Virus bagle

salut ,

merci pour tes conseils et la lescture que tu m as conseillé très très intéressant à lire à relire.

j ai fait le scan :

-->- Recherche:

C:\Qoobox: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programmes\HijackThis: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis\HijackThis.lnk: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programmes\HijackThis: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\HijackThis: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\HijackThis\HijackThis.lnk: trouvé !
C:\Windows\Gmer.exe: trouvé !

---------------------------------
-->- Suppression:

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis\HijackThis.lnk: supprimé !
C:\Windows\Gmer.exe: supprimé !
C:\Qoobox: supprimé !
C:\Program Files\Trend Micro\HijackThis: supprimé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programmes\HijackThis: Erreur de suppression !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis: supprimé !

encore merci de ton aide et maintenant je ferais bcp plus attention !

une erreure est si vite arrivée...

@++

Salut

ok,

1) Télécharge ToolsCleaner de A.Roshtein sur ton Bureau : il supprimera tous les logiciels téléchargés dont tu n'as plus besoin !

hxxp://pagesperso-orange.fr/AceRothstein/ToolsCleaner2.exe

* Clique sur Recherche et laisse le scan se terminer.

* Clique, sur Suppression pour finaliser.

* Clique sur Quitter, pour que le rapport puisse se créer.

* Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur( C:\).

2 )sinon je te conseil de remplacer ton antivirus avg par antivir, bien plus performant et d'installer un parfeu comme zone alarme !

3) tu peux garder MalwareByte's Anti-Malware qui est un très bon antispyware !

4) télécharge ce petit programme et met à jour tous tes applications non à jour, cela aura pour but de corriger les bugs, mais surtout corriger les failles de sécurités, donc optimisera la sécurité de ton pc d'une manière non négligeable !

==> https://filehippo.com/windows/tuning-utilities/

5) mets à jour windows !

et voilà ;-)

un peu de lecture au passage :

http://www.commentcamarche.net/faq/sujet 2432 securite proteger un ordinateur contre les malwares d internet

@+

salut!

oui j ai tout supprimé ce qu'AVG à trouvé j ai fait comme c'était indiqué (donc renouveler l'opération 3/4 fois pour qu'il n'y ait plus une erreure.

scan Hijackthis :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:06:26, on 31/07/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16681)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\conime.exe
C:\hp\support\hpsysdrv.exe
C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\RtHDVCpl.exe
c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Windows\system32\schtasks.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Hercules\WiFi Station pour Livebox\WiFiLB.exe
C:\Users\Déborah\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
C:\Users\Déborah\AppData\Roaming\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\IncrediMail\bin\ImApp.exe
C:\hp\kbd\kbd.exe
C:\Windows\Explorer.exe
C:\Windows\system32\notepad.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\AVG\AVG8\aAvgApi.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ustart.org
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KbdStub.EXE
O4 - HKLM\..\Run: [OsdMaestro] "C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe"
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [StartCCC] "c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SunJavaUpdateReg] "C:\Windows\system32\jureg.exe"
O4 - HKLM\..\Run: [HP Software Update] c:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [EPSON Stylus DX7400 Series] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATICDE.EXE /FU "C:\Windows\TEMP\E_S9848.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Startup: Outil de notification Live Search.lnk = ?
O4 - Global Startup: WiFi Station pour Livebox.lnk = C:\Program Files\Hercules\WiFi Station pour Livebox\WiFiLB.exe
O8 - Extra context menu item: &Recherche AOL Toolbar - c:\program files\aol\aol toolbar 5.0\resources\fr-fr\local\search.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe

Salut

Aucune action entreprise.

est-ce que tu as supprimé tout ce que avg a trouvé ??

oui un dernier hijack stp

tant pie pour le scan en ligne ...

++

;-)

salut voilà les rapports :

CCleaner
NETTOYAGE COMPLET - (2.473 secs)
------------------------------------------------------------------------------------------
543,6MB supprimés.
------------------------------------------------------------------------------------------

