Infecté par Backdoor.Win32.Hupigon.arlg

[Inarius]

salut a tous,

Je suis infecter par Backdoor.Win32.Hupigon.arlg . Je l'ai découvert grâce à une analyse en ligne Kaspersky dont voici le rapport:

 

 

-------------------------------------------------------------------------------

KASPERSKY ONLINE SCANNER REPORT

jeudi 21 février 2008 15:35:33

Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)

Kaspersky Online Scanner version: 5.0.98.0

Kaspersky Anti-Virus database last update: 21/02/2008

Kaspersky Anti-Virus database records: 574324

-------------------------------------------------------------------------------

 

Scan Settings:

Scan using the following antivirus database: extended

Scan Archives: true

Scan Mail Bases: true

 

Scan Target - My Computer:

C:\

D:\

E:\

 

Scan Statistics:

Total number of scanned objects: 62399

Number of viruses found: 1

Number of infected objects: 79

Number of suspicious objects: 0

Duration of the scan process: 00:59:51

 

Infected Object Name / Virus Name / Last Action

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\2008-02-21_Log.ALUSchedulerSvc.LiveUpdate Object is locked skipped

C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Historique\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\Ludovic\Application Data\Mozilla\Firefox\Profiles\msh5ew01.default\cert8.db Object is locked skipped

C:\Documents and Settings\Ludovic\Application Data\Mozilla\Firefox\Profiles\msh5ew01.default\content-prefs.sqlite Object is locked skipped

C:\Documents and Settings\Ludovic\Application Data\Mozilla\Firefox\Profiles\msh5ew01.default\cookies.sqlite Object is locked skipped

C:\Documents and Settings\Ludovic\Application Data\Mozilla\Firefox\Profiles\msh5ew01.default\downloads.sqlite Object is locked skipped

C:\Documents and Settings\Ludovic\Application Data\Mozilla\Firefox\Profiles\msh5ew01.default\formhistory.sqlite Object is locked skipped

C:\Documents and Settings\Ludovic\Application Data\Mozilla\Firefox\Profiles\msh5ew01.default\key3.db Object is locked skipped

C:\Documents and Settings\Ludovic\Application Data\Mozilla\Firefox\Profiles\msh5ew01.default\parent.lock Object is locked skipped

C:\Documents and Settings\Ludovic\Application Data\Mozilla\Firefox\Profiles\msh5ew01.default\permissions.sqlite Object is locked skipped

C:\Documents and Settings\Ludovic\Application Data\Mozilla\Firefox\Profiles\msh5ew01.default\places.sqlite Object is locked skipped

C:\Documents and Settings\Ludovic\Application Data\Mozilla\Firefox\Profiles\msh5ew01.default\places.sqlite-journal Object is locked skipped

C:\Documents and Settings\Ludovic\Application Data\Mozilla\Firefox\Profiles\msh5ew01.default\places.sqlite-stmtjrnl Object is locked skipped

C:\Documents and Settings\Ludovic\Application Data\Mozilla\Firefox\Profiles\msh5ew01.default\search.sqlite Object is locked skipped

C:\Documents and Settings\Ludovic\Application Data\Nero\Nero8\Nero BackItUp\Cache\NBKeyScan.txt Object is locked skipped

C:\Documents and Settings\Ludovic\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\Ludovic\Local Settings\Application Data\Microsoft\Messenger\pitiludo@hotmail.fr\SharingMetadata\activitylog.dat Object is locked skipped

C:\Documents and Settings\Ludovic\Local Settings\Application Data\Microsoft\Messenger\pitiludo@hotmail.fr\SharingMetadata\Logs\Dfsr00005.log Object is locked skipped

C:\Documents and Settings\Ludovic\Local Settings\Application Data\Microsoft\Messenger\pitiludo@hotmail.fr\SharingMetadata\pending.dat Object is locked skipped

C:\Documents and Settings\Ludovic\Local Settings\Application Data\Microsoft\Messenger\pitiludo@hotmail.fr\SharingMetadata\Working\database_68E4_6216_E4­61_E6B2\dfsr.db Object is locked skipped

C:\Documents and Settings\Ludovic\Local Settings\Application Data\Microsoft\Messenger\pitiludo@hotmail.fr\SharingMetadata\Working\database_68E4_6216_E4­61_E6B2\fsr.log Object is locked skipped

C:\Documents and Settings\Ludovic\Local Settings\Application Data\Microsoft\Messenger\pitiludo@hotmail.fr\SharingMetadata\Working\database_68E4_6216_E4­61_E6B2\fsrtmp.log Object is locked skipped

