Cheval troie Win32:BHO-KD [Trj]

Bonjour, que je dise pas de conneries:
moi aussi j'ai avast, et normalement, il te propose plusieurs solutions:mettre en quarantaine, supprimer, ne rien faire...
La connerie, c'est que je sait pas si quand on lui demande de supprimmer, il s'attaque qu'au virus(ou trojan) ou au fichier...
Pour ma part, je met toujours "mettre en quarantaine".

Salut,

SDFix :

Télécharger sur le bureau :
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

= Double-clic SDFix.
= Clic Install

= Redémarrer en mode Sans Échec (le démarrage peut prendre plusieurs minutes).
Attention, pas d’accès à internet dans ce mode. Enregistrer ou imprimer les consignes.

Pour démarrer en mode sans échec :

1/ -Démarrez Windows, ou s’il s’exécute, fermez Windows puis éteignez l'ordinateur.
2/ -Redémarrez l’ordinateur.
3/ -Au début du chargement du BIOS (mais pas trop tôt), commencez à appuyer sur la touche F8 de votre clavier plusieurs fois de suite. Procédez ainsi jusqu'à ce que le menu des options avancées de Windows apparaissent.
4/ -En utilisant les flèches de votre clavier, sélectionnez "Mode sans échec" dans le menu puis appuyez sur Entrée.

Une fois sous windows :

------
= Double-clic SDFix.
= Clic Install
= Double-clic sur le nouveau dossier SDFix qui est dans C:\
= Double-clic RunThis
= Presser Y
= A l’invitation ==> appuyer sur une touche pour redémarrer
= Redémarrage ( qui sera plus long ,car nettoyage en cours )
Continuer si un message d’erreurs apparaît ,dans ce cas aller directement au rapport dans SDfix
= apparition de Finished
= Appuyer sur une touche
= Dans SDFix , un rapport est généré, Report.txt
= Copier/Coller sur le forum.

_____________________________________________________

Colle un Log hijackthis :

télécharge HijackThis ici :
http://telechargement.zebulon.fr/138-hijackthis-1991.html

Dézippe le dans un dossier
Par exemple C:\hijackthis < Enregistre le bien dans c:\

Lance le puis:
clique sur "do a system scan and save logfile"
faire un copier coller du log et le poster sur le forum

Tuto ici: http://cybersecurite.xooit.com/t138-HijackThis-2-0-2.htm

_____________________________________________________

++

Re bonjour,

Ci joint le rapport Hijack ...

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:59:06, on 13/02/2008
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\VM_STI.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\userinit.exe,userinit.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {73BEBA23-DCCA-478A-983D-FB2C853A4E82} - C:\WINDOWS\System32\comctl3.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE Philips SPC315NC Webcam
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\RunServices: [MS Java for Windows XP & NT] javanet.exe
O4 - HKLM\..\RunServices: [Sun Java Console for Windows NT & XP] jconsole.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\RunServices: [MS Java for Windows XP & NT] javanet.exe
O4 - HKCU\..\RunServices: [Sun Java Console for Windows NT & XP] jconsole.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunServices: [MS Java for Windows XP & NT] javanet.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunServices: [MS Java for Windows XP & NT] javanet.exe (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\AIM.EXE (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {5392B545-31A5-4724-BEF3-4FED1D56FDAC} (CPlayFirstDinerDash2_frControl Object) - http://gamenextfr.oberon-media.com//online/online2/diner_dash_2/DinerDash2_fr.1.0.0.70.cab
O16 - DPF: {BAE1D8DF-0B35-47E3-A1E7-EEB3FF2ECD19} (CPlayFirstddfotgControl Object) - http://gamenextfr.oberon-media.com/online/online2/diner_dash_flo_on_the_go/ddfotg.1.0.0.33.cab
O16 - DPF: {DC75FEF6-165D-4D25-A518-C8C4BDA7BAA6} (CPlayFirstDinerDashControl Object) - http://gamenextfr.oberon-media.com/online/online2/diner_dash/DinerDash.1.0.0.80.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

Salut,

Avant toute chose,
Met à jour ta version de XP ----> SP2
Et ta version d'Internet Explorer :

met à jour Internet Explorer 7.0:
https://www.01net.com/telecharger/windows/Internet/navigateur/fiches/33081.html

_____________________________________________________

Aprés post le rapport HijackThis.

++

Ca y est après quelques difficultés de mise à jour, ci-joint le rapport hijack pour avis...

Merci bcp

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:17:25, on 13/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\VM_STI.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.01net.com/telecharger/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.01net.com/telecharger/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.01net.com/telecharger/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {73BEBA23-DCCA-478A-983D-FB2C853A4E82} - C:\WINDOWS\System32\comctl3.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE Philips SPC315NC Webcam
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\RunServices: [MS Java for Windows XP & NT] javanet.exe
O4 - HKLM\..\RunServices: [Sun Java Console for Windows NT & XP] jconsole.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunServices: [MS Java for Windows XP & NT] javanet.exe
O4 - HKCU\..\RunServices: [Sun Java Console for Windows NT & XP] jconsole.exe
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\System32\Macromed\Flash\FlashUtil9b.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunServices: [MS Java for Windows XP & NT] javanet.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunServices: [MS Java for Windows XP & NT] javanet.exe (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\AIM.EXE (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {5392B545-31A5-4724-BEF3-4FED1D56FDAC} (CPlayFirstDinerDash2_frControl Object) - http://gamenextfr.oberon-media.com//online/online2/diner_dash_2/DinerDash2_fr.1.0.0.70.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {BAE1D8DF-0B35-47E3-A1E7-EEB3FF2ECD19} (CPlayFirstddfotgControl Object) - http://gamenextfr.oberon-media.com/online/online2/diner_dash_flo_on_the_go/ddfotg.1.0.0.33.cab
O16 - DPF: {DC75FEF6-165D-4D25-A518-C8C4BDA7BAA6} (CPlayFirstDinerDashControl Object) - http://gamenextfr.oberon-media.com/online/online2/diner_dash/DinerDash.1.0.0.80.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

Re,

Ok trés bien, niveau sécurité c'est déjà un gros plus.

Ensuite :

SDFix :

Télécharger sur le bureau :
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

= Double-clic SDFix.
= Clic Install

= Redémarrer en mode Sans Échec (le démarrage peut prendre plusieurs minutes).
Attention, pas d’accès à internet dans ce mode. Enregistrer ou imprimer les consignes.

Pour démarrer en mode sans échec :

1/ -Démarrez Windows, ou s’il s’exécute, fermez Windows puis éteignez l'ordinateur.
2/ -Redémarrez l’ordinateur.
3/ -Au début du chargement du BIOS (mais pas trop tôt), commencez à appuyer sur la touche F8 de votre clavier plusieurs fois de suite. Procédez ainsi jusqu'à ce que le menu des options avancées de Windows apparaissent.
4/ -En utilisant les flèches de votre clavier, sélectionnez "Mode sans échec" dans le menu puis appuyez sur Entrée.

Une fois sous windows :

------
= Double-clic SDFix.
= Clic Install
= Double-clic sur le nouveau dossier SDFix qui est dans C:\
= Double-clic RunThis
= Presser Y
= A l’invitation ==> appuyer sur une touche pour redémarrer
= Redémarrage ( qui sera plus long ,car nettoyage en cours )
Continuer si un message d’erreurs apparaît ,dans ce cas aller directement au rapport dans SDfix
= apparition de Finished
= Appuyer sur une touche
= Dans SDFix , un rapport est généré, Report.txt
= Copier/Coller sur le forum.