Détails des fichiers effacés
------------------------------------------------------------------------------------------
Fichiers Temporaires d'Internet Explorer (fichiers 2680) 28,0MB
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@echanblardnext[2].txt 380 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@www.trendsecure[2].txt 145 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@mystart.incredimail[2].txt 156 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@google[3].txt 323 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@www.ilovemessenger[2].txt 81 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@com[1].txt 95 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@leboncoin[1].txt 76 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@www.musicme[1].txt 432 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@www.inoculer[2].txt 75 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@www.orange[1].txt 79 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@nouvelobs[1].txt 76 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@advertising[1].txt 394 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@tvunderground.org[2].txt 363 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@cnet[2].txt 185 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@mediaplex[1].txt 85 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@rad.msn[2].txt 680 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@intellitxt[1].txt 114 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@pubgnt.generation-nt[1].txt 395 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@mappy[1].txt 77 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@www.chapitre[2].txt 164 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@xiti[1].txt 107 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@01net[1].txt 279 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@www.googleadservices[3].txt 352 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@free-av[1].txt 372 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@avg.urlseek.vmn[2].txt 384 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@iapref.orange[1].txt 94 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@t.msn[2].txt 333 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@live[2].txt 759 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@cetelem.solution.weborama[2].txt 479 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@windowslivemessenger.solution.weborama[1].txt 322 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@answers.yahoo[1].txt 578 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@google[4].txt 130 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@ads.adbrite[2].txt 93 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@searchmobile.solution.weborama[2].txt 417 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@generation-nt[2].txt 471 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@ads.highmetrics[1].txt 680 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@antivirus-2008-fr[2].txt 289 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@sdv[2].txt 311 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@fe.lea.lycos[1].txt 107 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@stats.searchtrack[2].txt 892 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@adserver.aol[1].txt 106 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@adnext[2].txt 405 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@search.msn[2].txt 612 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@smartadserver[2].txt 403 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@statse.webtrendslive[1].txt 195 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@vente-privee[2].txt 152 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@yahoo[1].txt 88 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@fnac[2].txt 942 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@imrworldwide[2].txt 213 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@adviva[1].txt 79 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@rad.live[2].txt 700 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@supertoinette[1].txt 380 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@msn.co[2].txt 354 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@ebayrtm[3].txt 107 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@virus[1].txt 127 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@www.zonavirus[1].txt 188 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@lycos[1].txt 216 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@sosbusters02100.unblog[1].txt 103 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@video.msn[2].txt 188 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@bluestreak[2].txt 182 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@cybermonitor[1].txt 93 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@trafiz[1].txt 586 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@abonnez-vous.orange[2].txt 220 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@www.googleadservices[4].txt 326 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@750g[1].txt 366 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@baudelet[2].txt 405 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@liberation[2].txt 550 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@uniprix.nouvelobs[1].txt 90 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@fr.ebayrtm[2].txt 1,41KB
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@ssl-hints.netflame[1].txt 164 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@p.live[1].txt 104 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@cafr.ebayrtm[1].txt 581 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@babylon[2].txt 75 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@paypal.112.2o7[1].txt 122 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@avgtechnologies.112.2o7[2].txt 170 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@atdmt[2].txt 101 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@ebay[1].txt 784 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@canal-plus[1].txt 118 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@adbrite[2].txt 439 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@click.interactivebrands[1].txt 377 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@clubic[2].txt 512 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@youtube[1].txt 351 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@doubleclick[2].txt 89 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@login.live[1].txt 344 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@commentcamarche[1].txt 119 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@msn[3].txt 342 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@linternaute[2].txt 280 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@aimfar.solution.weborama[2].txt 116 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@edt02[1].txt 304 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@ebay[3].txt 824 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@francoischarron[2].txt 377 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@traceics.com[1].txt 118 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@ilovemessenger.solution.weborama[1].txt 304 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@ke.voila[1].txt 85 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@avg[1].txt 127 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@stats.paypal[2].txt 77 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@ps.jaildog[1].txt 84 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@apmebf[1].txt 95 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@www.pagesjaunes[2].txt 415 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@hotmail.msn[1].txt 71 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@get.live[1].txt 248 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@messenger.msn[2].txt 95 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@hijackthis[1].txt 401 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@fr.msn[2].txt 585 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@www.google[1].txt 219 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@weborama[1].txt 90 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@www.incredibarvuz[2].txt 177 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@chitika[2].txt 472 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@ebay[4].txt 523 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@onlinestores.metaservices.microsoft[1].txt 147 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@musicme[2].txt 575 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@overture[1].txt 102 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@fl01.ct2.comclick[2].txt 311 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@ebay[2].txt 1,66KB
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@zune[2].txt 233 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@windowsmarketplace[2].txt 261 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@roiservice[1].txt 121 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@google[1].txt 131 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@ebayobjects[1].txt 89 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@ebayrtm[1].txt 174 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@www.generation-nt[1].txt 113 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@msn[2].txt 447 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@internetdownloadmanager[1].txt 109 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@grisoft[1].txt 131 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@softpedia[1].txt 438 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@www.clubic[2].txt 247 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@main.ebayrtm[2].txt 530 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@www.leboncoin[2].txt 70 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@fr.youtube[2].txt 291 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@www.incredimail[1].txt 718 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@www.malekal[1].txt 361 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@www.softpedia[2].txt 77 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@intercambio4[1].txt 136 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@www.windowslive[1].txt 81 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@search.live[1].txt 517 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@zonavirus[1].txt 399 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@ads.operadormovilsms[2].txt 116 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@www.01net[1].txt 151 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@www.googleadservices[1].txt 334 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@pagesjaunes[2].txt 168 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@www.francoischarron[1].txt 132 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@befr.ebayrtm[2].txt 625 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@forum.malekal[2].txt 367 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@symantec[1].txt 109 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@download[1].txt 611 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@greendaynrdc[1].txt 352 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@cultureco[1].txt 433 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@forum.telecharger.01net[2].txt 561 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@examens2008.nouvelobs[1].txt 137 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@safepay2.interactivebrands[1].txt 86 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@www.cultureco[1].txt 101 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@paypal[1].txt 437 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\low\déborah@ebay[2].txt 147 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\low\déborah@ebay[3].txt 821 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\low\déborah@fr.ebayrtm[2].txt 764 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\low\déborah@hotmail.msn[1].txt 70 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\low\déborah@mystart.incredimail[2].txt 156 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\low\déborah@www.incredimail[1].txt 545 bytes
