Probleme vundo

Rapport GenProc 2.532 [2] - 09/05/2009 à 16:33:48 - Windows Vista

GenProc n'a détecté aucune infection caractéristique et suggère de suivre la procédure suivante :


Poste un rapport Nod32 https://www.eset.com/ (il faut utiliser Internet Explorer)
- coche toutes les cases à chaque fois, et lorsque c'est terminé, colle le rapport :
- C:\Program Files\EsetOnlineScanner\log.txt

----------------------------------------------------------------------
Sites officiels GenProc : www.alt-shift-return.org et www.genproc.com
----------------------------------------------------------------------

Merci pour les conseils! Voila le rapport! Je fais quoi ensuite!

Daccord merci! Voila le rapport!

Malwarebytes' Anti-Malware 1.36
Version de la base de données: 2099
Windows 6.0.6001 Service Pack 1

10/05/2009 01:33:15
mbam-log-2009-05-10 (01-33-15).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 192539
Temps écoulé: 2 hour(s), 16 minute(s), 20 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Windows\System32\dahogemu.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

D'accord! Voila le rapport!


SUPERAntiSpyware Scan Log
https://www.superantispyware.com/

Generated 05/10/2009 at 01:07 PM

Application Version : 4.26.1002

Core Rules Database Version : 3868
Trace Rules Database Version: 1816

Scan type : Complete Scan
Total Scan Time : 00:59:59

Memory items scanned : 607
Memory threats detected : 0
Registry items scanned : 6712
Registry threats detected : 1
File items scanned : 26788
File threats detected : 6

Adware.Tracking Cookie
C:\Users\Olivier\AppData\Roaming\Microsoft\Windows\Cookies\olivier@doubleclick[1].txt
C:\Users\Olivier\AppData\Roaming\Microsoft\Windows\Cookies\olivier@ads.canalblog[1].txt
C:\Users\Olivier\AppData\Roaming\Microsoft\Windows\Cookies\olivier@stats.canalblog[1].txt
C:\Users\Olivier\AppData\Roaming\Microsoft\Windows\Cookies\olivier@xiti[1].txt
C:\Users\Olivier\AppData\Roaming\Microsoft\Windows\Cookies\olivier@atdmt[2].txt

Rogue.Component/Trace
HKU\S-1-5-21-302479301-2748411814-3595095209-1000\Software\Microsoft\FIAS4057

Adware.Vundo/Variant
C:\PROGRAMDATA\HONAHOFU\HONAHOFU.DLL

Je l'ai telechargé! Je lance le scan sur C:/???

Il a rien trouvé! Voila le scan! Ca veut dire que mon ordio est guéri ou y'a encore des choses à faire?
Scan
----
Scanned: 6688
Detected: 0
Untreated: 0
Start time: 11/05/2009 07:48:50
Duration: 00:02:28
Finish time: 11/05/2009 07:51:18


Detected
--------
Status Object
------ ------


Events
------
Time Name Status Reason
---- ---- ------ ------
11/05/2009 07:48:57 Running module: iexplore.exe\iexplore.exe ok scanned


Statistics
----------
Object Scanned Detected Untreated Deleted Moved to Quarantine Archives Packed files Password protected Corrupted
------ ------- -------- --------- ------- ------------------- -------- ------------ ------------------ ---------


Settings
--------
Parameter Value
--------- -----
Security Level Recommended
Action Prompt for action when the scan is complete
Run mode Manually
File types Scan all files
Scan only new and changed files No
Scan archives All
Scan embedded OLE objects All
Skip if object is larger than No
Skip if scan takes longer than No
Parse email formats No
Scan password-protected archives No
Enable iChecker technology No
Enable iSwift technology No
Show detected threats on "Detected" tab Yes
Rootkits search Yes
Deep rootkits search No
Use heuristic analyzer Yes


