Cheval troie Win32:BHO-KD [Trj]

Question

Bonjour,

Avast, m'indique une cheval de troie :

C:\WINDOWS\System32\comctl3.dll\[UPX]
Win32:BHO-KD [Trj]

Pouvez vous m'aider à le supprimer?

Merci

carter31 · Answer

Bonjour, que je dise pas de conneries:
moi aussi j'ai avast, et normalement, il te propose plusieurs solutions:mettre en quarantaine, supprimer, ne rien faire...
La connerie, c'est que je sait pas si quand on lui demande de supprimmer, il s'attaque qu'au virus(ou trojan) ou au fichier...
Pour ma part, je met toujours "mettre en quarantaine".

Saiyen75 · Answer

Salut,


SDFix :

Télécharger sur le bureau :
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

= Double-clic SDFix. 
= Clic Install 

= Redémarrer en mode Sans Échec (le démarrage peut prendre plusieurs minutes).
Attention, pas d’accès à internet dans ce mode. Enregistrer ou imprimer les consignes. 

Pour démarrer en mode sans échec : 

1/ -Démarrez Windows, ou s’il s’exécute, fermez Windows puis éteignez l'ordinateur. 
2/ -Redémarrez l’ordinateur.
3/ -Au début du chargement du BIOS (mais pas trop tôt), commencez à appuyer sur la touche F8 de votre clavier plusieurs fois de suite. Procédez ainsi jusqu'à ce que le menu des options avancées de Windows apparaissent.
4/ -En utilisant les flèches de votre clavier, sélectionnez "Mode sans échec" dans le menu puis appuyez sur Entrée.

Une fois sous windows :

------ 
= Double-clic SDFix. 
= Clic Install 
= Double-clic sur le nouveau dossier SDFix qui est dans C:\ 
= Double-clic RunThis 
= Presser Y 
= A l’invitation ==> appuyer sur une touche pour redémarrer 
= Redémarrage ( qui sera plus long ,car nettoyage en cours ) 
Continuer si un message d’erreurs apparaît ,dans ce cas aller directement au rapport dans SDfix 
= apparition de Finished 
= Appuyer sur une touche 
= Dans SDFix , un rapport est généré, Report.txt
= Copier/Coller sur le forum.

_____________________________________________________

Colle un Log hijackthis :

télécharge HijackThis ici : 
http://telechargement.zebulon.fr/138-hijackthis-1991.html 

 Dézippe  le dans un dossier 
Par exemple C:\hijackthis < Enregistre le bien dans c:\

Lance le puis: 
clique sur  "do a system scan and save logfile"  
faire un copier coller du log et le poster sur le forum

Tuto ici: http://cybersecurite.xooit.com/t138-HijackThis-2-0-2.htm

_____________________________________________________

++

Pikin · Answer

Re bonjour, 

Ci joint le rapport Hijack ...

  Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:59:06, on 13/02/2008
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\VM_STI.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\userinit.exe,userinit.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {73BEBA23-DCCA-478A-983D-FB2C853A4E82} - C:\WINDOWS\System32\comctl3.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE Philips SPC315NC Webcam
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\RunServices: [MS Java for Windows XP & NT] javanet.exe
O4 - HKLM\..\RunServices: [Sun Java Console for Windows NT & XP] jconsole.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\RunServices: [MS Java for Windows XP & NT] javanet.exe
O4 - HKCU\..\RunServices: [Sun Java Console for Windows NT & XP] jconsole.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunServices: [MS Java for Windows XP & NT] javanet.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunServices: [MS Java for Windows XP & NT] javanet.exe (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\AIM.EXE (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS
ppdf32.dll
O16 - DPF: {5392B545-31A5-4724-BEF3-4FED1D56FDAC} (CPlayFirstDinerDash2_frControl Object) - http://gamenextfr.oberon-media.com//online/online2/diner_dash_2/DinerDash2_fr.1.0.0.70.cab
O16 - DPF: {BAE1D8DF-0B35-47E3-A1E7-EEB3FF2ECD19} (CPlayFirstddfotgControl Object) - http://gamenextfr.oberon-media.com/online/online2/diner_dash_flo_on_the_go/ddfotg.1.0.0.33.cab
O16 - DPF: {DC75FEF6-165D-4D25-A518-C8C4BDA7BAA6} (CPlayFirstDinerDashControl Object) - http://gamenextfr.oberon-media.com/online/online2/diner_dash/DinerDash.1.0.0.80.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

Saiyen75 · Answer

Salut,

Avant toute chose, 
Met à jour ta version de XP ----> SP2
Et ta version d'Internet Explorer :

met à jour Internet Explorer 7.0:
https://www.01net.com/telecharger/windows/Internet/navigateur/fiches/33081.html

_____________________________________________________

Aprés post le rapport HijackThis.

++

Pikin · Answer

Ca y est après quelques difficultés de mise à jour, ci-joint le rapport hijack pour avis...

Merci bcp 

   Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:17:25, on 13/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\VM_STI.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.01net.com/telecharger/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.01net.com/telecharger/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.01net.com/telecharger/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {73BEBA23-DCCA-478A-983D-FB2C853A4E82} - C:\WINDOWS\System32\comctl3.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE Philips SPC315NC Webcam
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\RunServices: [MS Java for Windows XP & NT] javanet.exe
O4 - HKLM\..\RunServices: [Sun Java Console for Windows NT & XP] jconsole.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunServices: [MS Java for Windows XP & NT] javanet.exe
O4 - HKCU\..\RunServices: [Sun Java Console for Windows NT & XP] jconsole.exe
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\System32\Macromed\Flash\FlashUtil9b.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunServices: [MS Java for Windows XP & NT] javanet.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunServices: [MS Java for Windows XP & NT] javanet.exe (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\AIM.EXE (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS
ppdf32.dll
O16 - DPF: {5392B545-31A5-4724-BEF3-4FED1D56FDAC} (CPlayFirstDinerDash2_frControl Object) - http://gamenextfr.oberon-media.com//online/online2/diner_dash_2/DinerDash2_fr.1.0.0.70.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {BAE1D8DF-0B35-47E3-A1E7-EEB3FF2ECD19} (CPlayFirstddfotgControl Object) - http://gamenextfr.oberon-media.com/online/online2/diner_dash_flo_on_the_go/ddfotg.1.0.0.33.cab
O16 - DPF: {DC75FEF6-165D-4D25-A518-C8C4BDA7BAA6} (CPlayFirstDinerDashControl Object) - http://gamenextfr.oberon-media.com/online/online2/diner_dash/DinerDash.1.0.0.80.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

Saiyen75 · Answer

Re,

Ok trés bien, niveau sécurité c'est déjà un gros plus.

Ensuite :


SDFix :

Télécharger sur le bureau :
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

= Double-clic SDFix. 
= Clic Install 

= Redémarrer en mode Sans Échec (le démarrage peut prendre plusieurs minutes).
Attention, pas d’accès à internet dans ce mode. Enregistrer ou imprimer les consignes. 

Pour démarrer en mode sans échec : 

1/ -Démarrez Windows, ou s’il s’exécute, fermez Windows puis éteignez l'ordinateur. 
2/ -Redémarrez l’ordinateur.
3/ -Au début du chargement du BIOS (mais pas trop tôt), commencez à appuyer sur la touche F8 de votre clavier plusieurs fois de suite. Procédez ainsi jusqu'à ce que le menu des options avancées de Windows apparaissent.
4/ -En utilisant les flèches de votre clavier, sélectionnez "Mode sans échec" dans le menu puis appuyez sur Entrée.

Une fois sous windows :

------ 
= Double-clic SDFix. 
= Clic Install 
= Double-clic sur le nouveau dossier SDFix qui est dans C:\ 
= Double-clic RunThis 
= Presser Y 
= A l’invitation ==> appuyer sur une touche pour redémarrer 
= Redémarrage ( qui sera plus long ,car nettoyage en cours ) 
Continuer si un message d’erreurs apparaît ,dans ce cas aller directement au rapport dans SDfix 
= apparition de Finished 
= Appuyer sur une touche 
= Dans SDFix , un rapport est généré, Report.txt
= Copier/Coller sur le forum.

_____________________________________________________

VundoFix :

Télécharge VundoFix.exe sur ton Bureau. 
http://www.atribune.org/ccount/click.php?id=4 

Double-clique VundoFix.exe afin de le lancer. 
Coche Run VundoFix as a task. 
Un message t'avertira que l'outil va se fermer et s'ouvrir à nouveau : clique Ok 
Clique sur le bouton Scan for Vundo. 
Lorsque le scan est complété, clique sur le bouton Remove Vundo. 
Une invite te demandera si tu veux supprimer les fichiers, clique YES 
Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers. 
Tu verras une invite qui t'annonce que ton PC va s'éteindre ("shutdown") ; clique OK 
Démarre ton PC à nouveau. 
Copie/colle le contenu du rapport situé dans C:\vundofix.txt ainsi qu'un nouveau rapport HijackThis! dans ta prochaine réponse. 

_____________________________________________________

Un fois que tu as les rapports, post les puis enchaine avec la désinstallation d'Avast, et l'installation d'Antivir :
Comparatif (par Malekal) pour comprendre : http://forum.malekal.com/ftopic3528.php
_____________________________________________________


Pour Désinstaller Avast : 

il faut le désinstaller à partir d'un prog : 

https://www.avast.com/fr-fr/uninstall-utility 

_____________________________________________________

Pour installer Antivir : 

Telecharge Antivir:  http://www.commentcamarche.net/telecharger/telecharger 55 antivir 

Installe le. 
Pendant l'installation, cocher la case "generate random serial..."
Lance Antivir, 
fais les mises à jours, puis lance un scan (si des virus sont découverts, mets les en quarantaine. Si tu ne peux pas alors supprime les). 
A la fin du scan clique sur 'report', enregistre ce rapport sur le bureau (fichier => enregistrer sous), puis fait un copier/coller de ce rapport dans ton prochain message. 

