Sujet Précédent Sujet Suivant

[contrôle HijackThis svp]

blue laelia -  
Kristopher Messages postés 3752 Statut Contributeur -
Bonjour,
Suite à des problèmes sur mon PC (Excel inactif après 2min d'ouverture) j'ai effectué les contrôles préconisés par Kristopher.

Ewido n'a rien trouvé.

Bitdefender a trouvé des virus sur des mails anciens qu'il a supprimés ou mis à jour (sauf un "disinfection failed), des fichiers System Volume Information\_restore{...} qu'il a supprimés, et un fichier Windows\backup\TB040207.DAT => (Embedded EXE g) qu'il a supprimé mais n'a pas pu mettre à jour

Je ne pige rien au rapport d'HijackThis !

Voici les rapports. Pourriez-vous m'aider, SVP ? (je ne suis pas trés douée !) merci d'avance :)

Rapport Ewido :
ewido anti-malware - Rapport de scan
---------------------------------------------------------

+ Créé le: 13:13:11, 09/06/2006
+ Somme de contrôle: 5C4A0DE4

+ Résultats du scan:

Pas de fichiers infectés trouvés!

::Fin du rapport

Rapport HijackThis :
Logfile of HijackThis v1.99.1
Scan saved at 17:33:35, on 09/06/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\S3tray2.exe
C:\WINDOWS\system32\S3hotkey.exe
C:\Program Files\Microsoft Works\WksSb.exe
C:\PROGRA~1\EZButton\CP51NBtn.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\HPJETDSC.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\SmartDisk\FlashPath\sdstat.exe
C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\OLITEC\PC Card 802.11g OLITEC \Installer\Winxp\olitec.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\Program Files\Wacom\TabUserW.exe
C:\PROGRA~1\EZButton\CPHKCnt.EXE
C:\PROGRA~1\EZButton\DtcEMail.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\Tablet.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://r.wanadoo.fr/r/WGrecherche
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.orange.fr/portail
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.freesurf.fr:3128
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O4 - HKLM\..\Run: [S3TRAY2] S3tray2.exe
O4 - HKLM\..\Run: [S3hotkey] S3hotkey.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [CP51NBtn] C:\PROGRA~1\EZButton\CP51NBtn.EXE
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsoemon.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKCU\..\Run: [HP JetDiscovery] HPJETDSC.EXE
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsoemon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - Startup: La Solution Plus Ciel.lnk = C:\CIEL\Starter.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Démarrage d'Office.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: FlashPath Monitor.lnk = C:\Program Files\SmartDisk\FlashPath\sdstat.exe
O4 - Global Startup: Image Transfer.lnk = ?
O4 - Global Startup: Microsoft Recherche accélérée.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: olitec.lnk = ?
O4 - Global Startup: Rappels du Calendrier Microsoft Works.lnk = ?
O4 - Global Startup: TabUserW.lnk = C:\Program Files\Wacom\TabUserW.exe
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZNxmk570YYFR
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.orange.fr/portail
O16 - DPF: {09C21411-B9A2-4DE6-8416-4E3B58577BE0} (France Telecom MDM ActiveX Control) - http://minitelweb.minitel.com/imin_data/ocx/MDM.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\System32\Tablet.exe

A bientôt j'espère :) merci d'avance !
A voir également:

2 réponses

Réponse 1 / 2
Kristopher Messages postés 3752 Statut Contributeur 106
 
Bonsoir ;)

C'est une bonne idée d'avoir procédé à la désinfection préliminaire comme suggeré sur ce lien :
virus methode preliminaire de desinfection version fr

Malheuresement, il aurait fallu poster le rapport BitDefender.
C'est bien beau d'avoir posté celui de Ewido, mais il nous avance en rien puisque aucun infection n'as été trouvées :)

~~ Fais ceci dans l'ordre ~~

1/ Si tu n'en n'as pas, télécharge absolument un firewall.
Par exemple, Sunbelt Kerio Personal Firewall : https://www.01net.com/telecharger/windows/Securite/firewall/fiches/22418.html
Tutorial là : https://forums.cnetfrance.fr

Le rapport montre la présence de nombreux malwares donc :

2/ Télécharge, mets à jour et scanne ton PC avec a² free : https://www.01net.com/telecharger/windows/Securite/antivirus-antitrojan/fiches/26618.html