Quarantine
----------
Status Object Size Added
------ ------ ---- -----


Backup
------
Status Object Size
------ ------ ----

Il m'a pas proposé de deuxieme scan et il ma pas proposé de virus!
Voila le rapport!
RemoveIT Pro v4 - SE (Build date: 6.6.2008) full information log file.
Generated at: 11/05/2009 on 10:42:05
Microsoft Windows Vista Home Edition Service Pack 1 (Build 6001)
Author: Damjan Irgolic
https://www.incodesolutions.com/
support@incodesolutions.com


Running processes: (22)
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Java\jre1.6.0\bin\jusched.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Windows\sttray.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Windows\System32\rundll32.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\InCode Solutions\RemoveIT Pro v4 - SE\removeit.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe

Startup files:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Sidebar
[C:\Program Files\Windows Sidebar\sidebar.exe /autoRun]
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\ehTray.exe
[C:\Windows\ehome\ehTray.exe]
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\msnmsgr
["C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background]
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\SUPERAntiSpyware
[C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe]
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Windows Defender
[%ProgramFiles%\Windows Defender\MSASCui.exe -hide]
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\
[]
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\SynTPEnh
[C:\Program Files\Synaptics\SynTP\SynTPEnh.exe]
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\SunJavaUpdateSched
["c:\Program Files\Java\jre1.6.0\bin\jusched.exe"]
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\DellSupportCenter
["C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter]
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\dscactivate
["C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"]
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\AppleSyncNotifier
[C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe]
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\SigmatelSysTrayApp
[sttray.exe]
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\NvSvc
[RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart]
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\NvCplDaemon
[RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup]
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\NvMediaCenter
[RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit]
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\NVHotkey
[rundll32.exe C:\Windows\system32\nvHotkey.dll,Start]
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\QuickTime Task
["C:\Program Files\QuickTime\QTTask.exe" -atboottime]
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\iTunesHelper
["C:\Program Files\iTunes\iTunesHelper.exe"]
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\AVG8_TRAY
[C:\PROGRA~1\AVG\AVG8\avgtray.exe]