_____________________________________________________

VundoFix :

Télécharge VundoFix.exe sur ton Bureau.
http://www.atribune.org/ccount/click.php?id=4

Double-clique VundoFix.exe afin de le lancer.
Coche Run VundoFix as a task.
Un message t'avertira que l'outil va se fermer et s'ouvrir à nouveau : clique Ok
Clique sur le bouton Scan for Vundo.
Lorsque le scan est complété, clique sur le bouton Remove Vundo.
Une invite te demandera si tu veux supprimer les fichiers, clique YES
Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers.
Tu verras une invite qui t'annonce que ton PC va s'éteindre ("shutdown") ; clique OK
Démarre ton PC à nouveau.
Copie/colle le contenu du rapport situé dans C:\vundofix.txt ainsi qu'un nouveau rapport HijackThis! dans ta prochaine réponse.

_____________________________________________________

Un fois que tu as les rapports, post les puis enchaine avec la désinstallation d'Avast, et l'installation d'Antivir :
Comparatif (par Malekal) pour comprendre : http://forum.malekal.com/ftopic3528.php
_____________________________________________________

Pour Désinstaller Avast :

il faut le désinstaller à partir d'un prog :

https://www.avast.com/fr-fr/uninstall-utility

_____________________________________________________

Pour installer Antivir :

Telecharge Antivir: http://www.commentcamarche.net/telecharger/telecharger 55 antivir

Installe le.
Pendant l'installation, cocher la case "generate random serial..."
Lance Antivir,
fais les mises à jours, puis lance un scan (si des virus sont découverts, mets les en quarantaine. Si tu ne peux pas alors supprime les).
A la fin du scan clique sur 'report', enregistre ce rapport sur le bureau (fichier => enregistrer sous), puis fait un copier/coller de ce rapport dans ton prochain message.

----> Relance ton PC

Tutos : https://www.malekal.com/avira-free-security-antivirus-gratuit/

Si problème - mise à jour :
Telecharge la licence sur le site officiel :
http://dl1.avgate.net/down/windows/hbedv.key
Une fois telechargé, déplace le fichier téléchargé (hbedv.key) dans le dossier Antivir.
Par defaut : C:\Program Files\AntiVir PersonalEdition Classic

Refait la mise à jour, puis il ne sera plus périmé.
Et fait le scan comme indiqué plus haut.

_____________________________________________________

Ca parait trés long, mais c'est que les opérations sont détaillés.

++

Voici pour SDFix...

SDFix: Version 1.141

Run by latife on 13/02/2008 at 15:48

Microsoft Windows XP [version 5.1.2600]

Running From: C:\DOCUME~1\latife\Bureau\SDFix

Safe Mode:
Checking Services:

Name:
ctxeovay

Path:
system32\drivers\thdoqqbh.dat

ctxeovay - Deleted

Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...

Service ctxeovay - Deleted after Reboot

Normal Mode:
Checking Files:

Trojan Files Found:

C:\WINDOWS\system32\drivers\thdoqqbh.dat - Deleted
C:\WINDOWS\SYSTEM32\J.EXE - Deleted
C:\WINDOWS\SYSTEM32\Z.EXE - Deleted
C:\WINDOWS\SYSTEM32\COMCTL3.DLL - Deleted
C:\WINDOWS\Downloaded Program Files\UGDCFR_0001_N122M0712NetInstaller.exe - Deleted
C:\WINDOWS\system32\TFTP1828 - Deleted
C:\WINDOWS\system32\.exe - Deleted
C:\WINDOWS\system32\z.exe - Deleted

Removing Temp Files...

ADS Check:

Final Check:

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-13 16:01:09
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

C:\WINDOWS\SoftwareDistribution\Download\9c112f9fe737a2dbcc7e8bb2c8d04126
C:\WINDOWS\SoftwareDistribution\Download\9c112f9fe737a2dbcc7e8bb2c8d04126\_downloadprogress_.state 4 bytes
C:\WINDOWS\SoftwareDistribution\Download\9c112f9fe737a2dbcc7e8bb2c8d04126\_usedelta_.state 34 bytes
C:\WINDOWS\SoftwareDistribution\Download\9fc9db2b14f84a4407c2eebb504e6ed1
C:\WINDOWS\SoftwareDistribution\Download\9fc9db2b14f84a4407c2eebb504e6ed1\_downloadprogress_.state 4 bytes
C:\WINDOWS\SoftwareDistribution\Download\9fc9db2b14f84a4407c2eebb504e6ed1\_usedelta_.state 34 bytes
C:\WINDOWS\SoftwareDistribution\Download\a0141e73bbc406d3a6adf116f2c9aae1
C:\WINDOWS\SoftwareDistribution\Download\a0141e73bbc406d3a6adf116f2c9aae1\_downloadprogress_.state 4 bytes
C:\WINDOWS\SoftwareDistribution\Download\a0141e73bbc406d3a6adf116f2c9aae1\_usedelta_.state 34 bytes
C:\WINDOWS\SoftwareDistribution\Download\a97bd412ef78c20b97d5d1e3965f7491
C:\WINDOWS\SoftwareDistribution\Download\a97bd412ef78c20b97d5d1e3965f7491\_downloadprogress_.state 4 bytes
C:\WINDOWS\SoftwareDistribution\Download\a97bd412ef78c20b97d5d1e3965f7491\_usedelta_.state 34 bytes
C:\WINDOWS\SoftwareDistribution\Download\63d24d8d47da118138382ddd3268b368
C:\WINDOWS\SoftwareDistribution\Download\63d24d8d47da118138382ddd3268b368\_downloadprogress_.state 4 bytes
C:\WINDOWS\SoftwareDistribution\Download\63d24d8d47da118138382ddd3268b368\_usedelta_.state 34 bytes
C:\WINDOWS\SoftwareDistribution\Download\656c92fcd66b00f9a3fa9acad9d3bf1a
C:\WINDOWS\SoftwareDistribution\Download\656c92fcd66b00f9a3fa9acad9d3bf1a\_downloadprogress_.state 4 bytes
C:\WINDOWS\SoftwareDistribution\Download\656c92fcd66b00f9a3fa9acad9d3bf1a\_usedelta_.state 34 bytes
C:\WINDOWS\SoftwareDistribution\Download\699e24e86f6415432011025cecec293a
C:\WINDOWS\SoftwareDistribution\Download\699e24e86f6415432011025cecec293a\_downloadprogress_.state 4 bytes
C:\WINDOWS\SoftwareDistribution\Download\699e24e86f6415432011025cecec293a\_usedelta_.state 34 bytes
C:\WINDOWS\SoftwareDistribution\Download\74e9f428b65f24096f98956842c7b924
C:\WINDOWS\KB941568.log 3446 bytes
C:\WINDOWS\KB890046.log 4375 bytes
C:\WINDOWS\KB896358.log 4838 bytes
C:\WINDOWS\KB896423.log 4413 bytes
C:\WINDOWS\KB900725.log 3363 bytes
C:\WINDOWS\KB901214.log 3794 bytes
C:\WINDOWS\KB905414.log 3908 bytes
C:\WINDOWS\KB905749.log 2986 bytes
C:\WINDOWS\KB908519.log 2643 bytes
C:\WINDOWS\KB913580.log 2882 bytes
C:\WINDOWS\KB914389.log 3465 bytes
C:\WINDOWS\KB918118.log 3561 bytes
C:\WINDOWS\KB918439.log 4469 bytes
C:\WINDOWS\KB919007.log 4010 bytes
C:\WINDOWS\KB920670.log 4579 bytes
C:\WINDOWS\KB920872.log 4665 bytes
C:\WINDOWS\KB925902.log 4716 bytes
C:\WINDOWS\KB930178.log 4121 bytes
C:\WINDOWS\KB930916.log 3098 bytes
C:\WINDOWS\KB935840.log 3211 bytes
C:\Documents and Settings\latife\Local Settings\Temporary Internet Files\Content.IE5\QP1URIDO\gmail[1].: 1047 bytes hidden from API