C:\Users\Déborah\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012008042720080428\index.dat 32,00KB
C:\Users\Déborah\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012008060720080608\index.dat 48,00KB
C:\Users\Déborah\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012008062920080630\index.dat 0,11MB
C:\Users\Déborah\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012008070620080707\index.dat 48,00KB
C:\Users\Déborah\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012008070720080714\index.dat 96,00KB
C:\Users\Déborah\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012008071420080721\index.dat 32,00KB
C:\Users\Déborah\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012008072120080728\index.dat 48,00KB
C:\Users\Déborah\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012008072820080729\index.dat 80,00KB
C:\Users\Déborah\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012008072920080730\index.dat 32,00KB
C:\Users\Déborah\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012008073020080731\index.dat 48,00KB
C:\Users\Déborah\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012008073120080801\index.dat 48,00KB
C:\Users\Déborah\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat 0,67MB
C:\Users\Déborah\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012008060420080605\index.dat 32,00KB
Marqué pour l'effacement: C:\Users\Déborah\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
Marqué pour l'effacement: C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
Marqué pour l'effacement: C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\Low\index.dat
Marqué pour l'effacement: C:\Users\Déborah\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini
Marqué pour l'effacement: C:\Users\Déborah\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
Marqué pour l'effacement: C:\Users\Déborah\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012008080120080802\index.dat
Marqué pour l'effacement: C:\Users\Déborah\AppData\Local\Microsoft\Windows\History\Low\History.IE5\desktop.ini
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Recent\100_1449.lnk 937 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Recent\Belley 05.2008.lnk 694 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Recent\BOOTSECT.lnk 459 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Recent\bootstat.dat.lnk 575 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Recent\Bug.lnk 428 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Recent\changes.lnk 703 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Recent\ComboFix.lnk 459 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Recent\de666387fc226c649add4566464bc5.lnk 537 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Recent\Downloads.lnk 516 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Recent\Fond d'écran.lnk 528 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Recent\FxBeagle.lnk 527 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Recent\FxBgleMO.lnk 527 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Recent\gmer.lnk 357 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Recent\halt--rophilie_1.lnk 629 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Recent\HP (C).lnk 319 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Recent\images.lnk 727 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Recent\InfoSat.lnk 452 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Recent\IpHlpSvc.lnk 693 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Recent\license.lnk 703 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Recent\Malwarebytes' Anti-Malware.lnk 517 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Recent\mbam-log-7-30-2008 (18-23-34).lnk 632 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Recent\MpSigStub.lnk 675 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Recent\mrt.exe._p.lnk 630 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Recent\ntbtlog.lnk 568 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Recent\PFRO.lnk 551 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Recent\rap1.lnk 503 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Recent\rapport.lnk 520 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Recent\system.lnk 563 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Recent\temp.lnk 505 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Recent\tracing.lnk 522 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Recent\Téléchargement.lnk 402 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Recent\unins000.dat.lnk 710 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Recent\unins000.lnk 710 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Recent\Windows.lnk 420 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Recent\www_hotmail_default.lnk 783 bytes
C:\Users\Déborah\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1024.db 55,0MB
C:\Users\Déborah\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db 43,0MB
C:\Users\Déborah\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db 2,00MB
C:\Users\Déborah\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db 42,0MB
C:\Users\Déborah\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db 0,12MB
C:\Users\Déborah\AppData\Local\Microsoft\Windows\Explorer\thumbcache_sr.db 24 bytes
C:\Windows\MEMORY.DMP 351,6MB
C:\Windows\MiniDump\Mini051508-01.dmp 0,13MB
C:\Windows\MiniDump\Mini070808-01.dmp 0,13MB
C:\Windows\MiniDump\Mini071008-01.dmp 0,13MB
C:\Windows\MiniDump\Mini071408-01.dmp 0,13MB
C:\Windows\MiniDump\Mini071608-01.dmp 0,13MB
C:\Windows\system32\wbem\Logs\FrameWork.log 9,90KB
C:\Windows\system32\wbem\Logs\wmiprov.log 55,42KB
C:\Windows\system32\wbem\Logs\WMITracing.log 16,0MB
C:\Windows\system32\wbem\Logs\wmiprov.lo_ 64,01KB
C:\Windows\Directx.log 57,47KB
C:\Windows\DPINST.LOG 20,67KB
C:\Windows\DtcInstall.log 3,04KB
C:\Windows\msxml4-KB936181-fra.LOG 0,25MB
C:\Windows\msxml4-KB941833-fra.LOG 0,25MB
C:\Windows\PFRO.log 78,54KB
C:\Windows\setupact.log 19,74KB
C:\Windows\SETUPAPI.LOG 94 bytes
C:\Windows\setuperr.log 0 bytes
C:\Windows\TSSysprep.log 3,46KB
C:\Windows\ntbtlog.txt 0,79MB
C:\Windows\Debug\mrt.log 4,09KB
C:\Windows\Debug\mrteng.log 2,07KB
C:\Windows\Debug\sammui.log 133 bytes
C:\Windows\Debug\UserMode\ChkAcc.log 0 bytes
C:\Windows\Debug\UserMode\ChkAcc.bak 0 bytes
C:\Windows\security\logs\scesetup.log 0,60MB
C:\Windows\security\logs\scecomp.old 234 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Office\Recent\ACTION PROFESSIONNELLE.LNK 493 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Office\Recent\action1.LNK 446 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Office\Recent\Anglais.LNK 686 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Office\Recent\calculPrimes.LNK 536 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Office\Recent\CAS1Girod.fiche descriptive.LNK 1,04KB
C:\Users\Déborah\AppData\Roaming\Microsoft\Office\Recent\changes.LNK 643 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Office\Recent\Classeur1.LNK 584 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Office\Recent\Concert de soutien.LNK 816 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Office\Recent\Conneries XXX.LNK 577 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Office\Recent\CPAP.LNK 344 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Office\Recent\Disque amovible (J).LNK 179 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Office\Recent\Doc1.LNK 555 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Office\Recent\Documents (2).LNK 446 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Office\Recent\Documents.LNK 446 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Office\Recent\Dossier prof.p1.LNK 922 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Office\Recent\EXERCICE 1.LNK 380 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Office\Recent\fiche de stock.LNK 542 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Office\Recent\FICHE DESCRIPTIVE D.LNK 634 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Office\Recent\fiche descriptive.LNK 551 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Office\Recent\fichierss sur www.blog4ever.com.url 61 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Office\Recent\Girod.LNK 417 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Office\Recent\GIROD4.LNK 868 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Office\Recent\halt--rophilie_1.LNK 603 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Office\Recent\Images.LNK 443 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Office\Recent\Incoming.LNK 629 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Office\Recent\index.dat 1,04KB
C:\Users\Déborah\AppData\Roaming\Microsoft\Office\Recent\INDEX.LNK 1,10KB
