[about blank et casino] fenetre indésirableRésolu/Fermé

Question

Bonjour,Je vous envoie un hijack de mon pc qui vient de choper about blank et casino. Pouvez-vous m'aider à supprimer tout ça ? (impossible de changer la page de démarrage IE par défaut par exemple).Merci d'avance.Logfile of HijackThis v1.99.1Scan saved at 16:31:43, on 14/11/2005Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\System32\ibmpmsvc.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\CommonTime\Cadenza\Cadenza.exeC:\PROGRA~1\NavNT\DefWatch.exeC:\WINDOWS\System32\NALNTSRV.EXEC:\PROGRA~1\AT&TGL~1\NetCfgSv.EXEC:\PROGRA~1\NavNTtvscan.exeC:\WINDOWS\System32\wm.exeZ:\clntrust.exeC:\WINDOWS\System32undll32.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\System32\dpmw32.exeC:\WINDOWS\System32\NWTRAY.EXEC:\WINDOWS\System32	p4mon.exeC:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exeC:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.EXEC:\WINDOWS\System32\ltmsg.exeC:\WINDOWS\System32\BESCH.EXEC:\PROGRA~1\ACDSYS~1\ACDSee\CAMDET~1.EXEC:\PROGRA~1\NavNT\vptray.exeC:\WINDOWS\System32\NALDESK.EXEC:\Program Files\IE Doctor\IEDoctor.exeC:\Program Files\Microsoft AntiSpyware\gcasDtServ.exeC:\WINDOWS\System32\ctfmon.exeC:\Program Files\CommonTime\Cadenza\CdzSvc.exeC:\Program Files\Spybot - Search & Destroy\TeaTimer.exeC:\Palm\HOTSYNC.EXEC:\Lotus\Notes\NLNOTES.EXEC:\Lotus\Notes
wrdaemn.EXEC:\Lotus\Notes
update.EXEC:\Lotus\Notes
hldaemn.EXEC:\Program Files\VANTIVE32\VANTIV32.EXEC:\Program Files\DevisSol\SOL.exeD:\documents and Settings\ebax178\My Documents\PERSO\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\Temp\se.dll/space.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blankR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = passR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\Temp\se.dll/space.htmlR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blankR1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blankR0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blankR0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.yahoo.comR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blankR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blankR1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://pic.fr.schneider-electric.com:1959/data/proxy.pacO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {2D1B4796-4E07-44B2-9EED-54DF3231F316} - C:\WINDOWS\System32
can.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO4 - HKLM\..\Run: [NDPS] C:\WINDOWS\System32\dpmw32.exeO4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXEO4 - HKLM\..\Run: [TrackPointSrv] tp4mon.exeO4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exeO4 - HKLM\..\Run: [TPTRAY] C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.EXEO4 - HKLM\..\Run: [LTWinModem1] ltmsg.exe 9O4 - HKLM\..\Run: [BackupExecScheduler] BESCH.EXEO4 - HKLM\..\Run: [Camera Detector] C:\PROGRA~1\ACDSYS~1\ACDSee\CAMDET~1.EXEO4 - HKLM\..\Run: [vptray] C:\PROGRA~1\NavNT\vptray.exeO4 - HKLM\..\Run: [Verif Symantec NAV8] "C:\Program Files\Schneider integration\VerifNAV.vbs"O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"O4 - HKLM\..\Run: [IE Doctor] C:\Program Files\IE Doctor\IEDoctor.exe /minO4 - HKLM\..\Run: [sp] rundll32 C:\Temp\se.dll,DllInstallO4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exeO4 - HKCU\..\Run: [Cadenza] C:\Program Files\CommonTime\Cadenza\CdzSvc.exeO4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exeO4 - Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXEO4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Readereader_sl.exeO6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions presentO6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cabO16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cabO16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cabO16 - DPF: {B2CC4BA0-08EB-4AF9-A532-1295DF0C8A07} (WebQuartzX Contrôle) - http://webquartz.fr.schneider-electric.com/ocx/WebQuartz.cabO16 - DPF: {C470E718-6117-11D7-A1AC-0002A5269C35} (CreditClient.ControlInactif) - file://C:\Temp\CreditClient.cabO17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = fr.schneider-electric.comO17 - HKLM\Software\..\Telephony: DomainName = fr.schneider-electric.comO17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = fr.schneider-electric.comO17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 139.160.77.13 139.160.111.43O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 139.160.77.13 139.160.111.43O18 - Filter: text/html - {FCE29A2C-462C-43BE-8587-C95F3112DA1A} - C:\WINDOWS\System32
can.dllO18 - Filter: text/plain - {FCE29A2C-462C-43BE-8587-C95F3112DA1A} - C:\WINDOWS\System32
can.dllO20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dllO23 - Service: CommonTime mNotes Server (CadenzaServer) - CommonTime Limited - C:\Program Files\CommonTime\Cadenza\Cadenza.exeO23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\NavNT\DefWatch.exeO23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\System32\ibmpmsvc.exeO23 - Service: Novell Application Launcher (NALNTSERVICE) - Novell, Inc. - C:\WINDOWS\System32\NALNTSRV.EXEO23 - Service: Network Configuration Service (NetCfgSvr) - AT&T - C:\PROGRA~1\AT&TGL~1\NetCfgSv.EXEO23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\NavNTtvscan.exeO23 - Service: OracleOraHome92ClientCache - Unknown owner - C:\oracle\BIN\ONRSD.EXEO23 - Service: ReplService - Unknown owner - C:\Program Files\Trilogy\ReplServiceepl.exeO23 - Service: Novell Workstation Manager (WM) - Novell, Inc. - C:\WINDOWS\System32\wm.exe

