Sujet Précédent Sujet Suivant

Virus exploit.iframe et generic 15152

Résolu/Fermé
passable Messages postés 157 Date d'inscription vendredi 11 juillet 2008 Statut Membre Dernière intervention 22 février 2021 - 4 nov. 2008 à 10:13
benurrr Messages postés 9643 Date d'inscription samedi 24 mai 2008 Statut Contributeur sécurité Dernière intervention 11 janvier 2012 - 4 nov. 2008 à 10:22
Bonjour,
Navré d'intervenir encore mais je ne m'en sors pas. J'ai fait un sacan avec bitdefender et voici les rapports, avec celui de hijackthis. Je suis allé sur les forums où je ne trouve pas la solution. En auriez-vous une à me proposer, svp?
D'avance merci!



//-----------------------------------------------------------------
//
// Produit BitDefender Free Edition v10
// Produit 10.2
//
// Créé le: 03/11/2008 23:53:11
//
//-----------------------------------------------------------------


Statistiques

Chemin cible: C:\
D:\
I:\
N:\
O:\
P:\
Dossiers : 30579
Fichiers : 1108822
Processus Mémoire analysés : 0
Archives : 14765
Fichiers enpaquetés : 126531
Virus trouvés : 3
Fichiers infectés : 18
Processus Mémoire infectés : 0
Fichiers suspects : 0
Alertes : 0
Fichiers désinfectés : 0
Fichiers effacés : 4
Fichiers déplacés : 0
Erreurs I/O : 34
Temps d'analyse :=04:33:54
Fichiers/seconde :67

Statistiques Spywares

Registres analysés : 0
Registres infectés : 0
Cookies analysés : 0
Cookies infectés : 0
Fichiers spyware infectés : 0
Menaces Spyware détectées : 0


Définitions virus : 2052462
Plugins d'analyse : 16
Plugins archives : 43
Plug-ins décompression : 7
Plug-ins messagerie : 6
Plug-ins système : 5

Options d'analyse

Détection
[X] Analyser le secteur de boot
[X] Processus mémoire
[X] Analyser les archives
[X] Analyser les fichiers enpaquetés
[X] Analyser la messagerie

Masque fichiers
[ ] Programmes
[X] Tous les fichiers
[ ] Extensions définies par l'utilisateur:
[ ] Exclure les extensions: ;

Action

Objets infectés
[ ] Ignorer
[X] Désinfecter
[ ] Effacer
[ ] Mettre en quarantaine
[ ] Demander l'action

Seconde action
[ ] Ignorer
[ ] Effacer
[X] Mettre en quarantaine
[ ] Demander l'action

Options d'analyse
[X] Activer les alertes
[X] Activer l'heuristique
[ ] Afficher tous les fichiers dans le journal
[X] Fichier journal: C:\Documents and Settings\All Users\Application Data\Bitdefender\Desktop\Profiles\Logs\deep_scan\1225752791.log

Options d'analyse Spyware

[X] Analyse contre les risques non-viraux
[ ] Ecarter de l'analyse les dialers et les applications
[X] Clés de registres
[X] Cookies


Résumé:

