svchost.exe

Question

Bonjour,
je suis infecté par un trojan que je n'arrive pas à effacer !

voila mon rapport de   hijackthis


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:28:22, on 23/05/2009
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Menara\dslmon.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.zikanet.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.zikanet.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Menara
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [zika] c:\windows\system32\zikpa.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [zika] c:\windows\system32\zikpa.exe
O4 - HKCU\..\Run: [nodenable] C:\Program Files\eset
odenable.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: DSLMON.lnk = C:\Program Files\Menara\dslmon.exe
O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htm
O17 - HKLM\System\CCS\Services\Tcpip\..\{F854CB82-2D5F-447E-9364-7B93EF06B020}: NameServer = 62.251.229.223 62.251.229.237
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

Utilisateur anonyme · Answer

bonjour,
il y a des failles de sécurité, pas étonnant que ton pc est infecté

warcrat3 · Answer

pouvez vous m'aider svp

warcraft3 · Answer

dsl pour le retard je ram tropp

warcraft3 · Answer

voila  

Malwarebytes' Anti-Malware 1.36
Version de la base de données: 2169
Windows 5.1.2600 

23/05/2009 13:14:10
mbam-log-2009-05-23 (13-14-10).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 111710
Temps écoulé: 17 minute(s), 5 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 8
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 6

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sysdrv32 (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sysdrv32 (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sysdrv32 (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\port135sik (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\fcn (Rogue.Residue) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i386si (Rootkit.Spamtool) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\systemntmi (Rootkit.Spamtool) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
icsk32 (Rootkit.Agent) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\System Volume Information\_restore{D6C2FBA0-35AF-4DA2-A258-703A127A55B8}\RP51\A0054639.sys (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D6C2FBA0-35AF-4DA2-A258-703A127A55B8}\RP51\A0054640.sys (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D6C2FBA0-35AF-4DA2-A258-703A127A55B8}\RP51\A0054650.sys (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D6C2FBA0-35AF-4DA2-A258-703A127A55B8}\RP51\A0054651.sys (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D6C2FBA0-35AF-4DA2-A258-703A127A55B8}\RP51\A0054673.scr (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\sysdrv32.sys (Backdoor.Bot) -> Quarantined and deleted successfully.

Polonwn · Answer

Svchost.exe  n'est pas un virus ....

SVCHOST est un processus générique, qui sert à lancer des services contenus
dans des DLL.

Au démarrage, SVCHOST scrute le contenu de la clef :
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost

Des entrées de type REG_MULTI_SZ contiennent une énumération de services à
lancer.


Il est donc normal d'en avoir plusieurs.

Sous Windows XP vous pouvez taper tasklist /SVC en ligne de commande pour avoir la liste des services qui fonctionnent.

Sous Windows Windows NT4 et Windows 2000, vous pouvez utiliser la commande tlist

Polonwn · Answer

oui je dis pas le contraire mais a la base il pensé que svchost.exe était le trojan c'est pour cela que j'ai mis l'annotation

warcraft3 · Answer

je vous remercie tt les 2 

quand je ctrl+alt+suppr  ds processus je trouve plein de svchost.exe ki consomme mes ressources apres un ptit tour ds gogle j'ai lus des sujet  ils disais ke c1 virus mes bon........

voila mes 2 rapport 

LOG

Logfile of random's system information tool 1.06 (written by random/random)
Run by mehdi at 2009-05-23 13:30:39
Microsoft Windows XP Professionnel 
System drive C: has 3 GB (30%) free of 10 GB
Total RAM: 247 MB (62% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:31:36, on 23/05/2009
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Menara\dslmon.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Documents and Settings\mehdi\Mes documents\Downloads\Programs\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\mehdi.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.zikanet.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.zikanet.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Menara
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [zika] c:\windows\system32\zikpa.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [zika] c:\windows\system32\zikpa.exe
O4 - HKCU\..\Run: [nodenable] C:\Program Files\eset
odenable.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: DSLMON.lnk = C:\Program Files\Menara\dslmon.exe
O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htm
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