3/ Télécharge, mets à jour et scanne ton PC avec Windows Defender :
https://www.01net.com/telecharger/windows/Securite/anti-spyware/fiches/31195.html

4/ Télécharge et nettoie ton PC avec ces deux logiciels :

CCLEANER https://www.01net.com/telecharger/windows/Utilitaire/nettoyeurs_et_installeurs/fiches/32599.html

Utilisation : Dans l'onglet "Nettoyeur" cliquez sur "Analyse". Une fois l'analyse terminée, cliquez sur "Lancer le Nettoyage".
Ensuite, dans l'onglet "Erreurs" cliquez sur "Chercher des erreurs" puis, avant de cliquer sur "Réparer les erreurs sélectionnées" effectuez une sauvegarde de votre registre (comme proposé).

CleanUp40
http://pageperso.aol.fr/Balltrap34/CleanUp40.exe
Démo d’utilisation :
http://pageperso.aol.fr/balltrap34/democleanup.htm

5/ Reposte un nouveau log HijackThis stp.

Courage, Kristopher
0
Blue Laelia
 
Hello Kristopher,

Tout d'abord un grand merci pour ta réponse rapide :)

J'ai oublié de te dire que j'ai :
AVG comme antivirus (mis à jour)
Pare-feu Windows

Je suppose que je devrai désinstaller Ewido et Bitdefender après ces manips ?

J'avais fait un scan ce matin avec AVG qui n'a rien trouvé de plus que ce qu'il avait mis en quarantaine (depuis longtemps et je ne l'avais pas vidée...). J'ai aussi passé Spybot qui n'a rien trouvé.

Enfin, voila le rapport de Bitdefender :
BitDefender Online Scanner


Scan report generated at: Fri, Jun 09, 2006 - 16:29:23



Scan path: A:\;C:\;D:\;





Statistics
Time 02:56:14
Files 367260
Folders 6344
Boot Sectors 2
Archives 26835
Packed Files 33658


Results
Identified Viruses 5
Infected Files 23
Suspect Files 0
Warnings 0
Disinfected 0
Deleted Files 23


Engines Info
Virus Definitions 387255
Engine build AVCORE v1.0 (build 2310) (i386) (Apr 17 2006 16:24:38)
Scan plugins 13
Archive plugins 39
Unpack plugins 5
E-mail plugins 6
System plugins 1


Scan Settings
First Action Disinfect
Second Action Delete
Heuristics Yes
Enable Warnings Yes
Scanned Extensions *;
Exclude Extensions
Scan Emails Yes
Scan Archives Yes
Scan Packed Yes
Scan Files Yes
Scan Boot Yes