D:\System Volume Information\_restore{7C7D176B-B2A6-4D8C-B738-90FD33097320}\RP486\A0156217.exe=>(CAB Sfx o)=>\Disk1\data2.cab=>(IShield Module 1) Détecté: Application.Generic.15152
D:\System Volume Information\_restore{7C7D176B-B2A6-4D8C-B738-90FD33097320}\RP486\A0156217.exe=>(CAB Sfx o)=>\Disk1\data2.cab=>(IShield Module 1) Désinfection impossible
D:\System Volume Information\_restore{7C7D176B-B2A6-4D8C-B738-90FD33097320}\RP486\A0156217.exe=>(CAB Sfx o)=>\Disk1\data2.cab=>(IShield Module 1) Déplacement impossible
O:\copie PORTABLE\Documents and Settings\francis\Local Settings\Application Data\Identities\{465E6E2F-3489-41FC-824B-43CDA0FBA28A}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 33): Mail Delivery (failure frcrespin@wanadoo.fr)=>[Subject: Mail Delivery (failure frcrespin@wanad][Date: Tue, 25 May 2004 10:38:13 +0200]=>(MIME part)=>(MIME part)=>(message body) Infecté: Exploit.Iframe.Vulnerability.B
O:\copie PORTABLE\Documents and Settings\francis\Local Settings\Application Data\Identities\{465E6E2F-3489-41FC-824B-43CDA0FBA28A}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 33): Mail Delivery (failure frcrespin@wanadoo.fr)=>[Subject: Mail Delivery (failure frcrespin@wanad][Date: Tue, 25 May 2004 10:38:13 +0200]=>(MIME part)=>(MIME part)=>(message body) Désinfection impossible
O:\copie PORTABLE\Documents and Settings\francis\Local Settings\Application Data\Identities\{465E6E2F-3489-41FC-824B-43CDA0FBA28A}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 33): Mail Delivery (failure frcrespin@wanadoo.fr)=>[Subject: Mail Delivery (failure frcrespin@wanad][Date: Tue, 25 May 2004 10:38:13 +0200]=>(MIME part)=>(MIME part)=>(message body) Déplacement impossible
O:\copie PORTABLE\Documents and Settings\francis\Local Settings\Application Data\Identities\{465E6E2F-3489-41FC-824B-43CDA0FBA28A}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 36): Mail Delivery (failure frcrespin@wanadoo.fr)=>[Subject: Mail Delivery (failure frcrespin@wanad][Date: Tue, 27 Jul 2004 13:45:16 +0200]=>(MIME part)=>(MIME part)=>(message body) Infecté: Exploit.Iframe.Vulnerability.B
O:\copie PORTABLE\Documents and Settings\francis\Local Settings\Application Data\Identities\{465E6E2F-3489-41FC-824B-43CDA0FBA28A}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 36): Mail Delivery (failure frcrespin@wanadoo.fr)=>[Subject: Mail Delivery (failure frcrespin@wanad][Date: Tue, 27 Jul 2004 13:45:16 +0200]=>(MIME part)=>(MIME part)=>(message body) Désinfection impossible
O:\copie PORTABLE\Documents and Settings\francis\Local Settings\Application Data\Identities\{465E6E2F-3489-41FC-824B-43CDA0FBA28A}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 36): Mail Delivery (failure frcrespin@wanadoo.fr)=>[Subject: Mail Delivery (failure frcrespin@wanad][Date: Tue, 27 Jul 2004 13:45:16 +0200]=>(MIME part)=>(MIME part)=>(message body) Déplacement impossible
O:\copie PORTABLE\Documents and Settings\francis\Local Settings\Application Data\Identities\{465E6E2F-3489-41FC-824B-43CDA0FBA28A}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 38): Undelivered Mail Returned to Sender=>[Subject: Undelivered Mail Returned to Sender][Date: Tue, 20 Jul 2004 11:30:38 +0200 (CEST)]=>(MIME part)=>(message)=>[Subject: Important m$6h?3p][Date: Tue, 20 Jul 2004 09:29:03 +0200]=>(MIME part)=>document07.zip=>archstored:document.txt .exe Infecté: Win32.Netsky.P@mm
O:\copie PORTABLE\Documents and Settings\francis\Local Settings\Application Data\Identities\{465E6E2F-3489-41FC-824B-43CDA0FBA28A}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 38): Undelivered Mail Returned to Sender=>[Subject: Undelivered Mail Returned to Sender][Date: Tue, 20 Jul 2004 11:30:38 +0200 (CEST)]=>(MIME part)=>(message)=>[Subject: Important m$6h?3p][Date: Tue, 20 Jul 2004 09:29:03 +0200]=>(MIME part)=>document07.zip=>archstored:document.txt .exe Effacé
