rapport HijackThis- cpu à 100% et mo à 100%

belllangelo · le 24 mars 2007

Bonjour à tous,

Depuis quelques temps mon ordinateur présente une utilisation en mémoire vive anormale.

Depuis une semaine, les choses se sont considérablement dégradées:

à l'ouverture de ma session j'ai 100% d'utilisation de mémoire vive et au moindre clic j'ai le cpu à 100% également!

Impossible donc d'utiliser ma session habituelle. Seule solution, le mode sans échec.

A partir du mode sans echec j'ai lancé plusieurs antivirus online.

Un antivirus en ligne "Trend Micro scan" a identifié un virus nommé : BKDR_LANAFTP.J et me propose de suprimer le programme "service.exe" de windows (le processus service.exe apparait dans ma liste de processus dans ma session utilisateur).

Avant de faire une manip malheureuse que je viens vous demander conseil.

Voici mon rapport HijackThis-

................................................................................

Logfile of HijackThis v1.99.1

Scan saved at 13:12:21, on 24/03/2007

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE

C:\Program Files\CA\eTrust Antivirus\InoRpc.exe

C:\Program Files\CA\eTrust Antivirus\InoRT.exe

C:\Program Files\CA\eTrust Antivirus\InoTask.exe

C:\PROGRA~1\CA\SHARED~1\SCANEN~1\InoDist.exe

C:\PROGRA~1\Iomega\System32\AppServices.exe

C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe

C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe

C:\Program Files\MySQL\MySQL Server 4.1\bin\mysqld-nt.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Iomega\AutoDisk\ADService.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\wuauclt.exe

C:\PROGRA~1\CA\ETRUST~1\realmon.exe

C:\WINDOWS\mHotkey.exe

C:\WINDOWS\System32\RunDll32.exe

C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\Program Files\Iomega\AutoDisk\ADUserMon.exe

C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe

C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe

C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe

C:\HJT\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.yahoo.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.auchan.fr/

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O3 - Toolbar: &Save Flash - {4064EA35-578D-4073-A834-C96D82CBCF40} - C:\Program Files\Save Flash\SaveFlash.dll

O4 - HKLM\..\Run: [Realtime Monitor] C:\PROGRA~1\CA\ETRUST~1\realmon.exe -s

O4 - HKLM\..\Run: [CHotkey] mHotkey.exe

O4 - HKLM\..\Run: [siSUSBRG] C:\WINDOWS\SiSUSBrg.exe

O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd

O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

O4 - HKLM\..\Run: [ADUserMon] C:\Program Files\Iomega\AutoDisk\ADUserMon.exe

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe

O4 - HKLM\..\Run: [system] C:\WINDOWS\System32\support.exe

O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"

O4 - Startup: desktop(2).ini

O4 - Global Startup: desktop(2).ini

O4 - Global Startup: desktop(3).ini

O4 - Global Startup: desktop(4).ini

O4 - Global Startup: hpoddt01.exe.lnk = ?

O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll

O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm

O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE

O14 - IERESET.INF: START_PAGE_URL=http://www.auchan.fr/

O16 - DPF: Yahoo! MahJong Solitaire - http://download.games.yahoo.com/games/clients/y/mjst4_x.cab

O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/pote_x.cab

O16 - DPF: {072039AB-2117-4ED5-A85F-9B9EB903E021} (NowStarter Control) - http://www.clubbox.co.kr/neo.fld/NowStarter.cab

O16 - DPF: {09C21411-B9A2-4DE6-8416-4E3B58577BE0} (France Telecom MDM ActiveX Control) - http://minitelweb.minitel.com/imin_data/ocx/MDM.cab

O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://webscanner.kaspersky.fr/kavwebscan_unicode.cab

O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC...bin/AvSniff.cab

O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://207.188.7.150/12f7817c9c76667a9b15/...RdxIE601_fr.cab

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab

O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/200306...meInstaller.exe

O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111...all/xscan53.cab

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O16 - DPF: {A922B6AB-3B87-11D3-B3C2-0008C7DA6CB9} (InetDownload Class) - https://media.pineconeresearch.com/ActiveX/...loadcontrol.cab

