[OK]spyware

[Obi Wan Kenobi]

salut

lorsque je vais sur certaine page d internet j ai ces trois fentre qui s affiche me disant qu il y a un spyware ds mon ordi.
J ai dl Flowprotextoc2005 il m en a trouver pas mal, je les ai tous virer. mais sa m affiche toujours c est fenetre.
Je tien a preciser aussi que sa redirectionne mon navigateur sur la premiere fentre en plus de m en afficher deux autre.

<IMG SRC="http://realss2.free.fr/fentre1.jpg" BORDER="0">

<IMG SRC="http://realss2.free.fr/fentre2.jpg" BORDER="0">

<IMG SRC="http://realss2.free.fr/fenetre3.jpg" BORDER="0">


que dois je faire?
Je voulais formater mon disque (seulement celui ou il y a le systeme) est ce suffsant?
y a t il plus simple?



merci

[alain51]

Salut,

Essaye cela :

<TABLE BORDER=0 ALIGN=CENTER WIDTH=85%><TR><TD><font size=-1><b>Citation :</b></font></TD></TR></TABLE><TABLE BORDER=1 CELLPADDING=10 BORDERCOLOR=#FF0000 ALIGN=CENTER WIDTH=85%><TR BGCOLOR=#F3F2F4><TD><FONT SIZE=-1> <a href="reply.php?topic=27736&forum=41&post=138524&quote=1" target="_blank">reply.php?topic=27736&forum=41&post=138524&quote=1</a>
Le 10 déc 2004 à  23:18, Alain51 a écrit :

Salut,

Essaye de faire un scan avec hijackthis ;
tu peux le télécharger ici :
<a href="http://www.01net.com/telecharger/window ... 61.html?fy" target="_blank">http://www.01net.com/telecharger/window ... html?fy</a>

Quand le scan est fait, tu cliques sur save log, tu copies le résultat
et tu le colles ici.

</FONT></TD></TR></TABLE>

[Obi Wan Kenobi]

<TABLE BORDER=0 ALIGN=CENTER WIDTH=85%><TR><TD><font size=-1><b>Citation :</b></font></TD></TR></TABLE><TABLE BORDER=1 CELLPADDING=10 BORDERCOLOR=#FF0000 ALIGN=CENTER WIDTH=85%><TR BGCOLOR=#F3F2F4><TD><FONT SIZE=-1>Logfile of HijackThis v1.98.2
Scan saved at 19:28:41, on 14/12/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSSystem32Ati2evxx.exe
C:Program FilesDjinn Numéris Itoovstartx.exe
C:Program FilesDjinn Numéris Itoogisdnlog.exe
C:Program FilesAnalog DevicesSoundMAXSMAgent.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSExplorer.EXE
C:Program FilesATI TechnologiesATI Control Panelatiptaxx.exe
C:Program FilesDjinn Numéris Itoogsyno.exe
C:PROGRA~1WanadooCnxMon.exe
C:PROGRA~1WanadooTaskbarIcon.exe
C:Program FilesASUSProbeAsusProb.exe
C:Program FilesJavaj2re1.4.2_04binjusched.exe
C:WINDOWSSystem32ezSP_Px.exe
C:Program FilesWinampwinampa.exe
C:WINDOWSSystem32zhtyyxmv.exe
C:Program FilesWindows AdControlWinAdCtl.exe
C:WINDOWSjushed32.exe
C:WINDOWSSystem32msrexe.exe
C:Program FilesWindows AdControlWinAdAlt.exe
C:Program FilesMessengermsmsgs.exe
C:Program FilesMSN Messengermsnmsgr.exe
C:PROGRA~1INTERN~1iexplore.exe
C:Program FilesWanadooEspaceWanadoo.exe
C:Program FilesWanadooComComp.exe
C:Program FilesWanadooWatch.exe
C:Program FilesInternet Exploreriexplore.exe
C:Documents and SettingsmathieuMes documentshjtHijackThis.exe