C:\Documents and Settings\Ludovic\Local Settings\Application Data\Microsoft\Messenger\pitiludo@hotmail.fr\SharingMetadata\Working\database_68E4_6216_E4­61_E6B2\tmp.edb Object is locked skipped

C:\Documents and Settings\Ludovic\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\Ludovic\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\Ludovic\Local Settings\Application Data\Microsoft\Windows Live Contacts\pitiludo@hotmail.fr\real\members.stg Object is locked skipped

C:\Documents and Settings\Ludovic\Local Settings\Application Data\Microsoft\Windows Live Contacts\pitiludo@hotmail.fr\shadow\members.stg Object is locked skipped

C:\Documents and Settings\Ludovic\Local Settings\Application Data\Mozilla\Firefox\Profiles\msh5ew01.default\Cache\_CACHE_001_ Object is locked skipped

C:\Documents and Settings\Ludovic\Local Settings\Application Data\Mozilla\Firefox\Profiles\msh5ew01.default\Cache\_CACHE_002_ Object is locked skipped

C:\Documents and Settings\Ludovic\Local Settings\Application Data\Mozilla\Firefox\Profiles\msh5ew01.default\Cache\_CACHE_003_ Object is locked skipped

C:\Documents and Settings\Ludovic\Local Settings\Application Data\Mozilla\Firefox\Profiles\msh5ew01.default\Cache\_CACHE_MAP_ Object is locked skipped

C:\Documents and Settings\Ludovic\Local Settings\Application Data\Mozilla\Firefox\Profiles\msh5ew01.default\urlclassifier3.sqlite Object is locked skipped

C:\Documents and Settings\Ludovic\Local Settings\Historique\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\Ludovic\Local Settings\Temp\fla9AE.tmp Object is locked skipped

C:\Documents and Settings\Ludovic\Local Settings\Temp\fla9F1.tmp Object is locked skipped

C:\Documents and Settings\Ludovic\Local Settings\Temp\~DF201F.tmp Object is locked skipped

C:\Documents and Settings\Ludovic\Local Settings\Temp\~DF44E9.tmp Object is locked skipped

C:\Documents and Settings\Ludovic\Local Settings\Temp\~DF44FF.tmp Object is locked skipped

C:\Documents and Settings\Ludovic\Local Settings\Temp\~DF7553.tmp Object is locked skipped

C:\Documents and Settings\Ludovic\Local Settings\Temp\~DF769C.tmp Object is locked skipped

C:\Documents and Settings\Ludovic\Local Settings\Temporary Internet Files\Content.IE5\7WB85RW1\86bab483b661c9f19f202afe9d88cef726296078[1].flv Object is locked skipped

C:\Documents and Settings\Ludovic\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\Ludovic\Mes documents\Mes Historiques de Conversation\février 2008\ln.68@hotmail.fr.html Object is locked skipped

C:\Documents and Settings\Ludovic\Mes documents\Mes Historiques de Conversation\février 2008\maximuss_407@hotmail.com.html Object is locked skipped

C:\Documents and Settings\Ludovic\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\Ludovic\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcrst.dll Object is locked skipped

C:\Program Files\Fichiers communs\Symantec Shared\SNDALRT.log Object is locked skipped

C:\Program Files\Fichiers communs\Symantec Shared\SNDCON.log Object is locked skipped

C:\Program Files\Fichiers communs\Symantec Shared\SNDDBG.log Object is locked skipped

C:\Program Files\Fichiers communs\Symantec Shared\SNDFW.log Object is locked skipped

C:\Program Files\Fichiers communs\Symantec Shared\SNDIDS.log Object is locked skipped

C:\Program Files\Fichiers communs\Symantec Shared\SNDSYS.log Object is locked skipped

C:\Program Files\Fichiers communs\Symantec Shared\SPPolicy.log Object is locked skipped

C:\Program Files\Fichiers communs\Symantec Shared\SPStart.log Object is locked skipped

C:\Program Files\Fichiers communs\Symantec Shared\SPStop.log Object is locked skipped