O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab

O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game12.zylomgames.com/activex/zylomgamesplayer.cab

O16 - DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} (CSS Web Installer Class) - http://www.freedom.net/viruscenter/onlinev...cabs/cssweb.cab

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE

O23 - Service: Client de licence CA (CA_LIC_CLNT) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe

O23 - Service: Serveur de licence CA (CA_LIC_SRVR) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmtd.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRpc.exe

O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRT.exe

O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoTask.exe

O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe

O23 - Service: Event Log Watch (LogWatch) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe

O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exe

O23 - Service: MySQL - Unknown owner - C:\Program.exe (file missing)

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

O23 - Service: Iomega Active Disk (_IOMEGA_ACTIVE_DISK_SERVICE_) - Iomega Corporation - C:\Program Files\Iomega\AutoDisk\ADService.exe

................................................................................

Merci pour votre aide

Belllangelo

Malekal_morte · le 24 mars 2007

Bonjour,

Voici la manipulation à effectuer en entier

Merci de bien vouloir :

- Lire attentivement les instructions demandées et prendre son temps pour les effectuer convenablement, sinon la désinfection ne sera pas complète.

- Si certains éléments ne sont pas trouvés, merci de le signaler mais de poursuivre les manipulations jusqu'au bout.

- A l'issu de la procédure, merci de bien copier/coller TOUS les rapports demandés.

- N'hésitez pas à consulter les liens d'aides, ils sont là pour vous guider !

- Demarrer / executer / tape services.msc

- Cherche MySQL dans la liste

- Double clic dessus, positionne le type de démarrage sur désactiver

Sur HiJackThis, refais un scan et coches les lignes suivantes :

O4 - HKLM\..\Run: [system] C:\WINDOWS\System32\support.exe

---> puis clic sur le bouton "Fix Checked"

n'hésite pas à consulter l'aide HiJackThis

- Télécharge et installe AVG Anti-Spyware - Tutorial : http://www.malekal.com/tutorial_AVG_AntiSpyware.html

- Mets le à jour à partir du menu Mise à jour en haut

- Télécharge clean.zip, décompresse-le sur ton bureau (clic droit / extraire tout), tu dois obtenir un dossier clean.

-- Redémarre en mode en mode sans échec, si tu sais pas comment on fait lis ceci

Double-clic sur ce dossier clean, tu y trouveras dedans plusieurs fichiers.

Double-clic sur clean. Cela va ouvrir une fenêtre noire.

Un menu va apparaître, choisis l'option 2 en appuyant sur la touche 2 de ton clavier.

Clean va travailler.

Un rapport Va etre généré, colle le contenu entier ici.

- Ouvre AVG Anti-Spyware et clic sur l'onglet Analyse, puis le sous-onglet Paramètres

- Sélectionne dans Comment Réagir ? Quarantine. (voir l'aide l'aide AVG Anti-Spyware)

- Reviens au sous-onglet Analyser puis clique sur Analyse complète du système.

---> Le scan démarre.

A la fin clique sur Appliquer toutes les actions, les éléments doivent alors être déplacés en quarantaine.

Puis clique sur Enregistrer le rapport d'analyse et enregistre le rapport sur le Bureau.

Aide : N'hésite pas à consulter l'Aide AVG Anti-Spyware pour tout problème.

-- Redémarre en mode normal : Menu Démarrer / Arreter / Redémarre l'ordinateur

Attention : dans le cas où l'ordinateur redémarre en boucle en mode sans échec, faire la manipulation inverse en décochant l'option /SAFEBOOT à l'aide de msconfig : voir à nouveau cette page : cliquez-ici

-- Fais un scan en ligne avec Internet Explorer : Scan Kaspersky et colle le rapport ici. Si tu es perdu, tu peux suivre cette aide pour les scans en ligne

-- Copie/Colle ici les rapports :

- AVG Anti-Spyware

- le rapport clean : Poste de travail / double clic sur disque C / double-clic sur rapport_clean.txt et copier/coller le contenu ici C:\rapport_clean.txt

- ainsi qu'un nouveau log HiJackThis

belllangelo · le 24 mars 2007

Bonsoir,

Merci beaucoup pour ce protocole.