Detail report: (81)
Clsid c:\program files\superantispyware\saswinlo.dll[972edede23ac8d59aac0c09799c6f18a][356352]
Clsid C:\Windows\system32\avgrsstx.dll [a891f2c159bf92ed332e77517d6d2793][11952]
Clsid C:\Windows\system32\iconcodecservice.dll[08578f3ca5365f896d90ce2bf97fd000][9728]
Proc C:\Program Files\AVG\AVG8\avgtray.exe[74966d40f38c4e4a4dc712ab353e8634][1947928]
Proc C:\Program Files\Dell Support Center\bin\sprtcmd.exe[3917664c26b4344768c288bba6fefcb6][206064]
Proc C:\Program Files\Dell\QuickSet\quickset.exe[7bc61f85443295892f7b6a4d7ea4029d][1066528]
Proc C:\Program Files\InCode Solutions\RemoveIT Pro v4 - SE\removeit.exe[b2bf3a935b301fe84be4c9b768b4c61a][551424]
Proc C:\Program Files\Internet Explorer\iexplore.exe[9e6c1527d9a2c64bfd780aa23075380f][636072]
Proc C:\Program Files\iTunes\iTunesHelper.exe[6b0e8dee62c0c9695c77f14482ddf178][342312]
Proc C:\Program Files\Java\jre1.6.0\bin\jusched.exe[8f5e772b91a10ac97415b760ff21a94f][77824]
Proc C:\Program Files\MSN Messenger\msnmsgr.exe[a7efc7ea7ef6fb022a8a95813edcbe5d][5674352]
Proc C:\Program Files\QuickTime\QTTask.exe[0ab3c83fcb8ef6f56e4fb22089f0d3b9][413696]
Proc C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[38f8bd45fb8860399db4fb082ae9589c][1830128]
Proc C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[bc9e0a68a38e0e57d4f36beeb75c6e28][815104]
Proc C:\Program Files\Windows Defender\MSASCui.exe[0d392ede3b97e0b3131b2f63ef1db94e][1008184]
Proc C:\Windows\ehome\ehmsas.exe[0f4195b9b348de5cf9b822f81704b20e][37376]
Proc C:\Windows\ehome\ehtray.exe[bf08674925f151bd4537b89a493e3e0c][125952]
Proc C:\Windows\Explorer.EXE[4f554999d7d5f05daaebba7b5ba1089d][2927104]
Proc C:\Windows\sttray.exe[733da847d5c3e32c40ba831beaa8dc93][303104]
Proc C:\Windows\system32\Dwm.exe[59903071d7ace6a02093c47e9e38af97][81920]
Proc C:\Windows\System32\rundll32.exe[4b555106290bd117334e9a08761c035a][44544]
Proc C:\Windows\system32\taskeng.exe[5f109032ce46b7184ed9e50f9fe8489e][169472]
RegRun c:\progra~1\avg\avg8\avgtray.exe[74966d40f38c4e4a4dc712ab353e8634][1947928]
RegRun c:\program files\common files\apple\mobile device support\bin\applesyncnotifier.exe[3c59cb80d1849128c14ff2b3245419be][111936]
RegRun c:\program files\dell support center\bin\sprtcmd.exe [3917664c26b4344768c288bba6fefcb6][206064]
RegRun c:\program files\dell support center\gs_agent\custom\dsca.exe[267b3a856e9f4db1cabd4e6db71e07d2][16384]
RegRun c:\program files\itunes\ituneshelper.exe[6b0e8dee62c0c9695c77f14482ddf178][342312]
RegRun c:\program files\java\jre1.6.0\bin\jusched.exe[8f5e772b91a10ac97415b760ff21a94f][77824]
RegRun c:\program files\msn messenger\msnmsgr.exe [a7efc7ea7ef6fb022a8a95813edcbe5d][5674352]
RegRun c:\program files\quicktime\qttask.exe [0ab3c83fcb8ef6f56e4fb22089f0d3b9][413696]
RegRun c:\program files\superantispyware\superantispyware.exe[38f8bd45fb8860399db4fb082ae9589c][1830128]
RegRun c:\program files\synaptics\syntp\syntpenh.exe[bc9e0a68a38e0e57d4f36beeb75c6e28][815104]
RegRun c:\program files\windows sidebar\sidebar.exe [fd278e51a7d6f52d22fce6c67e037ad6][1233920]
RegRun c:\windows\ehome\ehtray.exe[bf08674925f151bd4537b89a493e3e0c][125952]
RegRun C:\Windows\sttray.exe[733da847d5c3e32c40ba831beaa8dc93][303104]
RegRun c:\windows\system32\nvcpl.dll[755418165d1758485e3a43e1473334e4][8497696]
RegRun c:\windows\system32\nvhotkey.dll[6e2a888065b71c3a12979c6b20abf73f][86016]
RegRun c:\windows\system32\nvmctray.dll[2703f601a152d311dfdbc917f779591b][81920]
RegRun c:\windows\system32\nvsvc.dll[0c811f640e1601b6d4884eb0abb1206d][86016]
Service c:\progra~1\avg\avg8\avgwdsvc.exe[bfc093c2ddde8fce5da078e663b4515b][298776]
Service c:\program files\bonjour\mdnsresponder.exe[3f56903e124e820aeece6d471583c6c1][238888]
Service c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe[43dc4fc662df064535e30b17c8b5ab00][132424]