O:\copie PORTABLE\Documents and Settings\francis\Local Settings\Application Data\Identities\{465E6E2F-3489-41FC-824B-43CDA0FBA28A}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 38): Undelivered Mail Returned to Sender=>[Subject: Undelivered Mail Returned to Sender][Date: Tue, 20 Jul 2004 11:30:38 +0200 (CEST)]=>(MIME part)=>(message)=>[Subject: Important m$6h?3p][Date: Tue, 20 Jul 2004 09:29:03 +0200]=>(MIME part)=>document07.zip La recompression des archives a échoué (actions marquées non effectuées)
O:\copie PORTABLE\Documents and Settings\francis\Local Settings\Application Data\Identities\{465E6E2F-3489-41FC-824B-43CDA0FBA28A}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 42): Undelivered Mail Returned to Sender=>[Subject: Undelivered Mail Returned to Sender][Date: Mon, 12 Jul 2004 16:34:06 +0200 (CEST)]=>(MIME part)=>(message)=>[Subject: Spamed?][Date: Mon, 12 Jul 2004 15:32:20 +0200]=>(MIME part)=>abuse_list.zip=>archstored:document.txt .exe Infecté: Win32.Netsky.P@mm
O:\copie PORTABLE\Documents and Settings\francis\Local Settings\Application Data\Identities\{465E6E2F-3489-41FC-824B-43CDA0FBA28A}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 42): Undelivered Mail Returned to Sender=>[Subject: Undelivered Mail Returned to Sender][Date: Mon, 12 Jul 2004 16:34:06 +0200 (CEST)]=>(MIME part)=>(message)=>[Subject: Spamed?][Date: Mon, 12 Jul 2004 15:32:20 +0200]=>(MIME part)=>abuse_list.zip=>archstored:document.txt .exe Effacé
O:\copie PORTABLE\Documents and Settings\francis\Local Settings\Application Data\Identities\{465E6E2F-3489-41FC-824B-43CDA0FBA28A}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 42): Undelivered Mail Returned to Sender=>[Subject: Undelivered Mail Returned to Sender][Date: Mon, 12 Jul 2004 16:34:06 +0200 (CEST)]=>(MIME part)=>(message)=>[Subject: Spamed?][Date: Mon, 12 Jul 2004 15:32:20 +0200]=>(MIME part)=>abuse_list.zip La recompression des archives a échoué (actions marquées non effectuées)
O:\copie PORTABLE\Documents and Settings\francis\Local Settings\Application Data\Identities\{465E6E2F-3489-41FC-824B-43CDA0FBA28A}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 43): Mail Delivery (failure frcrespin@wanadoo.fr)=>[Subject: Mail Delivery (failure frcrespin@wanad][Date: Mon, 12 Jul 2004 15:51:42 +0200]=>(MIME part)=>(MIME part)=>(message body) Infecté: Exploit.Iframe.Vulnerability.B
O:\copie PORTABLE\Documents and Settings\francis\Local Settings\Application Data\Identities\{465E6E2F-3489-41FC-824B-43CDA0FBA28A}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 43): Mail Delivery (failure frcrespin@wanadoo.fr)=>[Subject: Mail Delivery (failure frcrespin@wanad][Date: Mon, 12 Jul 2004 15:51:42 +0200]=>(MIME part)=>(MIME part)=>(message body) Désinfection impossible
O:\copie PORTABLE\Documents and Settings\francis\Local Settings\Application Data\Identities\{465E6E2F-3489-41FC-824B-43CDA0FBA28A}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 43): Mail Delivery (failure frcrespin@wanadoo.fr)=>[Subject: Mail Delivery (failure frcrespin@wanad][Date: Mon, 12 Jul 2004 15:51:42 +0200]=>(MIME part)=>(MIME part)=>(message body) Déplacement impossible
O:\copie PORTABLE\Documents and Settings\francis\Local Settings\Application Data\Identities\{465E6E2F-3489-41FC-824B-43CDA0FBA28A}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 45): Mail Delivery (failure frcrespin@wanadoo.fr)=>[Subject: Mail Delivery (failure frcrespin@wanad][Date: Sat, 10 Jul 2004 06:13:40 +0200]=>(MIME part)=>(MIME part)=>(message body) Infecté: Exploit.Iframe.Vulnerability.B