J'ai suivi à la lettre les recommandations et voici les différents rapports:

.........................................................

Rapport clean:

Script execute en mode sans echec

Rapport clean par Malekal_morte - http://www.malekal.com

Option 2, executee le 24/03/2007 a 15:43:31,59

Microsoft Windows XP [version 5.1.2600]

*** Suppression de fichiers sur C:

tentative de suppression de C:\unwise.exe

*** Suppression des fichiers dans C:\WINDOWS\

*** Suppression des fichiers dans C:\WINDOWS\system32

tentative de suppression de C:\WINDOWS\system32\RICHTX.DEP

tentative de suppression de "C:\WINDOWS\Downloaded Program Files\CONFLICT.1"

tentative de suppression de "C:\Program Files\Viewpoint\"

*** Suppression des clefs du registre effectuee..

*** Fin du rapport !

.........................................................

Rapport AVG:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

A V G A n t i - S p y w a r e - R a p p o r t d ' a n a l y s e

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

+ C r é é à : 1 9 : 2 1 : 3 8 2 4 / 0 3 / 2 0 0 7

+ R é s u l t a t d e l ' a n a l y s e :

C : \ W I N D O W S \ s y s t e m 3 2 \ s u p p o r t . e x e - > B a c k d o o r . L a n a F T P . j : N e t t o y é .

C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t e u r . C O Z Z A N O . 0 0 1 \ C o o k i e s \ a d m i n i s t r a t e u r @ 2 4 7 r e a l m e d i a [ 1 ] . t x t - > T r a c k i n g C o o k i e . 2 4 7 r e a l m e d i a : N e t t o y é .

C : \ D o c u m e n t s a n d S e t t i n g s \ u t i l i s a t e u r 1 \ C o o k i e s \ u t i l i s a t e u r 1 @ 2 4 7 r e a l m e d i a [ 1 ] . t x t - > T r a c k i n g C o o k i e . 2 4 7 r e a l m e d i a : N e t t o y é .

C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t e u r . C O Z Z A N O . 0 0 1 \ C o o k i e s \ a d m i n i s t r a t e u r @ 1 2 2 . 2 o 7 [ 2 ] . t x t - > T r a c k i n g C o o k i e . 2 o 7 : N e t t o y é .

C : \ D o c u m e n t s a n d S e t t i n g s \ u t i l i s a t e u r 1 \ C o o k i e s \ u t i l i s a t e u r 1 @ p a y p a l . 1 1 2 . 2 o 7 [ 1 ] . t x t - > T r a c k i n g C o o k i e . 2 o 7 : N e t t o y é .

C : \ D o c u m e n t s a n d S e t t i n g s \ u t i l i s a t e u r 1 \ C o o k i e s \ u t i l i s a t e u r 1 @ a d t e c h [ 2 ] . t x t - > T r a c k i n g C o o k i e . A d t e c h : N e t t o y é .

C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t e u r . C O Z Z A N O . 0 0 1 \ C o o k i e s \ a d m i n i s t r a t e u r @ a d v e r t i s i n g [ 2 ] . t x t - > T r a c k i n g C o o k i e . A d v e r t i s i n g : N e t t o y é .

C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t e u r . C O Z Z A N O . 0 0 1 \ C o o k i e s \ a d m i n i s t r a t e u r @ a t d m t [ 2 ] . t x t - > T r a c k i n g C o o k i e . A t d m t : N e t t o y é .

C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t e u r . C O Z Z A N O . 0 0 1 \ C o o k i e s \ a d m i n i s t r a t e u r @ b l u e s t r e a k [ 1 ] . t x t - > T r a c k i n g C o o k i e . B l u e s t r e a k : N e t t o y é .

C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t e u r . C O Z Z A N O . 0 0 1 \ C o o k i e s \ a d m i n i s t r a t e u r @ c o m [ 1 ] . t x t - > T r a c k i n g C o o k i e . C o m : N e t t o y é .