----> Relance ton PC 


Tutos : https://www.malekal.com/avira-free-security-antivirus-gratuit/

Si problème - mise à jour :
Telecharge la licence sur le site officiel :
http://dl1.avgate.net/down/windows/hbedv.key
Une fois telechargé, déplace le fichier téléchargé (hbedv.key) dans le dossier Antivir. 
Par defaut : C:\Program Files\AntiVir PersonalEdition Classic

Refait la mise à jour, puis il ne sera plus périmé.
Et fait le scan comme indiqué plus haut.

_____________________________________________________

Ca parait trés long, mais c'est que les opérations sont détaillés.

++

Pikin · Answer

Voici pour SDFix...


    
SDFix: Version 1.141

Run by latife on 13/02/2008 at 15:48

Microsoft Windows XP [version 5.1.2600]

Running From: C:\DOCUME~1\latife\Bureau\SDFix

Safe Mode:
Checking Services: 

Name:
ctxeovay

Path:
system32\drivers	hdoqqbh.dat 

ctxeovay - Deleted



Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...

Service ctxeovay - Deleted after Reboot

Normal Mode:
Checking Files: 

Trojan Files Found:

C:\WINDOWS\system32\drivers	hdoqqbh.dat - Deleted
C:\WINDOWS\SYSTEM32\J.EXE - Deleted
C:\WINDOWS\SYSTEM32\Z.EXE - Deleted
C:\WINDOWS\SYSTEM32\COMCTL3.DLL - Deleted
C:\WINDOWS\Downloaded Program Files\UGDCFR_0001_N122M0712NetInstaller.exe - Deleted
C:\WINDOWS\system32\TFTP1828 - Deleted
C:\WINDOWS\system32\.exe  - Deleted
C:\WINDOWS\system32\z.exe  - Deleted





Removing Temp Files...

ADS Check:
 


                                 Final Check:

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-13 16:01:09
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

C:\WINDOWS\SoftwareDistribution\Download\9c112f9fe737a2dbcc7e8bb2c8d04126
C:\WINDOWS\SoftwareDistribution\Download\9c112f9fe737a2dbcc7e8bb2c8d04126\_downloadprogress_.state 4 bytes
C:\WINDOWS\SoftwareDistribution\Download\9c112f9fe737a2dbcc7e8bb2c8d04126\_usedelta_.state 34 bytes
C:\WINDOWS\SoftwareDistribution\Download\9fc9db2b14f84a4407c2eebb504e6ed1
C:\WINDOWS\SoftwareDistribution\Download\9fc9db2b14f84a4407c2eebb504e6ed1\_downloadprogress_.state 4 bytes
C:\WINDOWS\SoftwareDistribution\Download\9fc9db2b14f84a4407c2eebb504e6ed1\_usedelta_.state 34 bytes
C:\WINDOWS\SoftwareDistribution\Download\a0141e73bbc406d3a6adf116f2c9aae1
C:\WINDOWS\SoftwareDistribution\Download\a0141e73bbc406d3a6adf116f2c9aae1\_downloadprogress_.state 4 bytes
C:\WINDOWS\SoftwareDistribution\Download\a0141e73bbc406d3a6adf116f2c9aae1\_usedelta_.state 34 bytes
C:\WINDOWS\SoftwareDistribution\Download\a97bd412ef78c20b97d5d1e3965f7491
C:\WINDOWS\SoftwareDistribution\Download\a97bd412ef78c20b97d5d1e3965f7491\_downloadprogress_.state 4 bytes
C:\WINDOWS\SoftwareDistribution\Download\a97bd412ef78c20b97d5d1e3965f7491\_usedelta_.state 34 bytes
C:\WINDOWS\SoftwareDistribution\Download\63d24d8d47da118138382ddd3268b368
C:\WINDOWS\SoftwareDistribution\Download\63d24d8d47da118138382ddd3268b368\_downloadprogress_.state 4 bytes
C:\WINDOWS\SoftwareDistribution\Download\63d24d8d47da118138382ddd3268b368\_usedelta_.state 34 bytes
C:\WINDOWS\SoftwareDistribution\Download\656c92fcd66b00f9a3fa9acad9d3bf1a
C:\WINDOWS\SoftwareDistribution\Download\656c92fcd66b00f9a3fa9acad9d3bf1a\_downloadprogress_.state 4 bytes
C:\WINDOWS\SoftwareDistribution\Download\656c92fcd66b00f9a3fa9acad9d3bf1a\_usedelta_.state 34 bytes
C:\WINDOWS\SoftwareDistribution\Download\699e24e86f6415432011025cecec293a
C:\WINDOWS\SoftwareDistribution\Download\699e24e86f6415432011025cecec293a\_downloadprogress_.state 4 bytes
C:\WINDOWS\SoftwareDistribution\Download\699e24e86f6415432011025cecec293a\_usedelta_.state 34 bytes
C:\WINDOWS\SoftwareDistribution\Download\74e9f428b65f24096f98956842c7b924
C:\WINDOWS\KB941568.log 3446 bytes
C:\WINDOWS\KB890046.log 4375 bytes
C:\WINDOWS\KB896358.log 4838 bytes
C:\WINDOWS\KB896423.log 4413 bytes
C:\WINDOWS\KB900725.log 3363 bytes
C:\WINDOWS\KB901214.log 3794 bytes
C:\WINDOWS\KB905414.log 3908 bytes
C:\WINDOWS\KB905749.log 2986 bytes
C:\WINDOWS\KB908519.log 2643 bytes
C:\WINDOWS\KB913580.log 2882 bytes
C:\WINDOWS\KB914389.log 3465 bytes
C:\WINDOWS\KB918118.log 3561 bytes
C:\WINDOWS\KB918439.log 4469 bytes
C:\WINDOWS\KB919007.log 4010 bytes
C:\WINDOWS\KB920670.log 4579 bytes
C:\WINDOWS\KB920872.log 4665 bytes
C:\WINDOWS\KB925902.log 4716 bytes
C:\WINDOWS\KB930178.log 4121 bytes
C:\WINDOWS\KB930916.log 3098 bytes
C:\WINDOWS\KB935840.log 3211 bytes
C:\Documents and Settings\latife\Local Settings\Temporary Internet Files\Content.IE5\QP1URIDO\gmail[1].: 1047 bytes hidden from API

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 43


Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype. Take a deep breath "

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

Remaining Files:
---------------

File Backups: - C:\DOCUME~1\latife\Bureau\SDFix\backups\backups.zip

Files with Hidden Attributes:

Fri 16 Mar 2007     5,355,320 A..H. --- "C:\Program Files\Picasa2\setup.exe"
Sun 30 Nov 2003         4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Sun 30 Nov 2003         4,348 A..H. --- "C:\Program Files\Wanadoo\Latifa NOUJOUM\Sauvegarde de la licence\drmv1key.bak"
Sat 31 Jan 2004            20 A..H. --- "C:\Program Files\Wanadoo\Latifa NOUJOUM\Sauvegarde de la licence\drmv1lic.bak"
Fri 16 Jan 2004           400 A..H. --- "C:\Program Files\Wanadoo\Latifa NOUJOUM\Sauvegarde de la licence\drmv2key.bak"
Sat 31 Jan 2004         1,536 A..H. --- "C:\Program Files\Wanadoo\Latifa NOUJOUM\Sauvegarde de la licence\drmv2lic.bak"
Sun 30 Nov 2003         4,348 A..H. --- "C:\Program Files\Wanadoo\Latifa NOUJOUM\Ma musique\Sauvegarde de la licence\drmv1key.bak"
Tue  2 Aug 2005            20 A..H. --- "C:\Program Files\Wanadoo\Latifa NOUJOUM\Ma musique\Sauvegarde de la licence\drmv1lic.bak"
Fri 16 Jan 2004           400 A.SH. --- "C:\Program Files\Wanadoo\Latifa NOUJOUM\Ma musique\Sauvegarde de la licence\drmv2key.bak"
Sun 30 Nov 2003         4,348 ...H. --- "C:\Program Files\Wanadoo\Utilisateur1\Ma musique\Sauvegarde de la licence\drmv1key.bak"
Wed 31 Jan 2007            20 A..H. --- "C:\Program Files\Wanadoo\Utilisateur1\Ma musique\Sauvegarde de la licence\drmv1lic.bak"
Fri 16 Jan 2004           400 A.SH. --- "C:\Program Files\Wanadoo\Utilisateur1\Ma musique\Sauvegarde de la licence\drmv2key.bak"
Wed 13 Feb 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\06610cab6d433e28e3786b6f4f2daf47\download\BIT99.tmp"
Wed 13 Feb 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\098219b4e8f2ef50f602517142a31237\download\BIT95.tmp"
Wed 13 Feb 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\184e9e50ae9fd7c95e99fc939967f16c\download\BIT9A.tmp"
Wed 13 Feb 2008        69,422 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\3fc4c48da845525f8f6c17a5f84323c2\download\BIT63.tmp"
Wed 13 Feb 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\5c6b46191661d86eff922cf2abc5383c\download\BIT97.tmp"
Wed 13 Feb 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\95fd4748e09823949a480f46a1d6e744\download\BIT98.tmp"
Wed 13 Feb 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\991b431aaac91158a60549d9003044fd\download\BIT96.tmp"
Wed 13 Feb 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\b437c563a57eb239b9adbb6181d9e57b\download\BIT91.tmp"
Tue  7 Aug 2007       395,054 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\b4e36ed2c9cf1a2608125d0f62467888\download\BIT8F.tmp"
Wed 13 Feb 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\b7a39c6d6693d1f3598adcd01ab559a0\download\BIT94.tmp"
Wed 13 Feb 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\cc0dcdff9ecf4bee0a8ff8d3fea71393\download\BIT93.tmp"
Wed 13 Feb 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\dc26aa093cda188e55518398937b3343\download\BIT92.tmp"
Wed 13 Feb 2008       322,708 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\dedd59f165d16967c81b4410c77412ff\download\BIT69.tmp"
Wed  8 Feb 2006         8,722 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\fc4435e0f8f00166afca314c45417b4f\download\BIT90.tmp"

Finished!