Service c:\program files\common files\installshield\driver\1050\intel 32\idrivert.exe[6f95324909b502e2651442c1548ab12f][73728]
Service c:\program files\common files\microsoft shared\source engine\ose.exe[7a56cf3e3f12e8af599963b16f50fb6a][89136]
Service c:\program files\common files\roxio shared\9.0\sharedcom\roxmediadb9.exe[ebcde8b48fadc6479d96a56d0a432160][880640]
Service c:\program files\common files\roxio shared\9.0\sharedcom\roxwatch9.exe[ab2b1de1c8f31efce2384b14b3dc4260][159744]
Service c:\program files\common files\surething shared\stllssvr.exe[51778fd315c9882f1cbd932743e62a72][73728]
Service c:\program files\dell support center\bin\sprtsvc.exe [777115c9cc675bd98127660712d2f784][201968]
Service c:\program files\dellsupport\brkrsvc.exe[01d5b95d0a12a916bbdc258629113258][70656]
Service c:\program files\ipod\bin\ipodservice.exe[f055c1760abfa52b159985e551ea0edc][656168]
Service c:\program files\msn messenger\usnsvc.exe[c5b70a6aa947667ce0e5fc84a05ec8b6][97136]
Service c:\program files\windows media player\wmpnetwk.exe[3978704576a121a9204f8cc49a301a9b][896512]
Service c:\windows\ehome\ehrecvr.exe[9be3744d295a7701eb425332014f0797][292352]
Service c:\windows\ehome\ehsched.exe[ad1870c8e5d6dd340c829e6074bf3c3f][131072]
Service c:\windows\microsoft.net\framework\v2.0.50727\mscorsvw.exe[a4af4201bd519971f8f34724f3ca9dbb][70144]
Service c:\windows\microsoft.net\framework\v3.0\windows communication foundation\infocard.exe[e7cc3aeaed9893a88876744cd439f76c][864256]
Service c:\windows\microsoft.net\framework\v3.0\windows communication foundation\smsvchost.exe[f9102685f97f9ba85f4a70afcf722cfe][122880]
Service c:\windows\microsoft.net\framework\v3.0\wpf\presentationfontcache.exe[993883524aa9cf1c90e1545411a9ac9c][36864]
Service c:\windows\servicing\trustedinstaller.exe[16613a1bad034d4ecf957af18b7c2ff5][39424]
Service c:\windows\system32\alg.exe[a1545b731579895d8cc44fc0481c1192][59392]
Service c:\windows\system32\dfsr.exe[fa3463f25f9cc9c3bcf1e7912feff099][2091520]
Service c:\windows\system32\dllhost.exe [be01e566d1f569aab32d0335613e1eea][7168]
Service c:\windows\system32\drivers\xaudio.exe[28dc5d626e036a75a572556f0a6eb1f6][386560]
Service c:\windows\system32\locator.exe[5123f83cbc4349d065534eeb6bbdc42b][7680]
Service c:\windows\system32\lsass.exe[dcf733788c7d088d814e5f80eb4b3e0f][9728]
Service c:\windows\system32\msdtc.exe[fd7520cc3a80c5fc8c48852bb24c6ded][105984]
Service c:\windows\system32\searchindexer.exe [7778bdfa3f6f6fba0e75b9594098f737][439808]
Service c:\windows\system32\slsvc.exe[0ba91e1358ad25236863039bb2609a2e][2623488]
Service c:\windows\system32\snmptrap.exe[2a146a055b4401c16ee62d18b8e2a032][12800]
Service c:\windows\system32\spoolsv.exe[846cdf9a3cf4da9b306adfb7d55ee4c2][125952]
Service c:\windows\system32\svchost.exe [3794b461c45882e06856f282eef025af][21504]
Service c:\windows\system32\ui0detect.exe[ecef404f62863755951e09c802c94ad5][35840]
Service c:\windows\system32\vds.exe[b13bc395b9d6116628f5af47e0802ac4][382976]
Service c:\windows\system32\vssvc.exe[d5fb73d19c46ade183f968e13f186b23][1054720]
Service c:\windows\system32\wbem\wmiapsrv.exe[aba4cf9f856d9a3a25f4ddd7690a6e9d][137728]
Startup c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe[dfcb9ade94a4f8a7c42eef41101a30ad][29696]
Startup c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini[7f1698bab066b764a314a589d338daae][174]
Startup c:\users\olivier\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini[7f1698bab066b764a314a589d338daae][174]
Startup c:\users\olivier\desktop\virus removal tool\is-h4l3m\startup.exe[c841b2bb4808cf708aa55f0ddbaecba9][65536]
Startup c:\windows\installer\{53a01cc6-14b0-4512-a2e7-10d39bf83dc4}\newshortcut2_53a01cc614b04512a2e710d39bf83dc4.exe[1b89d24637b870a9d2041b1b54bcb37c][45056]
System.ini c:\windows\system32\drivers\xaudio.exe[28dc5d626e036a75a572556f0a6eb1f6][386560]