R1 - HKCUSoftwareMicrosoftInternet Explorer,SearchURL = <a href="http://www.oborot.com/search.htm" target="_blank">http://www.oborot.com/search.htm</a>
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = <a href="http://www.searchweb.cc/search.html" target="_blank">http://www.searchweb.cc/search.html</a>
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = about:NavigationFailure
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = about:NavigationFailure
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,SearchURL = <a href="http://www.searchweb.cc/search.html" target="_blank">http://www.searchweb.cc/search.html</a>
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = <a href="http://www.searchweb.cc/search.html" target="_blank">http://www.searchweb.cc/search.html</a>
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Bar = about:NavigationFailure
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = about:NavigationFailure
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,SearchURL = <a href="http://www.searchweb.cc/search.html" target="_blank">http://www.searchweb.cc/search.html</a>
R1 - HKCUSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = about:NavigationFailure
R1 - HKCUSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch = <a href="http://www.searchweb.cc/" target="_blank">http://www.searchweb.cc/</a>
R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = about:NavigationFailure
R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch = <a href="http://www.searchweb.cc/" target="_blank">http://www.searchweb.cc/</a>
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,HomeOldSP = about:blank
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,HomeOldSP = about:blank
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Window Title = Wanadoo
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:PROGRA~1WanadooSEARCH~1.DLL
O2 - BHO: LocalNRDObj Class - {00320615-B6C2-40A6-8F99-F1C52D674FAD} - C:WINDOWSlocalNRD.dll
O2 - BHO: (no name) - {83DE62E0-5805-11D8-9B25-00E04C60FAF2} - C:WINDOWS2_0_1browserhelper2.dll
O2 - BHO: (no name) - {FF1B1264-E47E-43CC-BAF2-3B121BFA0B61} - C:WINDOWSSystem32cemnf.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:WINDOWSSystem32msdxm.ocx
O3 - Toolbar: Barre d'outils MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:Program FilesMSN Toolbar

[alain51]

<B>La désactivation HTML de ce message n'a pas fonctionné.
<font size="+1"><U>Ne cliquez pas sur les liens</U></font>, ou vous risquez d'avoir le même problème qu'Obi Wan Kenobi</B>

Salut,

Tu fais ctrl+alt+sup et tu arrêtes les tà¢ches suivantes:
WinAdCtl.exe
jushed32.exe
msrexe.exe
WinAdAlt.exe

et tu supprimes les .exe correspondants:
C:Program FilesWindows AdControlWinAdCtl.exe
C:WINDOWS jushed32.exe
C:WINDOWSSystem32msrexe.exe
C:Program FilesWindows AdControlWinAdAlt.exe

Tu refais un scan et tu effaces cela :
(tu cliques 2 fois sur toutes les lignes et tu cliques sur fix checked)

R1 - HKCUSoftwareMicrosoftInternet Explorer,SearchURL = <a href="http://www.oborot.com/search.htm" target="_blank">http://www.oborot.com/search.htm</a>
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = <a href="http://www.searchweb.cc/search.html" target="_blank">http://www.searchweb.cc/search.html</a>
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = about:NavigationFailure
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = about:NavigationFailure
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,SearchURL = <a href="http://www.searchweb.cc/search.html" target="_blank">http://www.searchweb.cc/search.html</a>
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = <a href="http://www.searchweb.cc/search.html" target="_blank">http://www.searchweb.cc/search.html</a>
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Bar = about:NavigationFailure
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = about:NavigationFailure
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,SearchURL = <a href="http://www.searchweb.cc/search.html" target="_blank">http://www.searchweb.cc/search.html</a>
R1 - HKCUSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = about:NavigationFailure
R1 - HKCUSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch = <a href="http://www.searchweb.cc/" target="_blank">http://www.searchweb.cc/</a>
R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = about:NavigationFailure
R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch = <a href="http://www.searchweb.cc/" target="_blank">http://www.searchweb.cc/</a>
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,HomeOldSP = about:blank
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,HomeOldSP = about:blank

O2 - BHO: LocalNRDObj Class - {00320615-B6C2-40A6-8F99-F1C52D674FAD} - C:WINDOWSlocalNRD.dll
O2 - BHO: (no name) - {83DE62E0-5805-11D8-9B25-00E04C60FAF2} - C:WINDOWS2_0_1browserhelper2.dll

O4 - HKLM..Run: [conscorr] C:WINDOWSconscorr.exe
O4 - HKLM..Run: [Windows AdControl] C:Program FilesWindows AdControlWinAdCtl.exe

