accés internet, trojan horse

Question

Salut à vous.
Voila mon problème. Je ne peux plus me connecter sur le web librement : lorsque je tape une adresse on me renvoit tjs sur le même site; ex : je veux aller sur hotmail et j'arrive sur "http://searchpage.cc/www.hotmail.com". pourquoi?
qu'ai je fait?
Est-ce un virus? (j'ai qques soucis avec un trojan horse)

Je compte sur vos connaissances. Merci à tous.

darkcrystal33 · Answer

télécharge et nettoie ton pc avec spybot==>
http://files.webattack.com/localdl834/spybotsd13.exe

ou bien suis les instructions ci dessous:

searchpage.cc is a browser helper object changes your SearchURL, Search Bar, Search Page, Default Page URL, SearchAssistant and CustomizeSearch to nkvd.us or searchpage.cc.

Classification
Adware

Files
mshelper.dll, mshelper_beta.dll

Manual removal
Please follow the instructions below if you would like to remove searchpage.cc manually. Please notice that you must follow the instructions very carefully and delete everything that is mentioned. In most cases the removal will fail if one single item is not deleted. If searchpage.cc remains on your system after stepping through the removal instructions, please double-check by stepping through them again.

1. Start the registry editor. This is done by clicking Start then Run. (The Run dialog will appear.) Type regedit and click OK. (The registry editor will open.)
2. Delete 'HKEY_LOCAL_MACHINE\SOFTWARE \ Classes \ CLSID \ {FF1BF4C7-4E08-4A28-A43F-9D60A9F7A880}', if it exists.
3. Delete 'HKEY_LOCAL_MACHINE\SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer\Browser Helper Objects \ {FF1BF4C7-4E08-4A28-A43F-9D60A9F7A880}', if it exists.
4. Exit the registry editor.
5. Restart your computer.
6. Start Windows Explorer and delete:
%SystemDir%\mshelper.dll
%SystemDir%\mshelper_beta.dll
Note: %SystemDir% is a variable (?). By default, this is C:\Windows\System (Windows 95/98/Me), C:\WINNT\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
7. Now it should be possible to change you browser settings without searchpage.cc interfering.

eps3m · Answer

Tout d'abord merci darkcrystal33.
Je ne connaissais pas spybot et il m'a permis d'éliminer 356 problèmes ! Mais il en reste 2, nommés Common hijacker et Possible hijacker (modification du registre) : les connais-tu ?
Mais je n'arrive tjs pas à me connecter librement et je retombe tjs sur les pages genre "search for..."
Dois je tenter d'éliminer ces 2 pb?

darkcrystal33 · Answer

télécharge hijackthis et colle le rapport de scan ici, je te dirais qu'elles lignes fixer.ftp://zebulon.fr/HijackThis.exe

eps3m · Answer

comment fais tu pour copier le résultat du scan?

darkcrystal33 · Answer

tu clique sur le bouton "save log"