Scanned File Status
C:\$VAULT$.AVG\00000001.FIL Infected with: Win32.Netsky.P@mm
C:\$VAULT$.AVG\00000001.FIL Deleted
C:\$VAULT$.AVG\00000001.FIL.OLD Infected with: Win32.Netsky.P@mm
C:\$VAULT$.AVG\00000001.FIL.OLD Deleted
C:\$VAULT$.AVG\00000002.FIL Infected with: Win32.Netsky.P@mm
C:\$VAULT$.AVG\00000002.FIL Deleted
C:\$VAULT$.AVG\00000002.FIL.OLD Infected with: Win32.Netsky.P@mm
C:\$VAULT$.AVG\00000002.FIL.OLD Deleted
C:\$VAULT$.AVG\00000003.FIL Infected with: Win32.Netsky.P@mm
C:\$VAULT$.AVG\00000003.FIL Deleted
C:\$VAULT$.AVG\00000003.FIL.OLD Infected with: Win32.Netsky.P@mm
C:\$VAULT$.AVG\00000003.FIL.OLD Deleted
C:\$VAULT$.AVG\00000004.FIL Infected with: Win32.Netsky.P@mm
C:\$VAULT$.AVG\00000004.FIL Deleted
C:\$VAULT$.AVG\00000004.FIL.OLD Infected with: Win32.Netsky.P@mm
C:\$VAULT$.AVG\00000004.FIL.OLD Deleted
C:\$VAULT$.AVG\00000005.FIL Infected with: Win32.Netsky.P@mm
C:\$VAULT$.AVG\00000005.FIL Deleted
C:\$VAULT$.AVG\00000005.FIL.OLD Infected with: Win32.Netsky.P@mm
C:\$VAULT$.AVG\00000005.FIL.OLD Deleted
C:\Documents and Settings\KAREN\Application Data\Thunderbird\Profiles\e33h24l6.default\Mail\Local Folders\Éléments envoyés=>(message 45)=>[Subject: Fw: Undelivered Mail Returned to Sende][Date: Mon, 26 Apr 2004 20:06:16 +0200]=>(MIME part)=>Here is it.eml=>[Subject: Here is it][Date: Sun, 25 Apr 2004 20:21:19 +0200]=>(MIME part)=>regards.zip Infected with: Win32.Netsky.C@mm.Damaged
C:\Documents and Settings\KAREN\Application Data\Thunderbird\Profiles\e33h24l6.default\Mail\Local Folders\Éléments envoyés=>(message 45)=>[Subject: Fw: Undelivered Mail Returned to Sende][Date: Mon, 26 Apr 2004 20:06:16 +0200]=>(MIME part)=>Here is it.eml=>[Subject: Here is it][Date: Sun, 25 Apr 2004 20:21:19 +0200]=>(MIME part)=>regards.zip Disinfection failed
C:\Documents and Settings\KAREN\Application Data\Thunderbird\Profiles\e33h24l6.default\Mail\Local Folders\Éléments envoyés=>(message 45)=>[Subject: Fw: Undelivered Mail Returned to Sende][Date: Mon, 26 Apr 2004 20:06:16 +0200]=>(MIME part)=>Here is it.eml=>[Subject: Here is it][Date: Sun, 25 Apr 2004 20:21:19 +0200]=>(MIME part)=>regards.zip Deleted
C:\Documents and Settings\KAREN\Application Data\Thunderbird\Profiles\e33h24l6.default\Mail\Local Folders\Éléments envoyés=>(message 45)=>[Subject: Fw: Undelivered Mail Returned to Sende][Date: Mon, 26 Apr 2004 20:06:16 +0200]=>(MIME part)=>Here is it.eml=>[Subject: Here is it][Date: Sun, 25 Apr 2004 20:21:19 +0200]=>(MIME part) Updated
C:\Documents and Settings\KAREN\Application Data\Thunderbird\Profiles\e33h24l6.default\Mail\Local Folders\Éléments envoyés=>(message 45)=>[Subject: Fw: Undelivered Mail Returned to Sende][Date: Mon, 26 Apr 2004 20:06:16 +0200]=>(MIME part)=>Here is it.eml Updated
C:\Documents and Settings\KAREN\Application Data\Thunderbird\Profiles\e33h24l6.default\Mail\Local Folders\Éléments envoyés=>(message 45)=>[Subject: Fw: Undelivered Mail Returned to Sende][Date: Mon, 26 Apr 2004 20:06:16 +0200]=>(MIME part) Updated
C:\Documents and Settings\KAREN\Application Data\Thunderbird\Profiles\e33h24l6.default\Mail\Local Folders\Éléments envoyés=>(message 45) Updated
C:\Documents and Settings\KAREN\Application Data\Thunderbird\Profiles\e33h24l6.default\Mail\Local Folders\Éléments envoyés Updated
C:\Documents and Settings\KAREN\Application Data\Thunderbird\Profiles\e33h24l6.default\Mail\Local Folders\Éléments envoyés=>(message 53)=>[Subject: Fw: Old times][Date: Tue, 22 Jun 2004 20:53:48 +0200]=>(MIME part)=>old_photos.zip Infected with: Win32.Netsky.P@mm