O:\copie PORTABLE\Documents and Settings\francis\Local Settings\Application Data\Identities\{465E6E2F-3489-41FC-824B-43CDA0FBA28A}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 45): Mail Delivery (failure frcrespin@wanadoo.fr)=>[Subject: Mail Delivery (failure frcrespin@wanad][Date: Sat, 10 Jul 2004 06:13:40 +0200]=>(MIME part)=>(MIME part)=>(message body) Désinfection impossible
O:\copie PORTABLE\Documents and Settings\francis\Local Settings\Application Data\Identities\{465E6E2F-3489-41FC-824B-43CDA0FBA28A}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 45): Mail Delivery (failure frcrespin@wanadoo.fr)=>[Subject: Mail Delivery (failure frcrespin@wanad][Date: Sat, 10 Jul 2004 06:13:40 +0200]=>(MIME part)=>(MIME part)=>(message body) Déplacement impossible
O:\copie PORTABLE\Documents and Settings\francis\Local Settings\Application Data\Identities\{465E6E2F-3489-41FC-824B-43CDA0FBA28A}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 48): Undelivered Mail Returned to Sender=>[Subject: Undelivered Mail Returned to Sender][Date: Thu, 8 Jul 2004 23:32:18 +0200 (CEST)]=>(MIME part)=>(message)=>[Subject: ][Date: Thu, 8 Jul 2004 23:30:57 +0200]=>(MIME part)=>important.zip=>archstored:data.rtf .scr Infecté: Win32.Netsky.P@mm
O:\copie PORTABLE\Documents and Settings\francis\Local Settings\Application Data\Identities\{465E6E2F-3489-41FC-824B-43CDA0FBA28A}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 48): Undelivered Mail Returned to Sender=>[Subject: Undelivered Mail Returned to Sender][Date: Thu, 8 Jul 2004 23:32:18 +0200 (CEST)]=>(MIME part)=>(message)=>[Subject: ][Date: Thu, 8 Jul 2004 23:30:57 +0200]=>(MIME part)=>important.zip=>archstored:data.rtf .scr Effacé
O:\copie PORTABLE\Documents and Settings\francis\Local Settings\Application Data\Identities\{465E6E2F-3489-41FC-824B-43CDA0FBA28A}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 48): Undelivered Mail Returned to Sender=>[Subject: Undelivered Mail Returned to Sender][Date: Thu, 8 Jul 2004 23:32:18 +0200 (CEST)]=>(MIME part)=>(message)=>[Subject: ][Date: Thu, 8 Jul 2004 23:30:57 +0200]=>(MIME part)=>important.zip La recompression des archives a échoué (actions marquées non effectuées)
O:\copie PORTABLE\Documents and Settings\francis\Local Settings\Application Data\Identities\{465E6E2F-3489-41FC-824B-43CDA0FBA28A}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 51): Mail Delivery (failure frcrespin@wanadoo.fr)=>[Subject: Mail Delivery (failure frcrespin@wanad][Date: Tue, 4 May 2004 17:52:16 +0200]=>(MIME part)=>(MIME part)=>(message body) Infecté: Exploit.Iframe.Vulnerability.B
O:\copie PORTABLE\Documents and Settings\francis\Local Settings\Application Data\Identities\{465E6E2F-3489-41FC-824B-43CDA0FBA28A}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 51): Mail Delivery (failure frcrespin@wanadoo.fr)=>[Subject: Mail Delivery (failure frcrespin@wanad][Date: Tue, 4 May 2004 17:52:16 +0200]=>(MIME part)=>(MIME part)=>(message body) Désinfection impossible
O:\copie PORTABLE\Documents and Settings\francis\Local Settings\Application Data\Identities\{465E6E2F-3489-41FC-824B-43CDA0FBA28A}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 51): Mail Delivery (failure frcrespin@wanadoo.fr)=>[Subject: Mail Delivery (failure frcrespin@wanad][Date: Tue, 4 May 2004 17:52:16 +0200]=>(MIME part)=>(MIME part)=>(message body) Déplacement impossible
O:\copie PORTABLE\Documents and Settings\francis\Local Settings\Application Data\Identities\{465E6E2F-3489-41FC-824B-43CDA0FBA28A}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 56): Mail Delivery (failure frcrespin@wanadoo.fr)=>[Subject: Mail Delivery (failure frcrespin@wanad][Date: Mon, 17 May 2004 20:10:43 +0200]=>(MIME part)=>(MIME part)=>(message body) Infecté: Exploit.Iframe.Vulnerability.B