Startup folder: (5)
Startup name: desktop.ini
Command: C:\Users\Olivier\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
Startup name: is-H4L3M.lnk
Command: C:\Users\Olivier\Desktop\Virus Removal Tool\is-H4L3M\startup.exe
Startup name: desktop.ini
Command: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
Startup name: Lancement rapide d'Adobe Reader.lnk
Command: C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
Startup name: QuickSet.lnk
Command: C:\Windows\Installer\{53A01CC6-14B0-4512-A2E7-10D39BF83DC4}\NewShortcut2_53A01CC614B04512A2E710D39BF83DC4.exe

Win.ini Startup: (1)
Path: No additional driver found!

Win.ini Startup: (1)
Path: No additional driver found!

Keyboard drivers: (1)
Name: No Keyboard Filter driver found!

Services: (138)
Service Name: Accès du périphérique d'interface utilisateur [Stopped],
Path: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
Service Name: Acquisition d'image Windows (WIA) [Running],
Path: C:\Windows\system32\svchost.exe -k imgsvc
Service Name: Agent de protection d’accès réseau [Stopped],
Path: C:\Windows\System32\svchost.exe -k NetworkService
Service Name: Agent de stratégie IPsec [Running],
Path: C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
Service Name: Appel de procédure distante (RPC) [Running],
Path: C:\Windows\system32\svchost.exe -k rpcss
Service Name: Apple Mobile Device [Running],
Path: "C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe"
Service Name: Application système COM+ [Stopped],
Path: C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
Service Name: Assistance IP [Running],
Path: C:\Windows\System32\svchost.exe -k NetSvcs
Service Name: Assistance NetBIOS sur TCP/IP [Running],
Path: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
Service Name: Audio Windows [Running],
Path: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
Service Name: AVG Free8 WatchDog [Running],
Path: C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
Service Name: Cache de police de Windows Presentation Foundation 3.0.0.0 [Stopped],
Path: C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
Service Name: Carte à puce [Stopped],
Path: C:\Windows\system32\svchost.exe -k LocalService
Service Name: Carte de performance WMI [Stopped],
Path: C:\Windows\system32\wbem\WmiApSrv.exe
Service Name: Centre de sécurité [Running],
Path: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
Service Name: Cliché instantané de volume [Stopped],
Path: C:\Windows\system32\vssvc.exe
Service Name: Client de stratégie de groupe [Running],
Path: C:\Windows\system32\svchost.exe -k netsvcs
Service Name: Client de suivi de lien distribué [Running],
Path: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
Service Name: Client DHCP [Running],
Path: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
Service Name: Client DNS [Running],
Path: C:\Windows\system32\svchost.exe -k NetworkService
Service Name: Collecteur d'événements de Windows [Stopped],
Path: C:\Windows\system32\svchost.exe -k NetworkService
Service Name: Configuration automatique de réseau câblé [Stopped],
Path: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
Service Name: Configuration des services Terminal Server [Stopped],
Path: C:\Windows\System32\svchost.exe -k netsvcs
Service Name: Connaissance des emplacements réseau [Running],
Path: C:\Windows\System32\svchost.exe -k NetworkService
Service Name: Connexions réseau [Running],
Path: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
Service Name: Contrôle parental [Stopped],
Path: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
Service Name: Coordinateur de transactions distribuées [Stopped],
Path: C:\Windows\System32\msdtc.exe
Service Name: Découverte SSDP [Running],
Path: C:\Windows\system32\svchost.exe -k LocalService
Service Name: Détection de services interactifs [Stopped],
Path: C:\Windows\system32\UI0Detect.exe
Service Name: Détection matériel noyau [Running],
Path: C:\Windows\System32\svchost.exe -k netsvcs
Service Name: Disque virtuel [Stopped],
