Comment supprimer SECURITY TOOLBAR 7.1?Fermé

Question

Bonjour à tous. Je n'arrive pas à supprimer cette toolbar. Pourriez vous m'aider?

Merci d'avance

Ci dessous le rapport 



Logfile of HijackThis v1.99.1
Scan saved at 22:10:44, on 22/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Agnitum\Outpost Firewall\outpost.exe
C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology\ELService.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
C:\Program Files\Sonic\DigitalMedia Plus\DigitalMedia Archive\DMAScheduler.exe
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Ulead Systems\Ulead Photo Explorer 7.0\Monitor.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\PROGRA~1\Wanadoo\Watch.exe
c:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Internet Explorer\iexplore.exe
c:\windows\system\hpsysdrv.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\Rar$EX01.281\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.gamesload.fr/home.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {36ADA89D-2440-4DC4-820A-3A05E8630935} - C:\Program Files\Video ActiveX Access\iesplg.dll
O2 - BHO: MSNToolBandBHO - {49E0E0F0-5C30-11D4-945D-000000000000} - C:\WINDOWS\system32\msntb.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll (file missing)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (file missing)
O3 - Toolbar: Protection Bar - {DF4E7A0C-E233-4906-B4C1-A404356541FF} - C:\Program Files\Video ActiveX Access\iesbpl.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
O4 - HKLM\..\Run: [DMAScheduler] c:\Program Files\Sonic\DigitalMedia Plus\DigitalMedia Archive\DMAScheduler.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [Ulead Memory Card Detector] C:\Program Files\Ulead Systems\Ulead Photo Explorer 7.0\Monitor.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [OutpostFeedBack] C:\Program Files\Agnitum\Outpost Firewall\feedback.exe /dump:os_startup
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [Internet Download Accelerator] C:\Program Files\IDA\ida.exe -autorun
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Ajouter à &Windows Live Favorites - https://onedrive.live.com/?id=favorites
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Réglage rapide de Outpost Firewall Pro - {44627E97-789B-40d4-B5C2-58BD171129A1} - C:\Program Files\Agnitum\Outpost Firewall\Plugins\BrowserBar\ie_bar.dll
O9 - Extra button: (no name) - {9819CC0E-9669-4D01-9CD7-2C66DA43AC6C} - (no file)
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {03B39B10-9AB9-4DBB-8189-7F76E0CE5F3F} (FavImport Class) - https://onedrive.live.com/?id=favorites
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Intel® Quick Resume Technology Drivers (ELService) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology\ELService.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum Ltd. - C:\Program Files\Agnitum\Outpost Firewall\outpost.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

Ona-ra · Answer

Bonjour ! 
Je n'est eu aucun mal a supprimer entiérement security toolbar en faisant une restauration du système tout simplement.
On gagne plus qu'on ne perd ^^

Cordialement Ona-ra

Bast · Answer

Bonjour, 
comment fair une réstoration du systéme ?!

mag · Answer

SmitFraudFix v2.250 
 
Scan done at 18:15:47.10, 08/11/2007 
Run from C:\Documents and Settings\HP_Administrator\Desktop\dossier\SmitfraudFix 
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT 
The filesystem type is NTFS 
Fix run in normal mode 
 
»»»»»»»»»»»»»»»»»»»»»»»» Process 
 
C:\WINDOWS\System32\smss.exe 
C:\WINDOWS\system32\winlogon.exe 
C:\WINDOWS\system32\services.exe 
C:\WINDOWS\system32\lsass.exe 
C:\WINDOWS\system32\svchost.exe 
C:\WINDOWS\System32\svchost.exe 
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe 
C:\WINDOWS\Explorer.EXE 
C:\WINDOWS\system32\spoolsv.exe 
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe 
C:\WINDOWS\eHome\ehRecvr.exe 
C:\WINDOWS\eHome\ehSched.exe 
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe 
C:\Program Files\Common Files\LightScribe\LSSrvc.exe 
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE 
C:\WINDOWS\system32
vsvc32.exe 
C:\WINDOWS\system32\svchost.exe 
C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology\ELService.exe 
C:\WINDOWS\system32\dllhost.exe 
C:\WINDOWS\ehome\ehtray.exe 
C:\WINDOWS\eHome\ehmsas.exe 
C:\WINDOWS\RTHDCPL.EXE 
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe 
C:\WINDOWS\system32undll32.exe 
C:\Program Files\DISC\DISCover.exe 
C:\Program Files\DISC\DiscUpdMgr.exe 
C:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe 
C:\Program Files\DISC\DiscStreamHub.exe 
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe 
C:\windows\ffpext\ffpsrv.exe 
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe 
C:\WINDOWS\system32\ctfmon.exe 
C:\Program Files\MSN Messenger\MsnMsgr.Exe 
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe 
C:\HP\KBD\KBD.EXE 
c:\windows\system\hpsysdrv.exe 
C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe 
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe 
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE 
C:\Program Files\Internet Explorer\iexplore.exe 
C:\Program Files\MSN Messenger\usnsvc.exe 
C:\WINDOWS\system32\cmd.exe 
 