C:\Users\Déborah\AppData\Roaming\Microsoft\Office\Recent\INTITULE DU DOSSIE1.LNK 935 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Office\Recent\Laissus.LNK 696 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Office\Recent\Lettres aux actionnaires.LNK 572 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Office\Recent\Malwarebytes' Anti-Malware.LNK 517 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Office\Recent\Mes fichiers reçus.LNK 605 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Office\Recent\Oral BTS.LNK 269 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Office\Recent\ORAL.LNK 669 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Office\Recent\planning CPAP.LNK 917 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Office\Recent\planning CPAP1.LNK 922 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Office\Recent\planning CPAP11.LNK 922 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Office\Recent\Presenting myself.LNK 864 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Office\Recent\présentation ent.LNK 487 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Office\Recent\Pélissier.LNK 560 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Office\Recent\tableau lettre aux fournisseurs.LNK 593 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Office\Recent\Temp.LNK 605 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Office\Recent\Templates.LNK 746 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Office\Recent\TURQUIE.LNK 455 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Office\Recent\Téléchargement.LNK 430 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Office\Recent\USE_G.LNK 1 012 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Office\Recent\Visites au stand.LNK 548 bytes
C:\Users\Déborah\AppData\Roaming\Microsoft\Office\Recent\X2006--1.LNK 714 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PBLRHTLA\ds.serving-sys.com\0803autoexpandOTMaroc787814.sol 122 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PBLRHTLA\ds.serving-sys.com\0805CIC_Hotmail.sol 114 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PBLRHTLA\ds.serving-sys.com\0805RenaultRipCurl873756.sol 119 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PBLRHTLA\fr.youtube.com\soundData.sol 58 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PBLRHTLA\fr.youtube.com\videostats.sol 199 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PBLRHTLA\images.soapbox.msn.com\flash\soapbox1_1.swf\CountryCode.sol 58 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PBLRHTLA\images.soapbox.msn.com\s_br.sol 35 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PBLRHTLA\images.video.msn.com\res\flash\f1b9v3e6b1w0k2v9g0h3n5h7h7u4x5m2\soapbox1_1.swf\CountryCode.sol 58 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PBLRHTLA\images.video.msn.com\res\flash\f1b9v3e6b1w0k2v9g0h3n5h7h7u4x5m2\soapbox1_1.swf\VideoWindow.sol 50 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PBLRHTLA\images.video.msn.com\res\flash\g2e0e2c4m6q2p1f9v5f7w4e2a2a0w6z7\soapbox1_1.swf\CountryCode.sol 58 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PBLRHTLA\images.video.msn.com\res\flash\n9i8p7u8a8t3d3k4p5r7x3y6c2j9y6x3\soapbox1_1.swf\CountryCode.sol 58 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PBLRHTLA\images.video.msn.com\res\flash\n9i8p7u8a8t3d3k4p5r7x3y6c2j9y6x3\soapbox1_1.swf\VideoWindow.sol 43 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PBLRHTLA\images.video.msn.com\s_br.sol 35 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PBLRHTLA\l.yimg.com\cosmos.bcst.yahoo.com\ver\260.0\embed-2008-03-20-0932\swf\yup_embed_module.swf\TestMovie_Config_Info.sol 341 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PBLRHTLA\l.yimg.com\LCOMMENGINEMGR.sol 154 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PBLRHTLA\macromedia.com\redirectSO.sol 115 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PBLRHTLA\p0.tv2n.com\uid.sol 46 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PBLRHTLA\pagead2.googlesyndication.com\pagead\googleadplayer.swf\mediaPlayerUserSettings.sol 94 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PBLRHTLA\s.ytimg.com\soundData.sol 58 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PBLRHTLA\s.ytimg.com\videostats.sol 199 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PBLRHTLA\secureinclude.ebaystatic.com\ebayLSO.sol 160 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PBLRHTLA\spe.atdmt.com\ft2262-13.sol 74 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PBLRHTLA\spe.atdmt.com\ft2262-22.sol 74 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PBLRHTLA\video.google.com\googleplayer.swf\mediaPlayerUserSettings.sol 94 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PBLRHTLA\video.google.com\videostats.sol 85 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PBLRHTLA\video.m6.fr\players\flash\generic\m6webtv.swf\webtv_nouvellestar_2008_userdatas.sol 109 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PBLRHTLA\video.msn.com\flash\soapbox1_1.swf\CountryCode.sol 58 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PBLRHTLA\video.msn.com\flash\soapbox1_1.swf\VideoWindow.sol 50 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PBLRHTLA\video.msn.com\s_br.sol 35 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PBLRHTLA\wat.tv\images\v2.5\flash\player.swf\watPlayer.sol 118 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PBLRHTLA\wideo.nouvellestar.fr\swf\p.swf\userPrefs.sol 68 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PBLRHTLA\www.canalplus.fr\flash\loader\loader_canalplus_V0_0.swf\bwDetect.sol 87 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PBLRHTLA\www.canalplus.fr\flash\loader\loader_canalplus_V0_1.swf\bwDetect.sol 87 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PBLRHTLA\www.dailymotion.com\flash\dmplayer\dmplayer-fr.swf\dmplayer.sol 89 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PBLRHTLA\www.kewego.fr\swf\p.swf\userPrefs.sol 54 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PBLRHTLA\www.musicme.com\playerShared.sol 883 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PBLRHTLA\www.vistaprint.fr\dataStorage.sol 101 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PBLRHTLA\www.youtube.com\soundData.sol 58 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PBLRHTLA\www.youtube.com\timeDisplayConfig.sol 81 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#ds.serving-sys.com\settings.sol 88 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#fr.youtube.com\settings.sol 84 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#images.soapbox.msn.com\settings.sol 92 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#images.video.msn.com\settings.sol 90 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#l.yimg.com\settings.sol 80 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#m6replay.fr\settings.sol 81 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#macromedia.com\settings.sol 84 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#p0.tv2n.com\settings.sol 81 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#pagead2.googlesyndication.com\settings.sol 99 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#s.ytimg.com\settings.sol 81 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#secureinclude.ebaystatic.com\settings.sol 98 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#spe.atdmt.com\settings.sol 83 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#video.google.com\settings.sol 86 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#video.m6.fr\settings.sol 81 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#video.msn.com\settings.sol 83 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#wat.tv\settings.sol 76 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#wideo.nouvellestar.fr\settings.sol 91 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.canalplus.fr\settings.sol 86 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.dailymotion.com\settings.sol 89 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.depuis-que-jai-messenger-sur-mon-mobile.com\settings.sol 117 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.goosto.fr\settings.sol 83 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.kewego.fr\settings.sol 83 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.musicme.com\settings.sol 85 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.vistaprint.fr\settings.sol 87 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.youtube.com\settings.sol 85 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol 927 bytes
C:\Users\Déborah\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe 1,46MB
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{02703556-2C6A-40D0-B16C-30BD9F2461C0} 5,68KB
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{05EBB659-9ED3-496C-87C5-BDA99C8B2F37} 5,97KB
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{0E4ADCE1-0EB0-4F5D-AC31-75D3F6429C5C} 5,68KB
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{0F739E79-99FC-411B-A37C-EAB9D6B2AE8E} 6,03KB
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{3E83EF51-CB80-440A-A054-C3234395A705} 5,97KB
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{422140D9-777E-4242-97AC-96D2DCAD2F69} 5,68KB
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{49750FFA-1ECE-4247-9ADA-8C504F41D649} 5,77KB
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{4A198D53-9764-43DA-9DF9-73D350FBF011} 5,97KB
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{4E22CFDB-993A-4851-B49C-364D2C8E6F6E} 10,64KB
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{4E428808-3C4A-444D-B2B2-80EEDCC4E4D3} 6,03KB
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{5A268724-AE02-4DC2-A513-C2751AF06671} 6,03KB
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{6273B13B-62BF-4331-9A5E-1F2FBE620465} 5,66KB
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{78F7ACE9-BDEE-4891-A2A1-27E463D3090B} 5,68KB
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{8A2208FA-2030-4AD9-8207-7D39D94783BC} 5,64KB
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{94BB6582-BF02-4178-B397-6F5C86ADE535} 5,77KB
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{A7DE7C43-27DB-4CF2-AAD4-42437E0057DF} 5,67KB
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{A9FCECB2-636E-4B4E-BC7B-AD6EC9248A41} 5,77KB
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{B34A2950-6742-479C-94D5-2F5A01B119A3} 5,76KB
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{C5B6897C-61E1-444E-9688-04A2B095DC08} 5,74KB
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{C8952580-AF4A-48EE-9D48-728283D6CB2D} 5,66KB
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{D3874C8E-9270-44FB-BBAF-73A3015226B8} 5,74KB
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{D862C040-BE99-49A4-9504-83245D491A59} 5,63KB
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{DFA18862-87E4-4021-93DC-49F0A5EEE418} 5,65KB
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{E772E17D-2C7F-4D58-8C5E-43E3059B1B40} 5,67KB
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{E8D81C69-0791-44E2-919C-71D34F7ACE37} 5,68KB
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{E977EFB1-842D-4E01-BC3C-CEFC0C9C3623} 10,76KB
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{FCFA696A-1EC7-4E90-B5F3-ABC59E2A5751} 5,64KB
------------------------------------------------------------------------------------------

