3/Applet/vchatsign.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {084DAC27-6FA3-4F55-9005-033F2F102F5C} (ITPPDiagIE Class) - http://downloads.winwise.fr/Common/npwwg.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab30149.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage) - http://go.microsoft.com/fwlink/?linkid=34738&clcid=0x409
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/LSSupCtl.cab
O16 - DPF: {2253F320-AB68-4A07-917D-4F12D8884A06} (ChainCast VMR Client Proxy) - http://www.streamaudio.com/download/ccpm_0237.cab
O16 - DPF: {2359626E-7524-4F87-B04E-22CD38A0C88C} (ICSScannerLight Class) - http://download.zonelabs.com/bin/free/cm/ICSCM.cab
O16 - DPF: {23B1D1AE-A29F-4AE2-B76E-CAB6E14811C4} (DHCPConfiguration Class) - http://eserv.sympatico.ca/netassistant/controls/BellCanadaPortalAX.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://groups.msn.com/controls/PhotoUC/MsnPUpld.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://207.188.7.150/131097d4a9fd44dfe514/netzip/RdxIE601_fr.cab
O16 - DPF: {665585FD-2068-4C5E-A6D3-53AC3270ECD4} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/en/filesharingctrl.cab
O16 - DPF: {68A2C3BD-7809-11D3-8ACF-0050046F2F9A} (AXELPlayer Class) - http://www.lachimie.com/AXELPlayerAX_Win32.cab
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://www.gamesmania.com/ExentCtl.ocx
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab
O16 - DPF: {88D758A3-D33B-45FD-91E3-67749B4057FA} - http://dm.screensavers.com/dm/installers/si/1/sinstaller.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://207.96.179.191/activex/AxisCamControl.ocx
O16 - DPF: {9FC87BC7-7963-4B70-8485-B1A41034C9A1} (Sony Pictures Game Downloader) - http://www.sonypictures.com/charliesangelsgame/SonyPicturesGameDownloader.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab30149.cab
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/SSC/SharedContent/common/bin/cabsa.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab30149.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) - http://www2.incredimail.com/contents/setup/downloader/imloader.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: MsgPlusLoader.dll
O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

4 réponses

  1. cmdt Messages postés 12 Statut Membre
     
    Bonjour, Suite à la recommandation que tu m'a fait. Voici le rapport que le programme Ewido m'a donné.

    PS: Pendant le scan le programme m'a demandé de supprimer certains fichiers, ce que j'ai fais, mais en les sauvegardant

    ---------------------------------------------------------
    ewido anti-malware - Rapport de scan
    ---------------------------------------------------------

    + Créé le: 15:26:14, 2006-02-04
    + Somme de contrôle: 2A3228EA

    + Résultats du scan:

    HKLM\SOFTWARE\Classes\CLSID\{35E78239-811E-4c3f-B37D-F339AC16C2C0} -> Spyware.CometCursor : Nettoyer et sauvegarder
    HKLM\SOFTWARE\Classes\CLSID\{70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} -> Spyware.GameSpyArcade : Nettoyer et sauvegarder
    HKLM\SOFTWARE\Classes\Interface\{665ABE65-2C16-4341-B4B8-01FF799E8F4C} -> Spyware.CometCursor : Nettoyer et sauvegarder
    HKLM\SOFTWARE\Classes\PROTOCOLS\Name-Space Handler\res -> Spyware.WebSearch : Nettoyer et sauvegarder
    HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} -> Spyware.GameSpyArcade : Nettoyer et sauvegarder
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{35E78239-811E-4c3f-B37D-F339AC16C2C0} -> Spyware.CometCursor : Nettoyer et sauvegarder
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\AUI -> Spyware.WebSearch : Nettoyer et sauvegarder
    HKLM\SYSTEM\CurrentControlSet\Services\WinToolsSvc -> Spyware.WebSearch : Erreur durant le nettoyage
    HKLM\SYSTEM\CurrentControlSet\Services\WinToolsSvc\Enum -> Spyware.WebSearch : Erreur durant le nettoyage
    HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{35E78239-811E-4C3F-B37D-F339AC16C2C0} -> Spyware.CometCursor : Nettoyer et sauvegarder
    HKU\.DEFAULT\Software\Toolbar -> Spyware.WebSearch : Nettoyer et sauvegarder
    HKU\.DEFAULT\Software\Toolbar\PlugIns -> Spyware.WebSearch : Nettoyer et sauvegarder
    HKU\.DEFAULT\Software\Toolbar\PlugIns\COMMON -> Spyware.WebSearch : Nettoyer et sauvegarder
    HKU\.DEFAULT\Software\Toolbar\Server -> Spyware.WebSearch : Nettoyer et sauvegarder
    HKU\S-1-5-21-1343024091-117609710-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{35E78239-811E-4C3F-B37D-F339AC16C2C0} -> Spyware.CometCursor : Nettoyer et sauvegarder
    HKU\S-1-5-21-1343024091-117609710-682003330-1003\Software\TrinityAYB -> Dialer.Generic : Nettoyer et sauvegarder
    HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{35E78239-811E-4C3F-B37D-F339AC16C2C0} -> Spyware.CometCursor : Nettoyer et sauvegarder
    HKU\S-1-5-18\Software\Toolbar -> Spyware.WebSearch : Nettoyer et sauvegarder
    HKU\S-1-5-18\Software\Toolbar\PlugIns -> Spyware.WebSearch : Nettoyer et sauvegarder
    HKU\S-1-5-18\Software\Toolbar\PlugIns\COMMON -> Spyware.WebSearch : Nettoyer et sauvegarder
    HKU\S-1-5-18\Software\Toolbar\Server -> Spyware.WebSearch : Nettoyer et sauvegarder
    [360] C:\DOCUME~1\JEAN-G~1\APPLIC~1\SHIMDA~1\MixManager.exe -> Downloader.Swizzor.bo : Nettoyer et sauvegarder
    [2316] C:\DOCUME~1\JEAN-G~1\APPLIC~1\SHIMDA~1\MixManager.exe -> Downloader.Swizzor.bo : Erreur durant le nettoyage
    C:\Documents and Settings\Jean- Guy Chartier\Local Settings\Application Data\IM\Identities\{28BC7AA9-C646-4E22-AA56-BB5CFB218B57}\Message Store\Attachments\new_uninstall.zip/new_uninstall.exe -> Adware.Lop : Nettoyer et sauvegarder
    C:\Documents and Settings\Jean- Guy Chartier\Mes documents\download\Logiciel\Détecte Pass\pspv.zip/pspv.exe -> Not-A-Virus.PSWTool.Win32.PassView.162 : Nettoyer et sauvegarder
    C:\Documents and Settings\Jean- Guy Chartier\Mes documents\download\Logiciel\Enlève les toolbar\lop_uninstall.exe -> Downloader.FunWeb : Nettoyer et sauvegarder
    C:\Documents and Settings\Jean- Guy Chartier\Mes documents\download\Logiciel\INTERNET EXPLORER\Enlever barre de menu IE\new_uninstall.zip/new_uninstall.exe -> Adware.Lop : Nettoyer et sauvegarder
    C:\Documents and Settings\Jean- Guy Chartier\Mes documents\download\Logiciel\NORTON - SYMANTEC\NIS 2005\internet security.rar/kgnis.exe -> Dropper.Delf.fd : Nettoyer et sauvegarder
    C:\Documents and Settings\Jean- Guy Chartier\Mes documents\download\Logiciel\Recherche de crack\CrackSearcher V1[1][1].0.2.rar/CrackSearcher V1.0.2.exe -> Not-A-Virus.HackTool.CrackSearch.a : Nettoyer et sauvegarder
    C:\Documents and Settings\Jean- Guy Chartier\Mes documents\Portable\Divers\IncrediMail Data.cab/{28BC7AA9-C646-4E22-AA56-BB5CFB218B57}\Message Store\Attachments\new_uninstall.zip/new_uninstall.exe -> Adware.Lop : Nettoyer et sauvegarder
    C:\Documents and Settings\Lorraine Rivest\Local Settings\Temp\~36329.tmp -> Spyware.Wintools : Nettoyer et sauvegarder
    C:\Documents and Settings\Lorraine Rivest\Local Settings\Temp\~484202.tmp -> Spyware.Wintools : Nettoyer et sauvegarder
    C:\Documents and Settings\Lorraine Rivest\Local Settings\Temp\~515091.tmp -> Spyware.Wintools : Nettoyer et sauvegarder
    C:\Documents and Settings\Lorraine Rivest\Local Settings\Temp\~523487.tmp -> Spyware.Wintools : Nettoyer et sauvegarder
    C:\Documents and Settings\Lorraine Rivest\Local Settings\Temp\~533721.tmp -> Spyware.Wintools : Nettoyer et sauvegarder
    C:\Documents and Settings\Lorraine Rivest\Local Settings\Temp\~553693.tmp -> Spyware.Wintools : Nettoyer et sauvegarder