C:\Documents and Settings\KAREN\Application Data\Thunderbird\Profiles\e33h24l6.default\Mail\Local Folders\Éléments envoyés=>(message 53)=>[Subject: Fw: Old times][Date: Tue, 22 Jun 2004 20:53:48 +0200]=>(MIME part)=>old_photos.zip Deleted
C:\Documents and Settings\KAREN\Application Data\Thunderbird\Profiles\e33h24l6.default\Mail\Local Folders\Éléments envoyés=>(message 53)=>[Subject: Fw: Old times][Date: Tue, 22 Jun 2004 20:53:48 +0200]=>(MIME part) Updated
C:\Documents and Settings\KAREN\Application Data\Thunderbird\Profiles\e33h24l6.default\Mail\Local Folders\Éléments envoyés=>(message 53) Updated
C:\Documents and Settings\KAREN\Application Data\Thunderbird\Profiles\e33h24l6.default\Mail\Local Folders\Éléments envoyés Updated
C:\Documents and Settings\KAREN\Application Data\Thunderbird\Profiles\e33h24l6.default\Mail\Local Folders\Éléments envoyés=>(message 59)=>[Subject: Fw: Hi][Date: Sat, 30 Oct 2004 09:34:38 +0200]=>(MIME part)=>Alive_condom.exe Infected with: Win32.Bagle.Z@mm
C:\Documents and Settings\KAREN\Application Data\Thunderbird\Profiles\e33h24l6.default\Mail\Local Folders\Éléments envoyés=>(message 59)=>[Subject: Fw: Hi][Date: Sat, 30 Oct 2004 09:34:38 +0200]=>(MIME part)=>Alive_condom.exe Disinfection failed
C:\Documents and Settings\KAREN\Application Data\Thunderbird\Profiles\e33h24l6.default\Mail\Local Folders\Éléments envoyés=>(message 59)=>[Subject: Fw: Hi][Date: Sat, 30 Oct 2004 09:34:38 +0200]=>(MIME part)=>Alive_condom.exe Deleted
C:\Documents and Settings\KAREN\Application Data\Thunderbird\Profiles\e33h24l6.default\Mail\Local Folders\Éléments envoyés=>(message 59)=>[Subject: Fw: Hi][Date: Sat, 30 Oct 2004 09:34:38 +0200]=>(MIME part) Updated
C:\Documents and Settings\KAREN\Application Data\Thunderbird\Profiles\e33h24l6.default\Mail\Local Folders\Éléments envoyés=>(message 59) Updated
C:\Documents and Settings\KAREN\Application Data\Thunderbird\Profiles\e33h24l6.default\Mail\Local Folders\Éléments envoyés Updated
C:\Documents and Settings\KAREN\Local Settings\Application Data\Identities\{DA82C34A-B11D-42C6-9AB2-23A51BB1FC6F}\Microsoft\Outlook Express\Boîte de réception.dbx=>(message 169)=>(base64) Infected with: Win32.Bagle.W@mm.damaged
C:\Documents and Settings\KAREN\Local Settings\Application Data\Identities\{DA82C34A-B11D-42C6-9AB2-23A51BB1FC6F}\Microsoft\Outlook Express\Boîte de réception.dbx=>(message 169)=>(base64) Deleted
C:\Documents and Settings\KAREN\Local Settings\Application Data\Identities\{DA82C34A-B11D-42C6-9AB2-23A51BB1FC6F}\Microsoft\Outlook Express\Boîte de réception.dbx=>(message 169) Updated
C:\Documents and Settings\KAREN\Local Settings\Application Data\Identities\{DA82C34A-B11D-42C6-9AB2-23A51BB1FC6F}\Microsoft\Outlook Express\Boîte de réception.dbx Update failed
C:\Documents and Settings\KAREN\Local Settings\Application Data\Identities\{EC891D9A-E80A-4065-9A23-2F0FC71DF982}\Microsoft\Outlook Express\Éléments envoyés.dbx=>(message 7)=>[Subject: Fw: Hi][Date: Sat, 30 Oct 2004 09:34:38 +0200]=>(MIME part)=>Alive_condom.exe Infected with: Win32.Bagle.Z@mm
C:\Documents and Settings\KAREN\Local Settings\Application Data\Identities\{EC891D9A-E80A-4065-9A23-2F0FC71DF982}\Microsoft\Outlook Express\Éléments envoyés.dbx=>(message 7)=>[Subject: Fw: Hi][Date: Sat, 30 Oct 2004 09:34:38 +0200]=>(MIME part)=>Alive_condom.exe Disinfection failed