C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t e u r . C O Z Z A N O . 0 0 1 \ C o o k i e s \ a d m i n i s t r a t e u r @ f l 0 1 . c t 2 . c o m c l i c k [ 1 ] . t x t - > T r a c k i n g C o o k i e . C o m c l i c k : N e t t o y é .

C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t e u r . C O Z Z A N O . 0 0 1 \ C o o k i e s \ a d m i n i s t r a t e u r @ d a t a . c o r e m e t r i c s [ 1 ] . t x t - > T r a c k i n g C o o k i e . C o r e m e t r i c s : N e t t o y é .

C : \ D o c u m e n t s a n d S e t t i n g s \ u t i l i s a t e u r 1 \ C o o k i e s \ u t i l i s a t e u r 1 @ c p v f e e d [ 2 ] . t x t - > T r a c k i n g C o o k i e . C p v f e e d : N e t t o y é .

: m o z i l l a . 9 : C : \ D o c u m e n t s a n d S e t t i n g s \ u t i l i s a t e u r 1 \ A p p l i c a t i o n D a t a \ M o z i l l a \ F i r e f o x \ P r o f i l e s \ 9 6 5 1 i x m 1 . d e f a u l t \ c o o k i e s . t x t - > T r a c k i n g C o o k i e . D o u b l e c l i c k : N e t t o y é .

C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t e u r . C O Z Z A N O . 0 0 1 \ C o o k i e s \ a d m i n i s t r a t e u r @ d o u b l e c l i c k [ 2 ] . t x t - > T r a c k i n g C o o k i e . D o u b l e c l i c k : N e t t o y é .

C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t e u r . C O Z Z A N O . 0 0 1 \ C o o k i e s \ a d m i n i s t r a t e u r @ e s t a t [ 1 ] . t x t - > T r a c k i n g C o o k i e . E s t a t : N e t t o y é .

C : \ D o c u m e n t s a n d S e t t i n g s \ u t i l i s a t e u r 1 \ C o o k i e s \ u t i l i s a t e u r 1 @ e s t a t [ 1 ] . t x t - > T r a c k i n g C o o k i e . E s t a t : N e t t o y é .

C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t e u r . C O Z Z A N O . 0 0 1 \ C o o k i e s \ a d m i n i s t r a t e u r @ f a s t c l i c k [ 2 ] . t x t - > T r a c k i n g C o o k i e . F a s t c l i c k : N e t t o y é .

C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t e u r . C O Z Z A N O . 0 0 1 \ C o o k i e s \ a d m i n i s t r a t e u r @ e h g - y o u t u b e . h i t b o x [ 2 ] . t x t - > T r a c k i n g C o o k i e . H i t b o x : N e t t o y é .

C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t e u r . C O Z Z A N O . 0 0 1 \ C o o k i e s \ a d m i n i s t r a t e u r @ h i t b o x [ 1 ] . t x t - > T r a c k i n g C o o k i e . H i t b o x : N e t t o y é .

C : \ D o c u m e n t s a n d S e t t i n g s \ u t i l i s a t e u r 1 \ C o o k i e s \ u t i l i s a t e u r 1 @ i d o t [ 1 ] . t x t - > T r a c k i n g C o o k i e . I d o t : N e t t o y é .

C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t e u r . C O Z Z A N O . 0 0 1 \ C o o k i e s \ a d m i n i s t r a t e u r @ m e d i a p l e x [ 2 ] . t x t - > T r a c k i n g C o o k i e . M e d i a p l e x : N e t t o y é .

C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t e u r . C O Z Z A N O . 0 0 1 \ C o o k i e s \ a d m i n i s t r a t e u r @ s s l - h i n t s . n e t f l a m e [ 2 ] . t x t - > T r a c k i n g C o o k i e . N e t f l a m e : N e t t o y é .

C : \ D o c u m e n t s a n d S e t t i n g s \ u t i l i s a t e u r 1 \ C o o k i e s \ u t i l i s a t e u r 1 @ s s l - h i n t s . n e t f l a m e [ 1 ] . t x t - > T r a c k i n g C o o k i e . N e t f l a m e : N e t t o y é .