    C:\Documents and Settings\Lorraine Rivest\Local Settings\Temp\~592503.tmp -> Spyware.Wintools : Nettoyer et sauvegarder
    C:\Documents and Settings\Lorraine Rivest\Local Settings\Temp\~601852.tmp -> Spyware.Wintools : Nettoyer et sauvegarder
    C:\Documents and Settings\Lorraine Rivest\Local Settings\Temp\~612705.tmp -> Spyware.Wintools : Nettoyer et sauvegarder
    C:\Documents and Settings\Lorraine Rivest\Local Settings\Temp\~613355.tmp -> Spyware.Wintools : Nettoyer et sauvegarder
    C:\Documents and Settings\Lorraine Rivest\Local Settings\Temp\~615967.tmp -> Spyware.Wintools : Nettoyer et sauvegarder
    C:\Documents and Settings\Lorraine Rivest\Local Settings\Temp\~617479.tmp -> Spyware.Wintools : Nettoyer et sauvegarder
    C:\Documents and Settings\Lorraine Rivest\Local Settings\Temp\~630866.tmp -> Spyware.Wintools : Nettoyer et sauvegarder
    C:\Documents and Settings\Lorraine Rivest\Local Settings\Temp\~632624.tmp -> Spyware.Wintools : Nettoyer et sauvegarder
    C:\Documents and Settings\Lorraine Rivest\Local Settings\Temp\~677692.tmp -> Spyware.Wintools : Nettoyer et sauvegarder
    C:\Documents and Settings\Lorraine Rivest\Local Settings\Temp\~705599.tmp -> Spyware.Wintools : Nettoyer et sauvegarder
    C:\Documents and Settings\Lorraine Rivest\Local Settings\Temp\~778862.tmp -> Spyware.Wintools : Nettoyer et sauvegarder
    C:\Documents and Settings\Lorraine Rivest\Local Settings\Temp\~939684.tmp -> Spyware.Wintools : Nettoyer et sauvegarder
    C:\Documents and Settings\Lorraine Rivest\Local Settings\Temp\~961411.tmp -> Spyware.Wintools : Nettoyer et sauvegarder
    C:\Documents and Settings\Lorraine Rivest\Local Settings\Temp\~965538.tmp -> Spyware.Wintools : Nettoyer et sauvegarder
    C:\Documents and Settings\Lorraine Rivest\Local Settings\Temp\~966118.tmp -> Spyware.Wintools : Nettoyer et sauvegarder
    C:\Documents and Settings\Lorraine Rivest\Local Settings\Temp\~968401.tmp -> Spyware.Wintools : Nettoyer et sauvegarder
    C:\Documents and Settings\Lorraine Rivest\Local Settings\Temp\~974474.tmp -> Spyware.Wintools : Nettoyer et sauvegarder
    C:\Documents and Settings\Lorraine Rivest\Local Settings\Temp\~976421.tmp -> Spyware.Wintools : Nettoyer et sauvegarder
    C:\Documents and Settings\Lorraine Rivest\Local Settings\Temp\~978201.tmp -> Spyware.Wintools : Nettoyer et sauvegarder
    C:\Documents and Settings\Lorraine Rivest\Local Settings\Temporary Internet Files\Content.IE5\WPYVOLIN\ErrorSafeScannerInstall_fr[1].exe -> Not-A-Virus.Downloader.Agent.d : Nettoyer et sauvegarder
    C:\Documents and Settings\Mélissa Chartier\Local Settings\Temporary Internet Files\Content.IE5\GN0925ER\ErrorSafeScannerInstall_fr[1].exe -> Not-A-Virus.Downloader.Agent.d : Nettoyer et sauvegarder
    C:\Documents and Settings\Mélissa Chartier\Mes documents\mes choses\MES CHOSES 2\Setup.dat/Sponsor.exe -> Downloader.Swizzor.bt : Nettoyer et sauvegarder
    C:\Program Files\Block Checker -> Spyware.BlockChecker : Nettoyer et sauvegarder
    C:\Program Files\Microsoft AntiSpyware\Quarantine\2CC227DC-0B0E-42CC-91AE-6B2D39\9EBD4E8C-A95A-4D52-A288-16E629 -> Spyware.Wintools : Nettoyer et sauvegarder
    C:\Program Files\Microsoft AntiSpyware\Quarantine\2CC227DC-0B0E-42CC-91AE-6B2D39\E1DE858A-2F97-49D8-ABDB-98C9EF -> Spyware.WebSearch : Nettoyer et sauvegarder
    C:\Program Files\Microsoft AntiSpyware\Quarantine\35C24C3F-971E-4CEE-AEBA-B2E8DF\08F9D4F3-3242-4DD7-A396-87A266 -> Spyware.MyWay : Nettoyer et sauvegarder
    C:\Program Files\Microsoft AntiSpyware\Quarantine\35C24C3F-971E-4CEE-AEBA-B2E8DF\7D28B488-BC26-4E5A-8AF8-D256EC -> Spyware.MyWay : Nettoyer et sauvegarder
    C:\Program Files\Microsoft AntiSpyware\Quarantine\983F4D24-B20D-4938-AF27-6DBE30\720992E1-C542-4619-91FA-C783C8 -> Spyware.IBIS : Nettoyer et sauvegarder
    C:\Program Files\Microsoft AntiSpyware\Quarantine\983F4D24-B20D-4938-AF27-6DBE30\BB9567C4-11A8-4E44-829A-BCAA0F -> Spyware.IBIS : Nettoyer et sauvegarder
    C:\Program Files\Microsoft AntiSpyware\Quarantine\C4CD7F74-3715-40F7-80BA-AC2D72\070FF2B7-09EC-4650-9B11-7A44AF -> Spyware.NewDotNet : Nettoyer et sauvegarder
    C:\WINDOWS\NDNuninstall5_64.exe -> Spyware.NewDotNet : Nettoyer et sauvegarder
    C:\WINDOWS\NDNuninstall6_10.exe -> Spyware.NewDotNet : Nettoyer et sauvegarder
    C:\WINDOWS\NDNuninstall6_22.exe -> Spyware.NewDotNet : Nettoyer et sauvegarder
    C:\WINDOWS\system32\70tovmto.ini -> Adware.SAHA : Nettoyer et sauvegarder
    C:\WINDOWS\system32\ConMain.dat -> Downloader.ConHook.f : Nettoyer et sauvegarder
    C:\WINDOWS\system32\f3PSSavr.scr -> Spyware.MyWebSearch : Nettoyer et sauvegarder
    C:\WINDOWS\system32\navshext1.dll -> Spyware.Chiem : Nettoyer et sauvegarder