eps3m · Answer

Logfile of HijackThis v1.97.7Scan saved at 19:36:31, on 04/07/04Platform: Windows 98 SE (Win9x 4.10.2222A)MSIE: Internet Explorer v5.50 (5.50.4134.0600)Running processes:C:\WINDOWS\SYSTEM\KERNEL32.DLLC:\WINDOWS\SYSTEM\MSGSRV32.EXEC:\WINDOWS\SYSTEM\MPREXE.EXEC:\WINDOWS\SYSTEM\mmtask.tskC:\WINDOWS\SOINTGR.EXEC:\PROGRAM FILES\AVG\GRISOFT\AVG6\AVGSERV9.EXEC:\WINDOWS\SYSTEM\MSTASK.EXEC:\WINDOWS\EXPLORER.EXEC:\WINDOWS\TASKMON.EXEC:\WINDOWS\SYSTEM\SYSTRAY.EXEC:\WINDOWS\SOUNDMAN.EXEC:\PROGRAM FILES\KFH\CL\LAUNCHER.EXEC:\WINDOWS\LOADQM.EXEC:\PROGRAM FILES\COMMON FILES\DPI\DPI.EXEC:\WINDOWS\SYSTEM32\PCS\PCSVC.EXEC:\PROGRAM FILES\AVG\GRISOFT\AVG6\AVGCC32.EXEC:\WINDOWS\SYSTEM\HPOOPM07.EXEC:\WINDOWS\TEMP\IRUUX4V9M.EXEC:\WINDOWS\TEMP\DZ.EXEC:\WINDOWS\WINLOGON.EXEC:\WINDOWS\WINPROXY.EXEC:\WINDOWS\SYSTEM\SPOOL32.EXEC:\WINDOWS\SYSTEM\WMIEXE.EXEC:\WINDOWS\RUNDLL32.EXEC:\PROGRAM FILES\HEWLETT-PACKARD\HP PSC 700 SERIES\BIN\HPODEV07.EXEC:\PROGRAM FILES\HEWLETT-PACKARD\DIGITAL IMAGING\BIN\HPOTDD01.EXEC:\PROGRAM FILES\NIKON\NKVIEW6\NKVMON.EXEC:\PROGRAM FILES\SAGEM\SAGEM F@ST 800-840\DSLMON.EXEC:\PROGRAM FILES\HEWLETT-PACKARD\HP PSC 700 SERIES\BIN\HPOEVM07.EXEC:\PROGRAM FILES\HEWLETT-PACKARD\HP PSC 700 SERIES\BIN\HPOSTS07.EXEC:\WINDOWS\SYSTEM\RNAAPP.EXEC:\WINDOWS\SYSTEM\TAPISRV.EXEC:\WINDOWS\SYSTEM\DDHELP.EXEC:\WINDOWS\SYSTEM\PSTORES.EXEC:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXEC:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXED:\MESDOC\MATHIEU\PROBLèMES\HIJACKTHIS\HIJACKTHIS.EXER1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://nkvd.us (obfuscated)R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.media-search.net/nph-search.cgi?track=mssb1&look=sbar1_srchbtnR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.media-search.net/nph-search.cgi?track=mssrc&look=stmpl1&find=R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.fr/R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://nkvd.us (obfuscated)R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ls0.net/home.html (obfuscated)R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.media-search.net/nph-search.cgi?track=mssrc&look=stmpl1&find=R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ls0.net/srchasst.html (obfuscated)R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://nkvd.us (obfuscated)R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.media-search.net/nph-search.cgi?track=mssb1&look=sbar1_srchbtnR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.media-search.net/nph-search.cgi?track=mssrc&look=stmpl1&find=R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ls0.net/home.html (obfuscated)R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.media-search.net/nph-search.cgi?track=mssrc&look=stmpl1&find=R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ls0.net/srchasst.html (obfuscated)R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.media-search.net/nph-search.cgi?track=mssrc&look=stmpl1&find=R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.media-search.net/nph-search.cgi?track=mssrc&look=stmpl1&find=R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensR1 - HKCU\Software\Microsoft\Internet Explorer,Search = http://nkvd.us (obfuscated)R1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://nkvd.us (obfuscated)R1 - HKLM\Software\Microsoft\Internet Explorer\Search,(Default) = http://ls0.net/srchasst.html (obfuscated)R3 - URLSearchHook: IncrediFindBHO Class - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLLO2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRAM FILES\YAHOO!