Path: C:\Windows\System32\vds.exe
Service Name: DSBrokerService [Stopped],
Path: "C:\Program Files\DellSupport\brkrsvc.exe"
Service Name: Emplacement protégé [Stopped],
Path: C:\Windows\system32\lsass.exe
Service Name: Énumérateur de bus IP PnP-X [Stopped],
Path: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
Service Name: Expérience audio-vidéo haute qualité Windows [Stopped],
Path: C:\Windows\system32\svchost.exe -k LocalService
Service Name: Expérience d’application [Running],
Path: C:\Windows\system32\svchost.exe -k netsvcs
Service Name: Explorateur d'ordinateurs [Stopped],
Path: C:\Windows\System32\svchost.exe -k netsvcs
Service Name: Fournisseur de cliché instantané de logiciel Microsoft [Stopped],
Path: C:\Windows\System32\svchost.exe -k swprv
Service Name: Générateur de points de terminaison du service Audio Windows [Running],
Path: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
Service Name: Gestion à distance de Windows (Gestion WSM) [Stopped],
Path: C:\Windows\System32\svchost.exe -k NetworkService
Service Name: Gestion des clés et des certificats d'intégrité [Stopped],
Path: C:\Windows\System32\svchost.exe -k netsvcs
Service Name: Gestionnaire de comptes de sécurité [Running],
Path: C:\Windows\system32\lsass.exe
Service Name: Gestionnaire de connexion automatique d'accès distant [Stopped],
Path: C:\Windows\system32\svchost.exe -k netsvcs
Service Name: Gestionnaire de connexions d'accès distant [Running],
Path: C:\Windows\system32\svchost.exe -k netsvcs
Service Name: Gestionnaire de sessions du Gestionnaire de fenêtrage [Running],
Path: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
Service Name: Gestionnaire d'identité réseau homologue [Stopped],
Path: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
Service Name: Groupement de mise en réseau de pairs [Stopped],
Path: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
Service Name: Horloge Windows [Running],
Path: C:\Windows\system32\svchost.exe -k LocalService
Service Name: Hôte de périphérique UPnP [Stopped],
Path: C:\Windows\system32\svchost.exe -k LocalService
Service Name: Hôte du fournisseur de découverte de fonctions [Stopped],
Path: C:\Windows\system32\svchost.exe -k LocalService
Service Name: Hôte système de diagnostics [Running],
Path: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
Service Name: Informations d'application [Stopped],
Path: C:\Windows\system32\svchost.exe -k netsvcs
Service Name: Infrastructure de gestion Windows [Running],
Path: C:\Windows\system32\svchost.exe -k netsvcs
Service Name: InstallDriver Table Manager [Stopped],
Path: "C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe"
Service Name: Interruption SNMP [Stopped],
Path: C:\Windows\System32\snmptrap.exe
Service Name: Isolation de clé CNG [Running],
Path: C:\Windows\system32\lsass.exe
Service Name: Journal d’événements Windows [Running],
Path: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
Service Name: Journaux & alertes de performance [Stopped],
Path: C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork
Service Name: Lanceur de processus serveur DCOM [Running],
Path: C:\Windows\system32\svchost.exe -k DcomLaunch
Service Name: Lanceur des services Windows Media Center [Stopped],
Path: C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
Service Name: Licence du logiciel [Running],
Path: C:\Windows\system32\SLsvc.exe
Service Name: Localisateur d'appels de procédure distante (RPC) [Stopped],
Path: C:\Windows\system32\locator.exe
Service Name: Mappage de découverte de topologie de la couche de liaison [Stopped],
Path: C:\Windows\System32\svchost.exe -k LocalService
Service Name: Microsoft .NET Framework NGEN v2.0.50727_X86 [Stopped],
Path: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
Service Name: Modules de génération de clés IKE et AuthIP [Running],
Path: C:\Windows\system32\svchost.exe -k netsvcs
Service Name: Moteur de filtrage de base [Running],
Path: C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
Service Name: Netlogon [Stopped],