O:\copie PORTABLE\Documents and Settings\francis\Local Settings\Application Data\Identities\{465E6E2F-3489-41FC-824B-43CDA0FBA28A}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 56): Mail Delivery (failure frcrespin@wanadoo.fr)=>[Subject: Mail Delivery (failure frcrespin@wanad][Date: Mon, 17 May 2004 20:10:43 +0200]=>(MIME part)=>(MIME part)=>(message body) Désinfection impossible
O:\copie PORTABLE\Documents and Settings\francis\Local Settings\Application Data\Identities\{465E6E2F-3489-41FC-824B-43CDA0FBA28A}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 56): Mail Delivery (failure frcrespin@wanadoo.fr)=>[Subject: Mail Delivery (failure frcrespin@wanad][Date: Mon, 17 May 2004 20:10:43 +0200]=>(MIME part)=>(MIME part)=>(message body) Déplacement impossible
O:\copie PORTABLE\Documents and Settings\francis\Local Settings\Application Data\Identities\{465E6E2F-3489-41FC-824B-43CDA0FBA28A}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 57): Mail Delivery (failure frcrespin@wanadoo.fr)=>[Subject: Mail Delivery (failure frcrespin@wanad][Date: Mon, 24 May 2004 17:59:59 +0200]=>(MIME part)=>(MIME part)=>(message body) Infecté: Exploit.Iframe.Vulnerability.B
O:\copie PORTABLE\Documents and Settings\francis\Local Settings\Application Data\Identities\{465E6E2F-3489-41FC-824B-43CDA0FBA28A}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 57): Mail Delivery (failure frcrespin@wanadoo.fr)=>[Subject: Mail Delivery (failure frcrespin@wanad][Date: Mon, 24 May 2004 17:59:59 +0200]=>(MIME part)=>(MIME part)=>(message body) Désinfection impossible
O:\copie PORTABLE\Documents and Settings\francis\Local Settings\Application Data\Identities\{465E6E2F-3489-41FC-824B-43CDA0FBA28A}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 57): Mail Delivery (failure frcrespin@wanadoo.fr)=>[Subject: Mail Delivery (failure frcrespin@wanad][Date: Mon, 24 May 2004 17:59:59 +0200]=>(MIME part)=>(MIME part)=>(message body) Déplacement impossible
O:\copie PORTABLE\Documents and Settings\francis\Local Settings\Application Data\Identities\{465E6E2F-3489-41FC-824B-43CDA0FBA28A}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 63): Undelivered Mail Returned to Sender=>[Subject: Undelivered Mail Returned to Sender][Date: Sat, 5 Jun 2004 21:30:52 +0200 (CEST)]=>(MIME part)=>(message)=>[Subject: Mail Delivery (failure esabonnement.ne][Date: Sat, 5 Jun 2004 21:29:22 +0200]=>(MIME part)=>(MIME part)=>(message body) Infecté: Exploit.Iframe.Vulnerability.B
O:\copie PORTABLE\Documents and Settings\francis\Local Settings\Application Data\Identities\{465E6E2F-3489-41FC-824B-43CDA0FBA28A}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 63): Undelivered Mail Returned to Sender=>[Subject: Undelivered Mail Returned to Sender][Date: Sat, 5 Jun 2004 21:30:52 +0200 (CEST)]=>(MIME part)=>(message)=>[Subject: Mail Delivery (failure esabonnement.ne][Date: Sat, 5 Jun 2004 21:29:22 +0200]=>(MIME part)=>(MIME part)=>(message body) Désinfection impossible
O:\copie PORTABLE\Documents and Settings\francis\Local Settings\Application Data\Identities\{465E6E2F-3489-41FC-824B-43CDA0FBA28A}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 63): Undelivered Mail Returned to Sender=>[Subject: Undelivered Mail Returned to Sender][Date: Sat, 5 Jun 2004 21:30:52 +0200 (CEST)]=>(MIME part)=>(message)=>[Subject: Mail Delivery (failure esabonnement.ne][Date: Sat, 5 Jun 2004 21:29:22 +0200]=>(MIME part)=>(MIME part)=>(message body) Déplacement impossible