C:\Program Files\Norton AntiVirus\AVApp.log Object is locked skipped

C:\Program Files\Norton AntiVirus\AVError.log Object is locked skipped

C:\Program Files\Norton AntiVirus\AVVirus.log Object is locked skipped

C:\Program Files\Norton AntiVirus\Quarantine24E66AE.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\Program Files\Norton AntiVirus\Quarantine8835792.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\Program Files\Norton AntiVirus\QuarantineC033AEA.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\Program Files\Norton AntiVirus\QuarantineFB3544E.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\Program Files\Norton AntiVirus\Quarantine\115B40FD.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\Program Files\Norton AntiVirus\Quarantine\11795292.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\Program Files\Norton AntiVirus\Quarantine\1EC14A03.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\Program Files\Norton AntiVirus\Quarantine\242E24DA.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\Program Files\Norton AntiVirus\Quarantine\275E2040.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\Program Files\Norton AntiVirus\Quarantine\289A300A.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\Program Files\Norton AntiVirus\Quarantine\294D06E9.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\Program Files\Norton AntiVirus\Quarantine\30BB070A.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\Program Files\Norton AntiVirus\Quarantine\39A8000D.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\Program Files\Norton AntiVirus\Quarantine\3ECE2862.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\Program Files\Norton AntiVirus\Quarantine\3FDC3784.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\Program Files\Norton AntiVirus\Quarantine\4A2868C1.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\Program Files\Norton AntiVirus\Quarantine\4A8B6E54.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\Program Files\Norton AntiVirus\Quarantine\58BB4EB8.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\Program Files\Norton AntiVirus\Quarantine\68C00439.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\Program Files\Norton AntiVirus\Quarantine\6A675D0F.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\Program Files\Norton AntiVirus\Quarantine\6BB453DA.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\Program Files\Norton AntiVirus\Quarantine\6D3E1FDB.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\Program Files\Norton AntiVirus\Quarantine\6EBB4039.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\Program Files\Norton AntiVirus\Quarantine\763E0364.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\Program Files\Norton AntiVirus\Quarantine\7B3C72BF.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\Program Files\Norton AntiVirus\Quarantine\7CBA4C8B.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\Program Files\Norton AntiVirus\Quarantine\7D816D1D.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\Program Files\Norton AntiVirus\Quarantine\7F6E1191.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