\COMPANION\YCOMP5_1_5_0.DLLO2 - BHO: NavErrRedir Class - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLLO2 - BHO: OsbornTech Popup Blocker - {FF1BF4C7-4E08-4A28-A43F-9D60A9F7A880} - C:\WINDOWS\SYSTEM\MSHELPER.DLLO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Mesdoc\Mathieu\Problèmes\Spybot - Search & Destroy\SDHelper.dllO3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\YCOMP5_1_5_0.DLLO3 - Toolbar: @msdxmLC.dll,-1@1036,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCXO4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorunO4 - HKLM\..\Run: [TaskMonitor] c:\windows	askmon.exeO4 - HKLM\..\Run: [SystemTray] SysTray.ExeO4 - HKLM\..\Run: [SoundMan] soundman.exeO4 - HKLM\..\Run: [SO5 Integrator Pass Two] C:\WINDOWS\SOINTGR.EXEO4 - HKLM\..\Run: [RegShave] C:\Progra~1\REGSHAVE\REGSHAVE.EXE /autorunO4 - HKLM\..\Run: [Launcher] "C:\Program Files\KFH\cl\launcher.exe" /PO4 - HKLM\..\Run: [LoadQM] loadqm.exeO4 - HKLM\..\Run: [Dpi] C:\PROGRAM FILES\COMMON FILES\DPI\DPI.EXEO4 - HKLM\..\Run: [Pcsv] C:\WINDOWS\system32\pcs\pcsvc.exeO4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\AVG\GRISOFT\AVG6\avgcc32.exe /STARTUPO4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrSchemeO4 - HKLM\..\Run: [autoclk] autoclk.exeO4 - HKLM\..\Run: [HPAIO_PrintFolderMgr] C:\WINDOWS\SYSTEM\hpoopm07.exeO4 - HKLM\..\Run: [sys] regedit -s sysdll.regO4 - HKLM\..\Run: [Windows Shell Library Loader] load shell32.dll /c /setO4 - HKLM\..\Run: [Media-Search] "C:\PROGRAM FILES\MSNET\V9\MSNET.EXE" /HO4 - HKLM\..\Run: [IRUUX4V9M.EXE] C:\WINDOWS\TEMP\IRUUX4V9M.EXEO4 - HKLM\..\Run: [DZ.EXE] C:\WINDOWS\TEMP\DZ.EXEO4 - HKLM\..\Run: [Bakra] C:\WINDOWS\SYSTEM\IEHost34.exeO4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe C:\PROGRA~1\WILDTA~1\APPS\CDA\CDAENG~1.DLL,cdaEngineMainO4 - HKLM\..\RunServices: [SO5 Integrator Pass One] C:\WINDOWS\SOINTGR.EXEO4 - HKLM\..\RunServices: [Avgserv9.exe] C:\PROGRA~1\AVG\GRISOFT\AVG6\Avgserv9.exeO4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrSchemeO4 - HKLM\..\RunServices: [SchedulingAgent] c:\windows\SYSTEM\mstask.exeO4 - HKCU\..\Run: [winlogon] c:\windows\winlogon.exeO4 - HKCU\..\Run: [winproxy] C:\windows\winproxy.exeO4 - HKCU\..\Run: [System Update4] c:\windows\system\update.exeO4 - HKCU\..\Run: [Service Manager] C:\windows\dxsound.exeO4 - HKCU\..\Run: [Instant Access] rundll32.exe p2esocks_1016.dll,InstantAccessO4 - Startup: HPAiODevice.lnk = C:\Program Files\Hewlett-Packard\hp psc 700 series\bin\hpodev07.exeO4 - Startup: hpoddt01.exe.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exeO4 - Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exeO4 - Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exeO4 - Global Startup: updater.lnk = C:\Program Files\Common Files\updater\wupdater.exeO8 - Extra context menu item: Web Search - C:\WINDOWS\ex.htmO9 - Extra button: Related (HKLM)O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)O9 - Extra button: Yahoo! Messenger (HKLM)O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)O9 - Extra 'Tools' menuitem: MaxSpeed (HKLM)O12 - Plugin for .mp3: C:\PROGRA~1\INTERN~1\PLUGINS
pqtplugin4.dllO13 - DefaultPrefix: http://%6E%6B%76%64%2E%75%73/O13 - WWW Prefix: http://%6E%6B%76%64%2E%75%73/O13 - Home Prefix: http://%6E%6B%76%64%2E%75%73/O13 - Mosaic Prefix: http://%6E%6B%76%64%2E%75%73/O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cabO16 - DPF: {946B0485-8F8C-4C35-A6E7-D2115E3B0B4F} (HTMLAccess Class) - http://fr4-download.nocreditcard.com/download/Object/DialerHTML/DHTMLAccess1043.cabO16 - DPF: {3B02AAA2-327C-40ED-A849-4BE819AE5385} (ImgSizer Control) - file://C:\WINDOWS\TEMP\~DlfnTmp0\imgSizer.ocxO16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?38149.5296759259O16 - DPF: {469C7080-8EC8-43A6-AD97-45848113743C} - http://akamai.downloadv3.com/binaries/IA/nethv32_FR.cabO16 - DPF: {0594AF7E-573B-40DF-8165-E47AB2EAEFE8} (EGEGAUTH Class) - http://akamai.downloadv3.com/binaries/P2EClient/EGAUTH_1016_FR.cabO19 - User stylesheet: C:\WINDOWS\color.cssJe t'écoute pour la suite