C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t e u r . C O Z Z A N O . 0 0 1 \ C o o k i e s \ a d m i n i s t r a t e u r @ o v e r t u r e [ 1 ] . t x t - > T r a c k i n g C o o k i e . O v e r t u r e : N e t t o y é .

C : \ D o c u m e n t s a n d S e t t i n g s \ u t i l i s a t e u r 1 \ C o o k i e s \ u t i l i s a t e u r 1 @ o v e r t u r e [ 1 ] . t x t - > T r a c k i n g C o o k i e . O v e r t u r e : N e t t o y é .

C : \ D o c u m e n t s a n d S e t t i n g s \ u t i l i s a t e u r 1 \ C o o k i e s \ u t i l i s a t e u r 1 @ w w w . p a y p a l [ 1 ] . t x t - > T r a c k i n g C o o k i e . P a y p a l : N e t t o y é .

C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t e u r . C O Z Z A N O . 0 0 1 \ C o o k i e s \ a d m i n i s t r a t e u r @ a d s . p o i n t r o l l [ 2 ] . t x t - > T r a c k i n g C o o k i e . P o i n t r o l l : N e t t o y é .

C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t e u r . C O Z Z A N O . 0 0 1 \ C o o k i e s \ a d m i n i s t r a t e u r @ w w w . s m a r t a d s e r v e r [ 1 ] . t x t - > T r a c k i n g C o o k i e . S m a r t a d s e r v e r : N e t t o y é .

C : \ D o c u m e n t s a n d S e t t i n g s \ u t i l i s a t e u r 1 \ C o o k i e s \ u t i l i s a t e u r 1 @ w w w . s m a r t a d s e r v e r [ 1 ] . t x t - > T r a c k i n g C o o k i e . S m a r t a d s e r v e r : N e t t o y é .

C : \ D o c u m e n t s a n d S e t t i n g s \ u t i l i s a t e u r 1 \ C o o k i e s \ u t i l i s a t e u r 1 @ t o p l i s t [ 1 ] . t x t - > T r a c k i n g C o o k i e . T o p l i s t : N e t t o y é .

C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t e u r . C O Z Z A N O . 0 0 1 \ C o o k i e s \ a d m i n i s t r a t e u r @ t r a d e d o u b l e r [ 1 ] . t x t - > T r a c k i n g C o o k i e . T r a d e d o u b l e r : N e t t o y é .

C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t e u r . C O Z Z A N O . 0 0 1 \ C o o k i e s \ a d m i n i s t r a t e u r @ t r i b a l f u s i o n [ 1 ] . t x t - > T r a c k i n g C o o k i e . T r i b a l f u s i o n : N e t t o y é .

C : \ D o c u m e n t s a n d S e t t i n g s \ u t i l i s a t e u r 1 \ C o o k i e s \ u t i l i s a t e u r 1 @ w e b o r a m a [ 2 ] . t x t - > T r a c k i n g C o o k i e . W e b o r a m a : N e t t o y é .

C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t e u r . C O Z Z A N O . 0 0 1 \ C o o k i e s \ a d m i n i s t r a t e u r @ m . w e b t r e n d s [ 2 ] . t x t - > T r a c k i n g C o o k i e . W e b t r e n d s : N e t t o y é .

C : \ D o c u m e n t s a n d S e t t i n g s \ u t i l i s a t e u r 1 \ C o o k i e s \ u t i l i s a t e u r 1 @ m . w e b t r e n d s [ 1 ] . t x t - > T r a c k i n g C o o k i e . W e b t r e n d s : N e t t o y é .

C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t e u r . C O Z Z A N O . 0 0 1 \ C o o k i e s \ a d m i n i s t r a t e u r @ s t a t s e . w e b t r e n d s l i v e [ 2 ] . t x t - > T r a c k i n g C o o k i e . W e b t r e n d s l i v e : N e t t o y é .

C : \ D o c u m e n t s a n d S e t t i n g s \ u t i l i s a t e u r 1 \ C o o k i e s \ u t i l i s a t e u r 1 @ y a d r o [ 1 ] . t x t - > T r a c k i n g C o o k i e . Y a d r o : N e t t o y é .

