Voial j´ai essaye tout spybot,... il me dit a chaque fois qu´il la supprimer mais il revient a chaque foi on ma di d´utiliser hijackthis et de faire un copier colle de ce qu´on me met je fais un copie coller ici
Logfile of HijackThis v1.99.1
Scan saved at 19:15:29, on 10/05/2005
Platform: Windows XP ( WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 ( 6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Apps\ActivBoard\nhksrv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\WinTools\WToolsA.exe
C:\Program Files\Fichiers communs\WinTools\WSup.exe
C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\Apps\ActivBoard\MMKeybd.exe
C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\WINDOWS\VM_STI.EXE
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\paytime.exe
C:\WINDOWS\System32\rsmtat.exe
C:\Program Files\AutoUpdate\AutoUpdate.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\paytime.exe
C:\Apps\ActivBoard\TrayMon.exe
C:\Apps\ActivBoard\OSD.exe
C:\Program Files\CxtPls\CxtPls.exe
C:\Program Files\WebSiteViewer\125018.dlr
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Documents and Settings\TEMP\Bureau\HijackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://81.222.131.49/index.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchcentral.cc/search.php?v=4&aff=2076
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchcentral.cc/index.php?v=4&aff=2076
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://81.222.131.49/index.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://81.222.131.49/index.php
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://81.222.131.49/index.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://81.222.131.49/index.php
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://81.222.131.49/index.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer fourni par Planetis
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O1 - Hosts file is located at: C:\WINDOWS\nsdb\hosts
O1 - Hosts: 82.179.166.164 lender-search.com
O1 - Hosts: 82.179.166.165 hot-searches.com
O2 - BHO: ( no name) - {016235BE-59D4-4CEB-ADD5-E2378282A1D9} - C:\Program Files\CxtPls\cxtpls.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\apps\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: ( no name) - {2E246FAE-8420-11D9-870D-000C2917DE7F} - ( no file)
O2 - BHO: ( no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: ( no name) - {7F6828CA-9E42-462C-BC60-418C8144012C} - ( no file)
O2 - BHO: ( no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\FICHIE~1\WinTools\WToolsB.dll
O2 - BHO: WHttpHelper Class - {9896231A-C487-43A5-8369-6EC9B0A96CC0} - C:\WINDOWS\System32\WStart.dll
O2 - BHO: ( no name) - {A0269420-A638-4509-889C-8FC3CC85DA7E} - C:\WINDOWS\drexinit.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: ( no name) - {D6D8D5BF-4902-43D9-5B80-6653070A13C0} - C:\WINDOWS\System32\wrjux.dll
O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\System32\msbe.dll ( file missing)
O3 - Toolbar: & - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: UCmore XP - The Search Accelerator - {44BE0690-5429-47f0-85BB-3FFD8020233E} - C:\Program Files\TheSearchAccelerator\UCMTSAIE.dll
O3 - Toolbar: & - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [ACTIVBOARD] C:\Apps\ActivBoard\MMKeybd.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] " C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" / icon
O4 - HKLM\..\Run: [MessengerPlus3] " C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [ClickMe] C:\apps\ClickMe\ClickMe.exe
O4 - HKLM\..\Run: [TkBellExe] " C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ScanRegistry] C:\W
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE WEBSHOT II USB CAM 300K
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] " C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PayTime] C:\WINDOWS\System32\paytime.exe
O4 - HKLM\..\Run: [7s4g3me] rsmtat.exe
O4 - HKLM\..\Run: [AutoUpdater] " C:\Program Files\AutoUpdate\AutoUpdate.exe"
O4 - HKLM\..\Run: [WinTools] C:\PROGRA~1\FICHIE~1\WinTools\WToolsA.exe
O4 - HKLM\..\Run: [gcasServ] " C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\RunOnce: [WinTools] C:\PROGRA~1\FICHIE~1\WinTools\WToolsA.exe / boot
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] " C:\Program Files\Messenger\msmsgs.exe" / background
O4 - HKCU\..\Run: [MoneyAgent] " C:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [PayTime] C:\WINDOWS\System32\paytime.exe
O4 - HKCU\..\Run: [msnmsgr] " C:\Program Files\MSN Messenger\msnmsgr.exe" / background
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra ´Tools´ menuitem: Show & Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O14 - IERESET.INF: START_PAGE_URL=http://www.planetis.com/be
O15 - Trusted Zone: *.blazefind.com ( HKLM)
O15 - Trusted Zone: *.clickspring.net ( HKLM)
O15 - Trusted Zone: http://ny.contentmatch.net ( HKLM)
O15 - Trusted Zone: *.flingstone.com ( HKLM)
O15 - Trusted Zone: *.mt-download.com ( HKLM)
O15 - Trusted Zone: *.my-internet.info ( HKLM)
O15 - Trusted Zone: *.searchbarcash.com ( HKLM)
O15 - Trusted Zone: *.searchmiracle.com ( HKLM)
O15 - Trusted Zone: *.skoobidoo.com ( HKLM)
O15 - Trusted Zone: *.slotch.com ( HKLM)
O15 - Trusted Zone: *.slotchbar.com ( HKLM)
O15 - Trusted Zone: *.windupdates.com ( HKLM)
O15 - Trusted Zone: *.xxxtoolbar.com ( HKLM)
O15 - Trusted Zone: *.ysbweb.com ( HKLM)
O15 - Trusted IP range: 81.222.131.59 ( HKLM)
O16 - DPF: {14A3221B-1678-1982-A355-7263B1281987} -
ms-its:mhtml:file://C:\foo.mht!http://82.179.170.8
2/e9xr2.chm::/file.exe
O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} ( Installer Class) - http://www.ysbweb.com/ist/softwares/v4.0/ysb_regular.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} ( MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} ( MediaTicketsInstaller Control) - http://www.mt-download.com/MediaTicketsInstaller.cab?refid=2732
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} ( IWinAmpActiveX Class) - http://cdn.digitalcity.cocom/_media/dalaillama/ampx.cab
O17 -
HKLM\System\CCS\Services\Tcpip\..\{248006B6-5043-4
6A2-882D-8952954CB4D5}: NameServer = 195.238.2.21 195.238.2.22
O18 - Filter: text/html - {4F7681E5-6CAF-478D-9CB8-4CA593BEE7FB} - ( no file)
O23 - Service: Netropa NHK Server ( nhksrv) - Unknown owner - C:\Apps\ActivBoard\nhksrv.exe
O23 - Service: NVIDIA Driver Helper Service ( NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SmartLinkService ( SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
Esque quelqu´un peux m´aidez que dois je faire maintenant ?