O:\copie PORTABLE\Documents and Settings\francis\Local Settings\Application Data\Identities\{465E6E2F-3489-41FC-824B-43CDA0FBA28A}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 65): Mail Delivery (failure frcrespin@wanadoo.fr)=>[Subject: Mail Delivery (failure frcrespin@wanad][Date: Thu, 10 Jun 2004 09:19:44 +0200]=>(MIME part)=>(MIME part)=>(message body) Infecté: Exploit.Iframe.Vulnerability.B
O:\copie PORTABLE\Documents and Settings\francis\Local Settings\Application Data\Identities\{465E6E2F-3489-41FC-824B-43CDA0FBA28A}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 65): Mail Delivery (failure frcrespin@wanadoo.fr)=>[Subject: Mail Delivery (failure frcrespin@wanad][Date: Thu, 10 Jun 2004 09:19:44 +0200]=>(MIME part)=>(MIME part)=>(message body) Désinfection impossible
O:\copie PORTABLE\Documents and Settings\francis\Local Settings\Application Data\Identities\{465E6E2F-3489-41FC-824B-43CDA0FBA28A}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 65): Mail Delivery (failure frcrespin@wanadoo.fr)=>[Subject: Mail Delivery (failure frcrespin@wanad][Date: Thu, 10 Jun 2004 09:19:44 +0200]=>(MIME part)=>(MIME part)=>(message body) Déplacement impossible
O:\copie PORTABLE\Documents and Settings\francis\Local Settings\Application Data\Identities\{465E6E2F-3489-41FC-824B-43CDA0FBA28A}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 67): Mail Delivery (failure frcrespin@wanadoo.fr)=>[Subject: Mail Delivery (failure frcrespin@wanad][Date: Mon, 14 Jun 2004 22:11:23 +0200]=>(MIME part)=>(MIME part)=>(message body) Infecté: Exploit.Iframe.Vulnerability.B
O:\copie PORTABLE\Documents and Settings\francis\Local Settings\Application Data\Identities\{465E6E2F-3489-41FC-824B-43CDA0FBA28A}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 67): Mail Delivery (failure frcrespin@wanadoo.fr)=>[Subject: Mail Delivery (failure frcrespin@wanad][Date: Mon, 14 Jun 2004 22:11:23 +0200]=>(MIME part)=>(MIME part)=>(message body) Désinfection impossible
O:\copie PORTABLE\Documents and Settings\francis\Local Settings\Application Data\Identities\{465E6E2F-3489-41FC-824B-43CDA0FBA28A}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 67): Mail Delivery (failure frcrespin@wanadoo.fr)=>[Subject: Mail Delivery (failure frcrespin@wanad][Date: Mon, 14 Jun 2004 22:11:23 +0200]=>(MIME part)=>(MIME part)=>(message body) Déplacement impossible
O:\copie PORTABLE\Documents and Settings\francis\Local Settings\Application Data\Identities\{465E6E2F-3489-41FC-824B-43CDA0FBA28A}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 70): Mail Delivery (failure frcrespin@wanadoo.fr)=>[Subject: Mail Delivery (failure frcrespin@wanad][Date: Wed, 16 Jun 2004 14:51:18 +0200]=>(MIME part)=>(MIME part)=>(message body) Infecté: Exploit.Iframe.Vulnerability.B
O:\copie PORTABLE\Documents and Settings\francis\Local Settings\Application Data\Identities\{465E6E2F-3489-41FC-824B-43CDA0FBA28A}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 70): Mail Delivery (failure frcrespin@wanadoo.fr)=>[Subject: Mail Delivery (failure frcrespin@wanad][Date: Wed, 16 Jun 2004 14:51:18 +0200]=>(MIME part)=>(MIME part)=>(message body) Désinfection impossible
O:\copie PORTABLE\Documents and Settings\francis\Local Settings\Application Data\Identities\{465E6E2F-3489-41FC-824B-43CDA0FBA28A}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 70): Mail Delivery (failure frcrespin@wanadoo.fr)=>[Subject: Mail Delivery (failure frcrespin@wanad][Date: Wed, 16 Jun 2004 14:51:18 +0200]=>(MIME part)=>(MIME part)=>(message body) Déplacement impossible