C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t e u r . C O Z Z A N O . 0 0 1 \ C o o k i e s \ a d m i n i s t r a t e u r @ a d . y i e l d m a n a g e r [ 2 ] . t x t - > T r a c k i n g C o o k i e . Y i e l d m a n a g e r : N e t t o y é .

F i n d u r a p p o r t

.........................................................

Rapport kaspersky:

Sunday, March 25, 2007 12:50:45 AM

Operating System: Microsoft Windows XP Home Edition, Service Pack 1 (Build 2600)

Kaspersky Online Scanner version: 5.0.83.0

Kaspersky Anti-Virus database last update: 24/03/2007

Kaspersky Anti-Virus database records: 269275

Scan Settings

Scan using the following antivirus database standard

Scan Archives true

Scan Mail Bases true

Scan Target My Computer

A:\

C:\

D:\

E:\

F:\

G:\

H:\

Scan Statistics

Total number of scanned objects 167659

Number of viruses found 2

Number of infected objects 4 / 0

Number of suspicious objects 8

Duration of the scan process 04:52:44

Infected Object Name Virus Name Last Action

C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Historique\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\utilisateur 1\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\utilisateur 1\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\utilisateur 1\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\utilisateur 1\Local Settings\Historique\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\utilisateur 1\Local Settings\Historique\History.IE5\MSHist012007032420070325\index.dat Object is locked skipped

C:\Documents and Settings\utilisateur 1\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\utilisateur 1\ntuser.dat Object is locked skipped

C:\Documents and Settings\utilisateur 1\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\utilisateur 1\UserData\index.dat Object is locked skipped

C:\Program Files\CA\eTrust Antivirus\DB\rtmaster.dbf Object is locked skipped

C:\Program Files\CA\eTrust Antivirus\DB\rtmaster.ntx Object is locked skipped

C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

C:\System Volume Information\_restore{88714686-DC26-49C4-A809-5AD6669CB3D1}\RP975\A0189687.exe/data.rar/support.exe Infected: Backdoor.Win32.LanaFTP.j skipped

C:\System Volume Information\_restore{88714686-DC26-49C4-A809-5AD6669CB3D1}\RP975\A0189687.exe/data.rar Infected: Backdoor.Win32.LanaFTP.j skipped

C:\System Volume Information\_restore{88714686-DC26-49C4-A809-5AD6669CB3D1}\RP975\A0189687.exe RarSFX: infected - 2 skipped

C:\System Volume Information\_restore{88714686-DC26-49C4-A809-5AD6669CB3D1}\RP975\A0190906.exe Infected: Backdoor.Win32.LanaFTP.j skipped

C:\System Volume Information\_restore{88714686-DC26-49C4-A809-5AD6669CB3D1}\RP975\change.log Object is locked skipped