    ::Fin du rapport
    0
    1. boulepate
       
      Salut,

      tu peux remettre un nouveau rapport Hijackthis stp

      A++
      0
    2. cmdt Messages postés 12 Statut Membre > boulepate
       
      Bonjour, Je te retourne un autre rapport de hijack this

      Logfile of HijackThis v1.99.1
      Scan saved at 11:44:10, on 2006-02-05
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\WINDOWS\system32\ZoneLabs\isafe.exe
      C:\WINDOWS\System32\CTsvcCDA.exe
      C:\Program Files\ewido anti-malware\ewidoctrl.exe
      C:\Program Files\ewido anti-malware\ewidoguard.exe
      C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
      C:\Program Files\Eset\nod32krn.exe
      C:\WINDOWS\System32\nvsvc32.exe
      C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\ZoneLabs\vsmon.exe
      C:\WINDOWS\Explorer.EXE
      C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
      C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe
      C:\WINDOWS\system32\carpserv.exe
      C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
      C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
      C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
      C:\Program Files\Ahead\InCD\InCD.exe
      C:\Program Files\Microsoft IntelliPoint\point32.exe
      C:\Program Files\iTunes\iTunesHelper.exe
      C:\Program Files\iPod\bin\iPodService.exe
      C:\Program Files\Fellowes\MediaFACE 4.0\SetHook.exe
      C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
      C:\WINDOWS\system32\CTHELPER.EXE
      C:\WINDOWS\system32\RUNDLL32.EXE
      C:\PROGRA~1\Druide\Antidote\Antidote\Gestionnaire Antidote.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
      C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe
      C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
      C:\Program Files\ATnotes\ATnotes.exe
      C:\Program Files\Palm\HOTSYNC.EXE
      C:\Program Files\Pixoria\Konfabulator\Konfabulator.exe
      C:\Program Files\Webshots\WebshotsTray.exe
      C:\Program Files\Pixoria\Konfabulator\Konfabulator.exe
      C:\Program Files\Pixoria\Konfabulator\Konfabulator.exe
      C:\Program Files\Pixoria\Konfabulator\Konfabulator.exe
      C:\Program Files\Pixoria\Konfabulator\Konfabulator.exe
      C:\Program Files\Pixoria\Konfabulator\Konfabulator.exe
      C:\Program Files\Messenger\msmsgs.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\PROGRA~1\Systran\4_0\Premium\SYSTRA~1.EXE
      C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/intl/fr/
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
      R3 - Default URLSearchHook is missing
      O1 - Hosts: 212.33.69.3 js1.hitbox.com
      O1 - Hosts: 212.33.69.3 stats.hitbox.com
      O1 - Hosts: 212.33.69.3 pagead2.googlesyndication.com
      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
      O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
      O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
      O2 - BHO: (no name) - {B4853465-75CE-BAD1-FC9D-37B355460299} - C:\DOCUME~1\JEAN-G~1\APPLIC~1\SHIMDA~1\MixManager.exe (file missing)
      O2 - BHO: (no name) - {CA356D79-679B-4b4c-8E49-5AF97014F4C1} - (no file)
      O3 - Toolbar: (no name) - {B1E741E7-1E77-40D4-9FD8-51949B9CCBD0} - (no file)
      O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
      O3 - Toolbar: Systran40premi.IEPlugIn - {CFB25594-4D5F-11D6-AB7B-00B0D094B576} - C:\Program Files\Systran\4_0\Premium\IEPlugIn.dll
      O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
      O4 - HKLM\..\Run: [AWMON] "C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe"
      O4 - HKLM\..\Run: [Ayxdc] C:\Program Files\Qvljy\Dzxj.exe
      O4 - HKLM\..\Run: [CARPService] carpserv.exe
      O4 - HKLM\..\Run: [ccApp] C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
      O4 - HKLM\..\Run: [ccRegVfy] C:\Program Files\Fichiers communs\Symantec Shared\ccRegVfy.exe
      O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run
      O4 - HKLM\..\Run: [ElbyCheckElbyCDFL] "C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
      O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
      O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
      O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
      O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
      O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
      O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
      O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
      O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
      O4 - HKLM\..\Run: [MediaFace Integration] C:\Program Files\Fellowes\MediaFACE 4.0\SetHook.exe
      O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr-ca\msnappau.exe"
      O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
      O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
      O4 - HKLM\..\Run: [update] winis.exe
      O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
      O4 - HKLM\..\Run: [win32] winhost.exe
      O4 - HKLM\..\Run: [Windows AdStatus] C:\Program Files\Windows AdStatus\WinStat.exe
      O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
      O4 - HKLM\..\Run: [Copy Amok Load Bows] C:\Documents and Settings\All Users\Application Data\thunk dumb copy amok\team grid.exe
      O4 - HKLM\..\Run: [BlockChecker] C:\Program Files\Block Checker\block-checker.exe
      O4 - HKLM\..\RunServices: [update] winis.exe
      O4 - HKLM\..\RunServices: [win32] winhost.exe
      O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