flopad · Answer

Salut,vas sur http://www.pandasoftware.com/activescan/activescan et fais un scan complet de ton poste.Ensuite vas sur http://www.telecharger.com et télécharges microsoft antispyware.Installes ca et apres tout ca, tu devrais etre debarasse de ces saletés...

fcduo · Answer

Merci,J'essaie demain matin et te tiens au courant.@+

fcduo · Answer

Bonjour,Impossible de tester par activscan (active X bloqué).Microsoft antispyware téléchargé et installé, mais tjrs IE dirigé vers about blank avec deux petits tirets verticaux entre about et blank (donc ce n'est pas une feuille blanche !).A tout hasard ci-joint hijack:Logfile of HijackThis v1.99.1Scan saved at 16:51:40, on 15/11/2005Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\System32\ibmpmsvc.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\CommonTime\Cadenza\Cadenza.exeC:\PROGRA~1\NavNT\DefWatch.exeC:\WINDOWS\System32\NALNTSRV.EXEC:\PROGRA~1\AT&TGL~1\NetCfgSv.EXEC:\PROGRA~1\NavNTtvscan.exeC:\WINDOWS\System32\wm.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\System32\dpmw32.exeC:\WINDOWS\System32\NWTRAY.EXEC:\WINDOWS\System32	p4mon.exeC:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exeC:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.EXEC:\WINDOWS\System32\ltmsg.exeC:\WINDOWS\System32\BESCH.EXEC:\PROGRA~1\ACDSYS~1\ACDSee\CAMDET~1.EXEC:\PROGRA~1\NavNT\vptray.exeC:\Program Files\Microsoft AntiSpyware\gcasServ.exeC:\Program Files\Microsoft AntiSpyware\gcasDtServ.exeC:\WINDOWS\System32undll32.exeC:\WINDOWS\System32\ctfmon.exeC:\Program Files\CommonTime\Cadenza\CdzSvc.exeC:\Program Files\Spybot - Search & Destroy\TeaTimer.exeC:\Palm\HOTSYNC.EXEC:\Program Files\Internet Explorer\iexplore.exeD:\documents and Settings\ebax178\My Documents\PERSO\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\Temp\se.dll/space.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blankR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = passR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\Temp\se.dll/space.htmlR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blankR1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blankR0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blankR0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.yahoo.comR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blankR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blankR1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://pic.fr.schneider-electric.com:1959/data/proxy.pacO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {2D1B4796-4E07-44B2-9EED-54DF3231F316} - C:\WINDOWS\System32
can.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO4 - HKLM\..\Run: [NDPS] C:\WINDOWS\System32\dpmw32.exeO4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXEO4 - HKLM\..\Run: [TrackPointSrv] tp4mon.exeO4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exeO4 - HKLM\..\Run: [TPTRAY] C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.EXEO4 - HKLM\..\Run: [LTWinModem1] ltmsg.exe 9O4 - HKLM\..\Run: [BackupExecScheduler] BESCH.EXEO4 - HKLM\..\Run: [Camera Detector] C:\PROGRA~1\ACDSYS~1\ACDSee\CAMDET~1.EXEO4 - HKLM\..\Run: [vptray] C:\PROGRA~1\NavNT\vptray.exeO4 - HKLM\..\Run: [Verif Symantec NAV8] "C:\Program Files\Schneider integration\VerifNAV.vbs"O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"O4 - HKLM\..\Run: [IE Doctor] C:\Program Files\IE Doctor\IEDoctor.exe /minO4 - HKLM\..\Run: [sp] rundll32 C:\Temp\se.dll,DllInstallO4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exeO4 - HKCU\..\Run: [Cadenza] C:\Program Files\CommonTime\Cadenza\CdzSvc.exeO4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exeO4 - Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXEO4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Readereader_sl.exeO6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions presentO6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cabO16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cabO16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cabO16 - DPF: {B2CC4BA0-08EB-4AF9-A532-1295DF0C8A07} (WebQuartzX Contrôle) - http://webquartz.fr.schneider-electric.com/ocx/WebQuartz.cabO16 - DPF: {C470E718-6117-11D7-A1AC-0002A5269C35} (CreditClient.ControlInactif) - file://C:\Temp\CreditClient.cabO17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = fr.schneider-electric.comO17 - HKLM\Software\..\Telephony: DomainName = fr.schneider-electric.comO17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = fr.schneider-electric.comO17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 139.160.77.13 139.160.111.43O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 139.160.77.13 139.160.111.43O18 - Filter: text/html - {FCE29A2C-462C-43BE-8587-C95F3112DA1A} - C:\WINDOWS\System32
can.dllO18 - Filter: text/plain - {FCE29A2C-462C-43BE-8587-C95F3112DA1A} - C:\WINDOWS\System32
can.dllO20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dllO23 - Service: CommonTime mNotes Server (CadenzaServer) - CommonTime Limited - C:\Program Files\CommonTime\Cadenza\Cadenza.exeO23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\NavNT\DefWatch.exeO23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\System32\ibmpmsvc.exeO23 - Service: Novell Application Launcher (NALNTSERVICE) - Novell, Inc. - C:\WINDOWS\System32\NALNTSRV.EXEO23 - Service: Network Configuration Service (NetCfgSvr) - AT&T - C:\PROGRA~1\AT&TGL~1\NetCfgSv.EXEO23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\NavNTtvscan.exeO23 - Service: OracleOraHome92ClientCache - Unknown owner - C:\oracle\BIN\ONRSD.EXEO23 - Service: ReplService - Unknown owner - C:\Program Files\Trilogy\ReplServiceepl.exeO23 - Service: Novell Workstation Manager (WM) - Novell, Inc. - C:\WINDOWS\System32\wm.exeMerci de votre aide.