Pikin · Answer

Pas moyen de télécharger Vundofix... Le site atribune ne mene à rien???

Saiyen75 · Answer

Ok trés bien,
Pas grave pour vundo,

bitdefender en ligne : 

Utilise Internet Explorer
accepte l'active X
la barre anti pop-up du SP2 (en haut) se met à clignoter, clic dessus et choisis "accepter l'active X"

http://www.bitdefender.fr/scan_fr/scan8/ie.html 

- Cliquer sur J'accepte
- Start Scan
- Une fois terminé, Dans l'onglet "Problèmes détectés"
- "Cliquer ici pour exporter le rapport"
- Enregistrer sur le bureau (choisir un nom)
- Fermer le scan
- Ouvrir le fichier enregistré le copier/coller sur le forum.

_____________________________________________________

Post le rapport ainsi qu'un nouveau log HijackThis.

++

Pikin · Answer

Re bonjour, 

Après queqlues péripéties, ci-joint le rapport BitDefender...

Pour avis SVP




BitDefender Online Scanner
  
  
 
Rapport d'analyse généré à: Thu, Feb 14, 2008 - 10:53:02
 
 
  
  
 
Voie d'analyse: A:\;C:\;D:\;
  
  
 
 
  
  
 
Statistiques
 
Temps
 01:59:33
 
Fichiers
 170065
 
Directoires
 4120
 
Secteurs de boot
 2
 
Archives
 12527
 
Paquets programmes
 9202
 
  
  
 
Résultats
 
Virus identifiés
 14
 
Fichiers infectés
 67
 
Fichiers suspects
 0
 
Avertissements
 0
 
Désinfectés
 1
 
Fichiers effacés
 66
 
  
  
 
Info sur les moteurs
 
Définition virus
 897141
 
Version des moteurs
 AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)
 
Analyse des plugins
 14
 
Archive des plugins
 38
 
Unpack des plugins
 7
 
E-mail plugins
 6
 
Système plugins
 1
 
  
  
 
Paramètres d'analyse
 
Première action
 Désinfecté
 
Seconde Action
 Supprimé
 
Heuristique
 Oui
 
Acceptez les avertissements
 Oui
 
Extensions analysées
 *;
 
Excludez les extensions
  
 
Analyse d'emails
 Oui
 
Analyse des Archives
 Oui
 
Analyser paquets programmes
 Oui
 
Analyse des fichiers
 Oui
 
Analyse de boot
 Oui
 
  
  