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 43

Remaining Services:
------------------

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype. Take a deep breath "

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

Remaining Files:
---------------

File Backups: - C:\DOCUME~1\latife\Bureau\SDFix\backups\backups.zip

Files with Hidden Attributes:

Fri 16 Mar 2007 5,355,320 A..H. --- "C:\Program Files\Picasa2\setup.exe"
Sun 30 Nov 2003 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Sun 30 Nov 2003 4,348 A..H. --- "C:\Program Files\Wanadoo\Latifa NOUJOUM\Sauvegarde de la licence\drmv1key.bak"
Sat 31 Jan 2004 20 A..H. --- "C:\Program Files\Wanadoo\Latifa NOUJOUM\Sauvegarde de la licence\drmv1lic.bak"
Fri 16 Jan 2004 400 A..H. --- "C:\Program Files\Wanadoo\Latifa NOUJOUM\Sauvegarde de la licence\drmv2key.bak"
Sat 31 Jan 2004 1,536 A..H. --- "C:\Program Files\Wanadoo\Latifa NOUJOUM\Sauvegarde de la licence\drmv2lic.bak"
Sun 30 Nov 2003 4,348 A..H. --- "C:\Program Files\Wanadoo\Latifa NOUJOUM\Ma musique\Sauvegarde de la licence\drmv1key.bak"
Tue 2 Aug 2005 20 A..H. --- "C:\Program Files\Wanadoo\Latifa NOUJOUM\Ma musique\Sauvegarde de la licence\drmv1lic.bak"
Fri 16 Jan 2004 400 A.SH. --- "C:\Program Files\Wanadoo\Latifa NOUJOUM\Ma musique\Sauvegarde de la licence\drmv2key.bak"
Sun 30 Nov 2003 4,348 ...H. --- "C:\Program Files\Wanadoo\Utilisateur1\Ma musique\Sauvegarde de la licence\drmv1key.bak"
Wed 31 Jan 2007 20 A..H. --- "C:\Program Files\Wanadoo\Utilisateur1\Ma musique\Sauvegarde de la licence\drmv1lic.bak"
Fri 16 Jan 2004 400 A.SH. --- "C:\Program Files\Wanadoo\Utilisateur1\Ma musique\Sauvegarde de la licence\drmv2key.bak"
Wed 13 Feb 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\06610cab6d433e28e3786b6f4f2daf47\download\BIT99.tmp"
Wed 13 Feb 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\098219b4e8f2ef50f602517142a31237\download\BIT95.tmp"
Wed 13 Feb 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\184e9e50ae9fd7c95e99fc939967f16c\download\BIT9A.tmp"
Wed 13 Feb 2008 69,422 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\3fc4c48da845525f8f6c17a5f84323c2\download\BIT63.tmp"
Wed 13 Feb 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\5c6b46191661d86eff922cf2abc5383c\download\BIT97.tmp"
Wed 13 Feb 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\95fd4748e09823949a480f46a1d6e744\download\BIT98.tmp"
Wed 13 Feb 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\991b431aaac91158a60549d9003044fd\download\BIT96.tmp"
Wed 13 Feb 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\b437c563a57eb239b9adbb6181d9e57b\download\BIT91.tmp"
Tue 7 Aug 2007 395,054 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\b4e36ed2c9cf1a2608125d0f62467888\download\BIT8F.tmp"
Wed 13 Feb 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\b7a39c6d6693d1f3598adcd01ab559a0\download\BIT94.tmp"
Wed 13 Feb 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\cc0dcdff9ecf4bee0a8ff8d3fea71393\download\BIT93.tmp"
Wed 13 Feb 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\dc26aa093cda188e55518398937b3343\download\BIT92.tmp"
Wed 13 Feb 2008 322,708 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\dedd59f165d16967c81b4410c77412ff\download\BIT69.tmp"
Wed 8 Feb 2006 8,722 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\fc4435e0f8f00166afca314c45417b4f\download\BIT90.tmp"

Finished!

Pas moyen de télécharger Vundofix... Le site atribune ne mene à rien???

Ok trés bien,
Pas grave pour vundo,

bitdefender en ligne :

Utilise Internet Explorer
accepte l'active X
la barre anti pop-up du SP2 (en haut) se met à clignoter, clic dessus et choisis "accepter l'active X"

http://www.bitdefender.fr/scan_fr/scan8/ie.html

- Cliquer sur J'accepte
- Start Scan
- Une fois terminé, Dans l'onglet "Problèmes détectés"
- "Cliquer ici pour exporter le rapport"
- Enregistrer sur le bureau (choisir un nom)
- Fermer le scan
- Ouvrir le fichier enregistré le copier/coller sur le forum.

_____________________________________________________

Post le rapport ainsi qu'un nouveau log HijackThis.

++

Re bonjour,

Après queqlues péripéties, ci-joint le rapport BitDefender...

Pour avis SVP

BitDefender Online Scanner

Rapport d'analyse généré à: Thu, Feb 14, 2008 - 10:53:02

Voie d'analyse: A:\;C:\;D:\;

Statistiques

Temps
01:59:33

Fichiers
170065

Directoires
4120

Secteurs de boot
2

Archives
12527

Paquets programmes
9202

Résultats

Virus identifiés
14

Fichiers infectés
67

Fichiers suspects
0

Avertissements
0

Désinfectés
1

Fichiers effacés
66

Info sur les moteurs

Définition virus
897141

Version des moteurs
AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)

Analyse des plugins
14

Archive des plugins
38

Unpack des plugins
7

E-mail plugins
6

Système plugins
1

Paramètres d'analyse

Première action
Désinfecté

Seconde Action
Supprimé

Heuristique
Oui

Acceptez les avertissements
Oui

Extensions analysées
*;

Excludez les extensions

Analyse d'emails
Oui

Analyse des Archives
Oui

Analyser paquets programmes
Oui

Analyse des fichiers
Oui

Analyse de boot
Oui

Fichier analysé
Statut

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Boîte de réception.dbx=>(message 259)=>[Subject: Re: Thanks!][Date: Thu, 15 Jul 2004 10:10:22 +0200]=>(MIME part)=>message_part2.pif
Infecté par: Win32.Netsky.D@mm

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Boîte de réception.dbx=>(message 259)=>[Subject: Re: Thanks!][Date: Thu, 15 Jul 2004 10:10:22 +0200]=>(MIME part)=>message_part2.pif
Echec de la désinfection

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Boîte de réception.dbx=>(message 259)=>[Subject: Re: Thanks!][Date: Thu, 15 Jul 2004 10:10:22 +0200]=>(MIME part)=>message_part2.pif
Supprimé

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Boîte de réception.dbx=>(message 259)=>[Subject: Re: Thanks!][Date: Thu, 15 Jul 2004 10:10:22 +0200]=>(MIME part)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Boîte de réception.dbx=>(message 259)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Boîte de réception.dbx
Echec de la mise à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Boîte de réception.dbx=>(message 282)=>[Subject: Undelivered Mail Returned to Sender][Date: Mon, 19 Apr 2004 11:13:01 +0200 (CEST)]=>(MIME part)=>(message)=>[Subject: Re: Thanks!][Date: Mon, 19 Apr 2004 11:13:02 +0200]=>(MIME part)=>message_part2.pif
Infecté par: Win32.Netsky.D@mm