O4 - HKLM..Run: [System Service] C:WINDOWSSystem32msrexe.exe

O4 - Global Startup: FlowProtector 2005.lnk = C:Program FilesCheckFlowFlowProtectorFlowProtector2005.exe

O8 - Extra context menu item: Web Rebates - <a href="file://C:Program" target="_blank">file://C:Program</a> FilesWeb_RebatesSy1150Tp1150scri1150a.htm

O13 - DefaultPrefix: <a href="http://www.oborot.com/c/c.pl?url=" target="_blank">http://www.oborot.com/c/c.pl?url=</a>

O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - <a href="http://public.windupdates.com/get_file. ... 0da17fcae7" target="_blank">http://public.windupdates.com/get_file. ... 17fcae7</a> 611e715c6b41c00fdb00745b8556a46ed40d87cef5a7ce39806754dbb1306a919f953f0a86874d30 24e6284b547291474:55c01b931c360e9d8cb0c2193bef45c2

Si tu ne connais pas les sites dans les lignes ci-dessous, tu supprimes aussi :

O16 - DPF: {15320607-1001-1831-1000-118599957123} - ms-its:mhtml:file://C:path.mht!http://64.200.26.76/d1/arctaa.chm::/painter.exe

O16 - DPF: {3AEA6239-7D97-4B70-A342-A824B55E5A5B} (Adam Class) - <a href="http://htmldialer.parisvoyeur.com/CABSPOLY/cd/1" target="_blank">http://htmldialer.parisvoyeur.com/CABSP ... fr/Eve.cab

O16 - DPF: {83252F41-71B7-492E-8B2E-A68AA3E301E7} (Ulysse Class) - <a href="http://htmldialer.parisvoyeur.com/CABSPOLY/cd/1" target="_blank">http://htmldialer.parisvoyeur.com/CABSP ... nelope.cab

O16 - DPF: {FD40EC41-D860-4579-8BA4-52671A45C71C} (AxHtChat Class) - <a href="http://images.goa.com/v3/InstallGoaIT/ChatAx/V4" target="_blank">http://images.goa.com/v3/InstallGoaIT/C ... axchat.cab

O17 - HKLMSystemCCSServicesTcpip..{CE3A4DF4-721D-4CA0-AEFA-1FFA991E58A1}: NameServer = 80.10.246.5 80.10.246.136

Ce qui fait un total de 29 spywares !

Tu refais un scan pour voir si tout est bien parti.

Tu peux aussi supprimer ces entrées inutiles :
Barre d'outils d'Internet Explorer
O3 - Toolbar: (no name) - {82315A18-6CFB-44a7-BDFD-90E36537C252} - (no file)
Boutons additionnels de la barre d'outils principale d'IE ou éléments additionnels du menu 'Outils' d'IE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:WINDOWSwebrelated.htm (file missing
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:WINDOWSwebrelated.htm (file missing)
O9 - Extra button: SEARCH - {FE5A1910-F121-11d2-BE9E-01C04A7936B1} - <a href="http://www.oborot.com/find.htm" target="_blank">http://www.oborot.com/find.htm</a> (file missing)
O9 - Extra button: ENTERTAINMENT - {FE5A1910-F121-11d2-BE9E-01C04A7936B2} - <a href="http://www.oborot.com/av.htm" target="_blank">http://www.oborot.com/av.htm</a> (file missing)
O9 - Extra button: PILLS - {FE5A1910-F121-11d2-BE9E-01C04A7936B3} - <a href="http://www.oborot.com/med.htm" target="_blank">http://www.oborot.com/med.htm</a> (file missing)
O9 - Extra button: SECURITY - {FE5A1910-F121-11d2-BE9E-01C04A7936B4} - <a href="http://www.oborot.com/check.htm" target="_blank">http://www.oborot.com/check.htm</a> (file missing)
O9 - Extra button: SEARCH - {FE5A1910-F121-11d2-BE9E-01C04A7936B5} - <a href="http://www.oborot.com" target="_blank">http://www.oborot.com</a> (file missing)
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - <a href="http://www.wanadoo.fr" target="_blank">http://www.wanadoo.fr</a> (file missing) (HKCU)

[Obi Wan Kenobi]

ah ouias c est bon j ai plus rien <IMG SRC="/images/smiles/teeth_smile46.gif">

merci