O:\copie PORTABLE\Documents and Settings\francis\Local Settings\Application Data\Identities\{465E6E2F-3489-41FC-824B-43CDA0FBA28A}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 74): Mail Delivery (failure frcrespin@wanadoo.fr)=>[Subject: Mail Delivery (failure frcrespin@wanad][Date: Wed, 23 Jun 2004 17:38:13 +0200]=>(MIME part)=>(MIME part)=>(message body) Infecté: Exploit.Iframe.Vulnerability.B
O:\copie PORTABLE\Documents and Settings\francis\Local Settings\Application Data\Identities\{465E6E2F-3489-41FC-824B-43CDA0FBA28A}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 74): Mail Delivery (failure frcrespin@wanadoo.fr)=>[Subject: Mail Delivery (failure frcrespin@wanad][Date: Wed, 23 Jun 2004 17:38:13 +0200]=>(MIME part)=>(MIME part)=>(message body) Désinfection impossible
O:\copie PORTABLE\Documents and Settings\francis\Local Settings\Application Data\Identities\{465E6E2F-3489-41FC-824B-43CDA0FBA28A}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 74): Mail Delivery (failure frcrespin@wanadoo.fr)=>[Subject: Mail Delivery (failure frcrespin@wanad][Date: Wed, 23 Jun 2004 17:38:13 +0200]=>(MIME part)=>(MIME part)=>(message body) Déplacement impossible
O:\copie PORTABLE\Documents and Settings\francis\Local Settings\Application Data\Identities\{465E6E2F-3489-41FC-824B-43CDA0FBA28A}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 77): Undelivered Mail Returned to Sender=>[Subject: Undelivered Mail Returned to Sender][Date: Sun, 4 Jul 2004 17:30:37 +0200 (CEST)]=>(MIME part)=>(message)=>[Subject: Re: Status][Date: Sun, 4 Jul 2004 17:29:29 +0200]=>(MIME part)=>readme_inister.zip=>archstored:document.txt .exe Infecté: Win32.Netsky.P@mm
O:\copie PORTABLE\Documents and Settings\francis\Local Settings\Application Data\Identities\{465E6E2F-3489-41FC-824B-43CDA0FBA28A}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 77): Undelivered Mail Returned to Sender=>[Subject: Undelivered Mail Returned to Sender][Date: Sun, 4 Jul 2004 17:30:37 +0200 (CEST)]=>(MIME part)=>(message)=>[Subject: Re: Status][Date: Sun, 4 Jul 2004 17:29:29 +0200]=>(MIME part)=>readme_inister.zip=>archstored:document.txt .exe Effacé
O:\copie PORTABLE\Documents and Settings\francis\Local Settings\Application Data\Identities\{465E6E2F-3489-41FC-824B-43CDA0FBA28A}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 77): Undelivered Mail Returned to Sender=>[Subject: Undelivered Mail Returned to Sender][Date: Sun, 4 Jul 2004 17:30:37 +0200 (CEST)]=>(MIME part)=>(message)=>[Subject: Re: Status][Date: Sun, 4 Jul 2004 17:29:29 +0200]=>(MIME part)=>readme_inister.zip La recompression des archives a échoué (actions marquées non effectuées)
O:\copie PORTABLE\Documents and Settings\francis\Local Settings\Application Data\Identities\{465E6E2F-3489-41FC-824B-43CDA0FBA28A}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 83): Mail Delivery (failure frcrespin@wanadoo.fr)=>[Subject: Mail Delivery (failure frcrespin@wanad][Date: Thu, 24 Jun 2004 09:42:54 +0200]=>(MIME part)=>(MIME part)=>(message body) Infecté: Exploit.Iframe.Vulnerability.B
O:\copie PORTABLE\Documents and Settings\francis\Local Settings\Application Data\Identities\{465E6E2F-3489-41FC-824B-43CDA0FBA28A}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 83): Mail Delivery (failure frcrespin@wanadoo.fr)=>[Subject: Mail Delivery (failure frcrespin@wanad][Date: Thu, 24 Jun 2004 09:42:54 +0200]=>(MIME part)=>(MIME part)=>(message body) Désinfection impossible
O:\copie PORTABLE\Documents and Settings\francis\Local Settings\Application Data\Identities\{465E6E2F-3489-41FC-824B-43CDA0FBA28A}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 83): Mail Delivery (failure frcrespin@wanadoo.fr)=>[Subject: Mail Delivery (failure frcrespin@wanad][Date: Thu, 24 Jun 2004 09:42:54 +0200]=>(MIME part)=>(MIME part)=>(message body) Déplacement impossible