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Boîte de réception.dbx=>(message 282)=>[Subject: Undelivered Mail Returned to Sender][Date: Mon, 19 Apr 2004 11:13:01 +0200 (CEST)]=>(MIME part)=>(message)=>[Subject: Re: Thanks!][Date: Mon, 19 Apr 2004 11:13:02 +0200]=>(MIME part)=>message_part2.pif
Echec de la désinfection

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Boîte de réception.dbx=>(message 282)=>[Subject: Undelivered Mail Returned to Sender][Date: Mon, 19 Apr 2004 11:13:01 +0200 (CEST)]=>(MIME part)=>(message)=>[Subject: Re: Thanks!][Date: Mon, 19 Apr 2004 11:13:02 +0200]=>(MIME part)=>message_part2.pif
Supprimé

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Boîte de réception.dbx=>(message 282)=>[Subject: Undelivered Mail Returned to Sender][Date: Mon, 19 Apr 2004 11:13:01 +0200 (CEST)]=>(MIME part)=>(message)=>[Subject: Re: Thanks!][Date: Mon, 19 Apr 2004 11:13:02 +0200]=>(MIME part)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Boîte de réception.dbx=>(message 282)=>[Subject: Undelivered Mail Returned to Sender][Date: Mon, 19 Apr 2004 11:13:01 +0200 (CEST)]=>(MIME part)=>(message)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Boîte de réception.dbx=>(message 282)=>[Subject: Undelivered Mail Returned to Sender][Date: Mon, 19 Apr 2004 11:13:01 +0200 (CEST)]=>(MIME part)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Boîte de réception.dbx=>(message 282)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Boîte de réception.dbx
Echec de la mise à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Boîte de réception.dbx=>(message 297)=>[Subject: Re: Your music][Date: Mon, 29 Mar 2004 09:10:07 +0200]=>(MIME part)=>mp3music.pif
Infecté par: Win32.Netsky.D@mm

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Boîte de réception.dbx=>(message 297)=>[Subject: Re: Your music][Date: Mon, 29 Mar 2004 09:10:07 +0200]=>(MIME part)=>mp3music.pif
Echec de la désinfection

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Boîte de réception.dbx=>(message 297)=>[Subject: Re: Your music][Date: Mon, 29 Mar 2004 09:10:07 +0200]=>(MIME part)=>mp3music.pif
Supprimé

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Boîte de réception.dbx=>(message 297)=>[Subject: Re: Your music][Date: Mon, 29 Mar 2004 09:10:07 +0200]=>(MIME part)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Boîte de réception.dbx=>(message 297)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Boîte de réception.dbx
Echec de la mise à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Boîte de réception.dbx=>(message 375)=>[Subject: ][Date: Wed, 28 Jan 2004 09:24:43 +0100]=>(MIME part)=>doc.zip=>doc.exe
Infecté par: Win32.Novarg.A@mm

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Boîte de réception.dbx=>(message 375)=>[Subject: ][Date: Wed, 28 Jan 2004 09:24:43 +0100]=>(MIME part)=>doc.zip=>doc.exe
Supprimé

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Boîte de réception.dbx=>(message 375)=>[Subject: ][Date: Wed, 28 Jan 2004 09:24:43 +0100]=>(MIME part)=>doc.zip
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Boîte de réception.dbx=>(message 375)=>[Subject: ][Date: Wed, 28 Jan 2004 09:24:43 +0100]=>(MIME part)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Boîte de réception.dbx=>(message 375)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Boîte de réception.dbx
Echec de la mise à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 557)=>[Subject: Re: Your bill][Date: Mon, 5 Apr 2004 08:52:57 +0200]=>(MIME part)=>your_bill.pif
Infecté par: Win32.Netsky.D@mm

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 557)=>[Subject: Re: Your bill][Date: Mon, 5 Apr 2004 08:52:57 +0200]=>(MIME part)=>your_bill.pif
Echec de la désinfection

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 557)=>[Subject: Re: Your bill][Date: Mon, 5 Apr 2004 08:52:57 +0200]=>(MIME part)=>your_bill.pif
Supprimé

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 557)=>[Subject: Re: Your bill][Date: Mon, 5 Apr 2004 08:52:57 +0200]=>(MIME part)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 557)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
Echec de la mise à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 750)=>[Subject: Undelivered Mail Returned to Sender][Date: Mon, 1 Nov 2004 16:50:01 +0100 (CET)]=>(MIME part)=>(message)=>[Subject: Re: Excel file][Date: Mon, 1 Nov 2004 16:49:58 +0100]=>(MIME part)=>document_excel.pif
Infecté par: Win32.Netsky.D@mm

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 750)=>[Subject: Undelivered Mail Returned to Sender][Date: Mon, 1 Nov 2004 16:50:01 +0100 (CET)]=>(MIME part)=>(message)=>[Subject: Re: Excel file][Date: Mon, 1 Nov 2004 16:49:58 +0100]=>(MIME part)=>document_excel.pif
Echec de la désinfection

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 750)=>[Subject: Undelivered Mail Returned to Sender][Date: Mon, 1 Nov 2004 16:50:01 +0100 (CET)]=>(MIME part)=>(message)=>[Subject: Re: Excel file][Date: Mon, 1 Nov 2004 16:49:58 +0100]=>(MIME part)=>document_excel.pif
Supprimé

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 750)=>[Subject: Undelivered Mail Returned to Sender][Date: Mon, 1 Nov 2004 16:50:01 +0100 (CET)]=>(MIME part)=>(message)=>[Subject: Re: Excel file][Date: Mon, 1 Nov 2004 16:49:58 +0100]=>(MIME part)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 750)=>[Subject: Undelivered Mail Returned to Sender][Date: Mon, 1 Nov 2004 16:50:01 +0100 (CET)]=>(MIME part)=>(message)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 750)=>[Subject: Undelivered Mail Returned to Sender][Date: Mon, 1 Nov 2004 16:50:01 +0100 (CET)]=>(MIME part)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 750)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
Echec de la mise à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 757)=>[Subject: Re: Hello][Date: Tue, 05 Oct 2004 11:44:49 +0100]=>(MIME part)=>price.com
Infecté par: Win32.Bagle.AS@mm

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 757)=>[Subject: Re: Hello][Date: Tue, 05 Oct 2004 11:44:49 +0100]=>(MIME part)=>price.com
Supprimé

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 757)=>[Subject: Re: Hello][Date: Tue, 05 Oct 2004 11:44:49 +0100]=>(MIME part)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 757)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
Echec de la mise à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 761)=>[Subject: oh][Date: Thu, 14 Oct 2004 12:53:07 +0200]=>(MIME part)=>ps_death.htm.com
Infecté par: Win32.Netsky.C@mm

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 761)=>[Subject: oh][Date: Thu, 14 Oct 2004 12:53:07 +0200]=>(MIME part)=>ps_death.htm.com
Supprimé

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 761)=>[Subject: oh][Date: Thu, 14 Oct 2004 12:53:07 +0200]=>(MIME part)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 761)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
Echec de la mise à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 763)=>[Subject: Undelivered Mail Returned to Sender][Date: Wed, 13 Oct 2004 15:33:54 +0200 (CEST)]=>(MIME part)=>(message)=>[Subject: Re: hi][Date: Wed, 13 Oct 2004 15:33:51 +0200]=>(MIME part)=>sexy.htm.com
Infecté par: Win32.Generic.3143