 
  Fichier analysé
  Statut
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Boîte de réception.dbx=>(message 259)=>[Subject: Re: Thanks!][Date: Thu, 15 Jul 2004 10:10:22 +0200]=>(MIME part)=>message_part2.pif
 Infecté par: Win32.Netsky.D@mm
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Boîte de réception.dbx=>(message 259)=>[Subject: Re: Thanks!][Date: Thu, 15 Jul 2004 10:10:22 +0200]=>(MIME part)=>message_part2.pif
 Echec de la désinfection
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Boîte de réception.dbx=>(message 259)=>[Subject: Re: Thanks!][Date: Thu, 15 Jul 2004 10:10:22 +0200]=>(MIME part)=>message_part2.pif
 Supprimé
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Boîte de réception.dbx=>(message 259)=>[Subject: Re: Thanks!][Date: Thu, 15 Jul 2004 10:10:22 +0200]=>(MIME part)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Boîte de réception.dbx=>(message 259)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Boîte de réception.dbx
 Echec de la mise à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Boîte de réception.dbx=>(message 282)=>[Subject: Undelivered Mail Returned to Sender][Date: Mon, 19 Apr 2004 11:13:01 +0200 (CEST)]=>(MIME part)=>(message)=>[Subject: Re: Thanks!][Date: Mon, 19 Apr 2004 11:13:02 +0200]=>(MIME part)=>message_part2.pif
 Infecté par: Win32.Netsky.D@mm
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Boîte de réception.dbx=>(message 282)=>[Subject: Undelivered Mail Returned to Sender][Date: Mon, 19 Apr 2004 11:13:01 +0200 (CEST)]=>(MIME part)=>(message)=>[Subject: Re: Thanks!][Date: Mon, 19 Apr 2004 11:13:02 +0200]=>(MIME part)=>message_part2.pif
 Echec de la désinfection
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Boîte de réception.dbx=>(message 282)=>[Subject: Undelivered Mail Returned to Sender][Date: Mon, 19 Apr 2004 11:13:01 +0200 (CEST)]=>(MIME part)=>(message)=>[Subject: Re: Thanks!][Date: Mon, 19 Apr 2004 11:13:02 +0200]=>(MIME part)=>message_part2.pif
 Supprimé
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Boîte de réception.dbx=>(message 282)=>[Subject: Undelivered Mail Returned to Sender][Date: Mon, 19 Apr 2004 11:13:01 +0200 (CEST)]=>(MIME part)=>(message)=>[Subject: Re: Thanks!][Date: Mon, 19 Apr 2004 11:13:02 +0200]=>(MIME part)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Boîte de réception.dbx=>(message 282)=>[Subject: Undelivered Mail Returned to Sender][Date: Mon, 19 Apr 2004 11:13:01 +0200 (CEST)]=>(MIME part)=>(message)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Boîte de réception.dbx=>(message 282)=>[Subject: Undelivered Mail Returned to Sender][Date: Mon, 19 Apr 2004 11:13:01 +0200 (CEST)]=>(MIME part)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Boîte de réception.dbx=>(message 282)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Boîte de réception.dbx
 Echec de la mise à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Boîte de réception.dbx=>(message 297)=>[Subject: Re: Your music][Date: Mon, 29 Mar 2004 09:10:07 +0200]=>(MIME part)=>mp3music.pif
 Infecté par: Win32.Netsky.D@mm
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Boîte de réception.dbx=>(message 297)=>[Subject: Re: Your music][Date: Mon, 29 Mar 2004 09:10:07 +0200]=>(MIME part)=>mp3music.pif
 Echec de la désinfection
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Boîte de réception.dbx=>(message 297)=>[Subject: Re: Your music][Date: Mon, 29 Mar 2004 09:10:07 +0200]=>(MIME part)=>mp3music.pif
 Supprimé
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Boîte de réception.dbx=>(message 297)=>[Subject: Re: Your music][Date: Mon, 29 Mar 2004 09:10:07 +0200]=>(MIME part)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Boîte de réception.dbx=>(message 297)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Boîte de réception.dbx
 Echec de la mise à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Boîte de réception.dbx=>(message 375)=>[Subject: ][Date: Wed, 28 Jan 2004 09:24:43 +0100]=>(MIME part)=>doc.zip=>doc.exe
 Infecté par: Win32.Novarg.A@mm
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Boîte de réception.dbx=>(message 375)=>[Subject: ][Date: Wed, 28 Jan 2004 09:24:43 +0100]=>(MIME part)=>doc.zip=>doc.exe
 Supprimé
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Boîte de réception.dbx=>(message 375)=>[Subject: ][Date: Wed, 28 Jan 2004 09:24:43 +0100]=>(MIME part)=>doc.zip
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Boîte de réception.dbx=>(message 375)=>[Subject: ][Date: Wed, 28 Jan 2004 09:24:43 +0100]=>(MIME part)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Boîte de réception.dbx=>(message 375)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Boîte de réception.dbx
 Echec de la mise à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 557)=>[Subject: Re: Your bill][Date: Mon, 5 Apr 2004 08:52:57 +0200]=>(MIME part)=>your_bill.pif
 Infecté par: Win32.Netsky.D@mm
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 557)=>[Subject: Re: Your bill][Date: Mon, 5 Apr 2004 08:52:57 +0200]=>(MIME part)=>your_bill.pif
 Echec de la désinfection
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 557)=>[Subject: Re: Your bill][Date: Mon, 5 Apr 2004 08:52:57 +0200]=>(MIME part)=>your_bill.pif
 Supprimé
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 557)=>[Subject: Re: Your bill][Date: Mon, 5 Apr 2004 08:52:57 +0200]=>(MIME part)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 557)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
 Echec de la mise à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 750)=>[Subject: Undelivered Mail Returned to Sender][Date: Mon, 1 Nov 2004 16:50:01 +0100 (CET)]=>(MIME part)=>(message)=>[Subject: Re: Excel file][Date: Mon, 1 Nov 2004 16:49:58 +0100]=>(MIME part)=>document_excel.pif
 Infecté par: Win32.Netsky.D@mm
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 750)=>[Subject: Undelivered Mail Returned to Sender][Date: Mon, 1 Nov 2004 16:50:01 +0100 (CET)]=>(MIME part)=>(message)=>[Subject: Re: Excel file][Date: Mon, 1 Nov 2004 16:49:58 +0100]=>(MIME part)=>document_excel.pif
 Echec de la désinfection
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 750)=>[Subject: Undelivered Mail Returned to Sender][Date: Mon, 1 Nov 2004 16:50:01 +0100 (CET)]=>(MIME part)=>(message)=>[Subject: Re: Excel file][Date: Mon, 1 Nov 2004 16:49:58 +0100]=>(MIME part)=>document_excel.pif
 Supprimé
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 750)=>[Subject: Undelivered Mail Returned to Sender][Date: Mon, 1 Nov 2004 16:50:01 +0100 (CET)]=>(MIME part)=>(message)=>[Subject: Re: Excel file][Date: Mon, 1 Nov 2004 16:49:58 +0100]=>(MIME part)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 750)=>[Subject: Undelivered Mail Returned to Sender][Date: Mon, 1 Nov 2004 16:50:01 +0100 (CET)]=>(MIME part)=>(message)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 750)=>[Subject: Undelivered Mail Returned to Sender][Date: Mon, 1 Nov 2004 16:50:01 +0100 (CET)]=>(MIME part)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 750)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
 Echec de la mise à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 757)=>[Subject: Re: Hello][Date: Tue, 05 Oct 2004 11:44:49 +0100]=>(MIME part)=>price.com
 Infecté par: Win32.Bagle.AS@mm
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 757)=>[Subject: Re: Hello][Date: Tue, 05 Oct 2004 11:44:49 +0100]=>(MIME part)=>price.com
 Supprimé
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 757)=>[Subject: Re: Hello][Date: Tue, 05 Oct 2004 11:44:49 +0100]=>(MIME part)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 757)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
 Echec de la mise à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 761)=>[Subject: oh][Date: Thu, 14 Oct 2004 12:53:07 +0200]=>(MIME part)=>ps_death.htm.com
 Infecté par: Win32.Netsky.C@mm
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 761)=>[Subject: oh][Date: Thu, 14 Oct 2004 12:53:07 +0200]=>(MIME part)=>ps_death.htm.com
 Supprimé
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 761)=>[Subject: oh][Date: Thu, 14 Oct 2004 12:53:07 +0200]=>(MIME part)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 761)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
 Echec de la mise à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 763)=>[Subject: Undelivered Mail Returned to Sender][Date: Wed, 13 Oct 2004 15:33:54 +0200 (CEST)]=>(MIME part)=>(message)=>[Subject: Re: hi][Date: Wed, 13 Oct 2004 15:33:51 +0200]=>(MIME part)=>sexy.htm.com
 Infecté par: Win32.Generic.3143
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 763)=>[Subject: Undelivered Mail Returned to Sender][Date: Wed, 13 Oct 2004 15:33:54 +0200 (CEST)]=>(MIME part)=>(message)=>[Subject: Re: hi][Date: Wed, 13 Oct 2004 15:33:51 +0200]=>(MIME part)=>sexy.htm.com
 Echec de la désinfection
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 763)=>[Subject: Undelivered Mail Returned to Sender][Date: Wed, 13 Oct 2004 15:33:54 +0200 (CEST)]=>(MIME part)=>(message)=>[Subject: Re: hi][Date: Wed, 13 Oct 2004 15:33:51 +0200]=>(MIME part)=>sexy.htm.com
 Supprimé
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 763)=>[Subject: Undelivered Mail Returned to Sender][Date: Wed, 13 Oct 2004 15:33:54 +0200 (CEST)]=>(MIME part)=>(message)=>[Subject: Re: hi][Date: Wed, 13 Oct 2004 15:33:51 +0200]=>(MIME part)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 763)=>[Subject: Undelivered Mail Returned to Sender][Date: Wed, 13 Oct 2004 15:33:54 +0200 (CEST)]=>(MIME part)=>(message)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 763)=>[Subject: Undelivered Mail Returned to Sender][Date: Wed, 13 Oct 2004 15:33:54 +0200 (CEST)]=>(MIME part)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 763)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
 Echec de la mise à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 764)=>[Subject: you?][Date: Tue, 12 Oct 2004 12:46:35 +0200]=>(MIME part)=>attachment.zip=>attachment.doc.exe
 Infecté par: Win32.Netsky.C@mm
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 764)=>[Subject: you?][Date: Tue, 12 Oct 2004 12:46:35 +0200]=>(MIME part)=>attachment.zip=>attachment.doc.exe
 Supprimé
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 764)=>[Subject: you?][Date: Tue, 12 Oct 2004 12:46:35 +0200]=>(MIME part)=>attachment.zip
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 764)=>[Subject: you?][Date: Tue, 12 Oct 2004 12:46:35 +0200]=>(MIME part)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 764)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
 Echec de la mise à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 767)=>[Subject: Re: Thanks :)][Date: Fri, 08 Oct 2004 14:26:37 +0100]=>(MIME part)=>price.cpl
 Infecté par: Win32.Bagle.10.Gen@mm
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 767)=>[Subject: Re: Thanks :)][Date: Fri, 08 Oct 2004 14:26:37 +0100]=>(MIME part)=>price.cpl
 Echec de la désinfection
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 767)=>[Subject: Re: Thanks :)][Date: Fri, 08 Oct 2004 14:26:37 +0100]=>(MIME part)=>price.cpl
 Supprimé
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 767)=>[Subject: Re: Thanks :)][Date: Fri, 08 Oct 2004 14:26:37 +0100]=>(MIME part)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 767)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
 Echec de la mise à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 769)=>[Subject: Re: Hello][Date: Fri, 08 Oct 2004 00:51:28 +0100]=>(MIME part)=>price.com
 Infecté par: Win32.Bagle.AS@mm
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 769)=>[Subject: Re: Hello][Date: Fri, 08 Oct 2004 00:51:28 +0100]=>(MIME part)=>price.com
 Supprimé
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 769)=>[Subject: Re: Hello][Date: Fri, 08 Oct 2004 00:51:28 +0100]=>(MIME part)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 769)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
 Echec de la mise à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 771)=>[Subject: Re: Thank you!][Date: Thu, 07 Oct 2004 01:36:51 +0100]=>(MIME part)=>Price.cpl
 Infecté par: Win32.Bagle.10.Gen@mm
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 771)=>[Subject: Re: Thank you!][Date: Thu, 07 Oct 2004 01:36:51 +0100]=>(MIME part)=>Price.cpl
 Echec de la désinfection
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 771)=>[Subject: Re: Thank you!][Date: Thu, 07 Oct 2004 01:36:51 +0100]=>(MIME part)=>Price.cpl
 Supprimé
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 771)=>[Subject: Re: Thank you!][Date: Thu, 07 Oct 2004 01:36:51 +0100]=>(MIME part)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 771)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
 Echec de la mise à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 772)=>[Subject: Re: Thanks :)][Date: Wed, 06 Oct 2004 15:49:11 +0100]=>(MIME part)=>price.cpl
 Infecté par: Win32.Bagle.10.Gen@mm
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 772)=>[Subject: Re: Thanks :)][Date: Wed, 06 Oct 2004 15:49:11 +0100]=>(MIME part)=>price.cpl
 Echec de la désinfection
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 772)=>[Subject: Re: Thanks :)][Date: Wed, 06 Oct 2004 15:49:11 +0100]=>(MIME part)=>price.cpl
 Supprimé
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 772)=>[Subject: Re: Thanks :)][Date: Wed, 06 Oct 2004 15:49:11 +0100]=>(MIME part)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 772)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
 Echec de la mise à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 773)=>[Subject: Re:][Date: Wed, 06 Oct 2004 12:39:54 +0100]=>(MIME part)=>price.com
 Infecté par: Win32.Bagle.AS@mm
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 773)=>[Subject: Re:][Date: Wed, 06 Oct 2004 12:39:54 +0100]=>(MIME part)=>price.com
 Supprimé
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 773)=>[Subject: Re:][Date: Wed, 06 Oct 2004 12:39:54 +0100]=>(MIME part)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 773)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
 Echec de la mise à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 774)=>[Subject: Re: Thanks :)][Date: Wed, 06 Oct 2004 12:24:38 +0100]=>(MIME part)=>Joke.com
 Infecté par: Win32.Bagle.AS@mm
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 774)=>[Subject: Re: Thanks :)][Date: Wed, 06 Oct 2004 12:24:38 +0100]=>(MIME part)=>Joke.com
 Supprimé
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 774)=>[Subject: Re: Thanks :)][Date: Wed, 06 Oct 2004 12:24:38 +0100]=>(MIME part)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 774)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
 Echec de la mise à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 775)=>[Subject: Re: Thank you!][Date: Wed, 06 Oct 2004 11:41:55 +0100]=>(MIME part)=>price.com
 Infecté par: Win32.Bagle.AS@mm
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 775)=>[Subject: Re: Thank you!][Date: Wed, 06 Oct 2004 11:41:55 +0100]=>(MIME part)=>price.com
 Supprimé
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 775)=>[Subject: Re: Thank you!][Date: Wed, 06 Oct 2004 11:41:55 +0100]=>(MIME part)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 775)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
 Echec de la mise à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 776)=>[Subject: Re: Thank you!][Date: Wed, 06 Oct 2004 11:25:17 +0100]=>(MIME part)=>Joke.com
 Infecté par: Win32.Bagle.AS@mm
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 776)=>[Subject: Re: Thank you!][Date: Wed, 06 Oct 2004 11:25:17 +0100]=>(MIME part)=>Joke.com