warcraft3 · Answer

le 2eme 


INFO


info.txt logfile of random's system information tool 1.06 2009-05-23 13:31:40

======Uninstall list======

-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Flash Player Plugin-->C:\WINDOWS\System32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 9.1 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A91000000001}
Applian FLV Player-->"C:\WINDOWS\Applian FLV Player\uninstall.exe" "/U:C:\Program Files\FLV Player\Uninstall\uninstall.xml"
BT Engine 5.05-->"C:\Program Files\BT Engine\unins000.exe"
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
CounterStrike 1.6 from VSI (Version 1.02)-->C:\PROGRA~1\Valve\CSTRIK~1.6\UNWISE.EXE C:\PROGRA~1\Valve\CSTRIK~1.6\ins_cs16_vsi102.log
Defraggler (remove only)-->"C:\Program Files\Defraggler\uninst.exe"
ESET NOD32 Antivirus-->MsiExec.exe /I{1A3D8A23-3215-46B7-AB97-E304ADABFC18}
EVEREST Home Edition v2.20-->"C:\Program Files\Lavalys\EVEREST Home Edition\unins000.exe"
GOM Player-->"C:\Program Files\GRETECH\GomPlayer\Uninstall.exe"
HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Intel(R) Extreme Graphics Driver-->RUNDLL32.EXE C:\WINDOWS\System32\ialmrem.dll,UninstallW2KIGfx PCI\VEN_8086&DEV_2562
Internet Download Manager-->C:\Program Files\Internet Download Manager\Uninstall.exe
Kit de Connexion MENARA-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AB25E068-C7A2-482F-A3BC-588A5869844D}\setup.exe" -l0x40c ControlPanel
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Mozilla Firefox (3.0.5)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSN Messenger 7.5 pour W2k/XP-->MsiExec.exe /I{BAFD3C1E-03EC-11DA-BFBD-00065BBDC0B5}
NOD32 v3.x FiX 1.1 by TemDono (Free Updates - Expire in 2050)-->"C:\Program Files\ESET\ESET NOD32 Antivirus\unins000.exe"
Shareaza 2.4.0.0-->"C:\Program Files\Shareaza\Uninstall\unins000.exe"
SoundMAX-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F0A37341-D692-11D4-A984-009027EC0A9C}\Setup.exe" 
Total Uninstall 5.4.0-->"C:\Program Files\Total Uninstall 5\unins000.exe"
Vista Rainbar 4.3-->C:\Program Files\Vista Rainbar\Uninstall.exe
VLC media player 0.9.8a-->C:\Program Files\VideoLAN\VLC\uninstall.exe
Windows Installer 3.1 (KB893803)-->"C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe"
WinRAR archiver-->C:\Program Files\WinRAR\uninstall.exe

======Hosts File======

127.0.0.1	www.007guard.com
127.0.0.1	007guard.com
127.0.0.1	008i.com
127.0.0.1	www.008k.com
127.0.0.1	008k.com
127.0.0.1	www.00hq.com
127.0.0.1	00hq.com
127.0.0.1	010402.com
127.0.0.1	www.032439.com
127.0.0.1	032439.com

======System event log======

Computer Name: MIIDO-C8P8OHXES
Event Code: 7036
Message: Le service Service COM de gravage de CD IMAPI est entré dans l'état : en cours d'exécution.

Record Number: 441
Source Name: Service Control Manager
Time Written: 20090416193207.000000+000
Event Type: Informations
User: 

Computer Name: MIIDO-C8P8OHXES
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service Service COM de gravage de CD IMAPI.

Record Number: 440
Source Name: Service Control Manager
Time Written: 20090416193207.000000+000
Event Type: Informations
User: AUTORITE NT\SYSTEM

Computer Name: MIIDO-C8P8OHXES
Event Code: 20159
Message: La connexion à Menara ADSL effectuée par l'utilisateur fido_mar1@menara utilisant le périphérique ISDN8-0 a été déconnectée.