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 763)=>[Subject: Undelivered Mail Returned to Sender][Date: Wed, 13 Oct 2004 15:33:54 +0200 (CEST)]=>(MIME part)=>(message)=>[Subject: Re: hi][Date: Wed, 13 Oct 2004 15:33:51 +0200]=>(MIME part)=>sexy.htm.com
Echec de la désinfection

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 763)=>[Subject: Undelivered Mail Returned to Sender][Date: Wed, 13 Oct 2004 15:33:54 +0200 (CEST)]=>(MIME part)=>(message)=>[Subject: Re: hi][Date: Wed, 13 Oct 2004 15:33:51 +0200]=>(MIME part)=>sexy.htm.com
Supprimé

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 763)=>[Subject: Undelivered Mail Returned to Sender][Date: Wed, 13 Oct 2004 15:33:54 +0200 (CEST)]=>(MIME part)=>(message)=>[Subject: Re: hi][Date: Wed, 13 Oct 2004 15:33:51 +0200]=>(MIME part)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 763)=>[Subject: Undelivered Mail Returned to Sender][Date: Wed, 13 Oct 2004 15:33:54 +0200 (CEST)]=>(MIME part)=>(message)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 763)=>[Subject: Undelivered Mail Returned to Sender][Date: Wed, 13 Oct 2004 15:33:54 +0200 (CEST)]=>(MIME part)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 763)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
Echec de la mise à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 764)=>[Subject: you?][Date: Tue, 12 Oct 2004 12:46:35 +0200]=>(MIME part)=>attachment.zip=>attachment.doc.exe
Infecté par: Win32.Netsky.C@mm

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 764)=>[Subject: you?][Date: Tue, 12 Oct 2004 12:46:35 +0200]=>(MIME part)=>attachment.zip=>attachment.doc.exe
Supprimé

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 764)=>[Subject: you?][Date: Tue, 12 Oct 2004 12:46:35 +0200]=>(MIME part)=>attachment.zip
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 764)=>[Subject: you?][Date: Tue, 12 Oct 2004 12:46:35 +0200]=>(MIME part)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 764)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
Echec de la mise à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 767)=>[Subject: Re: Thanks :)][Date: Fri, 08 Oct 2004 14:26:37 +0100]=>(MIME part)=>price.cpl
Infecté par: Win32.Bagle.10.Gen@mm

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 767)=>[Subject: Re: Thanks :)][Date: Fri, 08 Oct 2004 14:26:37 +0100]=>(MIME part)=>price.cpl
Echec de la désinfection

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 767)=>[Subject: Re: Thanks :)][Date: Fri, 08 Oct 2004 14:26:37 +0100]=>(MIME part)=>price.cpl
Supprimé

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 767)=>[Subject: Re: Thanks :)][Date: Fri, 08 Oct 2004 14:26:37 +0100]=>(MIME part)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 767)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
Echec de la mise à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 769)=>[Subject: Re: Hello][Date: Fri, 08 Oct 2004 00:51:28 +0100]=>(MIME part)=>price.com
Infecté par: Win32.Bagle.AS@mm

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 769)=>[Subject: Re: Hello][Date: Fri, 08 Oct 2004 00:51:28 +0100]=>(MIME part)=>price.com
Supprimé

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 769)=>[Subject: Re: Hello][Date: Fri, 08 Oct 2004 00:51:28 +0100]=>(MIME part)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 769)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
Echec de la mise à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 771)=>[Subject: Re: Thank you!][Date: Thu, 07 Oct 2004 01:36:51 +0100]=>(MIME part)=>Price.cpl
Infecté par: Win32.Bagle.10.Gen@mm

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 771)=>[Subject: Re: Thank you!][Date: Thu, 07 Oct 2004 01:36:51 +0100]=>(MIME part)=>Price.cpl
Echec de la désinfection

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 771)=>[Subject: Re: Thank you!][Date: Thu, 07 Oct 2004 01:36:51 +0100]=>(MIME part)=>Price.cpl
Supprimé

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 771)=>[Subject: Re: Thank you!][Date: Thu, 07 Oct 2004 01:36:51 +0100]=>(MIME part)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 771)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
Echec de la mise à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 772)=>[Subject: Re: Thanks :)][Date: Wed, 06 Oct 2004 15:49:11 +0100]=>(MIME part)=>price.cpl
Infecté par: Win32.Bagle.10.Gen@mm

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 772)=>[Subject: Re: Thanks :)][Date: Wed, 06 Oct 2004 15:49:11 +0100]=>(MIME part)=>price.cpl
Echec de la désinfection

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 772)=>[Subject: Re: Thanks :)][Date: Wed, 06 Oct 2004 15:49:11 +0100]=>(MIME part)=>price.cpl
Supprimé

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 772)=>[Subject: Re: Thanks :)][Date: Wed, 06 Oct 2004 15:49:11 +0100]=>(MIME part)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 772)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
Echec de la mise à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 773)=>[Subject: Re:][Date: Wed, 06 Oct 2004 12:39:54 +0100]=>(MIME part)=>price.com
Infecté par: Win32.Bagle.AS@mm

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 773)=>[Subject: Re:][Date: Wed, 06 Oct 2004 12:39:54 +0100]=>(MIME part)=>price.com
Supprimé

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 773)=>[Subject: Re:][Date: Wed, 06 Oct 2004 12:39:54 +0100]=>(MIME part)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 773)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
Echec de la mise à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 774)=>[Subject: Re: Thanks :)][Date: Wed, 06 Oct 2004 12:24:38 +0100]=>(MIME part)=>Joke.com
Infecté par: Win32.Bagle.AS@mm

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 774)=>[Subject: Re: Thanks :)][Date: Wed, 06 Oct 2004 12:24:38 +0100]=>(MIME part)=>Joke.com
Supprimé

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 774)=>[Subject: Re: Thanks :)][Date: Wed, 06 Oct 2004 12:24:38 +0100]=>(MIME part)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 774)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
Echec de la mise à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 775)=>[Subject: Re: Thank you!][Date: Wed, 06 Oct 2004 11:41:55 +0100]=>(MIME part)=>price.com
Infecté par: Win32.Bagle.AS@mm

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 775)=>[Subject: Re: Thank you!][Date: Wed, 06 Oct 2004 11:41:55 +0100]=>(MIME part)=>price.com
Supprimé

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 775)=>[Subject: Re: Thank you!][Date: Wed, 06 Oct 2004 11:41:55 +0100]=>(MIME part)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 775)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
Echec de la mise à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 776)=>[Subject: Re: Thank you!][Date: Wed, 06 Oct 2004 11:25:17 +0100]=>(MIME part)=>Joke.com
Infecté par: Win32.Bagle.AS@mm

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 776)=>[Subject: Re: Thank you!][Date: Wed, 06 Oct 2004 11:25:17 +0100]=>(MIME part)=>Joke.com
Supprimé

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 776)=>[Subject: Re: Thank you!][Date: Wed, 06 Oct 2004 11:25:17 +0100]=>(MIME part)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 776)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
Echec de la mise à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 779)=>[Subject: Re: Thank you!][Date: Tue, 05 Oct 2004 17:31:09 +0100]=>(MIME part)=>price.scr
Infecté par: Win32.Bagle.AS@mm

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 779)=>[Subject: Re: Thank you!][Date: Tue, 05 Oct 2004 17:31:09 +0100]=>(MIME part)=>price.scr
Supprimé

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 779)=>[Subject: Re: Thank you!][Date: Tue, 05 Oct 2004 17:31:09 +0100]=>(MIME part)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 779)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
Echec de la mise à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 780)=>[Subject: Re:][Date: Tue, 05 Oct 2004 17:15:10 +0100]=>(MIME part)=>Joke.scr
Infecté par: Win32.Bagle.AS@mm