rapport AVG
---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

+ Créé à: 16:33:01 01/08/2008

+ Résultat de l'analyse:

C:\Users\Déborah\Desktop\mdelk.exe.EXE -> Heuristic.Win32.AVKiller : Aucune action entreprise.
C:\Users\Déborah\Documents\Downloads\Programs\ELIBAGLA.BAØGBØØH.EXE -> Heuristic.Win32.AVKiller : Aucune action entreprise.
C:\Users\Déborah\Documents\Downloads\Programs\ELIBAGLA.BAØGBØØH_2.EXE -> Heuristic.Win32.AVKiller : Aucune action entreprise.
C:\Users\Déborah\AppData\Local\eMule\config\last.zip/EvID4226Patch.exe -> Not-A-Virus.Hacktool.EvID : Aucune action entreprise.
C:\Users\Déborah\AppData\Roaming\Microsoft\Windows\Cookies\déborah@ssl-hints.netflame[1].txt -> TrackingCookie.Netflame : Aucune action entreprise.

Fin du rapport

j ai pas réussis a faire le scan en ligne de bit defender impossible d installer Active X.

je te refait un scan Hijackthis ?

bonne soirée

@++

Salut

je pense que c'est tout bon, un petit dernier nettoyage complémentaire, fais ce qui est indiquer ici stp :

http://www.commentcamarche.net/faq/sujet 3174 virus methode preliminaire de desinfection version fr

@+

;-)

et le rapport Hijackthis :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:06:26, on 31/07/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16681)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\conime.exe
C:\hp\support\hpsysdrv.exe
C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\RtHDVCpl.exe
c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Windows\system32\schtasks.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Hercules\WiFi Station pour Livebox\WiFiLB.exe
C:\Users\Déborah\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
C:\Users\Déborah\AppData\Roaming\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\IncrediMail\bin\ImApp.exe
C:\hp\kbd\kbd.exe
C:\Windows\Explorer.exe
C:\Windows\system32\notepad.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\AVG\AVG8\aAvgApi.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ustart.org
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KbdStub.EXE
O4 - HKLM\..\Run: [OsdMaestro] "C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe"
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [StartCCC] "c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SunJavaUpdateReg] "C:\Windows\system32\jureg.exe"
O4 - HKLM\..\Run: [HP Software Update] c:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [EPSON Stylus DX7400 Series] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATICDE.EXE /FU "C:\Windows\TEMP\E_S9848.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Startup: Outil de notification Live Search.lnk = ?
O4 - Global Startup: WiFi Station pour Livebox.lnk = C:\Program Files\Hercules\WiFi Station pour Livebox\WiFiLB.exe
O8 - Extra context menu item: &Recherche AOL Toolbar - c:\program files\aol\aol toolbar 5.0\resources\fr-fr\local\search.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe

salut !!

alors je trouve que le pc réagit plus vite il marche comme avant il n'y a plus de problème (j avais un problème d'administrateur dû au virus); windows defender remarche également; En faite depuis hier tout marche correctement rien à dire !!

voilà le rapport ComboFix :

ComboFix 08-07-28.5 - Déborah 2008-07-31 22:55:43.1 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6000.0.1252.1.1036.18.2040 [GMT 2:00]
Endroit: C:\Users\Déborah\Desktop\Killbagle.exe
* Création d'un nouveau point de restauration
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\InfoSat.txt

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_SROSA

((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-06-28 to 2008-07-31 ))))))))))))))))))))))))))))))))))))
.