darkcrystal33 · Answer

fixe les lignes suivantes et redémarre ton pc...==>

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://nkvd.us (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.media-search.net/nph-search.cgi?track=mssb1&look=sbar1_srchbtn
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.media-search.net/nph-search.cgi?track=mssrc&look=stmpl1&find=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://nkvd.us (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ls0.net/home.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.media-search.net/nph-search.cgi?track=mssrc&look=stmpl1&find=
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ls0.net/srchasst.html (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://nkvd.us (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.media-search.net/nph-search.cgi?track=mssb1&look=sbar1_srchbtn
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.media-search.net/nph-search.cgi?track=mssrc&look=stmpl1&find=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ls0.net/home.html (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.media-search.net/nph-search.cgi?track=mssrc&look=stmpl1&find=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ls0.net/srchasst.html (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.media-search.net/nph-search.cgi?track=mssrc&look=stmpl1&find=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.media-search.net/nph-search.cgi?track=mssrc&look=stmpl1&find=
R1 - HKCU\Software\Microsoft\Internet Explorer,Search = http://nkvd.us (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://nkvd.us (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,(Default) = http://ls0.net/srchasst.html (obfuscated)

R3 - URLSearchHook: IncrediFindBHO Class - {5D60FF48-95BE-4956-B4C6-6BB168A70310} -
O13 - DefaultPrefix: http://%6E%6B%76%64%2E%75%73/
O13 - WWW Prefix: http://%6E%6B%76%64%2E%75%73/
O13 - Home Prefix: http://%6E%6B%76%64%2E%75%73/
O13 - Mosaic Prefix: http://%6E%6B%76%64%2E%75%73/
O19 - User stylesheet: C:\WINDOWS\color.css

eps3m · Answer

Merci et toutes mes félicitations... t'es le seul qui as su me virer cette m...en si peu de tps !
<Mais maintenant, j'aimerais comprendre : à quoi correspondent les fichiiers fixés? sont ils supprimés? Y a t il un risque de "rechute"?

eps3m · Answer

Je pense moi même pouvir répondre à ma question : oui, il y a risque de rechute... de nouveau, et notamment sur ma boite mail, la "search page" apparaît et pire encore, de nombreux liens ne marche plus et indiquent "impossible d'afficher cette page", est-ce dû aux nombreux fichiers fixés précédemment?

Merci pour votre aide.

luis dorta · Answer

I NEED HELP FOR http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D%00@%77%77%77%2e%65%2d%66%69%6e%64%65%72%2e%63%63/%68%70/

luis dorta · Answer

I NEED HELP FOR http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D%00@%77%77%77%2e%65%2d%66%69%6e%64%65%72%2e%63%63/%68%70/