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 780)=>[Subject: Re:][Date: Tue, 05 Oct 2004 17:15:10 +0100]=>(MIME part)=>Joke.scr
Supprimé

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 780)=>[Subject: Re:][Date: Tue, 05 Oct 2004 17:15:10 +0100]=>(MIME part)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 780)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
Echec de la mise à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 781)=>[Subject: Re: Hello][Date: Tue, 05 Oct 2004 13:46:11 +0100]=>(MIME part)=>Price.cpl
Infecté par: Win32.Bagle.10.Gen@mm

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 781)=>[Subject: Re: Hello][Date: Tue, 05 Oct 2004 13:46:11 +0100]=>(MIME part)=>Price.cpl
Echec de la désinfection

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 781)=>[Subject: Re: Hello][Date: Tue, 05 Oct 2004 13:46:11 +0100]=>(MIME part)=>Price.cpl
Supprimé

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 781)=>[Subject: Re: Hello][Date: Tue, 05 Oct 2004 13:46:11 +0100]=>(MIME part)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 781)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
Echec de la mise à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 782)=>[Subject: Re: Thanks :)][Date: Tue, 05 Oct 2004 13:33:09 +0100]=>(MIME part)=>price.cpl
Infecté par: Win32.Bagle.10.Gen@mm

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 782)=>[Subject: Re: Thanks :)][Date: Tue, 05 Oct 2004 13:33:09 +0100]=>(MIME part)=>price.cpl
Echec de la désinfection

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 782)=>[Subject: Re: Thanks :)][Date: Tue, 05 Oct 2004 13:33:09 +0100]=>(MIME part)=>price.cpl
Supprimé

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 782)=>[Subject: Re: Thanks :)][Date: Tue, 05 Oct 2004 13:33:09 +0100]=>(MIME part)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 782)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
Echec de la mise à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 784)=>[Subject: Re: Hi][Date: Tue, 05 Oct 2004 11:35:45 +0100]=>(MIME part)=>Price.com
Infecté par: Win32.Bagle.AS@mm

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 784)=>[Subject: Re: Hi][Date: Tue, 05 Oct 2004 11:35:45 +0100]=>(MIME part)=>Price.com
Supprimé

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 784)=>[Subject: Re: Hi][Date: Tue, 05 Oct 2004 11:35:45 +0100]=>(MIME part)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 784)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
Echec de la mise à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 817)=>[Subject: Re: Thanks!][Date: Thu, 10 Jun 2004 20:19:59 +0200]=>(MIME part)=>message_part2.pif
Infecté par: Win32.Netsky.D@mm

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 817)=>[Subject: Re: Thanks!][Date: Thu, 10 Jun 2004 20:19:59 +0200]=>(MIME part)=>message_part2.pif
Echec de la désinfection

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 817)=>[Subject: Re: Thanks!][Date: Thu, 10 Jun 2004 20:19:59 +0200]=>(MIME part)=>message_part2.pif
Supprimé

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 817)=>[Subject: Re: Thanks!][Date: Thu, 10 Jun 2004 20:19:59 +0200]=>(MIME part)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 817)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
Echec de la mise à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 835)=>[Subject: Postcard][Date: Thu, 5 Aug 2004 08:35:15 +0200]=>(MIME part)=>letter.doc
Infecté par: Win32.Netsky.P@mm

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 835)=>[Subject: Postcard][Date: Thu, 5 Aug 2004 08:35:15 +0200]=>(MIME part)=>letter.doc
Supprimé

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 835)=>[Subject: Postcard][Date: Thu, 5 Aug 2004 08:35:15 +0200]=>(MIME part)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 835)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
Echec de la mise à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 861)=>[Subject: Re: My details][Date: Tue, 27 Jul 2004 11:24:11 +0200]=>(MIME part)=>my_details.pif
Infecté par: Win32.Netsky.D@mm

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 861)=>[Subject: Re: My details][Date: Tue, 27 Jul 2004 11:24:11 +0200]=>(MIME part)=>my_details.pif
Echec de la désinfection

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 861)=>[Subject: Re: My details][Date: Tue, 27 Jul 2004 11:24:11 +0200]=>(MIME part)=>my_details.pif
Supprimé

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 861)=>[Subject: Re: My details][Date: Tue, 27 Jul 2004 11:24:11 +0200]=>(MIME part)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 861)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
Echec de la mise à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 862)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Thu, 5 Aug 2004 08:35:08 +0200]=>(MIME part)=>(MIME part)=>(message body)
Infecté par: Exploit.Iframe.Vulnerability.B

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 862)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Thu, 5 Aug 2004 08:35:08 +0200]=>(MIME part)=>(MIME part)=>(message body)
Echec de la désinfection

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 862)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Thu, 5 Aug 2004 08:35:08 +0200]=>(MIME part)=>(MIME part)=>(message body)
Supprimé

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 862)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Thu, 5 Aug 2004 08:35:08 +0200]=>(MIME part)=>(MIME part)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 862)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Thu, 5 Aug 2004 08:35:08 +0200]=>(MIME part)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 862)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 862)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Thu, 5 Aug 2004 08:35:08 +0200]=>(MIME part)=>message.scr
Infecté par: Win32.Netsky.P@mm

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 862)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Thu, 5 Aug 2004 08:35:08 +0200]=>(MIME part)=>message.scr
Supprimé

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 862)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Thu, 5 Aug 2004 08:35:08 +0200]=>(MIME part)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 862)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
Echec de la mise à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 865)=>[Subject: Re: Re: your document][Date: Wed, 4 Aug 2004 10:37:44 +0200]=>(MIME part)=>document.txt.pif
Infecté par: Win32.Netsky.P@mm

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 865)=>[Subject: Re: Re: your document][Date: Wed, 4 Aug 2004 10:37:44 +0200]=>(MIME part)=>document.txt.pif
Supprimé

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 865)=>[Subject: Re: Re: your document][Date: Wed, 4 Aug 2004 10:37:44 +0200]=>(MIME part)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 865)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
Echec de la mise à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 867)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Mon, 2 Aug 2004 02:13:28 +0200]=>(MIME part)=>(MIME part)=>(message body)
Infecté par: Exploit.Iframe.Vulnerability.B

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 867)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Mon, 2 Aug 2004 02:13:28 +0200]=>(MIME part)=>(MIME part)=>(message body)
Echec de la désinfection

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 867)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Mon, 2 Aug 2004 02:13:28 +0200]=>(MIME part)=>(MIME part)=>(message body)
Supprimé

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 867)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Mon, 2 Aug 2004 02:13:28 +0200]=>(MIME part)=>(MIME part)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 867)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Mon, 2 Aug 2004 02:13:28 +0200]=>(MIME part)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 867)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 867)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Mon, 2 Aug 2004 02:13:28 +0200]=>(MIME part)=>message.scr
Infecté par: Win32.Netsky.P@mm

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 867)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Mon, 2 Aug 2004 02:13:28 +0200]=>(MIME part)=>message.scr
Supprimé

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 867)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Mon, 2 Aug 2004 02:13:28 +0200]=>(MIME part)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 867)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
Echec de la mise à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 868)=>[Subject: Re: Error in document][Date: Mon, 2 Aug 2004 02:13:27 +0200]=>(MIME part)=>document.pif
Infecté par: Win32.Netsky.P@mm

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 868)=>[Subject: Re: Error in document][Date: Mon, 2 Aug 2004 02:13:27 +0200]=>(MIME part)=>document.pif
Supprimé