2008-07-30 14:44 . 2008-07-30 14:44 250 --a------ C:\Windows\gmer.ini
2008-07-29 20:29 . 2008-07-29 20:29 <REP> d-------- C:\Users\All Users\Malwarebytes
2008-07-29 20:29 . 2008-07-29 20:29 <REP> d-------- C:\PROGRA~2\Malwarebytes
2008-07-29 20:29 . 2008-07-30 18:01 <REP> d-------- C:\Malwarebytes' Anti-Malware
2008-07-29 20:29 . 2008-07-23 20:09 38,472 --a------ C:\Windows\System32\drivers\mbamswissarmy.sys
2008-07-29 20:29 . 2008-07-23 20:09 17,144 --a------ C:\Windows\System32\drivers\mbam.sys
2008-07-29 18:04 . 2008-07-29 18:04 <REP> d-------- C:\de666387fc226c649add4566464bc5
2008-07-23 18:53 . 2008-06-26 02:33 12,240,896 --a------ C:\Windows\System32\NlsLexicons0007.dll
2008-07-23 18:53 . 2008-06-26 05:22 9,845,248 --a------ C:\Windows\System32\NlsData000a.dll
2008-07-23 18:53 . 2008-06-26 05:22 4,874,240 --a------ C:\Windows\System32\NlsData0009.dll
2008-07-23 18:53 . 2008-06-26 02:33 2,644,480 --a------ C:\Windows\System32\NlsLexicons0009.dll
2008-07-23 18:53 . 2008-06-26 05:22 2,641,408 --a------ C:\Windows\System32\NlsData000c.dll
2008-07-23 18:53 . 2008-06-26 05:22 797,696 --a------ C:\Windows\System32\NaturalLanguage6.dll
2008-07-12 13:39 . 2008-07-12 13:39 <REP> d-------- C:\Muestras
2008-07-09 18:14 . 2008-07-09 18:14 <REP> d-------- C:\Program Files\Trend Micro
2008-07-07 22:18 . 2008-07-30 21:14 <REP> d--h----- C:\$AVG8.VAULT$
2008-07-07 22:00 . 2008-07-31 22:36 <REP> d-------- C:\Windows\System32\drivers\Avg
2008-07-07 22:00 . 2008-07-07 22:00 <REP> d-------- C:\Users\All Users\avg8
2008-07-07 22:00 . 2008-07-07 22:00 <REP> d-------- C:\Program Files\AVG
2008-07-07 22:00 . 2008-07-07 22:00 <REP> d-------- C:\PROGRA~2\avg8
2008-07-07 22:00 . 2008-07-07 22:00 96,520 --a------ C:\Windows\System32\drivers\avgldx86.sys
2008-07-07 22:00 . 2008-07-07 22:00 10,520 --a------ C:\Windows\System32\avgrsstx.dll
2008-07-07 21:33 . 2008-07-23 18:44 <REP> d-------- C:\Program Files\Internet Download Manager
2008-07-01 22:28 . 2008-07-01 22:28 <REP> d-------- C:\Users\All Users\Grisoft
2008-07-01 22:28 . 2008-07-01 22:28 <REP> d-------- C:\PROGRA~2\Grisoft
2008-07-01 21:31 . 2008-07-01 21:35 <REP> d-------- C:\Users\All Users\Lavasoft
2008-07-01 21:31 . 2008-07-01 21:31 <REP> d-------- C:\Program Files\Lavasoft
2008-07-01 21:31 . 2008-07-01 21:35 <REP> d-------- C:\PROGRA~2\Lavasoft
2008-07-01 20:33 . 2006-11-29 13:06 3,426,072 --a------ C:\Windows\System32\d3dx9_32.dll
2008-07-01 20:32 . 2008-07-01 20:32 <REP> d-------- C:\Program Files\Microsoft SQL Server Compact Edition
2008-06-16 18:26 . 2008-06-16 18:26 47,360 --a------ C:\Windows\System32\drivers\pcouffin.sys
2008-06-15 21:53 . 2008-07-23 18:46 <REP> d-------- C:\Program Files\Larousse
2008-06-15 21:53 . 2008-06-15 21:53 <REP> d-------- C:\Program Files\directx
2008-06-15 21:52 . 2008-06-15 21:52 <REP> d-------- C:\Program Files\MSXML 4.0
2008-06-14 23:38 . 2008-04-23 06:27 1,244,672 --a------ C:\Windows\System32\mcmde.dll
2008-06-14 23:38 . 2008-04-23 06:27 428,032 --a------ C:\Windows\System32\EncDec.dll
2008-06-14 23:38 . 2008-04-23 06:27 292,352 --a------ C:\Windows\System32\psisdecd.dll
2008-06-14 23:38 . 2008-04-23 06:26 218,624 --a------ C:\Windows\System32\psisrndr.ax
2008-06-14 23:38 . 2008-04-23 06:26 80,896 --a------ C:\Windows\System32\MSNP.ax
2008-06-14 23:38 . 2008-04-23 06:26 68,608 --a------ C:\Windows\System32\Mpeg2Data.ax
2008-06-14 23:38 . 2008-04-23 06:26 57,856 --a------ C:\Windows\System32\MSDvbNP.ax
2008-06-04 20:50 . 2008-06-04 20:50 <REP> d-------- C:\Users\All Users\IncrediMail
2008-06-04 20:50 . 2008-06-04 20:51 <REP> d-------- C:\Users\All Users\IM
2008-06-04 20:50 . 2008-06-04 20:51 <REP> d-------- C:\Program Files\IncrediMail
2008-06-04 20:50 . 2008-06-04 20:50 <REP> d-------- C:\PROGRA~2\IncrediMail
2008-06-04 20:50 . 2008-06-04 20:51 <REP> d-------- C:\PROGRA~2\IM
2008-06-03 22:32 . 2008-07-31 22:58 0 --------- C:\Windows\System32\Ikeext.etl

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-28 14:12 --------- d-----w C:\PROGRA~2\WLInstaller
2008-07-27 20:49 --------- d-----w C:\Program Files\Windows Live
2008-07-23 20:24 --------- d-----w C:\PROGRA~2\Microsoft Help
2008-07-23 16:46 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-14 10:16 --------- d-----w C:\Program Files\eChanblard
2008-07-10 01:12 174 --sha-w C:\Program Files\desktop.ini
2008-07-10 01:00 --------- d-----w C:\Program Files\Windows Mail
2008-07-01 19:30 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-06-25 12:03 --------- d---a-w C:\PROGRA~2\TEMP
2008-04-29 07:18 319,456 ----a-w C:\Windows\DIFxAPI.dll
2008-04-25 04:23 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-04-20 01:10 2,923,520 ----a-w C:\Windows\explorer.exe
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-04-20 03:07 1232896]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 14:35 125440]
"EPSON Stylus DX7400 Series"="C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATICDE.EXE" [2007-04-12 08:00 182272]
"IncrediMail"="C:\Program Files\IncrediMail\bin\IncMail.exe" [2008-06-03 17:25 243072]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 14:36 201728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2007-04-18 17:01 65536]
"KBD"="C:\HP\KBD\KbdStub.EXE" [2006-12-08 18:16 65536]
"OsdMaestro"="C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe" [2007-02-15 13:59 118784]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-07-12 17:36 178712]
"StartCCC"="c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 13:35 90112]
"SunJavaUpdateReg"="C:\Windows\system32\jureg.exe" [2007-04-07 03:56 54936]
"HP Software Update"="c:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 17:24 54840]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-07-07 22:00 1232152]
"RtHDVCpl"="RtHDVCpl.exe" [2008-01-15 11:26 4874240 C:\Windows\RtHDVCpl.exe]