»»»»»»»»»»»»»»»»»»»»»»»» hosts 
 
 
»»»»»»»»»»»»»»»»»»»»»»»» C:\ 
 
 
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS 
 
 
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system 
 
 
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web 
 
 
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32 
 
 
»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\HP_Administrator 
 
 
»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\HP_Administrator\Application Data 
 
 
»»»»»»»»»»»»»»»»»»»»»»»» Start Menu 
 
 
»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\HP_ADM~1\FAVORI~1 
 
 
»»»»»»»»»»»»»»»»»»»»»»»» Desktop 
 
 
»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files  
 
 
»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys 
 
 
»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components 
  
  
 
»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler 
!!!Attention, following keys are not inevitably infected!!! 
 
SrchSTS.exe by S!Ri 
Search SharedTaskScheduler's .dll 
 
 
»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs 
!!!Attention, following keys are not inevitably infected!!! 
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] 
"AppInit_DLLs"="" 
 
 
»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System 
!!!Attention, following keys are not inevitably infected!!! 
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 
"System"="" 
 
 
»»»»»»»»»»»»»»»»»»»»»»»» Rustock 
 
 
 
»»»»»»»»»»»»»»»»»»»»»»»» DNS 
 
Description: Intel(R) PRO/100 VE Network Connection - Packet Scheduler Miniport 
DNS Server Search Order: 16.92.3.242 
DNS Server Search Order: 16.92.3.243 
DNS Server Search Order: 16.81.3.243 
DNS Server Search Order: 16.118.3.243 
 
Description: ARRIS TOUCHSTONE DEVICE #2 - Packet Scheduler Miniport 
DNS Server Search Order: 24.200.241.37 
DNS Server Search Order: 24.201.245.77 
DNS Server Search Order: 24.200.243.189 
 
Description: ARRIS TOUCHSTONE DEVICE #2 - Packet Scheduler Miniport 
DNS Server Search Order: 24.200.241.37 
DNS Server Search Order: 24.201.245.77 
DNS Server Search Order: 24.200.243.189 
 
HKLM\SYSTEM\CCS\Services\Tcpip\..\{892900FC-9814-4488-99C0-81491C1EE93D}: DhcpNameServer=16.92.3.242 16.92.3.243 16.81.3.243 16.118.3.243 
HKLM\SYSTEM\CCS\Services\Tcpip\..\{C64E4607-6FAB-49A4-94A3-842C703B7FE6}: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189 
HKLM\SYSTEM\CCS\Services\Tcpip\..\{FA920003-6B52-4084-97B7-1DE12CE87D64}: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189 
HKLM\SYSTEM\CS1\Services\Tcpip\..\{892900FC-9814-4488-99C0-81491C1EE93D}: DhcpNameServer=16.92.3.242 16.92.3.243 16.81.3.243 16.118.3.243 
HKLM\SYSTEM\CS1\Services\Tcpip\..\{C64E4607-6FAB-49A4-94A3-842C703B7FE6}: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189 
HKLM\SYSTEM\CS1\Services\Tcpip\..\{FA920003-6B52-4084-97B7-1DE12CE87D64}: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189 
HKLM\SYSTEM\CS3\Services\Tcpip\..\{892900FC-9814-4488-99C0-81491C1EE93D}: DhcpNameServer=16.92.3.242 16.92.3.243 16.81.3.243 16.118.3.243 
HKLM\SYSTEM\CS3\Services\Tcpip\..\{C64E4607-6FAB-49A4-94A3-842C703B7FE6}: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189 
HKLM\SYSTEM\CS3\Services\Tcpip\..\{FA920003-6B52-4084-97B7-1DE12CE87D64}: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189 
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189 
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189 
 
 
»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection 
 
 
»»»»»»»»»»»»»»»»»»»»»»»» End

crashboy26 · Answer

Bonsoir,

Télécharge VUNDOFIX, lance-le et supprime ce qu'il te trouve.

Apparement, ça fonctionne très bien pour virer cette toolbar.

Comment supprimer SECURITY TOOLBAR 7.1?

4 réponses

Discussions similaires

Newsletters