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 868)=>[Subject: Re: Error in document][Date: Mon, 2 Aug 2004 02:13:27 +0200]=>(MIME part)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 868)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
Echec de la mise à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 869)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Sun, 1 Aug 2004 22:33:22 +0200]=>(MIME part)=>(MIME part)=>(message body)
Infecté par: Exploit.Iframe.Vulnerability.B

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 869)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Sun, 1 Aug 2004 22:33:22 +0200]=>(MIME part)=>(MIME part)=>(message body)
Echec de la désinfection

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 869)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Sun, 1 Aug 2004 22:33:22 +0200]=>(MIME part)=>(MIME part)=>(message body)
Supprimé

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 869)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Sun, 1 Aug 2004 22:33:22 +0200]=>(MIME part)=>(MIME part)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 869)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Sun, 1 Aug 2004 22:33:22 +0200]=>(MIME part)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 869)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 869)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Sun, 1 Aug 2004 22:33:22 +0200]=>(MIME part)=>message.scr
Infecté par: Win32.Netsky.P@mm

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 869)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Sun, 1 Aug 2004 22:33:22 +0200]=>(MIME part)=>message.scr
Supprimé

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 869)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Sun, 1 Aug 2004 22:33:22 +0200]=>(MIME part)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 869)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
Echec de la mise à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 872)=>[Subject: Re: important][Date: Fri, 30 Jul 2004 14:20:00 +0200]=>(MIME part)=>product.zip=>data.rtf .scr
Infecté par: Win32.Netsky.P@mm

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 872)=>[Subject: Re: important][Date: Fri, 30 Jul 2004 14:20:00 +0200]=>(MIME part)=>product.zip=>data.rtf .scr
Supprimé

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 872)=>[Subject: Re: important][Date: Fri, 30 Jul 2004 14:20:00 +0200]=>(MIME part)=>product.zip
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 872)=>[Subject: Re: important][Date: Fri, 30 Jul 2004 14:20:00 +0200]=>(MIME part)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 872)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
Echec de la mise à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 873)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Fri, 30 Jul 2004 14:19:47 +0200]=>(MIME part)=>(MIME part)=>(message body)
Infecté par: Exploit.Iframe.Vulnerability.B

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 873)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Fri, 30 Jul 2004 14:19:47 +0200]=>(MIME part)=>(MIME part)=>(message body)
Echec de la désinfection

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 873)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Fri, 30 Jul 2004 14:19:47 +0200]=>(MIME part)=>(MIME part)=>(message body)
Supprimé

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 873)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Fri, 30 Jul 2004 14:19:47 +0200]=>(MIME part)=>(MIME part)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 873)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Fri, 30 Jul 2004 14:19:47 +0200]=>(MIME part)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 873)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 873)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Fri, 30 Jul 2004 14:19:47 +0200]=>(MIME part)=>message.scr
Infecté par: Win32.Netsky.P@mm

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 873)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Fri, 30 Jul 2004 14:19:47 +0200]=>(MIME part)=>message.scr
Supprimé

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 873)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Fri, 30 Jul 2004 14:19:47 +0200]=>(MIME part)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 873)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
Echec de la mise à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 874)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Thu, 29 Jul 2004 18:24:24 +0200]=>(MIME part)=>(MIME part)=>(message body)
Infecté par: Exploit.Iframe.Vulnerability.B

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 874)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Thu, 29 Jul 2004 18:24:24 +0200]=>(MIME part)=>(MIME part)=>(message body)
Echec de la désinfection

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 874)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Thu, 29 Jul 2004 18:24:24 +0200]=>(MIME part)=>(MIME part)=>(message body)
Supprimé

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 874)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Thu, 29 Jul 2004 18:24:24 +0200]=>(MIME part)=>(MIME part)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 874)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Thu, 29 Jul 2004 18:24:24 +0200]=>(MIME part)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 874)
Mis à jour

C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 874)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Thu, 29 Jul 2004 18:24:24 +0200]=>(MIME part)=>message.scr
Infecté par

Salut,

As tu fait le scan Antivir ?
Repost un log HijackThis,

puis :

- Télécharger et installer AVG Anti-Spyware 7.5 (si tu ne l'as pas déjà).

https://www.avg.com/en-ww/free-antivirus-download

Lancer AVG Anti-Spyware.
Cliquer sur le menu Mise à jour.
Dans le paragraphe "Mise à jour manuelle", cliquer sur le bouton "Commencer la mise à jour".
Attendre la fin de cette mise à jour puis fermer le programme.

- Lance AVG Anti-Spyware 7.5

Cliquer sur le menu" Analyse" (de la barre d'outils).
Cliquer sur l'onglet "Paramètres".
Dans "Comment réagir"? cliquer sur "Actions recommandées" et choisir "Quarantaine".
Dans Comment faire l'analyse ? et dans Programmes potentiellement dangereux, vérifier que toutes les cases soient cochées.
Vérifier que le bouton-radio "Générer un rapport après chaque analyse" soit aussi coché.
Dans l'onglet "Analyse"
Cliquer sur "Analyse complète du système".
Important : Ne pas ouvrir de fenêtre, ne pas lancer de programme pendant l'exécution de AVG Anti-Spyware, car cela pourrait interférer avec le processus de recherche.
Très important : A la fin de l'analyse, cocher tout ce qui a été trouvé puis cliquer sur " Appliquer toutes les actions"
Ensuite.
Cliquer sur "Enregistrer le rapport". Ceci génère un rapport en fichier texte qui se trouve dans le dossier Reports du dossier d'AVG Anti-Spyware.
(C:\Programfiles\Grisoft\AVG Antispyware 7.5\Reports )
Puis fermer AVG Anti-Spyware.

_____________________________________________________

Salut,

Voici pour le Hijack...

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:14:26, on 14/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\VM_STI.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.01net.com/telecharger/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.01net.com/telecharger/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.01net.com/telecharger/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE Philips SPC315NC Webcam
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-21-1538417202-1907411925-173008773-1003\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\AIM.EXE (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {5392B545-31A5-4724-BEF3-4FED1D56FDAC} (CPlayFirstDinerDash2_frControl Object) - http://gamenextfr.oberon-media.com//online/online2/diner_dash_2/DinerDash2_fr.1.0.0.70.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {BAE1D8DF-0B35-47E3-A1E7-EEB3FF2ECD19} (CPlayFirstddfotgControl Object) - http://gamenextfr.oberon-media.com/online/online2/diner_dash_flo_on_the_go/ddfotg.1.0.0.33.cab
O16 - DPF: {DC75FEF6-165D-4D25-A518-C8C4BDA7BAA6} (CPlayFirstDinerDashControl Object) - http://gamenextfr.oberon-media.com/online/online2/diner_dash/DinerDash.1.0.0.80.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

Re,

Tu n'as pas répondu à ma question, tu as fait le scan Antivir ?

Mets JAVA à jour :
https://www.java.com/fr/download/manual.jsp
---------------------------------------------------------------------
Tester Java et autres players:
http://www.chemgapedia.de/vsengine/info/fr/help/requirements/java.html

_____________________________________________________

Fixe les lignes dans Hijackthis :

Relance HijackThis, choisis "do a scan only" coche la case devant les lignes ci-dessous et clic en bas sur "fix checked".