Path: C:\Windows\system32\lsass.exe
Service Name: Office Source Engine [Stopped],
Path: "C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
Service Name: Ouverture de session secondaire [Running],
Path: C:\Windows\system32\svchost.exe -k netsvcs
Service Name: Pare-feu Windows [Running],
Path: C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
Service Name: Partage de connexion Internet (ICS) [Stopped],
Path: C:\Windows\System32\svchost.exe -k netsvcs
Service Name: Planificateur de classes multimédias [Running],
Path: C:\Windows\system32\svchost.exe -k netsvcs
Service Name: Planificateur de tâches [Running],
Path: C:\Windows\system32\svchost.exe -k netsvcs
Service Name: Plug-and-Play [Running],
Path: C:\Windows\system32\svchost.exe -k DcomLaunch
Service Name: Prise en charge de l’application Rapports et solutions aux problèmes du Panneau de configuration [Stopped],
Path: C:\Windows\System32\svchost.exe -k netsvcs
Service Name: Programme d’installation de modules Windows [Stopped],
Path: C:\Windows\servicing\TrustedInstaller.exe
Service Name: Propagation du certificat [Stopped],
Path: C:\Windows\system32\svchost.exe -k netsvcs
Service Name: Protocole de résolution de noms d'homologues [Stopped],
Path: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
Service Name: Protocole EAP (Extensible Authentication Protocol) [Running],
Path: C:\Windows\System32\svchost.exe -k netsvcs
Service Name: Publication des ressources de découverte de fonctions [Running],
Path: C:\Windows\system32\svchost.exe -k LocalService
Service Name: Registre à distance [Stopped],
Path: C:\Windows\system32\svchost.exe -k regsvc
Service Name: Réplication DFS [Stopped],
Path: C:\Windows\system32\DFSR.exe
Service Name: Routage et accès distant [Stopped],
Path: C:\Windows\system32\svchost.exe -k netsvcs
Service Name: Roxio Hard Drive Watcher 9 [Running],
Path: "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe"
Service Name: RoxMediaDB9 [Running],
Path: "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe"
Service Name: Sauvegarde Windows [Stopped],
Path: C:\Windows\system32\svchost.exe -k SDRSVC
Service Name: Serveur [Running],
Path: C:\Windows\system32\svchost.exe -k netsvcs
Service Name: Serveur de priorités des threads [Stopped],
Path: C:\Windows\system32\svchost.exe -k LocalService
Service Name: Service Bonjour [Running],
Path: "C:\Program Files\Bonjour\mDNSResponder.exe"
Service Name: Service de configuration automatique WLAN [Running],
Path: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
Service Name: Service de découverte automatique de Proxy Web pour les services HTTP Windows [Stopped],
Path: C:\Windows\system32\svchost.exe -k LocalService
Service Name: Service de l’Assistant Compatibilité des programmes [Running],
Path: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
Service Name: Service de l’iPod [Running],
Path: "C:\Program Files\iPod\bin\iPodService.exe"
Service Name: Service de la passerelle de la couche Application [Stopped],
Path: C:\Windows\System32\alg.exe
Service Name: Service de notification d’événements système [Running],
Path: C:\Windows\system32\svchost.exe -k netsvcs
Service Name: Service de notification de l’interface utilisateur SL [Stopped],
Path: C:\Windows\system32\svchost.exe -k LocalService
Service Name: Service de partage de ports Net.Tcp [Stopped],
Path: "C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe"
Service Name: Service de planification Windows Media Center [Stopped],
Path: C:\Windows\ehome\ehsched.exe
Service Name: Service de profil utilisateur [Running],
Path: C:\Windows\system32\svchost.exe -k netsvcs
Service Name: Service de publication des noms d’ordinateurs PNRP [Stopped],
Path: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
Service Name: Service de rapport d'erreurs Windows [Running],
Path: C:\Windows\System32\svchost.exe -k WerSvcGroup
Service Name: Service de réception Windows Media Center [Stopped],
Path: C:\Windows\ehome\ehRecvr.exe
Service Name: Service de stratégie de diagnostic [Running],