cyril · Answer

moi g sa comme registre , et je suis ossi infecter par cette m.... , comment modifier le registre ?
Logfile of HijackThis v1.98.2
Scan saved at 13:42:41, on 20/08/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\NavNT\rtvscan.exe
C:\Program Files\Kerio\Personal Firewall\persfw.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\CTHELPER.EXE
C:\Program Files\NavNT\vptray.exe
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
C:\WINDOWS\System32\MsgSys.EXE
C:\Program Files\Wanadoo\EspaceWanadoo.exe
C:\Program Files\Wanadoo\ComComp.exe
C:\Program Files\Wanadoo\Watch.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Overnet\overnet.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\dwwin.exe
C:\Documents and Settings\AdminCyril\Bureau\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.wanadoo.fr/go/page_recherche/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.heretofind.com/show.php?id=9&q=%s
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = mk:@MSITStore:C:\spe\start.chm::/start.html#
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.heretofind.com/show.php?id=9&q=%s
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = mk:@MSITStore:C:\spe\start.chm::/start.html#
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &NeoTrace It! - C:\PROGRA~1\NEOTRA~1\NTXcontext.htm
O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O9 - Extra button: Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - C:\Program Files\VisualRoute\vrie.dll
O9 - Extra 'Tools' menuitem: VisualRoute Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - C:\Program Files\VisualRoute\vrie.dll
O9 - Extra button: Corel Network monitor worker - {29EDF01B-EBF0-4996-9096-944329C1C4D3} - (no file)
O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {29EDF01B-EBF0-4996-9096-944329C1C4D3} - (no file)
O9 - Extra button: ProRat V1.8 - {89999700-cba3-4071-b251-47cb894244cd} - C:\Documents and Settings\AdminCyril\Bureau\cyril\prorat18\ProRat.exe (file missing)
O9 - Extra 'Tools' menuitem: ProRat V1.8 - {89999700-cba3-4071-b251-47cb894244cd} - C:\Documents and Settings\AdminCyril\Bureau\cyril\prorat18\ProRat.exe (file missing)
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.wanadoo.fr (file missing) (HKCU)
O9 - Extra button: Corel Network monitor worker - {29EDF01B-EBF0-4996-9096-944329C1C4D3} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {29EDF01B-EBF0-4996-9096-944329C1C4D3} - (no file) (HKCU)
O9 - Extra button: NeoTrace It! - {9885224C-1217-4c5f-83C2-00002E6CEF2B} - C:\PROGRA~1\NEOTRA~1\NTXtoolbar.htm (HKCU)
O13 - DefaultPrefix: http://www.heretofind.com/show.php?id=9&q=
O13 - WWW Prefix: http://www.heretofind.com/show.php?id=9&q=
O13 - Home Prefix: http://www.heretofind.com/show.php?id=9&q=
O13 - Mosaic Prefix: http://www.heretofind.com/show.php?id=9&q=
O13 - Gopher Prefix: http://www.heretofind.com/show.php?id=9&q=
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1E2F7C48-F0B4-4366-8F78-55C987C61402}: NameServer = 80.10.246.130 80.10.246.3
O17 - HKLM\System\CS1\Services\Tcpip\..\{1E2F7C48-F0B4-4366-8F78-55C987C61402}: NameServer = 80.10.246.130 80.10.246.3

que faire, merci

cyril · Answer

souplait quelqun pour me repondre, jen ai marre

balltrap34 · Answer

salut
commence par ceci
CWShredder
http://pageperso.aol.fr/Balltrap34/CWShredder.exe

il faut l'ouvrir (absolument) toutes fenêtres fermées et hors connexion et faire fix- next - next

Supprimer les mouchards avec AdAware ou Spybot:
http://www.ordi-netfr.org/tutorialadaware.html
---------------------------
spyboot
http://www.safer-networking.org/index.php?page=mirrors

aide pour ces 2 log
http://www.cestfacile.org/adaware6ut.htm
http://www.cestfacile.org/spybot.htm
--------------------------
http://pageperso.aol.fr/Balltrap34/AboutBuster.exe

la chasse et le balltrap ma vrai passion
voir site perso dans profil

Accés internet, trojan horse

14 réponses

Discussions similaires

Newsletters