 Supprimé
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 776)=>[Subject: Re: Thank you!][Date: Wed, 06 Oct 2004 11:25:17 +0100]=>(MIME part)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 776)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
 Echec de la mise à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 779)=>[Subject: Re: Thank you!][Date: Tue, 05 Oct 2004 17:31:09 +0100]=>(MIME part)=>price.scr
 Infecté par: Win32.Bagle.AS@mm
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 779)=>[Subject: Re: Thank you!][Date: Tue, 05 Oct 2004 17:31:09 +0100]=>(MIME part)=>price.scr
 Supprimé
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 779)=>[Subject: Re: Thank you!][Date: Tue, 05 Oct 2004 17:31:09 +0100]=>(MIME part)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 779)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
 Echec de la mise à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 780)=>[Subject: Re:][Date: Tue, 05 Oct 2004 17:15:10 +0100]=>(MIME part)=>Joke.scr
 Infecté par: Win32.Bagle.AS@mm
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 780)=>[Subject: Re:][Date: Tue, 05 Oct 2004 17:15:10 +0100]=>(MIME part)=>Joke.scr
 Supprimé
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 780)=>[Subject: Re:][Date: Tue, 05 Oct 2004 17:15:10 +0100]=>(MIME part)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 780)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
 Echec de la mise à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 781)=>[Subject: Re: Hello][Date: Tue, 05 Oct 2004 13:46:11 +0100]=>(MIME part)=>Price.cpl
 Infecté par: Win32.Bagle.10.Gen@mm
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 781)=>[Subject: Re: Hello][Date: Tue, 05 Oct 2004 13:46:11 +0100]=>(MIME part)=>Price.cpl
 Echec de la désinfection
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 781)=>[Subject: Re: Hello][Date: Tue, 05 Oct 2004 13:46:11 +0100]=>(MIME part)=>Price.cpl
 Supprimé
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 781)=>[Subject: Re: Hello][Date: Tue, 05 Oct 2004 13:46:11 +0100]=>(MIME part)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 781)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
 Echec de la mise à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 782)=>[Subject: Re: Thanks :)][Date: Tue, 05 Oct 2004 13:33:09 +0100]=>(MIME part)=>price.cpl
 Infecté par: Win32.Bagle.10.Gen@mm
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 782)=>[Subject: Re: Thanks :)][Date: Tue, 05 Oct 2004 13:33:09 +0100]=>(MIME part)=>price.cpl
 Echec de la désinfection
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 782)=>[Subject: Re: Thanks :)][Date: Tue, 05 Oct 2004 13:33:09 +0100]=>(MIME part)=>price.cpl
 Supprimé
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 782)=>[Subject: Re: Thanks :)][Date: Tue, 05 Oct 2004 13:33:09 +0100]=>(MIME part)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 782)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
 Echec de la mise à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 784)=>[Subject: Re: Hi][Date: Tue, 05 Oct 2004 11:35:45 +0100]=>(MIME part)=>Price.com
 Infecté par: Win32.Bagle.AS@mm
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 784)=>[Subject: Re: Hi][Date: Tue, 05 Oct 2004 11:35:45 +0100]=>(MIME part)=>Price.com
 Supprimé
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 784)=>[Subject: Re: Hi][Date: Tue, 05 Oct 2004 11:35:45 +0100]=>(MIME part)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 784)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
 Echec de la mise à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 817)=>[Subject: Re: Thanks!][Date: Thu, 10 Jun 2004 20:19:59 +0200]=>(MIME part)=>message_part2.pif
 Infecté par: Win32.Netsky.D@mm
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 817)=>[Subject: Re: Thanks!][Date: Thu, 10 Jun 2004 20:19:59 +0200]=>(MIME part)=>message_part2.pif
 Echec de la désinfection
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 817)=>[Subject: Re: Thanks!][Date: Thu, 10 Jun 2004 20:19:59 +0200]=>(MIME part)=>message_part2.pif
 Supprimé
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 817)=>[Subject: Re: Thanks!][Date: Thu, 10 Jun 2004 20:19:59 +0200]=>(MIME part)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 817)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
 Echec de la mise à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 835)=>[Subject: Postcard][Date: Thu, 5 Aug 2004 08:35:15 +0200]=>(MIME part)=>letter.doc 
 Infecté par: Win32.Netsky.P@mm
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 835)=>[Subject: Postcard][Date: Thu, 5 Aug 2004 08:35:15 +0200]=>(MIME part)=>letter.doc 
 Supprimé
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 835)=>[Subject: Postcard][Date: Thu, 5 Aug 2004 08:35:15 +0200]=>(MIME part)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 835)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
 Echec de la mise à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 861)=>[Subject: Re: My details][Date: Tue, 27 Jul 2004 11:24:11 +0200]=>(MIME part)=>my_details.pif
 Infecté par: Win32.Netsky.D@mm
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 861)=>[Subject: Re: My details][Date: Tue, 27 Jul 2004 11:24:11 +0200]=>(MIME part)=>my_details.pif
 Echec de la désinfection
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 861)=>[Subject: Re: My details][Date: Tue, 27 Jul 2004 11:24:11 +0200]=>(MIME part)=>my_details.pif
 Supprimé
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 861)=>[Subject: Re: My details][Date: Tue, 27 Jul 2004 11:24:11 +0200]=>(MIME part)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 861)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
 Echec de la mise à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 862)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Thu, 5 Aug 2004 08:35:08 +0200]=>(MIME part)=>(MIME part)=>(message body)
 Infecté par: Exploit.Iframe.Vulnerability.B
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 862)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Thu, 5 Aug 2004 08:35:08 +0200]=>(MIME part)=>(MIME part)=>(message body)
 Echec de la désinfection
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 862)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Thu, 5 Aug 2004 08:35:08 +0200]=>(MIME part)=>(MIME part)=>(message body)
 Supprimé
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 862)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Thu, 5 Aug 2004 08:35:08 +0200]=>(MIME part)=>(MIME part)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 862)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Thu, 5 Aug 2004 08:35:08 +0200]=>(MIME part)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 862)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 862)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Thu, 5 Aug 2004 08:35:08 +0200]=>(MIME part)=>message.scr
 Infecté par: Win32.Netsky.P@mm
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 862)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Thu, 5 Aug 2004 08:35:08 +0200]=>(MIME part)=>message.scr
 Supprimé
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 862)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Thu, 5 Aug 2004 08:35:08 +0200]=>(MIME part)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 862)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
 Echec de la mise à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 865)=>[Subject: Re: Re: your document][Date: Wed, 4 Aug 2004 10:37:44 +0200]=>(MIME part)=>document.txt.pif
 Infecté par: Win32.Netsky.P@mm
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 865)=>[Subject: Re: Re: your document][Date: Wed, 4 Aug 2004 10:37:44 +0200]=>(MIME part)=>document.txt.pif
 Supprimé
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 865)=>[Subject: Re: Re: your document][Date: Wed, 4 Aug 2004 10:37:44 +0200]=>(MIME part)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 865)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
 Echec de la mise à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 867)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Mon, 2 Aug 2004 02:13:28 +0200]=>(MIME part)=>(MIME part)=>(message body)
 Infecté par: Exploit.Iframe.Vulnerability.B
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 867)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Mon, 2 Aug 2004 02:13:28 +0200]=>(MIME part)=>(MIME part)=>(message body)
 Echec de la désinfection
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 867)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Mon, 2 Aug 2004 02:13:28 +0200]=>(MIME part)=>(MIME part)=>(message body)
 Supprimé
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 867)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Mon, 2 Aug 2004 02:13:28 +0200]=>(MIME part)=>(MIME part)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 867)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Mon, 2 Aug 2004 02:13:28 +0200]=>(MIME part)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 867)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 867)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Mon, 2 Aug 2004 02:13:28 +0200]=>(MIME part)=>message.scr
 Infecté par: Win32.Netsky.P@mm
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 867)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Mon, 2 Aug 2004 02:13:28 +0200]=>(MIME part)=>message.scr
 Supprimé
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 867)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Mon, 2 Aug 2004 02:13:28 +0200]=>(MIME part)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 867)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
 Echec de la mise à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 868)=>[Subject: Re: Error in document][Date: Mon, 2 Aug 2004 02:13:27 +0200]=>(MIME part)=>document.pif
 Infecté par: Win32.Netsky.P@mm
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 868)=>[Subject: Re: Error in document][Date: Mon, 2 Aug 2004 02:13:27 +0200]=>(MIME part)=>document.pif
 Supprimé
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 868)=>[Subject: Re: Error in document][Date: Mon, 2 Aug 2004 02:13:27 +0200]=>(MIME part)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 868)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
 Echec de la mise à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 869)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Sun, 1 Aug 2004 22:33:22 +0200]=>(MIME part)=>(MIME part)=>(message body)
 Infecté par: Exploit.Iframe.Vulnerability.B
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 869)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Sun, 1 Aug 2004 22:33:22 +0200]=>(MIME part)=>(MIME part)=>(message body)
 Echec de la désinfection
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 869)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Sun, 1 Aug 2004 22:33:22 +0200]=>(MIME part)=>(MIME part)=>(message body)
 Supprimé
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 869)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Sun, 1 Aug 2004 22:33:22 +0200]=>(MIME part)=>(MIME part)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 869)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Sun, 1 Aug 2004 22:33:22 +0200]=>(MIME part)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 869)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 869)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Sun, 1 Aug 2004 22:33:22 +0200]=>(MIME part)=>message.scr
 Infecté par: Win32.Netsky.P@mm
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 869)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Sun, 1 Aug 2004 22:33:22 +0200]=>(MIME part)=>message.scr
 Supprimé
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 869)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Sun, 1 Aug 2004 22:33:22 +0200]=>(MIME part)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 869)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
 Echec de la mise à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 872)=>[Subject: Re: important][Date: Fri, 30 Jul 2004 14:20:00 +0200]=>(MIME part)=>product.zip=>data.rtf .scr
 Infecté par: Win32.Netsky.P@mm
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 872)=>[Subject: Re: important][Date: Fri, 30 Jul 2004 14:20:00 +0200]=>(MIME part)=>product.zip=>data.rtf .scr
 Supprimé
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 872)=>[Subject: Re: important][Date: Fri, 30 Jul 2004 14:20:00 +0200]=>(MIME part)=>product.zip
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 872)=>[Subject: Re: important][Date: Fri, 30 Jul 2004 14:20:00 +0200]=>(MIME part)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 872)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
 Echec de la mise à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 873)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Fri, 30 Jul 2004 14:19:47 +0200]=>(MIME part)=>(MIME part)=>(message body)
 Infecté par: Exploit.Iframe.Vulnerability.B
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 873)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Fri, 30 Jul 2004 14:19:47 +0200]=>(MIME part)=>(MIME part)=>(message body)
 Echec de la désinfection
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 873)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Fri, 30 Jul 2004 14:19:47 +0200]=>(MIME part)=>(MIME part)=>(message body)
 Supprimé
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 873)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Fri, 30 Jul 2004 14:19:47 +0200]=>(MIME part)=>(MIME part)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 873)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Fri, 30 Jul 2004 14:19:47 +0200]=>(MIME part)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 873)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 873)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Fri, 30 Jul 2004 14:19:47 +0200]=>(MIME part)=>message.scr
 Infecté par: Win32.Netsky.P@mm
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 873)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Fri, 30 Jul 2004 14:19:47 +0200]=>(MIME part)=>message.scr
 Supprimé
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 873)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Fri, 30 Jul 2004 14:19:47 +0200]=>(MIME part)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 873)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx
 Echec de la mise à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 874)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Thu, 29 Jul 2004 18:24:24 +0200]=>(MIME part)=>(MIME part)=>(message body)
 Infecté par: Exploit.Iframe.Vulnerability.B
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 874)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Thu, 29 Jul 2004 18:24:24 +0200]=>(MIME part)=>(MIME part)=>(message body)
 Echec de la désinfection
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 874)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Thu, 29 Jul 2004 18:24:24 +0200]=>(MIME part)=>(MIME part)=>(message body)
 Supprimé
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 874)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Thu, 29 Jul 2004 18:24:24 +0200]=>(MIME part)=>(MIME part)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 874)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Thu, 29 Jul 2004 18:24:24 +0200]=>(MIME part)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 874)
 Mis à jour
 