      O4 - HKCU\..\Run: [Gestionnaire Antidote.exe] C:\PROGRA~1\Druide\Antidote\Antidote\Gestionnaire Antidote.exe
      O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\Run: [Axis Wait] C:\DOCUME~1\JEAN-G~1\APPLIC~1\INSIDE~1\curbbaitbows.exe
      O4 - Startup: ATnotes.lnk = C:\Program Files\ATnotes\ATnotes.exe
      O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE
      O4 - Startup: Konfabulator.lnk = C:\Program Files\Pixoria\Konfabulator\Konfabulator.exe
      O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\WebshotsTray.exe
      O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
      O4 - Global Startup: Assistant d'Acrobat.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
      O4 - Global Startup: Assistant Internet.lnk = C:\Program Files\Assistant Internet\bin\matcli.exe
      O4 - Global Startup: DataViz Inc Messenger.lnk = C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe
      O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
      O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
      O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
      O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
      O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra button: Correcteur - {F7C8E5F6-B6D1-45db-8D91-2BCFA5DF11A9} - C:\PROGRA~1\Druide\Antidote\Antidote\Internet Explorer\6\Antidote K - IE 6.htm (HKCU)
      O9 - Extra button: Dictionnaire - {FB4AE6A3-EE20-442c-9189-251885352358} - C:\PROGRA~1\Druide\Antidote\Antidote\Internet Explorer\6\Antidote D - IE 6.htm (HKCU)
      O9 - Extra button: Synonymes - {FDD637F8-2693-49ce-817E-1AD59574900C} - C:\PROGRA~1\Druide\Antidote\Antidote\Internet Explorer\6\Antidote S - IE 6.htm (HKCU)
      O9 - Extra button: Conjugueur - {FF229BEC-9E1F-48c1-99A6-AF34ABEFAB0A} - C:\PROGRA~1\Druide\Antidote\Antidote\Internet Explorer\6\Antidote C - IE 6.htm (HKCU)
      O9 - Extra button: Grammaire - {FFB5EE7F-726F-423e-83C2-572FE7CEB3F0} - C:\PROGRA~1\Druide\Antidote\Antidote\Internet Explorer\6\Antidote G - IE 6.htm (HKCU)
      O16 - DPF: Interface Chat Voila - http://chat15.x-echo.com/version3/Applet/vchatsign.cab
      O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
      O16 - DPF: {084DAC27-6FA3-4F55-9005-033F2F102F5C} (ITPPDiagIE Class) - http://downloads.winwise.fr/Common/npwwg.cab
      O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab30149.cab
      O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage) - http://go.microsoft.com/fwlink/?linkid=34738&clcid=0x409
      O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/LSSupCtl.cab
      O16 - DPF: {2253F320-AB68-4A07-917D-4F12D8884A06} (ChainCast VMR Client Proxy) - http://www.streamaudio.com/download/ccpm_0237.cab
      O16 - DPF: {2359626E-7524-4F87-B04E-22CD38A0C88C} (ICSScannerLight Class) - http://download.zonelabs.com/bin/free/cm/ICSCM.cab
      O16 - DPF: {23B1D1AE-A29F-4AE2-B76E-CAB6E14811C4} (DHCPConfiguration Class) - http://eserv.sympatico.ca/netassistant/controls/BellCanadaPortalAX.cab
      O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab
      O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
      O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://groups.msn.com/controls/PhotoUC/MsnPUpld.cab
      O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://207.188.7.150/131097d4a9fd44dfe514/netzip/RdxIE601_fr.cab
      O16 - DPF: {665585FD-2068-4C5E-A6D3-53AC3270ECD4} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/en/filesharingctrl.cab
      O16 - DPF: {68A2C3BD-7809-11D3-8ACF-0050046F2F9A} (AXELPlayer Class) - http://www.lachimie.com/AXELPlayerAX_Win32.cab
      O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://www.gamesmania.com/ExentCtl.ocx
      O16 - DPF: {88D758A3-D33B-45FD-91E3-67749B4057FA} - http://dm.screensavers.com/dm/installers/si/1/sinstaller.cab
      O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
      O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://207.96.179.191/activex/AxisCamControl.ocx
      O16 - DPF: {9FC87BC7-7963-4B70-8485-B1A41034C9A1} (Sony Pictures Game Downloader) - http://www.sonypictures.com/charliesangelsgame/SonyPicturesGameDownloader.cab
      O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
      O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab30149.cab
      O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/SSC/SharedContent/common/bin/cabsa.cab
      O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab30149.cab
      O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) - http://www2.incredimail.com/contents/setup/downloader/imloader.cab
      O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
      O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab
      O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
      O20 - AppInit_DLLs: MsgPlusLoader.dll
      O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe.exe
      O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
      O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
      O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
      O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
      O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
      O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
      O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe
      O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
      O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
      0
    3. boulepate > cmdt Messages postés 12 Statut Membre
       