Path: C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork
Service Name: Service de transfert intelligent en arrière-plan [Running],
Path: C:\Windows\System32\svchost.exe -k netsvcs
Service Name: Service Énumérateur d’appareil mobile [Running],
Path: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
Service Name: Service hôte WDIServiceHost [Stopped],
Path: C:\Windows\System32\svchost.exe -k wdisvc
Service Name: Service Initiateur iSCSI de Microsoft [Stopped],
Path: C:\Windows\system32\svchost.exe -k netsvcs
Service Name: Service Interface du magasin réseau [Running],
Path: C:\Windows\system32\svchost.exe -k LocalService
Service Name: Service KtmRm pour Distributed Transaction Coordinator [Running],
Path: C:\Windows\System32\svchost.exe -k NetworkService
Service Name: Service Liste des réseaux [Running],
Path: C:\Windows\System32\svchost.exe -k LocalService
Service Name: Service Messenger Sharing Folders USN Journal Reader [Running],
Path: "C:\Program Files\MSN Messenger\usnsvc.exe"
Service Name: Service Panneau de saisie Tablet PC [Running],
Path: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
Service Name: Service Partage réseau du Lecteur Windows Media [Stopped],
Path: "C:\Program Files\Windows Media Player\wmpnetwk.exe"
Service Name: Service ReadyBoost [Running],
Path: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
Service Name: Service Windows Media Center Extender [Stopped],
Path: C:\Windows\system32\svchost.exe -k LocalService
Service Name: Service SSTP (Secure Socket Tunneling Protocol) [Running],
Path: C:\Windows\system32\svchost.exe -k LocalService
Service Name: Services de base de module de plateforme sécurisée [Stopped],
Path: C:\Windows\System32\svchost.exe -k LocalService
Service Name: Services de chiffrement [Running],
Path: C:\Windows\system32\svchost.exe -k NetworkService
Service Name: Services Terminal Server [Running],
Path: C:\Windows\System32\svchost.exe -k NetworkService
Service Name: Spouleur d'impression [Running],
Path: C:\Windows\System32\spoolsv.exe
Service Name: Station de travail [Running],
Path: C:\Windows\System32\svchost.exe -k LocalService
Service Name: stllssvr [Stopped],
Path: "C:\Program Files\Common Files\SureThing Shared\stllssvr.exe"
Service Name: Stratégie de retrait de la carte à puce [Stopped],
Path: C:\Windows\system32\svchost.exe -k netsvcs
Service Name: Superfetch [Running],
Path: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
Service Name: SupportSoft Sprocket Service (dellsupportcenter) [Running],
Path: C:\Program Files\Dell Support Center\bin\sprtsvc.exe /service /p dellsupportcenter
Service Name: Système de couleurs Windows [Stopped],
Path: C:\Windows\system32\svchost.exe -k wcssvc
Service Name: Système d'événement COM+ [Running],
Path: C:\Windows\system32\svchost.exe -k LocalService
Service Name: Téléphonie [Running],
Path: C:\Windows\System32\svchost.exe -k NetworkService
Service Name: Thèmes [Running],
Path: C:\Windows\System32\svchost.exe -k netsvcs
Service Name: WebClient [Running],
Path: C:\Windows\system32\svchost.exe -k LocalService
Service Name: Windows CardSpace [Stopped],
Path: "C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe"
Service Name: Windows Connect Now - Registre de configuration [Stopped],
Path: C:\Windows\System32\svchost.exe -k LocalService
Service Name: Windows Defender [Running],
Path: C:\Windows\System32\svchost.exe -k secsvcs
Service Name: Windows Driver Foundation - Infrastructure de pilote mode-utilisateur [Running],
Path: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
Service Name: Windows Installer [Stopped],
Path: C:\Windows\system32\msiexec /V
Service Name: Windows Search [Running],
Path: C:\Windows\system32\SearchIndexer.exe /Embedding
Service Name: Windows Update [Stopped],
Path: C:\Windows\system32\svchost.exe -k netsvcs
Service Name: XAudioService [Running],
Path: C:\Windows\system32\DRIVERS\xaudio.exe
Finished...

Là c'est fini, le virus reviendra plus jamais?

Il m'en a pas proposé!