C:\Documents and Settings\latife\Local Settings\Application Data\Identities\{8069AA75-9D96-480C-9B62-1596E05B445B}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 874)=>[Subject: Mail Delivery (failure latifa6@wanadoo][Date: Thu, 29 Jul 2004 18:24:24 +0200]=>(MIME part)=>message.scr
 Infecté par

Saiyen75 · Answer

Salut,

As tu fait le scan Antivir ?
Repost un log HijackThis,

puis :

- Télécharger et installer AVG Anti-Spyware 7.5 (si tu ne l'as pas déjà).

https://www.avg.com/en-ww/free-antivirus-download 

Lancer AVG Anti-Spyware. 
Cliquer sur le menu Mise à jour. 
Dans le paragraphe "Mise à jour manuelle", cliquer sur le bouton "Commencer la mise à jour". 
Attendre la fin de cette mise à jour puis fermer le programme. 


- Lance AVG Anti-Spyware 7.5 

Cliquer sur le menu" Analyse" (de la barre d'outils). 
Cliquer sur l'onglet "Paramètres". 
Dans "Comment réagir"? cliquer sur "Actions recommandées" et choisir "Quarantaine". 
Dans Comment faire l'analyse ? et dans Programmes potentiellement dangereux, vérifier que toutes les cases soient cochées. 
Vérifier que le bouton-radio "Générer un rapport après chaque analyse" soit aussi coché. 
Dans l'onglet "Analyse" 
Cliquer sur "Analyse complète du système". 
Important : Ne pas ouvrir de fenêtre, ne pas lancer de programme pendant l'exécution de AVG Anti-Spyware, car cela pourrait interférer avec le processus de recherche. 
Très important : A la fin de l'analyse, cocher tout ce qui a été trouvé puis cliquer sur " Appliquer toutes les actions" 
Ensuite. 
Cliquer sur "Enregistrer le rapport". Ceci génère un rapport en fichier texte qui se trouve dans le dossier Reports du dossier d'AVG Anti-Spyware. 
(C:\Programfiles\Grisoft\AVG Antispyware 7.5\Reports ) 
Puis fermer AVG Anti-Spyware. 

_____________________________________________________

Pikin · Answer

Salut, 

Voici pour le Hijack...


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:14:26, on 14/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\VM_STI.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.01net.com/telecharger/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.01net.com/telecharger/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.01net.com/telecharger/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE Philips SPC315NC Webcam
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-21-1538417202-1907411925-173008773-1003\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\AIM.EXE (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS
ppdf32.dll
O16 - DPF: {5392B545-31A5-4724-BEF3-4FED1D56FDAC} (CPlayFirstDinerDash2_frControl Object) - http://gamenextfr.oberon-media.com//online/online2/diner_dash_2/DinerDash2_fr.1.0.0.70.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {BAE1D8DF-0B35-47E3-A1E7-EEB3FF2ECD19} (CPlayFirstddfotgControl Object) - http://gamenextfr.oberon-media.com/online/online2/diner_dash_flo_on_the_go/ddfotg.1.0.0.33.cab
O16 - DPF: {DC75FEF6-165D-4D25-A518-C8C4BDA7BAA6} (CPlayFirstDinerDashControl Object) - http://gamenextfr.oberon-media.com/online/online2/diner_dash/DinerDash.1.0.0.80.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

Saiyen75 · Answer

Re,

Tu n'as pas répondu à ma question, tu as fait le scan Antivir ?


    Mets JAVA à jour :
https://www.java.com/fr/download/manual.jsp 
---------------------------------------------------------------------
Tester Java et autres players:
http://www.chemgapedia.de/vsengine/info/fr/help/requirements/java.html

_____________________________________________________ 

Fixe les lignes dans Hijackthis :

Relance HijackThis, choisis  "do a scan only"  coche la case devant les lignes ci-dessous et clic en bas sur "fix checked". 

O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\AIM.EXE (file missing) 
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file) 

O16 - DPF: {5392B545-31A5-4724-BEF3-4FED1D56FDAC} (CPlayFirstDinerDash2_frControl Object) - http://gamenextfr.oberon-media.com/ 
O16 - DPF: {BAE1D8DF-0B35-47E3-A1E7-EEB3FF2ECD19} (CPlayFirstddfotgControl Object) - http://gamenextfr.oberon-media.com/ 
O16 - DPF: {DC75FEF6-165D-4D25-A518-C8C4BDA7BAA6} (CPlayFirstDinerDashControl Object) - http://gamenextfr.oberon-media.com/online/online2/diner_dash/DinerDash.1.0.0.80.cab 


S'il te demande un redémarrage, relance ton PC.
_____________________________________________________

++

Pikin · Answer

Salut, 

Ca a beaucoup ramé cette nuit.

Ci dessous les rapports Antivir.

J'ai fait aussi le scan Hijack avec les fix....

Est-ce qu'il y a encore des choses à faire?



AntiVir PersonalEdition Classic
Report file date: jeudi 14 février 2008  20:32

Scanning for 1109375 virus strains and unwanted programs.

Licensed to:      Avira AntiVir PersonalEdition Classic
Serial number:    0000149996-ADJIE-0001
Platform:         Windows XP
Windows version:  (Service Pack 2)  [5.1.2600]
Username:         SYSTEM
Computer name:    LATIFA

Version information:
BUILD.DAT    : 270           15603 Bytes  19/09/2007 13:32:00
AVSCAN.EXE   : 7.0.6.1      290856 Bytes  23/08/2007 13:16:29
AVSCAN.DLL   : 7.0.6.0       49192 Bytes  16/08/2007 12:23:51
LUKE.DLL     : 7.0.5.3      147496 Bytes  14/08/2007 15:32:47
LUKERES.DLL  : 7.0.6.1       10280 Bytes  21/08/2007 12:35:20
ANTIVIR0.VDF : 6.40.0.0    11030528 Bytes  18/07/2007 14:27:15
ANTIVIR1.VDF : 7.0.1.95    3367424 Bytes  14/12/2007 19:28:30
ANTIVIR2.VDF : 7.0.2.113   1673728 Bytes  08/02/2008 19:28:30
ANTIVIR3.VDF : 7.0.2.140    184320 Bytes  14/02/2008 19:28:30
AVEWIN32.DLL : 7.6.0.65    3240448 Bytes  14/02/2008 19:28:32
AVWINLL.DLL  : 1.0.0.7       14376 Bytes  26/02/2007 10:36:26
AVPREF.DLL   : 7.0.2.2       25640 Bytes  18/07/2007 07:39:17
AVREP.DLL    : 7.0.0.1      155688 Bytes  16/04/2007 13:16:24
AVPACK32.DLL : 7.6.0.3      360488 Bytes  14/02/2008 19:28:32
AVREG.DLL    : 7.0.1.6       30760 Bytes  18/07/2007 07:17:06
AVARKT.DLL   : 1.0.0.20     278568 Bytes  28/08/2007 12:26:33
AVEVTLOG.DLL : 7.0.0.20      86056 Bytes  18/07/2007 07:10:18
NETNT.DLL    : 7.0.0.0        7720 Bytes  08/03/2007 11:09:42
RCIMAGE.DLL  : 7.0.1.30    2342952 Bytes  07/08/2007 12:38:13
RCTEXT.DLL   : 7.0.62.0      86056 Bytes  21/08/2007 12:50:37
SQLITE3.DLL  : 3.3.17.1     339968 Bytes  23/07/2007 09:37:21

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: C:, 
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: jeudi 14 février 2008  20:32

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'WLLoginProxy.exe' - '1' Module(s) have been scanned
Scan process 'iexplore.exe' - '1' Module(s) have been scanned
Scan process 'avast.setup' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'avgas.exe' - '1' Module(s) have been scanned
Scan process 'guard.exe' - '0' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'skypePM.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'ashMaiSv.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'wdfmgr.exe' - '1' Module(s) have been scanned
Scan process 'Skype.exe' - '1' Module(s) have been scanned
Scan process 'VM_STI.EXE' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'ashServ.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
35 processes with 35 modules were scanned

Start scanning boot sectors:
Boot sector 'C:\'
      [NOTE]      No virus was found!