boulepate · Answer

Re,fixe ceci en mode sans echec.O16 - DPF: {C470E718-6117-11D7-A1AC-0002A5269C35} (CreditClient.ControlInactif) - file://C:\Temp\CreditClient.cabO16 - DPF: {B2CC4BA0-08EB-4AF9-A532-1295DF0C8A07} (WebQuartzX Contrôle) - http://webquartz.fr.schneider-electric.com/ocx/WebQuartz.cab O18 - Filter: text/html - {920E720B-29C4-44BA-A403-BD54CE57B374} - C:\WINDOWS\System32
can.dllO18 - Filter: text/plain - {920E720B-29C4-44BA-A403-BD54CE57B374} - C:\WINDOWS\System32
can.dll Clique sur demarrer, executer, tape msconfig, và dans l'onglet demarrage et desactive ceci si tu le vois ou processus ayant le même nom:O18 - Filter: text/plain - {920E720B-29C4-44BA-A403-BD54CE57B374} - C:\WINDOWS\System32
can.dll Redemarre clique droit sur poste de travail, propriétés, onglet restauration du systeme, puis decoche la case, appliquer, puis ok.A tu utilisais les programmes que je t'ai donné ?! (a²free et ad-aware) Ensuite telecharge ceci, un pare feu, puisque tu en à pas:ZoneAlarm: firewall gratuit et simple d'utilisationZone AlarmPuis fait ceci: télécharge SmitfraudFix http://siri.urz.free.fr/Fix/SmitfraudFix.zip -Lance SmitfraudFix, et choisir l’option 1 copie le rapport ici

fcduo · Answer

Bonsoir,C'est mon pc du boulot et je ne l'ai pas sous la main !J'ai spybot et adware, par contre, impossible de m'enregistrer sur a².Quant à la protection réseau, je ne sais pas si je pourrai l'installer sans problème....Je te tiens au courant mais pas avant la semaine prochaine, je suis en déplacement.Merci encore.@+