Record Number: 439
Source Name: RemoteAccess
Time Written: 20090416193159.000000+000
Event Type: Informations
User: 

Computer Name: MIIDO-C8P8OHXES
Event Code: 7036
Message: Le service Compatibilité avec le Changement rapide d'utilisateur est entré dans l'état : en cours d'exécution.

Record Number: 438
Source Name: Service Control Manager
Time Written: 20090416193136.000000+000
Event Type: Informations
User: 

Computer Name: MIIDO-C8P8OHXES
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service Compatibilité avec le Changement rapide d'utilisateur.

Record Number: 437
Source Name: Service Control Manager
Time Written: 20090416193136.000000+000
Event Type: Informations
User: AUTORITE NT\SYSTEM

=====Application event log=====

Computer Name: MIIDO-C8P8OHXES
Event Code: 4354
Message: Le système d'événements de COM+ n'a pas pu déclencher la méthode ConnectionMade de l'abonnement {6F0657B8-D704-4E53-8ACF-E2A1F0FA4F8E}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}. L'abonné a renvoyé HRESULT 80004001.
Record Number: 198
Source Name: EventSystem
Time Written: 20090430214010.000000+000
Event Type: Avertissement
User: 

Computer Name: MIIDO-C8P8OHXES
Event Code: 4354
Message: Le système d'événements de COM+ n'a pas pu déclencher la méthode ConnectionMade de l'abonnement {6F0657B8-D704-4E53-8ACF-E2A1F0FA4F8E}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}. L'abonné a renvoyé HRESULT 80004001.
Record Number: 197
Source Name: EventSystem
Time Written: 20090430202515.000000+000
Event Type: Avertissement
User: 

Computer Name: MIIDO-C8P8OHXES
Event Code: 2001
Message: Le service EAPOL a été démarré correctement

Record Number: 196
Source Name: EAPOL
Time Written: 20090430202419.000000+000
Event Type: Informations
User: 

Computer Name: MIIDO-C8P8OHXES
Event Code: 2001
Message: Le service EAPOL a été démarré correctement

Record Number: 195
Source Name: EAPOL
Time Written: 20090430174807.000000+000
Event Type: Informations
User: 

Computer Name: MIIDO-C8P8OHXES
Event Code: 2001
Message: Le service EAPOL a été démarré correctement

Record Number: 194
Source Name: EAPOL
Time Written: 20090430161536.000000+000
Event Type: Informations
User: 

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem
"windir"=%SystemRoot%
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 2 Stepping 7, GenuineIntel
"PROCESSOR_REVISION"=0207
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP

-----------------EOF-----------------

warcraft3 · Answer

[b]SDFix: Version 1.240 [/b]
Run by mehdi on 23/05/2009 at 14:11

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


[b]Checking Files [/b]: 

Trojan Files Found:

C:\WINDOWS\system32\msvcrt2.dll - Deleted





Removing Temp Files

[b]ADS Check [/b]:
 