C:\Documents and Settings\KAREN\Local Settings\Application Data\Identities\{EC891D9A-E80A-4065-9A23-2F0FC71DF982}\Microsoft\Outlook Express\Éléments envoyés.dbx=>(message 7)=>[Subject: Fw: Hi][Date: Sat, 30 Oct 2004 09:34:38 +0200]=>(MIME part)=>Alive_condom.exe Deleted
C:\Documents and Settings\KAREN\Local Settings\Application Data\Identities\{EC891D9A-E80A-4065-9A23-2F0FC71DF982}\Microsoft\Outlook Express\Éléments envoyés.dbx=>(message 7)=>[Subject: Fw: Hi][Date: Sat, 30 Oct 2004 09:34:38 +0200]=>(MIME part) Updated
C:\Documents and Settings\KAREN\Local Settings\Application Data\Identities\{EC891D9A-E80A-4065-9A23-2F0FC71DF982}\Microsoft\Outlook Express\Éléments envoyés.dbx=>(message 7) Updated
C:\Documents and Settings\KAREN\Local Settings\Application Data\Identities\{EC891D9A-E80A-4065-9A23-2F0FC71DF982}\Microsoft\Outlook Express\Éléments envoyés.dbx Update failed
C:\Documents and Settings\KAREN\Local Settings\Application Data\Identities\{EC891D9A-E80A-4065-9A23-2F0FC71DF982}\Microsoft\Outlook Express\Éléments envoyés.dbx=>(message 8)=>[Subject: Fw: Old times][Date: Tue, 22 Jun 2004 20:53:48 +0200]=>(MIME part)=>old_photos.zip Infected with: Win32.Netsky.P@mm
C:\Documents and Settings\KAREN\Local Settings\Application Data\Identities\{EC891D9A-E80A-4065-9A23-2F0FC71DF982}\Microsoft\Outlook Express\Éléments envoyés.dbx=>(message 8)=>[Subject: Fw: Old times][Date: Tue, 22 Jun 2004 20:53:48 +0200]=>(MIME part)=>old_photos.zip Deleted
C:\Documents and Settings\KAREN\Local Settings\Application Data\Identities\{EC891D9A-E80A-4065-9A23-2F0FC71DF982}\Microsoft\Outlook Express\Éléments envoyés.dbx=>(message 8)=>[Subject: Fw: Old times][Date: Tue, 22 Jun 2004 20:53:48 +0200]=>(MIME part) Updated
C:\Documents and Settings\KAREN\Local Settings\Application Data\Identities\{EC891D9A-E80A-4065-9A23-2F0FC71DF982}\Microsoft\Outlook Express\Éléments envoyés.dbx=>(message 8) Updated
C:\Documents and Settings\KAREN\Local Settings\Application Data\Identities\{EC891D9A-E80A-4065-9A23-2F0FC71DF982}\Microsoft\Outlook Express\Éléments envoyés.dbx Update failed
C:\Documents and Settings\KAREN\Local Settings\Application Data\Identities\{EC891D9A-E80A-4065-9A23-2F0FC71DF982}\Microsoft\Outlook Express\Éléments envoyés.dbx=>(message 9)=>[Subject: Fw: Undelivered Mail Returned to Sende][Date: Mon, 26 Apr 2004 20:06:16 +0200]=>(MIME part)=>Here is it.eml=>[Subject: Here is it][Date: Sun, 25 Apr 2004 20:21:19 +0200]=>(MIME part)=>regards.zip Infected with: Win32.Netsky.C@mm.Damaged
C:\Documents and Settings\KAREN\Local Settings\Application Data\Identities\{EC891D9A-E80A-4065-9A23-2F0FC71DF982}\Microsoft\Outlook Express\Éléments envoyés.dbx=>(message 9)=>[Subject: Fw: Undelivered Mail Returned to Sende][Date: Mon, 26 Apr 2004 20:06:16 +0200]=>(MIME part)=>Here is it.eml=>[Subject: Here is it][Date: Sun, 25 Apr 2004 20:21:19 +0200]=>(MIME part)=>regards.zip Disinfection failed
C:\Documents and Settings\KAREN\Local Settings\Application Data\Identities\{EC891D9A-E80A-4065-9A23-2F0FC71DF982}\Microsoft\Outlook Express\Éléments envoyés.dbx=>(message 9)=>[Subject: Fw: Undelivered Mail Returned to Sende][Date: Mon, 26 Apr 2004 20:06:16 +0200]=>(MIME part)=>Here is it.eml=>[Subject: Here is it][Date: Sun, 25 Apr 2004 20:21:19 +0200]=>(MIME part)=>regards.zip Deleted