fcduo · Answer

Bonjour,J'ai fini par détruire ncan.dll, et depuis plus de soucis.Je viens de supprimer les deux lignes 018.Je joins un hijack à tout hasard, mais tout va bien !Merci encore de ton aide boulepate !@+Logfile of HijackThis v1.99.1Scan saved at 12:15:49, on 21/11/2005Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\System32\ibmpmsvc.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\CommonTime\Cadenza\Cadenza.exeC:\PROGRA~1\NavNT\DefWatch.exeC:\WINDOWS\System32\NALNTSRV.EXEC:\PROGRA~1\AT&TGL~1\NetCfgSv.EXEC:\PROGRA~1\NavNTtvscan.exeC:\WINDOWS\System32\wm.exeZ:\clntrust.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\System32\dpmw32.exeC:\WINDOWS\System32\NWTRAY.EXEC:\WINDOWS\System32	p4mon.exeC:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exeC:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.EXEC:\WINDOWS\System32\ltmsg.exeC:\WINDOWS\System32\BESCH.EXEC:\WINDOWS\System32\NALDESK.EXEC:\PROGRA~1\ACDSYS~1\ACDSee\CAMDET~1.EXEC:\PROGRA~1\NavNT\vptray.exeC:\Program Files\Microsoft AntiSpyware\gcasServ.exeC:\Program Files\IE Doctor\IEDoctor.exeC:\WINDOWS\System32\ctfmon.exeC:\Program Files\CommonTime\Cadenza\CdzSvc.exeC:\Program Files\Spybot - Search & Destroy\TeaTimer.exeC:\Palm\HOTSYNC.EXEC:\Program Files\Microsoft AntiSpyware\gcasDtServ.exeC:\Lotus\Notes\NLNOTES.EXEC:\Lotus\Notes
wrdaemn.EXEC:\Lotus\Notes
update.EXEC:\Lotus\Notes
hldaemn.EXEC:\Program Files\VANTIVE32\VANTIV32.EXEC:\Program Files\DevisSol\SOL.exeC:\Program Files\Internet Explorer\iexplore.exeD:\documents and Settings\ebax178\My Documents\PERSO\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.yahoo.comR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://pass.fr.schneider-electric.com/FR/DCF/Cialsitemgr.nsf/HomePage?ReadFormR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.yahoo.comR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://pass/R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.yahoo.comR0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.yahoo.comR1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://pic.fr.schneider-electric.com:1959/data/proxy.pacO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO4 - HKLM\..\Run: [NDPS] C:\WINDOWS\System32\dpmw32.exeO4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXEO4 - HKLM\..\Run: [TrackPointSrv] tp4mon.exeO4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exeO4 - HKLM\..\Run: [TPTRAY] C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.EXEO4 - HKLM\..\Run: [LTWinModem1] ltmsg.exe 9O4 - HKLM\..\Run: [BackupExecScheduler] BESCH.EXEO4 - HKLM\..\Run: [Camera Detector] C:\PROGRA~1\ACDSYS~1\ACDSee\CAMDET~1.EXEO4 - HKLM\..\Run: [vptray] C:\PROGRA~1\NavNT\vptray.exeO4 - HKLM\..\Run: [Verif Symantec NAV8] "C:\Program Files\Schneider integration\VerifNAV.vbs"O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"O4 - HKLM\..\Run: [IE Doctor] C:\Program Files\IE Doctor\IEDoctor.exe /minO4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exeO4 - HKCU\..\Run: [Cadenza] C:\Program Files\CommonTime\Cadenza\CdzSvc.exeO4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exeO4 - Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXEO4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Readereader_sl.exeO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cabO16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cabO16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cabO16 - DPF: {B2CC4BA0-08EB-4AF9-A532-1295DF0C8A07} (WebQuartzX Contrôle) - http://webquartz.fr.schneider-electric.com/ocx/WebQuartz.cabO16 - DPF: {C470E718-6117-11D7-A1AC-0002A5269C35} (CreditClient.ControlInactif) - file://C:\Temp\CreditClient.cabO17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = fr.schneider-electric.comO17 - HKLM\Software\..\Telephony: DomainName = fr.schneider-electric.comO17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = fr.schneider-electric.comO17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 139.160.77.13 139.160.111.43O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 139.160.77.13 139.160.111.43O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dllO23 - Service: CommonTime mNotes Server (CadenzaServer) - CommonTime Limited - C:\Program Files\CommonTime\Cadenza\Cadenza.exeO23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\NavNT\DefWatch.exeO23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\System32\ibmpmsvc.exeO23 - Service: Novell Application Launcher (NALNTSERVICE) - Novell, Inc. - C:\WINDOWS\System32\NALNTSRV.EXEO23 - Service: Network Configuration Service (NetCfgSvr) - AT&T - C:\PROGRA~1\AT&TGL~1\NetCfgSv.EXEO23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\NavNTtvscan.exeO23 - Service: OracleOraHome92ClientCache - Unknown owner - C:\oracle\BIN\ONRSD.EXEO23 - Service: ReplService - Unknown owner - C:\Program Files\Trilogy\ReplServiceepl.exeO23 - Service: Novell Workstation Manager (WM) - Novell, Inc. - C:\WINDOWS\System32\wm.exe

[about blank et casino] fenetre indésirable

6 réponses

Discussions similaires

Newsletters