Starting to scan the registry.
The registry was scanned ( '18' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\hiberfil.sys
      [WARNING]   The file could not be opened!
C:\pagefile.sys
      [WARNING]   The file could not be opened!


End of the scan: vendredi 15 février 2008  01:10
Used time:  4:38:52 min

The scan has been done completely.

   4182 Scanning directories
 279909 Files were scanned
      0 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      2 Files cannot be scanned
 279909 Files not concerned
   6922 Archives were scanned
      2 Warnings
      0 Notes



AntiVir PersonalEdition Classic
Report file date: jeudi 14 février 2008  20:32

Scanning for 1109375 virus strains and unwanted programs.

Licensed to:      Avira AntiVir PersonalEdition Classic
Serial number:    0000149996-ADJIE-0001
Platform:         Windows XP
Windows version:  (Service Pack 2)  [5.1.2600]
Username:         SYSTEM
Computer name:    LATIFA

Version information:
BUILD.DAT    : 270           15603 Bytes  19/09/2007 13:32:00
AVSCAN.EXE   : 7.0.6.1      290856 Bytes  23/08/2007 13:16:29
AVSCAN.DLL   : 7.0.6.0       49192 Bytes  16/08/2007 12:23:51
LUKE.DLL     : 7.0.5.3      147496 Bytes  14/08/2007 15:32:47
LUKERES.DLL  : 7.0.6.1       10280 Bytes  21/08/2007 12:35:20
ANTIVIR0.VDF : 6.40.0.0    11030528 Bytes  18/07/2007 14:27:15
ANTIVIR1.VDF : 7.0.1.95    3367424 Bytes  14/12/2007 19:28:30
ANTIVIR2.VDF : 7.0.2.113   1673728 Bytes  08/02/2008 19:28:30
ANTIVIR3.VDF : 7.0.2.140    184320 Bytes  14/02/2008 19:28:30
AVEWIN32.DLL : 7.6.0.65    3240448 Bytes  14/02/2008 19:28:32
AVWINLL.DLL  : 1.0.0.7       14376 Bytes  26/02/2007 10:36:26
AVPREF.DLL   : 7.0.2.2       25640 Bytes  18/07/2007 07:39:17
AVREP.DLL    : 7.0.0.1      155688 Bytes  16/04/2007 13:16:24
AVPACK32.DLL : 7.6.0.3      360488 Bytes  14/02/2008 19:28:32
AVREG.DLL    : 7.0.1.6       30760 Bytes  18/07/2007 07:17:06
AVARKT.DLL   : 1.0.0.20     278568 Bytes  28/08/2007 12:26:33
AVEVTLOG.DLL : 7.0.0.20      86056 Bytes  18/07/2007 07:10:18
NETNT.DLL    : 7.0.0.0        7720 Bytes  08/03/2007 11:09:42
RCIMAGE.DLL  : 7.0.1.30    2342952 Bytes  07/08/2007 12:38:13
RCTEXT.DLL   : 7.0.62.0      86056 Bytes  21/08/2007 12:50:37
SQLITE3.DLL  : 3.3.17.1     339968 Bytes  23/07/2007 09:37:21

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: C:, 
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: jeudi 14 février 2008  20:32

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'WLLoginProxy.exe' - '1' Module(s) have been scanned
Scan process 'iexplore.exe' - '1' Module(s) have been scanned
Scan process 'avast.setup' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'avgas.exe' - '1' Module(s) have been scanned
Scan process 'guard.exe' - '0' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'skypePM.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'ashMaiSv.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'wdfmgr.exe' - '1' Module(s) have been scanned
Scan process 'Skype.exe' - '1' Module(s) have been scanned
Scan process 'VM_STI.EXE' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'ashServ.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
35 processes with 35 modules were scanned

Start scanning boot sectors:
Boot sector 'C:\'
      [NOTE]      No virus was found!

Starting to scan the registry.
The registry was scanned ( '18' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\hiberfil.sys
      [WARNING]   The file could not be opened!
C:\pagefile.sys
      [WARNING]   The file could not be opened!
C:\System Volume Information\_restore{F81371C3-672A-44E6-850B-9DF35254ED1F}\RP759\A0149559.exe
      [DETECTION] Is the Trojan horse TR/Drop.Agent.cro
      [INFO]      The file was moved to '47e5b081.qua'!


End of the scan: jeudi 14 février 2008  23:50
Used time:  3:18:44 min

The scan has been done completely.

   4182 Scanning directories
 279910 Files were scanned
      1 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      1 files were moved to quarantine
      0 files were renamed
      2 Files cannot be scanned
 279909 Files not concerned
   6922 Archives were scanned
      2 Warnings
      0 Notes

Saiyen75 · Answer

Salut,

Bon plus de virus en vue, Refait un log HijackThis,

Aprés passe un coup de TCleaner (ATTENTION : fait d'abord le log hijackthis avant ce logiciel car il va supprimer HjT)


++

Pikin · Answer

Hello, 

Merci. 
Ci-joint le rapport Hijack

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:05:03, on 15/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\VM_STI.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Java\jre1.6.0_03\bin\jucheck.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.01net.com/telecharger/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.01net.com/telecharger/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.01net.com/telecharger/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE Philips SPC315NC Webcam
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS
ppdf32.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

Pikin · Answer

Re

C'est quoi Tcleaner?

Saiyen75 · Answer

Re,

TCleaner va supprimer les logiciels utilisé lors de la désinfection (tu n'en as plus besoin)
Il va également supprimer HijackThis, c'est pourquoi je t'ai dis de faire le log en 1er.

Ensuite fait ça :

Maintenant que ton PC n'est plus infecté, désactive ta "Restauration du système" puis réactive la afin de créer un point de restauration sain. 

* Désactivation : 
Cliquer droit sur le "Poste de travail" > Propriétés > onglet "Restauration du système" > cocher la case "Désactiver la Restauration du système sur tous les lecteurs" 
> Appliquer patiente jusqu a que cela soit marqué "désactivée" puis Ok. 

* Activation : 
Suivre le même chemin ; décocher la case "Désactiver la Restauration du système sur tous les lecteurs" 
> Appliquer attends que cela soit a nouveau sur "surveillance" puis Ok. Redémarrer l'ordinateur...

Pikin · Answer

OK merci beaucoup, 

Peux tu juste me dire où trouver Tcleaner.

Merci pour tout

A+

Saiyen75 · Answer

Re re,

Télécharge ToolsCleaner de A.Roshtein sur ton Bureau. 

* http://a-rothstein.changelog.fr/TC/ToolsCleaner2.exe 

* Clique sur Recherche et laisse le scan se terminer. 
* Clique, sur Suppression pour finaliser. 
* Tu peux, si tu le souhaites, te servir des Options facultatives. 
* Clique sur Quitter, pour que le rapport puisse se créer. 
* Poste moi le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur( C:\). 

_____________________________________________________

Pikin · Answer

Salut 

Ci joint le rapport Tcleaner.


-->- Recherche: 

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
C:\Documents and Settings\latife\Bureau\HijackThis.lnk: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !

---------------------------------
-->- Suppression: 

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: supprimé !
C:\Documents and Settings\latife\Bureau\HijackThis.lnk: supprimé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: supprimé !
C:\Program Files\Trend Micro\HijackThis: supprimé !

Corbeille vidée!
Fichiers temporaires nettoyés !

Saiyen75 · Answer

Salut,

C'est bon pour ça,
maintenant tu peux faire un point de restauration propre :

Maintenant que ton PC n'est plus infecté, désactive ta "Restauration du système" puis réactive la afin de créer un point de restauration sain. 

* Désactivation : 
Cliquer droit sur le "Poste de travail" > Propriétés > onglet "Restauration du système" > cocher la case "Désactiver la Restauration du système sur tous les lecteurs" 
> Appliquer patiente jusqu a que cela soit marqué "désactivée" puis Ok. 

* Activation : 
Suivre le même chemin ; décocher la case "Désactiver la Restauration du système sur tous les lecteurs" 
> Appliquer attends que cela soit a nouveau sur "surveillance" puis Ok. Redémarrer l'ordinateur...