C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\
WiFi Station pour Livebox.lnk - C:\Program Files\Hercules\WiFi Station pour Livebox\WiFiLB.exe [2008-04-19 11:51:08 102400]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3codecp"= l3codecp.acm
"VIDC.YV12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1422842385-45425781-3350853422-1000]
"EnableNotificationsRef"=dword:00000007

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{2A13FD50-7C0E-45D0-BE41-9AA064C25C31}"= c:\Program Files\Cyberlink\PowerDirector\PDR.EXE:CyberLink PowerDirector
"{92F445BB-C5D8-4847-AFA9-F2ED5A749AB3}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{25BB2D31-24F2-4D9E-8B4D-C7D3C9622959}C:\\program files\\echanblard\\emule.exe"= UDP:C:\program files\echanblard\emule.exe:eMule
"UDP Query User{F088AC81-72A6-471B-83A0-66A91FD071BC}C:\\program files\\echanblard\\emule.exe"= TCP:C:\program files\echanblard\emule.exe:eMule
"{1A0AA0E0-E8E9-4002-97D2-A7416AD3CCF3}"= UDP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
"{D5DF192D-03F8-492F-A37A-A71FEBF4E320}"= TCP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
"{390D7FF4-E77A-49F9-8D4D-8AC08E75017B}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{F97743DD-D852-4B79-A7E5-159F01C9DE50}"= Disabled:UDP:C:\Program Files\IncrediMail\bin\ImpCnt.exe:IncrediMail
"{2CC738BB-29B1-4D8B-8224-38B8FB1336C9}"= Disabled:TCP:C:\Program Files\IncrediMail\bin\ImpCnt.exe:IncrediMail
"{5A6632AA-67D8-4A9C-A4EC-0DC35BB7998D}"= Disabled:UDP:C:\Program Files\IncrediMail\bin\IncMail.exe:IncrediMail
"{DD0438AD-1700-4480-BDD7-E1FB11040FFE}"= Disabled:TCP:C:\Program Files\IncrediMail\bin\IncMail.exe:IncrediMail
"{BC37AEC1-3C7A-4E85-82B8-103A9E3DFF08}"= Disabled:UDP:C:\Program Files\IncrediMail\bin\ImApp.exe:IncrediMail
"{732A0173-BF18-4AE1-AEBB-7FEE630D10C7}"= Disabled:TCP:C:\Program Files\IncrediMail\bin\ImApp.exe:IncrediMail

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"C:\\Program Files\\Orange\\Connectivity\\ConnectivityManager.exe"= C:\Program Files\Orange\Connectivity\ConnectivityManager.exe:*:enabled:CSS
"C:\\Program Files\\Winsos\\winsos.exe"= C:\Program Files\Winsos\winsos.exe:*:Enabled:Winsos

R1 AvgLdx86;AVG Free AVI Loader Driver x86;C:\Windows\system32\Drivers\avgldx86.sys [2008-07-07 22:00]
R2 avg8wd;AVG Free8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-07-07 22:00]
R3 atikmdag;atikmdag;C:\Windows\system32\DRIVERS\atikmdag.sys [2007-09-15 00:16]
S3 GameConsoleService;GameConsoleService;C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe [2008-05-06 00:25]
S3 netr73;Hercules Wireless USB Dongle Driver for Vista;C:\Windows\system32\DRIVERS\netr73.sys [2007-01-31 17:01]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e2f4eec5-0406-11dd-a452-001e8c4e9577}]
\shell\AutoRun\command - J:\nideiect.com
\shell\explore\Command - J:\nideiect.com
\shell\open\Command - J:\nideiect.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e2f4eec8-0406-11dd-a452-001e8c4e9577}]
\shell\AutoRun\command - K:\LaunchU3.exe -a
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-WINSOS VERIFY - C:\Program Files\Winsos\WINSOS.EXE

.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.google.fr/
R0 -: HKLM-Main,Start Page = hxxp://www.ustart.org
O8 -: &Recherche AOL Toolbar - c:\program files\aol\aol toolbar 5.0\resources\fr-fr\local\search.html
O8 -: E&xporter vers Microsoft Excel - C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-31 22:58:40
Windows 6.0.6000 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Windows\System32\Ati2evxx.exe
C:\Windows\System32\audiodg.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\[u]0/u\FTRTSVC.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\System32\WUDFHost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Windows\System32\conime.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Windows\System32\schtasks.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Windows\ehome\ehmsas.exe
C:\Users\Déborah\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Users\Déborah\AppData\Roaming\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\Windows\System32\wbem\unsecapp.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\IncrediMail\bin\ImApp.exe
C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Service.exe
C:\hp\KBD\kbd.exe
C:\Windows\System32\dllhost.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-07-31 23:01:18 - machine was rebooted [D‚borah]
ComboFix-quarantined-files.txt 2008-07-31 21:01:11
ComboFix2.txt 2008-07-30 12:08:46

Pre-Run: 356,229,709,824 octets libres
Post-Run: 356,755,460,096 octets libres

198 --- E O F --- 2008-07-31 20:41:27

Salut

très bien, oui j'ai tout reçu ! dis moi à présent comment se comporte le pc, et poste un nouveau combo et un nouveau rapport hijackthis stp

je te ferai faire le nettoyage de tout ce que l'on a téléchargé à la fin, et je te dirai ce qu'il te manque en logiciel aussi

derrière ligne droite ! :-)

de rien,@+

;-)

bon gros bug avec l'orage pourras tu m'envoyer un mail pour voir si tu as reçu tout mes messages ????
merci

dsl le message est en triple exemplaire aucun signe que le message est été bien enregistrer (le tps n'ai pas au rdv chez moi du coup sa bug un peu !!) !!! ducoup tu a qq variantes du même message !!!
là y a peut être trop de compliments !!!!!!!! ;-))

aller bonne soirée :-)

a++

voilà le rapport :

Malwarebytes' Anti-Malware 1.23
Version de la base de données: 1008
Windows 6.0.6000