C:\Documents and Settings\KAREN\Local Settings\Application Data\Identities\{EC891D9A-E80A-4065-9A23-2F0FC71DF982}\Microsoft\Outlook Express\Éléments envoyés.dbx=>(message 9)=>[Subject: Fw: Undelivered Mail Returned to Sende][Date: Mon, 26 Apr 2004 20:06:16 +0200]=>(MIME part)=>Here is it.eml=>[Subject: Here is it][Date: Sun, 25 Apr 2004 20:21:19 +0200]=>(MIME part) Updated
C:\Documents and Settings\KAREN\Local Settings\Application Data\Identities\{EC891D9A-E80A-4065-9A23-2F0FC71DF982}\Microsoft\Outlook Express\Éléments envoyés.dbx=>(message 9)=>[Subject: Fw: Undelivered Mail Returned to Sende][Date: Mon, 26 Apr 2004 20:06:16 +0200]=>(MIME part)=>Here is it.eml Updated
C:\Documents and Settings\KAREN\Local Settings\Application Data\Identities\{EC891D9A-E80A-4065-9A23-2F0FC71DF982}\Microsoft\Outlook Express\Éléments envoyés.dbx=>(message 9)=>[Subject: Fw: Undelivered Mail Returned to Sende][Date: Mon, 26 Apr 2004 20:06:16 +0200]=>(MIME part) Updated
C:\Documents and Settings\KAREN\Local Settings\Application Data\Identities\{EC891D9A-E80A-4065-9A23-2F0FC71DF982}\Microsoft\Outlook Express\Éléments envoyés.dbx=>(message 9) Updated
C:\Documents and Settings\KAREN\Local Settings\Application Data\Identities\{EC891D9A-E80A-4065-9A23-2F0FC71DF982}\Microsoft\Outlook Express\Éléments envoyés.dbx Update failed
C:\System Volume Information\_restore{F6B23C6E-2658-44FD-A3D0-D86F9F14D84A}\RP519\A0155698.OLD Infected with: Win32.Netsky.P@mm
C:\System Volume Information\_restore{F6B23C6E-2658-44FD-A3D0-D86F9F14D84A}\RP519\A0155698.OLD Deleted
C:\System Volume Information\_restore{F6B23C6E-2658-44FD-A3D0-D86F9F14D84A}\RP519\A0155699.OLD Infected with: Win32.Netsky.P@mm
C:\System Volume Information\_restore{F6B23C6E-2658-44FD-A3D0-D86F9F14D84A}\RP519\A0155699.OLD Deleted
C:\System Volume Information\_restore{F6B23C6E-2658-44FD-A3D0-D86F9F14D84A}\RP519\A0155700.OLD Infected with: Win32.Netsky.P@mm
C:\System Volume Information\_restore{F6B23C6E-2658-44FD-A3D0-D86F9F14D84A}\RP519\A0155700.OLD Deleted
C:\System Volume Information\_restore{F6B23C6E-2658-44FD-A3D0-D86F9F14D84A}\RP519\A0155701.OLD Infected with: Win32.Netsky.P@mm
C:\System Volume Information\_restore{F6B23C6E-2658-44FD-A3D0-D86F9F14D84A}\RP519\A0155701.OLD Deleted
C:\System Volume Information\_restore{F6B23C6E-2658-44FD-A3D0-D86F9F14D84A}\RP519\A0155702.OLD Infected with: Win32.Netsky.P@mm
C:\System Volume Information\_restore{F6B23C6E-2658-44FD-A3D0-D86F9F14D84A}\RP519\A0155702.OLD Deleted
C:\WINDOWS\backup\TB040207.DAT=>(Embedded EXE g) Infected with: Win32.Swen.A@mm
C:\WINDOWS\backup\TB040207.DAT=>(Embedded EXE g) Deleted
C:\WINDOWS\backup\TB040207.DAT Update failed

Je me mets au boulot pour faire ce que tu m'as conseillé.

Bonne soirée à toi et encore un big merci pour ta gentillesse et ton aide :)
0
Réponse 2 / 2
Kristopher Messages postés 3752 Statut Contributeur 106
 
Re Blue Laelia ;)

Apparemment, les liens ont changés pour certains logiciels.

Voici les bons à coup sûr :

a² free :
https://www.01net.com/telecharger/windows/Securite/antivirus-antitrojan/fiches/26618.html

Windows Defender :
https://www.01net.com/telecharger/windows/Securite/anti-spyware/fiches/31195.html

On attend les rapports.

Accroche Toi ;)

a+
0

Discussions similaires

passer outre le contrôle parental
Jeuls21 -
giselledurand -

12 réponses
Contrôle d’accès Bbox
Granny -
brupala -

1 réponse
touche CTRL Bloquée
biilyboy85 -
DameVio -

32 réponses
Probleme de touche Ctrl
Jbeuh -
Philou -

110 réponses