C:\WINDOWS\$NtUninstallKB824141$\user32.dll Object is locked skipped

C:\WINDOWS\$NtUninstallKB824141$\win32k.sys Object is locked skipped

C:\WINDOWS\$NtUninstallKB826942$\dhcpcsvc.dll Object is locked skipped

C:\WINDOWS\$NtUninstallKB826942$\ndis.sys Object is locked skipped

C:\WINDOWS\$NtUninstallKB826942$\ndisuio.sys Object is locked skipped

C:\WINDOWS\$NtUninstallKB826942$\netshell.dll Object is locked skipped

C:\WINDOWS\$NtUninstallKB826942$\wzcdlg.dll Object is locked skipped

C:\WINDOWS\$NtUninstallKB826942$\wzcsapi.dll Object is locked skipped

C:\WINDOWS\$NtUninstallKB826942$\wzcsvc.dll Object is locked skipped

C:\WINDOWS\$NtUninstallKB828035$\msgsvc.dll Object is locked skipped

C:\WINDOWS\$NtUninstallKB828035$\wkssvc.dll Object is locked skipped

C:\WINDOWS\$NtUninstallKB829558$\dao360.dll Object is locked skipped

C:\WINDOWS\$NtUninstallKB829558$\msexcl40.dll Object is locked skipped

C:\WINDOWS\$NtUninstallKB829558$\msjet40.dll Object is locked skipped

C:\WINDOWS\$NtUninstallKB829558$\msjetol1.dll Object is locked skipped

C:\WINDOWS\$NtUninstallKB829558$\msjetoledb40.dll Object is locked skipped

C:\WINDOWS\$NtUninstallKB829558$\msjtes40.dll Object is locked skipped

C:\WINDOWS\$NtUninstallKB829558$\mspbde40.dll Object is locked skipped

C:\WINDOWS\$NtUninstallKB829558$\msrepl40.dll Object is locked skipped

C:\WINDOWS\$NtUninstallKB829558$\mstext40.dll Object is locked skipped

C:\WINDOWS\$NtUninstallKB829558$\msxbde40.dll Object is locked skipped

C:\WINDOWS\$NtUninstallQ828026$\msdxm.ocx Object is locked skipped

C:\WINDOWS\$NtUninstallQ828026$\wmp.dll Object is locked skipped

C:\WINDOWS\Debug\oakley.log Object is locked skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\SchedLgU.Txt Object is locked skipped

C:\WINDOWS\SoftwareDistribution\EventCache\{73554AFB-9C6C-4886-AE6B-01167A9596DF}.bin Object is locked skipped

C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped

C:\WINDOWS\Sti_Trace.log Object is locked skipped

C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\default Object is locked skipped

C:\WINDOWS\system32\config\default.LOG Object is locked skipped

C:\WINDOWS\system32\config\SAM Object is locked skipped

C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SECURITY Object is locked skipped

C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

C:\WINDOWS\system32\config\software Object is locked skipped

C:\WINDOWS\system32\config\software.LOG Object is locked skipped

C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\system Object is locked skipped

C:\WINDOWS\system32\config\system.LOG Object is locked skipped

C:\WINDOWS\system32\h323log.txt Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped

C:\WINDOWS\wiadebug.log Object is locked skipped

C:\WINDOWS\wiaservc.log Object is locked skipped

C:\WINDOWS\WindowsUpdate.log Object is locked skipped

D:\archives\dreamweaver6\Patch_Dreamweaver MX6vf.zip/Patch_Dreamweaver MX6vf.exe Suspicious: Password-protected-EXE skipped

D:\archives\dreamweaver6\Patch_Dreamweaver MX6vf.zip ZIP: suspicious - 1 skipped

D:\archives\PSP8\crackPSPro810.zip/crackPSPro810.exe Suspicious: Password-protected-EXE skipped

D:\archives\PSP8\crackPSPro810.zip ZIP: suspicious - 1 skipped

D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

D:\System Volume Information\_restore{88714686-DC26-49C4-A809-5AD6669CB3D1}\RP975\change.log Object is locked skipped

H:\Archives\dreamweaver6\Patch_Dreamweaver MX6vf.zip/Patch_Dreamweaver MX6vf.exe Suspicious: Password-protected-EXE skipped

H:\Archives\dreamweaver6\Patch_Dreamweaver MX6vf.zip ZIP: suspicious - 1 skipped

H:\Archives\PSP8\crackPSPro810.zip/crackPSPro810.exe Suspicious: Password-protected-EXE skipped

H:\Archives\PSP8\crackPSPro810.zip ZIP: suspicious - 1 skipped

Scan process completed.

.........................................................

log HiJackThis:

Logfile of HijackThis v1.99.1

Scan saved at 00:37:41, on 25/03/2007

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE

C:\Program Files\CA\eTrust Antivirus\InoRpc.exe

C:\Program Files\CA\eTrust Antivirus\InoRT.exe

C:\Program Files\CA\eTrust Antivirus\InoTask.exe

C:\PROGRA~1\Iomega\System32\AppServices.exe

C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe

C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Iomega\AutoDisk\ADService.exe

C:\PROGRA~1\CA\ETRUST~1\realmon.exe

C:\WINDOWS\mHotkey.exe

C:\WINDOWS\System32\RunDll32.exe

C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\Program Files\Iomega\AutoDisk\ADUserMon.exe

C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe

C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe

C:\WINDOWS\System32\wuauclt.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe

C:\Program Files\Microsoft Office\Office\WINWORD.EXE