                                 [b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-23 14:19:01
Windows 5.1.2600  NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\System]
"OODEFRAG10.00.00.01WORKSTATION"="8455E435FC27637A98ED15D1D940AC82823FBA34BF3E11E51577620364109D740E4B91C3E5B2C78F8D233B83EA65CA1050DE09820471D6C8C09E68FCE6FE8C0ADBA4F5F777FEC73EDCC42D27A29A3E983FDCEF607FC468C88FEBD91AD0C646490E29E27FC56ADFB81A37D7179832AD46F7619BEEF21C3BA85D67BDE226FA2B2ED4605CEDB9DD7FCFEBA65C8D3B02B5E136566AB2EE5DB7CC1BDDCFC53FB49255F6181C3990C087FA8E0011A94DE4E6DD4B6CED935B753ABDCDDE01144790C602CFE08DBA590151D350F4FD6FE339C4CB1A15EC5EF15395A810BEF202BE2F8398CB8F51B27A11269B95FC63FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79335D575E7D6A3B98085D575E7D6A3B9808A9C6AECB7A5D140782269CB27516D45EA449CB2895039D4D11196FA681B348DF4E914E1F0360D1AE59E5DB950103424232CA5AAA5A44DD848388157BC5C4DD084FEDA14CDBA3C51AB680BD8412663BA74907AC7C622579726763391AE90E4E97B93AAD3C3031A560A9EB7976E4A82F66005C4DA04501028C7D8AD4317CFEE741137CFC69A82F2210A2F44DD3DCC2CB0BD0FA480D3E46C77C673567E5B21DBEE9C91020C713D4AEED773AF8FBFD4309D69AE6302E2D78619EADEBF44FE101A9AD2F24A93C5E71837161B1414172CC9F3E1FFA9A621330A8063A8C81F807D5435BF4BAB21D21651DC5FDA0EDE809158CE905629F7C98173CF6DEC89AE3C2DCE973B5ABD5B913A63B4B4EA4CCACB2668F36571E6044866C7D6C4C28CC8459E8C32E6D9F335392BEE094B7ACAEBA07A030B283837BF3CE0513131C82AAC1B063B4F67A98ED9C9FC8596805FC6736BDB3B5A45C3B97BA0246E6CB49064C7756C86A69A4662E41DDF82DC3E0AC5034B627AE0519C05E3CD6AC28AD3235CB777A29D2D912311FDC9892AFD5DEA8453EF115EA005267FC8EA94748811B65470470A820CECF727001BB6EF102742FA753972B7F7587D1273DF8B9FCC32B40E1D5AE7E4B834E7BD6B2D7FB4F5F7955DC65EFADC77B1CF80FC767BABFA66D43429953790FE461EC08E922BBE13A2D824BD9E770DE5955A9F09FBB15D111D1C092EC9D77E916423FC19473C189122F71E18A14DE260BDC860A2DE029311BAB5E0267F0ED9E6D8C3B4394C838EB1986348FC62977434342021C4C66E92813B195430ED565B6764200CE3DC25CF0391C2CC94F804B9EE478E66C4AFE5E3E7880350D5E7778F96EC5822D592700430BBC9209DB9882E78853CFC3EA01224183975D9948A6D87A486086A9A45D87D4611AF24A9413D50C7A102EF064E6E3451D5805A73056CB0AABBE2A9450F2EC58BC492D8D98B594433CCB48C5E251689FE10D76F9EB9E273FF1705940011ABC47D6C4F35878EB"

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\WINDOWS\System32\svcpr0xy.exe"="C:\WINDOWS\System32\svcpr0xy.exe:*:Enabled:ServiceProxy"

[b]Remaining Files [/b]:


File Backups: - C:\SDFix\backups\backups.zip

[b]Files with Hidden Attributes [/b]:

Mon  7 Jan 2008           352 A..H. --- "C:\WINDOWS
od32fixtemdono.reg"

[b]Finished![/b]

warcraft3 · Answer

je c pas 


c un logiciel ???

warcraft3 · Answer

a l'aide de regcleaner j trouver ke zika et une application ds system32   je lé effacer

V-X · Answer

Bonjour,

Rends toi sur ce site :

https://www.virustotal.com/gui/

Clique sur parcourir et cherche ce fichier : 

c:\windows\system32\zikpa.exe 


Clique sur Send File.

Un rapport va s'élaborer ligne à ligne.

Attends la fin. Il doit comprendre la taille du fichier envoyé.

Sauvegarde le rapport avec le bloc-note.

Copie le dans ta réponse. 

Egalement le lien.