O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\AIM.EXE (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

O16 - DPF: {5392B545-31A5-4724-BEF3-4FED1D56FDAC} (CPlayFirstDinerDash2_frControl Object) - http://gamenextfr.oberon-media.com/
O16 - DPF: {BAE1D8DF-0B35-47E3-A1E7-EEB3FF2ECD19} (CPlayFirstddfotgControl Object) - http://gamenextfr.oberon-media.com/
O16 - DPF: {DC75FEF6-165D-4D25-A518-C8C4BDA7BAA6} (CPlayFirstDinerDashControl Object) - http://gamenextfr.oberon-media.com/online/online2/diner_dash/DinerDash.1.0.0.80.cab

S'il te demande un redémarrage, relance ton PC.
_____________________________________________________

++

Salut,

Ca a beaucoup ramé cette nuit.

Ci dessous les rapports Antivir.

J'ai fait aussi le scan Hijack avec les fix....

Est-ce qu'il y a encore des choses à faire?

AntiVir PersonalEdition Classic
Report file date: jeudi 14 février 2008 20:32

Scanning for 1109375 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Username: SYSTEM
Computer name: LATIFA

Version information:
BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00
AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 13:16:29
AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 12:23:51
LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 15:32:47
LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 12:35:20
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 14:27:15
ANTIVIR1.VDF : 7.0.1.95 3367424 Bytes 14/12/2007 19:28:30
ANTIVIR2.VDF : 7.0.2.113 1673728 Bytes 08/02/2008 19:28:30
ANTIVIR3.VDF : 7.0.2.140 184320 Bytes 14/02/2008 19:28:30
AVEWIN32.DLL : 7.6.0.65 3240448 Bytes 14/02/2008 19:28:32
AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 10:36:26
AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 07:39:17
AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:16:24
AVPACK32.DLL : 7.6.0.3 360488 Bytes 14/02/2008 19:28:32
AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 07:17:06
AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 12:26:33
AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 07:10:18
NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 11:09:42
RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 12:38:13
RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 12:50:37
SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 09:37:21

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: C:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: jeudi 14 février 2008 20:32

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'WLLoginProxy.exe' - '1' Module(s) have been scanned
Scan process 'iexplore.exe' - '1' Module(s) have been scanned
Scan process 'avast.setup' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'avgas.exe' - '1' Module(s) have been scanned
Scan process 'guard.exe' - '0' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'skypePM.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'ashMaiSv.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'wdfmgr.exe' - '1' Module(s) have been scanned
Scan process 'Skype.exe' - '1' Module(s) have been scanned
Scan process 'VM_STI.EXE' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'ashServ.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
35 processes with 35 modules were scanned

Start scanning boot sectors:
Boot sector 'C:\'
[NOTE] No virus was found!

Starting to scan the registry.
The registry was scanned ( '18' files ).

Starting the file scan:

Begin scan in 'C:\'
C:\hiberfil.sys
[WARNING] The file could not be opened!
C:\pagefile.sys
[WARNING] The file could not be opened!

End of the scan: vendredi 15 février 2008 01:10
Used time: 4:38:52 min

The scan has been done completely.

4182 Scanning directories
279909 Files were scanned
0 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
0 files were moved to quarantine
0 files were renamed
2 Files cannot be scanned
279909 Files not concerned
6922 Archives were scanned
2 Warnings
0 Notes

AntiVir PersonalEdition Classic
Report file date: jeudi 14 février 2008 20:32

Scanning for 1109375 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Username: SYSTEM
Computer name: LATIFA

Version information:
BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00
AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 13:16:29
AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 12:23:51
LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 15:32:47
LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 12:35:20
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 14:27:15
ANTIVIR1.VDF : 7.0.1.95 3367424 Bytes 14/12/2007 19:28:30
ANTIVIR2.VDF : 7.0.2.113 1673728 Bytes 08/02/2008 19:28:30
ANTIVIR3.VDF : 7.0.2.140 184320 Bytes 14/02/2008 19:28:30
AVEWIN32.DLL : 7.6.0.65 3240448 Bytes 14/02/2008 19:28:32
AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 10:36:26
AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 07:39:17
AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:16:24
AVPACK32.DLL : 7.6.0.3 360488 Bytes 14/02/2008 19:28:32
AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 07:17:06
AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 12:26:33
AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 07:10:18
NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 11:09:42
RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 12:38:13
RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 12:50:37
SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 09:37:21

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: C:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: jeudi 14 février 2008 20:32

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'WLLoginProxy.exe' - '1' Module(s) have been scanned
Scan process 'iexplore.exe' - '1' Module(s) have been scanned
Scan process 'avast.setup' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'avgas.exe' - '1' Module(s) have been scanned
Scan process 'guard.exe' - '0' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'skypePM.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'ashMaiSv.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'wdfmgr.exe' - '1' Module(s) have been scanned
Scan process 'Skype.exe' - '1' Module(s) have been scanned
Scan process 'VM_STI.EXE' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'ashServ.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
35 processes with 35 modules were scanned

Start scanning boot sectors:
Boot sector 'C:\'
[NOTE] No virus was found!

Starting to scan the registry.
The registry was scanned ( '18' files ).

Starting the file scan:

Begin scan in 'C:\'
C:\hiberfil.sys
[WARNING] The file could not be opened!
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\System Volume Information\_restore{F81371C3-672A-44E6-850B-9DF35254ED1F}\RP759\A0149559.exe
[DETECTION] Is the Trojan horse TR/Drop.Agent.cro
[INFO] The file was moved to '47e5b081.qua'!

End of the scan: jeudi 14 février 2008 23:50
Used time: 3:18:44 min

The scan has been done completely.

4182 Scanning directories
279910 Files were scanned
1 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
1 files were moved to quarantine
0 files were renamed
2 Files cannot be scanned
279909 Files not concerned
6922 Archives were scanned
2 Warnings
0 Notes

Salut,

Bon plus de virus en vue, Refait un log HijackThis,

Aprés passe un coup de TCleaner (ATTENTION : fait d'abord le log hijackthis avant ce logiciel car il va supprimer HjT)

++

Hello,

Merci.
Ci-joint le rapport Hijack

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:05:03, on 15/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\VM_STI.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Java\jre1.6.0_03\bin\jucheck.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.01net.com/telecharger/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.01net.com/telecharger/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.01net.com/telecharger/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE Philips SPC315NC Webcam
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

Re

C'est quoi Tcleaner?

Re,

TCleaner va supprimer les logiciels utilisé lors de la désinfection (tu n'en as plus besoin)
Il va également supprimer HijackThis, c'est pourquoi je t'ai dis de faire le log en 1er.

Ensuite fait ça :

Maintenant que ton PC n'est plus infecté, désactive ta "Restauration du système" puis réactive la afin de créer un point de restauration sain.

* Désactivation :
Cliquer droit sur le "Poste de travail" > Propriétés > onglet "Restauration du système" > cocher la case "Désactiver la Restauration du système sur tous les lecteurs"
> Appliquer patiente jusqu a que cela soit marqué "désactivée" puis Ok.

* Activation :
Suivre le même chemin ; décocher la case "Désactiver la Restauration du système sur tous les lecteurs"
> Appliquer attends que cela soit a nouveau sur "surveillance" puis Ok. Redémarrer l'ordinateur...

OK merci beaucoup,

Peux tu juste me dire où trouver Tcleaner.

Merci pour tout

A+

Re re,

Télécharge ToolsCleaner de A.Roshtein sur ton Bureau.

* http://a-rothstein.changelog.fr/TC/ToolsCleaner2.exe

* Clique sur Recherche et laisse le scan se terminer.
* Clique, sur Suppression pour finaliser.
* Tu peux, si tu le souhaites, te servir des Options facultatives.
* Clique sur Quitter, pour que le rapport puisse se créer.
* Poste moi le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur( C:\).

_____________________________________________________