      Salut,
      Relance HijackThis, choisis " do a scan only" coche la case devant les lignes ci-dessous et clique en bas sur "fix checked"

      R3 - Default URLSearchHook is missing
      O1 - Hosts: 212.33.69.3 js1.hitbox.com
      O1 - Hosts: 212.33.69.3 stats.hitbox.com
      O1 - Hosts: 212.33.69.3 pagead2.googlesyndication.com
      O4 - HKLM\..\Run: [Ayxdc] C:\Program Files\Qvljy\Dzxj.exe
      O4 - HKLM\..\Run: [update] winis.exe
      O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
      O4 - HKLM\..\Run: [win32] winhost.exe
      O4 - HKLM\..\Run: [Windows AdStatus] C:\Program Files\Windows AdStatus\WinStat.exe
      O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
      O4 - HKLM\..\Run: [Copy Amok Load Bows] C:\Documents and Settings\All Users\Application Data\thunk dumb copy amok\team grid.exe
      O4 - HKLM\..\Run: [BlockChecker] C:\Program Files\Block Checker\block-checker.exe
      O4 - HKLM\..\RunServices: [update] winis.exe
      O4 - HKLM\..\RunServices: [win32] winhost.exe
      O16 - DPF: Interface Chat Voila - http://chat15.x-echo.com/version3/Applet/vchatsign.cab
      O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
      O16 - DPF: {084DAC27-6FA3-4F55-9005-033F2F102F5C} (ITPPDiagIE Class) - http://downloads.winwise.fr/Common/npwwg.cab
      O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab30149.cab
      O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage) - http://go.microsoft.com/fwlink/?linkid=34738&clcid=0x409
      O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/LSSupCtl.cab
      O16 - DPF: {2253F320-AB68-4A07-917D-4F12D8884A06} (ChainCast VMR Client Proxy) - http://www.streamaudio.com/download/ccpm_0237.cab
      O16 - DPF: {2359626E-7524-4F87-B04E-22CD38A0C88C} (ICSScannerLight Class) - http://download.zonelabs.com/bin/free/cm/ICSCM.cab
      O16 - DPF: {23B1D1AE-A29F-4AE2-B76E-CAB6E14811C4} (DHCPConfiguration Class) - http://eserv.sympatico.ca/netassistant/controls/BellCanadaPortalAX.cab
      O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab
      O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
      O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://groups.msn.com/controls/PhotoUC/MsnPUpld.cab
      O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://207.188.7.150/131097d4a9fd44dfe514/netzip/RdxIE601_fr.cab
      O16 - DPF: {665585FD-2068-4C5E-A6D3-53AC3270ECD4} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/en/filesharingctrl.cab
      O16 - DPF: {68A2C3BD-7809-11D3-8ACF-0050046F2F9A} (AXELPlayer Class) - http://www.lachimie.com/AXELPlayerAX_Win32.cab
      O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://www.gamesmania.com/ExentCtl.ocx
      O16 - DPF: {88D758A3-D33B-45FD-91E3-67749B4057FA} - http://dm.screensavers.com/dm/installers/si/1/sinstaller.cab
      O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
      O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://207.96.179.191/activex/AxisCamControl.ocx
      O16 - DPF: {9FC87BC7-7963-4B70-8485-B1A41034C9A1} (Sony Pictures Game Downloader) - http://www.sonypictures.com/charliesangelsgame/SonyPicturesGameDownloader.cab
      O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
      O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab30149.cab
      O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/SSC/SharedContent/common/bin/cabsa.cab
      O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab30149.cab
      O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) - http://www2.incredimail.com/contents/setup/downloader/imloader.cab
      O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
      O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab

      Clique sur demarrer, executer, tape: msconfig ,vas dans l'onglet "services" et decoche la case devant ces lignes:

      [update] winis.exe
      [win32] winhost.exe

      clique sur demarrer, rechercher, cherche et supprime ces fichiers:

      Dzxj.exe
      WinStat.exe
      CTHELPER.EXE
      team grid.exe
      block-checker.exe
      winis.exe
      winhost.exe

      clique sur demarrer, poste detravail, C:, program files, cherche et supprime ces dossiers:

      Qvljy
      Windows AdStatus
      Block Checker

      puis fais ceci:

      ¤Telecharge et installe ceci, dans la colonne de gauche clique sur "erreurs" coche toute les cases, puis clique en bas sur "chercher des erreurs" une fois finit, clique sur "reparer les erreurs" et tu aura un message pour sauvegarder ta base de registre tu dis "oui" puis tu recommences jusqu'a ce qu'il te trouve plus d'erreurs

      CCleaner:(à telecharger à côté de la fléche verte en haut à droite)
      http://www.filehippo.com/download_ccleaner/