Merci

warcraft3 · Answer

j telecharger spyware terminator et j lancer l'analyse

warcraft3 · Answer

voila je suis parti ds system32 j trouver l'application puis je l'ai supprimer tt simplement

V-X · Answer

Re,

Mais non , fallait le faire analyser sur "virustotal"..

pfffffffff

warcraft3 · Answer

dsl mes je l'avais supprimer avant ton 1er poste   

dsl encore

V-X · Answer

Re,

Refait un log avec rsit STP.

++

V-X · Answer

Re,

Non , c'est pour voir ce que c'est pour faire la remonter ni plus ni moins..

++

warcraft3 · Answer

voila 

Logfile of random's system information tool 1.06 (written by random/random)
Run by mehdi at 2009-05-23 15:16:25
Microsoft Windows XP Professionnel 
System drive C: has 3 GB (28%) free of 10 GB
Total RAM: 247 MB (24% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:16:35, on 23/05/2009
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Menara\dslmon.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\mehdi\Mes documents\Downloads\Programs\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\mehdi.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.crawler.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=60327
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.zikanet.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60327
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60327
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.zikanet.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60327
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60327
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Menara
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Barre d'outils &Crawler - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [nodenable] C:\Program Files\eset
odenable.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: DSLMON.lnk = C:\Program Files\Menara\dslmon.exe
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htm
O17 - HKLM\System\CCS\Services\Tcpip\..\{F854CB82-2D5F-447E-9364-7B93EF06B020}: NameServer = 62.251.229.223 62.251.229.237
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe

V-X · Answer

Re,

Tant pis ...

bonne continuation .

++

warcraft3 · Answer

-----------\  ToolBar S&D 1.2.8   XP/Vista

   Microsoft Windows XP Professionnel ( v5.1.2600 ) 
   X86-based PC ( Uniprocessor Free :               Intel(R) Pentium(R) 4 CPU 2.40GHz )
   BIOS : 686O2 v2.14
   USER : mehdi ( Administrator )
   BOOT : Normal boot
   A:\ (USB)
   C:\ (Local Disk) - NTFS - Total:9 Go (Free:2 Go)
   D:\ (Local Disk) - NTFS - Total:27 Go (Free:10 Go)

   "C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
   Option : [1] ( 23/05/2009|15:41 )

   -----------\  Recherche de Fichiers / Dossiers ...

   C:\WINDOWS\iun6002.exe
   C:\Program Files\Mozilla Firefox\searchplugins\crawlersrch.xml

   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Local Page"="C:\WINDOWS\System32\blank.htm"
   "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "Search Bar"="http://www.crawler.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=60327"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Default_Page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
   "Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "SearchAssistant"="http://www.crawler.com/search/ie.aspx?tb_id=60327"
   "CustomizeSearch"="http://dnl.crawler.com/support/sa_customize.aspx?TbId=60327"


   --------------------\  Recherche d'autres infections

   --------------------\  Cracks & Keygens ..

   C:\DOCUME~1\mehdi\Application Data\uTorrent\ABBYY FineReader v9.0.0.724 Professional Edition Multilanguage + Crack.1.torrent
   C:\DOCUME~1\mehdi\Application Data\uTorrent\ABBYY FineReader v9.0.0.724 Professional Edition Multilanguage + Crack.torrent
   C:\DOCUME~1\mehdi\Mes documents\Downloads\ABBYY FineReader v9.0.0.724 Professional Edition Multilanguage + Crack
   C:\DOCUME~1\mehdi\Mes documents\Downloads\ABBYY FineReader v9.0.0.724 Professional Edition Multilanguage + Crack\ABBYY FineReader v9.0.0.724.uif
   C:\DOCUME~1\mehdi\Mes documents\Downloads\ABBYY FineReader v9.0.0.724 Professional Edition Multilanguage + Crack\Readme.txt



   1 - "C:\ToolBar SD\TB_1.txt" - 23/05/2009|15:41 - Option : [1]

   -----------\  Fin du rapport a 15:41:35,77

Svchost.exe

21 réponses

Votre réponse

Discussions similaires

Newsletters