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:14:23, on 04/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Softwin\BitDefender10\bdmcon.exe
C:\Program Files\Softwin\BitDefender10\bdagent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\e-Carte Bleue La Banque Postale\ecbl-lbp.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Softwin\BitDefender10\vsserv.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Crespin\Local Settings\Temporary Internet Files\Content.IE5\VH0JUAYF\HiJackThis[1].exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: e-Carte Bleue Browser Helper Object - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} - C:\WINDOWS\system32\BhoECart.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [EPSON Stylus C64 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C64 Series" /O6 "USB001" /M "Stylus C64"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: e-Carte Bleue La Banque Postale.lnk = C:\Program Files\e-Carte Bleue La Banque Postale\ecbl-lbp.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {05D96F71-87C6-11D3-9BE4-00902742D6E0} (QuickPlace Class) - http://qp1.orion.education.fr/qp2.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O17 - HKLM\System\CCS\Services\Tcpip\..\{9E16DC93-40B8-4A97-91E6-5FAE4E1343AE}: NameServer = 80.10.246.2,80.10.246.129
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender10\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
A voir également:

1 réponse

Réponse 1 / 1
benurrr Messages postés 9643 Date d'inscription samedi 24 mai 2008 Statut Contributeur sécurité Dernière intervention 11 janvier 2012 107
4 nov. 2008 à 10:22
salut ; ton hijack est mal installer tu risque d'avoir des probleme de restauration si tu fixe des ligne qu'il ne faut pas

pourtant ton rapport est propre par precaution passe malewarbyte


télécharge malwarbyte http://www.commentcamarche.net/telecharger/telechargement 34055379 malwarebytes anti malware

a l'installation vérifie que mise a jour et lancer programme et scan complet sont bien cocher

Une fois a jour, le programme va se lancer; clic sur l´onglet paramètre, et coche la case : "Arrêter internet explorer pendant la suppression".

A la fin du scan clique sur Afficher les résultats

Suppression des éléments détectés >>>> clique sur Supprimer la sélection ou supprimer tout
S'il t'es demandé de redémarrer >>> clique sur "Yes"

Et tu poste le rapport générer

et on attendant une réponse tu peut refaire un scan malwarbyte mais on mode sans échec car beaucoup plus efficace

comment démarrer on mode sans échec ici tuto http://www.infos-du-net.com/forum/272325-11-tuto-demarrer-mode-echec

tu enregistre le rapport générer de façon a le retrouver et tu poste le nouveau rapport rapport
0

Discussions similaires

Est ce que le site tlauncher est dangereux ?
caribou -
bazfile -

1 réponse
Softonic,est-ce un virus ?
techmel1 -
techmel1 -

6 réponses
4 virus en raison d’un porno ????
valou -
Bello040420 -

9 réponses
'' generic android ''
Flxra._.Atxmics -
Flxra._.Atxmics -

2 réponses
problême Opéra est ce un virus??
sand2504 -
sand2504 -

85 réponses