Bonne journée :)

sebbissy · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:29:21, on 18/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Safe mode

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://192.168.1.1/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Shareaza Web Download Hook - {0EEDB912-C5FA-486F-8334-57288578C627} - C:\Program Files\Shareaza\Plugins\RazaWebHook.dll
O2 - BHO: ShoppingReport - {100EB1FD-D03E-47FD-81F3-EE91287F9465} - C:\Program Files\ShoppingReport\Bin\2.0.26\ShoppingReport.dll
O2 - BHO: Adssite Search Assistant - {1648E328-3E5A-4EA5-A9C6-E5F09EE272DA} - C:\WINDOWS\system32\adssite_sidebar.dll
O2 - BHO: (no name) - {18818BD4-DA1B-4669-8031-35F145CBC776} - C:\WINDOWS\system32\pmnnm.dll (file missing)
O2 - BHO: BrowserCmp - {1D8282E6-BC4F-469B-AAED-7E4FF077AD93} - C:\WINDOWS\system32\iebrowserc.dll
O2 - BHO: (no name) - {2D767C9A-534B-4419-92F9-CA3FF43585EF} - C:\WINDOWS\system32\dbghel.dll
O2 - BHO: dsWebAllowBHO Class - {2F85D76C-0569-466F-A488-493E6BD0E955} - C:\Program Files\Windows Desktop Search\dsWebAllow.dll
O2 - BHO: Online_TV Toolbar - {40d1c3a7-4ffb-4443-b3a0-a64b2df7fc3b} - C:\Program Files\Online_TV	bOnl0.dll
O2 - BHO: {c3fb72ac-dc59-df98-8624-6dc79386e674} - {476e6839-7cd6-4268-89fd-95cdca27bf3c} - C:\WINDOWS\system32\xweapjiu.dll (file missing)
O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - C:\WINDOWS\system32\urqrrsr.dll (file missing)
O2 - BHO: dcads - {6FC3C36D-7635-4D43-BA62-0D9D2F2CD06E} - C:\WINDOWS\system32
srB15.dll
O2 - BHO: Multi_Media_France Toolbar - {7009fcd4-05be-44f4-9583-93fe419ab7b0} - C:\Program Files\Multi_Media_France	bMul0.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: superiorads - {79F562E5-768C-4494-8E6C-824ADA4A9C2C} - C:\WINDOWS\system32\sprt_ads.dll (file missing)
O2 - BHO: ads_optimizer - {9C8A568E-4201-478a-8536-526CF371D2E2} - C:\WINDOWS\system32
sgB37.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O2 - BHO: Multi_Media Toolbar - {b5146c40-189a-4311-bda9-fbae3e023187} - C:\Program Files\Multi_Media	bMul1.dll
O2 - BHO: (no name) - {C04FB9D4-AD8A-4BC0-9BE3-28406402C09C} - C:\WINDOWS\system32\ssqrq.dll (file missing)
O2 - BHO: WhIeHelperObj Class - {c900b400-cdfe-11d3-976a-00e02913a9e0} - C:\Program Files\webHancer\programs\whiehlpr.dll (file missing)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Online_TV Toolbar - {40d1c3a7-4ffb-4443-b3a0-a64b2df7fc3b} - C:\Program Files\Online_TV	bOnl0.dll
O3 - Toolbar: Multi_Media_France Toolbar - {7009fcd4-05be-44f4-9583-93fe419ab7b0} - C:\Program Files\Multi_Media_France	bMul0.dll
O3 - Toolbar: Multi_Media Toolbar - {b5146c40-189a-4311-bda9-fbae3e023187} - C:\Program Files\Multi_Media	bMul1.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [TVPService] "C:\Program Files\HP\TVPlay\TVPService.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro	ype32.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [trioService] "C:\PROGRA~1\Freeze.com\Living 3D Dolphins	rioService.exe "
O4 - HKLM\..\Run: [DisableIPC] C:\Program Files\Cable & ADSL Optimizer\DisableIPC.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [845d713a] rundll32.exe "C:\WINDOWS\system32\dvcwhqat.dll",sitypnow
O4 - HKLM\..\Run: [spa_start] C:\WINDOWS\System32\Rundll32.exe "C:\WINDOWS\system32\sprt_ads.dll" DllStart
O4 - HKLM\..\Run: [webHancer Agent] C:\Program Files\webHancer\Programs\whagent.exe
O4 - HKLM\..\Run: [ptask] C:\Program Files\ProtectionConue\ptask.exe
O4 - HKLM\..\Run: [Salestart] "C:\Program Files\Fichiers communs\ReparateurDeSysteme\strpmon.exe" dm=http://reparateurdesysteme.com ad=http://reparateurdesysteme.com sd=http://repay.reparateurdesysteme.com
O4 - HKLM\..\Run: [bm] "C:\Program Files\Fichiers communs\ProtectionConue\bm.exe" dm=http://protectionconue.com ad=http://protectionconue.com sd=http://gregistre.protectionconue.com
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [Internet Download Accelerator] C:\Program Files\IDA\ida.exe -autorun
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: SmartCenter 2.0.lnk = C:\LOTSUITE\SMARTCTR\SMARTCTR.EXE
O4 - Startup: Vente Flash.lnk = C:\Program Files\Vente Flash\vente_flash.exe
O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: Download with &Shareaza - res://C:\Program Files\Shareaza\Plugins\RazaWebHook.dll/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {9819CC0E-9669-4D01-9CD7-2C66DA43AC6C} - (no file)
O9 - Extra button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - C:\Program Files\ShoppingReport\Bin\2.0.26\ShoppingReport.dll
O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\Program Files\ShoppingReport\Bin\2.0.26\ShoppingReport.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O14 - IERESET.INF: START_PAGE_URL=https://www8.hp.com/fr/fr/home.html
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://jeuxmultijoueurs.orange.fr/Gameshell/GameHost/1.0/OberonGameHost.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O20 - Winlogon Notify: awtqo - C:\WINDOWS\system32\awtqo.dll (file missing)
O20 - Winlogon Notify: awtqppq - awtqppq.dll (file missing)
O20 - Winlogon Notify: awtqr - C:\WINDOWS\system32\awtqr.dll (file missing)
O20 - Winlogon Notify: awtsp - C:\WINDOWS\system32\awtsp.dll (file missing)
O20 - Winlogon Notify: awvtr - C:\WINDOWS\system32\awvtr.dll (file missing)
O20 - Winlogon Notify: awvvw - C:\WINDOWS\system32\awvvw.dll (file missing)
O20 - Winlogon Notify: ddayv - C:\WINDOWS\system32\ddayv.dll (file missing)
O20 - Winlogon Notify: ddccc - C:\WINDOWS\system32\ddccc.dll (file missing)
O20 - Winlogon Notify: ddcya - C:\WINDOWS\system32\ddcya.dll (file missing)
O20 - Winlogon Notify: gebcc - C:\WINDOWS\system32\gebcc.dll (file missing)
O20 - Winlogon Notify: jkhfg - C:\WINDOWS\system32\jkhfg.dll (file missing)
O20 - Winlogon Notify: jkhhf - C:\WINDOWS\system32\jkhhf.dll (file missing)
O20 - Winlogon Notify: jkkjg - C:\WINDOWS\system32\jkkjg.dll (file missing)
O20 - Winlogon Notify: mljge - C:\WINDOWS\system32\mljge.dll (file missing)
O20 - Winlogon Notify: mljgg - C:\WINDOWS\system32\mljgg.dll (file missing)
O20 - Winlogon Notify: mljji - C:\WINDOWS\system32\mljji.dll (file missing)
O20 - Winlogon Notify: mllji - C:\WINDOWS\system32\mllji.dll (file missing)
O20 - Winlogon Notify: mllml - C:\WINDOWS\system32\mllml.dll (file missing)
O20 - Winlogon Notify: nnnligf - nnnligf.dll (file missing)
O20 - Winlogon Notify: pmkhe - C:\WINDOWS\system32\pmkhe.dll (file missing)
O20 - Winlogon Notify: pmkhf - C:\WINDOWS\system32\pmkhf.dll (file missing)
O20 - Winlogon Notify: pmnlj - C:\WINDOWS\system32\pmnlj.dll (file missing)
O20 - Winlogon Notify: pmnll - C:\WINDOWS\system32\pmnll.dll (file missing)
O20 - Winlogon Notify: pmnlm - C:\WINDOWS\system32\pmnlm.dll (file missing)
O20 - Winlogon Notify: pmnnm - C:\WINDOWS\system32\pmnnm.dll (file missing)
O20 - Winlogon Notify: ssqro - C:\WINDOWS\system32\ssqro.dll (file missing)
O20 - Winlogon Notify: ssqrs - C:\WINDOWS\system32\ssqrs.dll (file missing)
O20 - Winlogon Notify: sstqn - C:\WINDOWS\system32\sstqn.dll (file missing)
O20 - Winlogon Notify: ssttt - C:\WINDOWS\system32\ssttt.dll (file missing)
O20 - Winlogon Notify: urqrrsr - urqrrsr.dll (file missing)
O20 - Winlogon Notify: vtsqn - C:\WINDOWS\system32\vtsqn.dll (file missing)
O20 - Winlogon Notify: vtsqo - C:\WINDOWS\system32\vtsqo.dll (file missing)
O20 - Winlogon Notify: vtuts - C:\WINDOWS\system32\vtuts.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: CyberLink Media Library Service(HP TVPlay) - Cyberlink - C:\Program Files\HP\TVPlay\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: CyberLink Background Capture Service (CBCS HP TVPlay) (TVPCapSvc) - Unknown owner - C:\Program Files\HP\TVPlay\Kernel\TV\TVPCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS HP TVPlay) (TVPSched) - Unknown owner - C:\Program Files\HP\TVPlay\Kernel\TV\TVPSched.exe

Saiyen75 · Answer

Salut  sebbissy,

Il serait préférable que tu crées ton propre " topic " 
Cela rendra ce poste plus compréhensible, et nous pourrons traiter ton soucis avec plus d’efficacité.
Donc,fais comme expliqué ce dessous :

Creer nouveau sujet

Quelqu'un t'aideras surement :)

Merci

++

Cheval troie Win32:BHO-KD [Trj]

24 réponses

Votre réponse

Discussions similaires

Newsletters