      ¤Relance Ccleaner ,vas dans l'onglet "nettoyeur" present sur la gauche, decoche la derniere case (Avancé si elle est cochée) puis clique sur "lancer le nettoyage"

      ensuite remet un nouveau rapport HijackThis

      Si un fichier à persisté lors de sa suppression utilise le mode sans echec.
      0
    4. cmdt Messages postés 12 Statut Membre > boulepate
       
      Bonjour, J'ai fais exactement ce que tu m'as dit. Tout c'est replacer pour ma session mais nous sommes 4 personnes avec chacun notre session. Il y a 2 sessions qui ont encore le même problème. Je te fais parvenir le rapport de hijack this d'une de ces 2 sessions. J'ai essayé d'enlever les même lignes que ma session, mais sans succès. Je crois qu'il y a une autre ligne qui fait en sorte que je ne peux même pas enlever ces lignes

      Merci d'avance pour votre coup de pouce

      Logfile of HijackThis v1.99.1
      Scan saved at 18:07:32, on 2006-02-06
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\WINDOWS\system32\ZoneLabs\isafe.exe
      C:\WINDOWS\System32\CTsvcCDA.exe
      C:\Program Files\ewido anti-malware\ewidoctrl.exe
      C:\Program Files\ewido anti-malware\ewidoguard.exe
      C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
      C:\Program Files\Eset\nod32krn.exe
      C:\WINDOWS\System32\nvsvc32.exe
      C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\ZoneLabs\vsmon.exe
      C:\WINDOWS\Explorer.EXE
      C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
      C:\Program Files\Eset\nod32kui.exe
      C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe
      C:\WINDOWS\system32\carpserv.exe
      C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
      C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
      C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
      C:\Program Files\Ahead\InCD\InCD.exe
      C:\Program Files\Microsoft IntelliPoint\point32.exe
      C:\Program Files\iTunes\iTunesHelper.exe
      C:\Program Files\Fellowes\MediaFACE 4.0\SetHook.exe
      C:\Program Files\iPod\bin\iPodService.exe
      C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\Messenger\msmsgs.exe
      C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
      C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe
      C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
      C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
      c:\progra~1\intern~1\iexplore.exe
      C:\Program Files\Webshots\WebshotsTray.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.jqmrmtacim.com/nv0i2j/yMsQNn8rnCgG3npfcheAdcWjGcICn9Ow6rwiF0XUha4Ko/nHVURMhJRPc.html
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
      O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
      O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
      O2 - BHO: (no name) - {B4853465-75CE-BAD1-FC9D-37B355460299} - (no file)
      O2 - BHO: (no name) - {CA356D79-679B-4b4c-8E49-5AF97014F4C1} - (no file)
      O3 - Toolbar: (no name) - {B1E741E7-1E77-40D4-9FD8-51949B9CCBD0} - (no file)
      O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
      O3 - Toolbar: Systran40premi.IEPlugIn - {CFB25594-4D5F-11D6-AB7B-00B0D094B576} - C:\Program Files\Systran\4_0\Premium\IEPlugIn.dll
      O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
      O4 - HKLM\..\Run: [AWMON] "C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe"
      O4 - HKLM\..\Run: [CARPService] carpserv.exe
      O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run
      O4 - HKLM\..\Run: [ElbyCheckElbyCDFL] "C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
      O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
      O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
      O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
      O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
      O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
      O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
      O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
      O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
      O4 - HKLM\..\Run: [MediaFace Integration] C:\Program Files\Fellowes\MediaFACE 4.0\SetHook.exe
      O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr-ca\msnappau.exe"
      O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
      O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
      O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
      O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
      O4 - HKLM\..\Run: [win32] winhost.exe
      O4 - HKLM\..\Run: [update] winis.exe
      O4 - HKLM\..\Run: [ccApp] C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
      O4 - HKLM\..\Run: [ccRegVfy] C:\Program Files\Fichiers communs\Symantec Shared\ccRegVfy.exe
      O4 - HKLM\..\Run: [Ayxdc] C:\Program Files\Qvljy\Dzxj.exe
      O4 - HKLM\..\Run: [Copy Amok Load Bows] C:\Documents and Settings\All Users\Application Data\thunk dumb copy amok\team grid.exe
      O4 - HKLM\..\Run: [Windows AdStatus] C:\Program Files\Windows AdStatus\WinStat.exe
      O4 - HKLM\..\Run: [BlockChecker] C:\Program Files\Block Checker\block-checker.exe
      O4 - HKLM\..\RunServices: [win32] winhost.exe
      O4 - HKLM\..\RunServices: [update] winis.exe
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
      O4 - HKCU\..\Run: [Axis Wait] C:\DOCUME~1\LORRAI~1\APPLIC~1\INSIDE~1\curbbaitbows.exe
      O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\WebshotsTray.exe
      O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
      O4 - Global Startup: Assistant d'Acrobat.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
      O4 - Global Startup: Assistant Internet.lnk = C:\Program Files\Assistant Internet\bin\matcli.exe
      O4 - Global Startup: DataViz Inc Messenger.lnk = C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe
      O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
      O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
      O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
      O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
      O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZS
      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
      O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra button: Correcteur - {F7C8E5F6-B6D1-45db-8D91-2BCFA5DF11A9} - C:\PROGRA~1\Druide\Antidote\Antidote\Internet Explorer\6\Antidote K - IE 6.htm (HKCU)
      O9 - Extra button: Dictionnaire - {FB4AE6A3-EE20-442c-9189-251885352358} - C:\PROGRA~1\Druide\Antidote\Antidote\Internet Explorer\6\Antidote D - IE 6.htm (HKCU)
      O9 - Extra button: Synonymes - {FDD637F8-2693-49ce-817E-1AD59574900C} - C:\PROGRA~1\Druide\Antidote\Antidote\Internet Explorer\6\Antidote S - IE 6.htm (HKCU)
      O9 - Extra button: Conjugueur - {FF229BEC-9E1F-48c1-99A6-AF34ABEFAB0A} - C:\PROGRA~1\Druide\Antidote\Antidote\Internet Explorer\6\Antidote C - IE 6.htm (HKCU)
      O9 - Extra button: Grammaire - {FFB5EE7F-726F-423e-83C2-572FE7CEB3F0} - C:\PROGRA~1\Druide\Antidote\Antidote\Internet Explorer\6\Antidote G - IE 6.htm (HKCU)
      O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
      O20 - AppInit_DLLs: MsgPlusLoader.dll
      O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe.exe
      O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
      O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
      O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
      O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
      O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
      O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
      O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe
      O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
      O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
      0
    5. boulepate > cmdt Messages postés 12 Statut Membre
       