C:\System Volume Information\_restore{FC2B8125-4C6D-455E-8CE6-ACDB0B9AB38C}\RP165\A0039683.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\System Volume Information\_restore{FC2B8125-4C6D-455E-8CE6-ACDB0B9AB38C}\RP165\A0039686.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\System Volume Information\_restore{FC2B8125-4C6D-455E-8CE6-ACDB0B9AB38C}\RP165\A0039707.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\System Volume Information\_restore{FC2B8125-4C6D-455E-8CE6-ACDB0B9AB38C}\RP165\A0040707.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\System Volume Information\_restore{FC2B8125-4C6D-455E-8CE6-ACDB0B9AB38C}\RP166\A0041707.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\System Volume Information\_restore{FC2B8125-4C6D-455E-8CE6-ACDB0B9AB38C}\RP167\A0041738.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\System Volume Information\_restore{FC2B8125-4C6D-455E-8CE6-ACDB0B9AB38C}\RP167\A0042739.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\System Volume Information\_restore{FC2B8125-4C6D-455E-8CE6-ACDB0B9AB38C}\RP167\A0043738.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\System Volume Information\_restore{FC2B8125-4C6D-455E-8CE6-ACDB0B9AB38C}\RP167\A0044738.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\System Volume Information\_restore{FC2B8125-4C6D-455E-8CE6-ACDB0B9AB38C}\RP167\A0044748.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\System Volume Information\_restore{FC2B8125-4C6D-455E-8CE6-ACDB0B9AB38C}\RP168\A0044766.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\System Volume Information\_restore{FC2B8125-4C6D-455E-8CE6-ACDB0B9AB38C}\RP169\A0044803.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\System Volume Information\_restore{FC2B8125-4C6D-455E-8CE6-ACDB0B9AB38C}\RP169\A0044824.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\System Volume Information\_restore{FC2B8125-4C6D-455E-8CE6-ACDB0B9AB38C}\RP170\A0044875.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\System Volume Information\_restore{FC2B8125-4C6D-455E-8CE6-ACDB0B9AB38C}\RP170\A0045875.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\System Volume Information\_restore{FC2B8125-4C6D-455E-8CE6-ACDB0B9AB38C}\RP170\A0046876.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\System Volume Information\_restore{FC2B8125-4C6D-455E-8CE6-ACDB0B9AB38C}\RP170\A0047876.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\System Volume Information\_restore{FC2B8125-4C6D-455E-8CE6-ACDB0B9AB38C}\RP170\A0048875.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\System Volume Information\_restore{FC2B8125-4C6D-455E-8CE6-ACDB0B9AB38C}\RP171\A0048914.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\System Volume Information\_restore{FC2B8125-4C6D-455E-8CE6-ACDB0B9AB38C}\RP172\A0048948.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\System Volume Information\_restore{FC2B8125-4C6D-455E-8CE6-ACDB0B9AB38C}\RP173\A0048976.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\System Volume Information\_restore{FC2B8125-4C6D-455E-8CE6-ACDB0B9AB38C}\RP173\A0048997.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\System Volume Information\_restore{FC2B8125-4C6D-455E-8CE6-ACDB0B9AB38C}\RP174\A0049049.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\System Volume Information\_restore{FC2B8125-4C6D-455E-8CE6-ACDB0B9AB38C}\RP176\A0050050.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\System Volume Information\_restore{FC2B8125-4C6D-455E-8CE6-ACDB0B9AB38C}\RP176\A0051049.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\System Volume Information\_restore{FC2B8125-4C6D-455E-8CE6-ACDB0B9AB38C}\RP176\A0052050.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\System Volume Information\_restore{FC2B8125-4C6D-455E-8CE6-ACDB0B9AB38C}\RP176\A0053049.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\System Volume Information\_restore{FC2B8125-4C6D-455E-8CE6-ACDB0B9AB38C}\RP177\A0054049.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\System Volume Information\_restore{FC2B8125-4C6D-455E-8CE6-ACDB0B9AB38C}\RP178\A0054095.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\System Volume Information\_restore{FC2B8125-4C6D-455E-8CE6-ACDB0B9AB38C}\RP179\A0055095.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\System Volume Information\_restore{FC2B8125-4C6D-455E-8CE6-ACDB0B9AB38C}\RP179\A0056100.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\System Volume Information\_restore{FC2B8125-4C6D-455E-8CE6-ACDB0B9AB38C}\RP180\A0057097.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\System Volume Information\_restore{FC2B8125-4C6D-455E-8CE6-ACDB0B9AB38C}\RP180\A0057118.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\System Volume Information\_restore{FC2B8125-4C6D-455E-8CE6-ACDB0B9AB38C}\RP183\A0058118.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\System Volume Information\_restore{FC2B8125-4C6D-455E-8CE6-ACDB0B9AB38C}\RP184\A0059118.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\System Volume Information\_restore{FC2B8125-4C6D-455E-8CE6-ACDB0B9AB38C}\RP185\A0060118.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\System Volume Information\_restore{FC2B8125-4C6D-455E-8CE6-ACDB0B9AB38C}\RP185\A0060128.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\System Volume Information\_restore{FC2B8125-4C6D-455E-8CE6-ACDB0B9AB38C}\RP186\A0061128.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\System Volume Information\_restore{FC2B8125-4C6D-455E-8CE6-ACDB0B9AB38C}\RP187\A0061152.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\System Volume Information\_restore{FC2B8125-4C6D-455E-8CE6-ACDB0B9AB38C}\RP188\A0062152.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\System Volume Information\_restore{FC2B8125-4C6D-455E-8CE6-ACDB0B9AB38C}\RP188\A0062162.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\System Volume Information\_restore{FC2B8125-4C6D-455E-8CE6-ACDB0B9AB38C}\RP189\A0063162.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\System Volume Information\_restore{FC2B8125-4C6D-455E-8CE6-ACDB0B9AB38C}\RP190\A0064162.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\System Volume Information\_restore{FC2B8125-4C6D-455E-8CE6-ACDB0B9AB38C}\RP191\A0064213.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\System Volume Information\_restore{FC2B8125-4C6D-455E-8CE6-ACDB0B9AB38C}\RP191\A0064226.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\System Volume Information\_restore{FC2B8125-4C6D-455E-8CE6-ACDB0B9AB38C}\RP192\A0064252.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\System Volume Information\_restore{FC2B8125-4C6D-455E-8CE6-ACDB0B9AB38C}\RP193\A0065252.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\System Volume Information\_restore{FC2B8125-4C6D-455E-8CE6-ACDB0B9AB38C}\RP193\A0066253.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\System Volume Information\_restore{FC2B8125-4C6D-455E-8CE6-ACDB0B9AB38C}\RP193\A0066262.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\System Volume Information\_restore{FC2B8125-4C6D-455E-8CE6-ACDB0B9AB38C}\RP193\A0067264.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\System Volume Information\_restore{FC2B8125-4C6D-455E-8CE6-ACDB0B9AB38C}\RP194\A0068264.DLL Infected: Backdoor.Win32.Hupigon.arlg skipped

C:\System Volume Information\_restore{FC2B8125-4C6D-455E-8CE6-ACDB0B9AB38C}\RP202\change.log Object is locked skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\pfirewall.log Object is locked skipped