18:23:34 2008-07-30
mbam-log-7-30-2008 (18-23-34).txt

Type de recherche: Examen complet (C:\|D:\|E:\|F:\|G:\|H:\|I:\|L:\|)
Eléments examinés: 150925
Temps écoulé: 18 minute(s), 11 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

je pense que tout est bon !!
merci mille fois je n'en pouvais plus et personne dans mon entourage pour m'aider !!!encore merci pour ton aide !!!!
est ce que je dois supprimer tous ce que j'ai téléchatger (gmer, malware, elibagla, et tous les rapports) ???
est ce que je dois mettre une protection supplémentaire j'utilise AVG et je n'ai que ça, quel autre logiciel je dois installer ????

merci merci ;-)

voilà le rapport :

Malwarebytes' Anti-Malware 1.23
Version de la base de données: 1008
Windows 6.0.6000

18:23:34 2008-07-30
mbam-log-7-30-2008 (18-23-34).txt

Type de recherche: Examen complet (C:\|D:\|E:\|F:\|G:\|H:\|I:\|L:\|)
Eléments examinés: 150925
Temps écoulé: 18 minute(s), 11 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

bon là je pense que tout est bon !!!
en tout cas je voulais dire que ce forum est génial parce que je suis une vrai débutante en ce qui concerne internbet et là tu m'as vraiment bien aidé !!!!!
merci de ta patience parce que sa a pas été facile !!!!!
je te remercie énormément ;-))

j ai encore qq questions comme tu as l'air bien sur le sujet !!
j utilise l'anti virus avg est ce que c'est une protection suffisante ou il faut que je le complète???
pourrais tu me dire ce qu'il faudrait que je rajoute comme protection supplémentaires ????

moi je serais là que demain soir alors bon jeudi ! :-)

voilà le rapport :

Malwarebytes' Anti-Malware 1.23
Version de la base de données: 1008
Windows 6.0.6000

18:23:34 2008-07-30
mbam-log-7-30-2008 (18-23-34).txt

Type de recherche: Examen complet (C:\|D:\|E:\|F:\|G:\|H:\|I:\|L:\|)
Eléments examinés: 150925
Temps écoulé: 18 minute(s), 11 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

je crois bien que tout est bon !!!!!

merci beaucoup je désespérais !!!!
grâce à ton aide tout est bon encore merci !!!
une dernière question est ce que je dois supprimer maintenant elibagla, killbagle, gmer ???
encore une question comme tu as l'air de vraaiment bien t'y connaître en info j 'utilise l'antivirus AVG est ce que cela suffit ou je doit me protéger un peu plus ???

Bonne journée je seras là que jeudi soir alors passe une bonne journée

;-))

@+++++

Ah ! non, je serai pas là, mais je verrai le résultat du scan demain ;-)

on l'a eu ! :)

bonne journée ! @+

;-)

je dois parti je fais ça a 18h tu seras là ???
a tout a l'heure

merci bcp de ton aidea tout :-))

Très bien, à présent faus le scan en mode sans echec avec : MalwareByte's Anti-Malware et poste le rapport stp

@+

rapport gmer :

GMER 1.0.14.14536 - http://www.gmer.net
Rootkit scan 2008-07-30 14:54:13
Windows 6.0.6000

---- Kernel code sections - GMER 1.0.14 ----

PAGE spsys.sys!?SPVersion@@3PADA + 1807 9788B03F 119 Bytes [ 8B, FF, 55, 8B, EC, 8B, 45, ... ]
PAGE spsys.sys!?SPVersion@@3PADA + 187F 9788B0B7 384 Bytes [ 87, 97, C3, 8B, FF, A1, 18, ... ]
PAGE spsys.sys!?SPVersion@@3PADA + 1A00 9788B238 434 Bytes [ 04, 3B, C1, 73, 05, 8B, 02, ... ]
PAGE spsys.sys!?SPVersion@@3PADA + 1BB3 9788B3EB 120 Bytes [ 5D, 0C, EB, 03, 8B, 4D, 10, ... ]
PAGE spsys.sys!?SPVersion@@3PADA + 1C2C 9788B464 1379 Bytes [ 8B, 4E, 10, 31, 4D, D4, 8B, ... ]
PAGE ...

---- User code sections - GMER 1.0.14 ----

.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[2152] kernel32.dll!SetUnhandledExceptionFilter 769CD187 5 Bytes JMP 0056DBBD C:\Program Files\Windows Live\Messenger\msnmsgr.exe (Windows Live Messenger/Microsoft Corporation)
.text C:\Users\DBORAH~1\AppData\Local\Temp\Rar$EX00.388\gmer.exe[4640] ntdll.dll!NtCreateFile + 3 777FF417 2 Bytes [ 85, FA ]
.text C:\Program Files\Internet Explorer\iexplore.exe[5324] USER32.dll!DialogBoxIndirectParamW 76AA14EA 5 Bytes JMP 71871667 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5324] USER32.dll!MessageBoxExA 76AB570D 5 Bytes JMP 718715AE C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5324] USER32.dll!DialogBoxParamA 76AB65BF 5 Bytes JMP 7187162C C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5324] USER32.dll!MessageBoxIndirectW 76ABF1B3 5 Bytes JMP 717016B6 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5324] USER32.dll!DialogBoxParamW 76AC129F 5 Bytes JMP 716DF301 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5324] USER32.dll!DialogBoxIndirectParamA 76AE29C9 5 Bytes JMP 718716A2 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5324] USER32.dll!MessageBoxIndirectA 76AEFACF 5 Bytes JMP 718715E8 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5324] USER32.dll!MessageBoxExW 76AEFBC9 5 Bytes JMP 71871574 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

---- EOF - GMER 1.0.14 ----

Hum, dans le rapport que tu me poste ça n'apparait pas :/

poste un nouveau rapport gmer stp !

@+

voici le rapport elibagla :

Wed Jul 30 14:28:28 2008
EliBagle v11.62 (c)2008 S.G.H. / Satinfo S.L. (Actualizado el 24 de Julio del 2008)
----------------------------------------------
Lista de Acciones (por Acción Directa):

Wed Jul 30 14:28:29 2008
EliBagle v11.62 (c)2008 S.G.H. / Satinfo S.L. (Actualizado el 24 de Julio del 2008)
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad C:\

14 fichier au nom de bagle ont été supprimés

est ce que c'est vraiment bon ????