      Salut,
      Relance HijackThis, choisis " do a scan only" coche la case devant les lignes ci-dessous et clique en bas sur "fix checked"

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.jqmrmtacim.com/nv0i2j/yMsQNn8rnCgG3npfcheAdcWjGcICn9Ow6rwiF0XUha4Ko/nHVURMhJRPc.htm
      O4 - HKLM\..\Run: [AWMON] "C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe"
      O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run
      O4 - HKLM\..\Run: [ElbyCheckElbyCDFL] "C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
      O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
      O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
      O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
      O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
      O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
      O4 - HKLM\..\Run: [MediaFace Integration] C:\Program Files\Fellowes\MediaFACE 4.0\SetHook.exe
      O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr-ca\msnappau.exe"
      O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
      O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
      O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
      O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
      O4 - HKLM\..\Run: [win32] winhost.exe
      O4 - HKLM\..\Run: [update] winis.exe
      O4 - HKLM\..\Run: [Copy Amok Load Bows] C:\Documents and Settings\All Users\Application Data\thunk dumb copy amok\team grid.exe
      O4 - HKLM\..\Run: [Windows AdStatus] C:\Program Files\Windows AdStatus\WinStat.exe
      O4 - HKLM\..\Run: [BlockChecker] C:\Program Files\Block Checker\block-checker.exe
      O4 - HKLM\..\RunServices: [win32] winhost.exe
      O4 - HKLM\..\RunServices: [update] winis.exe
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
      O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
      O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
      O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
      O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
      O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZS

      clique sur demarrer, executer, tape: msconfig ,vas dans l'onglet "services" decoche les cases devant ces lignes:

      [win32] winhost.exe
      [update] winis.exe

      clique sur demarrer, rechercher, cherche et supprime ces fichiers:

      winhost.exe
      winis.exe
      block-checker.exe
      team grid.exe
      WinStat.exe

      clique sur demarrer, poste de travail, C:, program files, cherche et supprime ce dossier:

      Block Checker
      Windows AdStatus

      fais ceci:

      Affiche tous les fichiers et dossiers :
      Clique sur démarrer, panneau de configuration, outi,option des dossiers, affichage

      Coche: afficher les fichiers et dossiers cachés

      Décoche la case:
      -masquer les fichiers protégés du système d'exploitation (recommandé)
      -masquer les extensions dont le type est connu

      Appliquer, puis ok

      Puis clique sur demarrer, poste de travail, C:, documents & setting, all users, Application Data, puis supprime ce dossier:

      thunk dumb copy amok

      Puis remet un rapport HijackThis

      A++
      0
  2. aranjuez31 Messages postés 8161 Date d'inscription   Statut Contributeur 354
     
    bsr
    à peine un peu moins crade.....
    0
  3. cmdt Messages postés 12 Statut Membre
     
    Bonjour, J'ai règlé une bonne parti de mon problème et je voudrais remercié Boulepate pour ces justicieux conseils, sa diligence et sa patience. Je pourrais écrire plusieurs qualificatifs pour le remecier, mais aucun ne serait capable de dire le bonheur que j'ai à avoir eu l'aide de cette personne.

    Ça ne serait pas trop vous demandez encore une fois votre aide. J'ai un problème qui persiste lorsque j'ouvre le programme Ad-Watch qui vient de Ad-Aware. Lorsque Ad-Watch s'ouvre il change la page d'accueil d'Internet Explorer d'une des sessions de l'ordinateur.

    Merci d'avance pour votre aide.
    0