C:\WINDOWS\SchedLgU.Txt Object is locked skipped

C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped

C:\WINDOWS\Sti_Trace.log Object is locked skipped

C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\default Object is locked skipped

C:\WINDOWS\system32\config\default.LOG Object is locked skipped

C:\WINDOWS\system32\config\SAM Object is locked skipped

C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SECURITY Object is locked skipped

C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

C:\WINDOWS\system32\config\software Object is locked skipped

C:\WINDOWS\system32\config\software.LOG Object is locked skipped

C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\system Object is locked skipped

C:\WINDOWS\system32\config\system.LOG Object is locked skipped

C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped

C:\WINDOWS\system32\h323log.txt Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped

C:\WINDOWS\wiadebug.log Object is locked skipped

C:\WINDOWS\wiaservc.log Object is locked skipped

C:\WINDOWS\WindowsUpdate.log Object is locked skipped

D:\Program Files\Jetico\firewall.1.log Object is locked skipped

D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

D:\System Volume Information\_restore{FC2B8125-4C6D-455E-8CE6-ACDB0B9AB38C}\RP202\change.log Object is locked skipped

 

Scan process completed.

 

 

 

 

Voici egalement le rapport Hijackthis:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 20:49:13, on 21/02/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe

C:\Program Files\Norton AntiVirus\navapsvc.exe

C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe

C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe

C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe

D:\Program Files\Nero 8\Nero BackItUp\NBKeyScan.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\Fichiers communs\ACD Systems\EN\DevDetect.exe

D:\Program Files\Jetico\fwsrv.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\MSN Messenger\msnmsgr.exe

D:\Program Files\Spybot\TeaTimer.exe

D:\Program Files\Veoh\VeohClient.exe

C:\Program Files\MSN Messenger\usnsvc.exe

D:\Program Files\Mozilla Firefox 3 Beta 3\firefox.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = "http://www.daemon-search.com/startpage

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\Spybot\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - D:\Program Files\Veoh\Plugins\reg\VeohToolbar.dll

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer

O4 - HKLM\..\Run: [NBKeyScan] "D:\Program Files\Nero 8\Nero BackItUp\NBKeyScan.exe"

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [Device Detector] DevDetect.exe -autorun

O4 - HKLM\..\Run: [JeticoPFStartup] "D:\Program Files\Jetico\fwsrv.exe"

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [spybotSD TeaTimer] D:\Program Files\Spybot\TeaTimer.exe

O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "D:\Program Files\DAEMON Tools Pro\DTProAgent.exe"

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')

O8 - Extra context menu item: Add to AMV Converter... - D:\Program Files\MP3 Player Utilities 4.13\AMVConverter\grab.html

O8 - Extra context menu item: MediaManager tool grab multimedia file - D:\Program Files\MP3 Player Utilities 4.13\MediaManager\grab.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\Spybot\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\Spybot\SDHelper.dll

O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d...can_unicode.cab

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.zebulon.fr/scan8/oscan8.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1191759465421

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1191774450437

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL

O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe

O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe

O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe

O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe

O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe

 

--

End of file - 7967 bytes

 

 

 

 

merci d'avance pour votre aide

cordialement

Inarius

[Thanos]

salut et bienvenue

 

Ne t'inquiêtes pas pour la détection faite par Kaspersky! Regarde ou se situent les fichiers infectés > C:\Program Files\Norton AntiVirus\Quarantine

Il s'agit de fichiers infectés qui ont été mis en quarantaine par Norton: ils sont donc inactifs.

Pour les éliminer définitivement, il faut que tu passes par les options de Norton et que tu vides la quarantaine.

 

D'autres détections ont été faites, mais c'est dans la restauration système cette fois ci.

De la même manière, l'infection n'est pas active: tant que tu ne te sert pas de la restauration système.

Tu vas éliminer ces points infectés comme ceci >

 

Désactive puis réactive la restauration système comme ceci => aide visuelle

Clique sur Démarrer.

Clique avec le bouton droit sur l'icône Poste de travail, puis cliquez sur Propriétés.

Clique sur l'onglet «Restauration du système».

Sélectionne «Désactiver la Restauration du système» ou «Désactiver la Restauration du système sur tous les lecteurs»

Clique sur "Appliquer".

Comme le dit le message, ceci supprimera tous les points de restauration existants. Pour faire cela, clique sur Oui.

Clique sur OK.Redémarre ton PC. Fais l'opération inverse, et réactive la restauration:un nouveau point sera automatiquement créé.

 

Si tu refais le scan avec Kaspersky après ces maips, il ne doit plus rien trouver.

 

@++