Svchost infecte par un trojan - Page 3

[url=https://www.hiboox.fr/][img]http://images0.hiboox.com/images/4108/084268be81aae90da25ec3b7b353c5fc.bmp[/img][/url]

https://www.hiboox.fr/

Re,

tu as le CD de Windows ? avec le SP2 ? et la clé de 25 caractères ?

On va envisager de réparer Windows.

C'est good je l'ai

Re,

on va commencer par la console de récupération.

Ouvre ce lien :

https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

tu as des procédures pour installer la console de récupération.

Choisis celle qui correspond à ton cas et installe la.

Ensuite, exécute Combofix comme indiqué.

Je change le svchost depuis la console de réparation ?

voici le rapport de combofix :

ComboFix 08-10-08.05 - Elanakin 2008-10-09 22:23:11.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.627 [GMT 2:00]
Lancé depuis: C:\Documents and Settings\Elanakin\Bureau\ComboFix.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\EhRrutwa.ini
C:\WINDOWS\system32\EhRrutwa.ini2
C:\WINDOWS\system32\eqdfikqn.ini
C:\WINDOWS\system32\vvutnnyv.ini
C:\WINDOWS\system32\wfdiorgs.ini
C:\WINDOWS\system32\xswxurcw.ini

.
((((((((((((((((((((((((((((( Fichiers créés du 2008-09-09 au 2008-10-09 ))))))))))))))))))))))))))))))))))))
.

2008-10-09 21:55 . 2008-10-09 21:55 362 --a------ C:\WINDOWS\Raccourci vers WINDOWS.lnk
2008-10-08 22:29 . 2008-10-08 22:29 <REP> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-10-07 09:36 . 2008-10-07 09:40 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\GrabIt
2008-10-07 08:56 . 2008-10-07 08:57 <REP> d-------- C:\Program Files\trend micro
2008-10-06 18:01 . 2008-10-06 18:49 <REP> d-------- C:\Program Files\SoundBase
2008-10-06 07:08 . 2008-10-06 18:31 <REP> d-------- C:\Program Files\AIMP2
2008-10-05 22:17 . 2008-10-05 22:18 <REP> d-------- C:\Program Files\Winamp
2008-10-05 22:17 . 2008-10-05 22:31 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\Winamp
2008-10-03 17:35 . 2008-10-03 17:35 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\LameFE
2008-10-03 07:19 . 2008-10-06 23:17 <REP> d-------- C:\Program Files\LameFE
2008-10-03 07:19 . 2008-10-03 07:23 <REP> d-------- C:\Documents and Settings\Elanakin\LameFE22
2008-09-28 12:59 . 2008-10-02 17:57 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\LimeWire
2008-09-28 12:55 . 2008-09-28 12:56 <REP> d-------- C:\Program Files\LimeWire
2008-09-24 14:48 . 2008-09-27 08:55 <REP> d-------- C:\Program Files\Trojan Remover
2008-09-23 12:12 . 2008-09-23 12:12 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\Windows Search
2008-09-23 11:54 . 2008-09-23 11:54 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\Windows Desktop Search
2008-09-23 11:53 . 2008-09-23 11:53 <REP> d-------- C:\WINDOWS\system32\GroupPolicy
2008-09-23 11:53 . 2008-09-23 11:53 <REP> d-------- C:\Program Files\Windows Desktop Search
2008-09-23 11:43 . 2008-09-23 11:43 <REP> d-------- C:\WINDOWS\system32\CatRoot_bak
2008-09-23 09:55 . 2008-09-23 09:57 <REP> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-09-23 09:55 . 2008-09-23 09:58 <REP> d-------- C:\Documents and Settings\All Users\Application Data\PassMark
2008-09-23 09:42 . 2008-09-23 10:34 6,203,424 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-09-23 09:42 . 2008-09-23 10:34 74,816 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-09-22 19:14 . 2008-09-22 19:22 <REP> d-------- C:\Documents and Settings\All Users\Application Data\nView_Profiles
2008-09-16 13:17 . 2008-09-16 13:17 <REP> d-------- C:\WINDOWS\Sun
2008-09-16 11:06 . 2008-09-16 11:06 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\Malwarebytes
2008-09-09 08:01 . 2008-10-09 19:02 <REP> d-------- C:\Warhammer Online - Age of Reckoning

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-09 16:39 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\uTorrent
2008-10-07 15:56 --------- d-----w C:\Program Files\Malwarebytes' Anti-Malware
2008-09-16 08:27 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-15 19:10 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\dvdcss
2008-09-13 11:02 --------- d-----w C:\Program Files\LucasArts
2008-09-09 22:04 38,528 ----a-w C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-09-09 22:03 17,200 ----a-w C:\WINDOWS\system32\drivers\mbam.sys
2008-09-08 01:01 --------- d-----w C:\Program Files\Windows Live
2008-09-07 18:04 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\TuneUp Software
2008-09-07 18:03 --------- d-----w C:\Program Files\ESET
2008-09-07 13:22 2,322,176 ----a-w C:\WINDOWS\system32\TUKernel.exe
2008-09-07 13:08 --------- d-----w C:\Program Files\TuneUp Utilities 2008
2008-09-07 13:04 355,584 ----a-w C:\WINDOWS\system32\TuneUpDefragService.exe
2008-09-07 13:04 --------- d-----w C:\Documents and Settings\All Users\Application Data\TuneUp Software
2008-09-07 13:02 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-09-07 13:02 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-09-07 12:58 --------- d-----w C:\Program Files\OO Software
2008-09-07 09:29 --------- d-----w C:\Program Files\uTorrent
2008-09-07 09:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-09-07 09:10 --------- d-----w C:\Program Files\Microsoft SQL Server Compact Edition
2008-09-06 16:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-09-05 15:06 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-09-05 06:56 --------- d-----w C:\Program Files\Fichiers communs\BitDefender
2008-09-04 19:32 --------- d-----w C:\Program Files\BitDefender
2008-09-04 19:17 --------- d-----w C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-09-01 14:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\TomTom
2008-09-01 14:12 --------- d-----w C:\Program Files\TomTom HOME
2008-09-01 10:49 --------- d-----w C:\Program Files\Lavasoft
2008-09-01 10:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-08-31 12:03 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\Nero
2008-08-31 11:52 --------- d-----w C:\Program Files\Fichiers communs\Nero
2008-08-31 11:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\Nero
2008-08-31 11:47 --------- d-----w C:\Program Files\Nero
2008-08-31 10:06 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\TomTom
2008-08-31 09:23 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\InstallShield
2008-08-31 09:21 --------- d-----w C:\Program Files\TomTom DesktopSuite
2008-08-31 08:30 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\Ahead
2008-08-31 08:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ahead
2008-08-31 08:00 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\Canneverbe_Limited
2008-08-31 07:38 --------- d-----w C:\Program Files\StarWarsGalaxies
2008-08-31 06:56 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2008-08-30 07:21 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\Petroglyph
2008-08-28 07:30 98,304 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-08-27 08:15 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-08-25 20:31 --------- d-----w C:\Program Files\Fichiers communs\Logitech
2008-08-25 20:30 --------- d-----w C:\Program Files\Fichiers communs\Logishrd
2008-08-19 12:15 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-08-19 08:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\LogiShrd
2008-08-19 07:43 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\Logitech
2008-08-19 07:42 0 ---ha-w C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-08-19 07:42 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_LUsbFilt_01005.Wdf
2008-08-19 07:42 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
2008-08-19 07:39 --------- d-----w C:\Program Files\Logitech
2008-08-17 13:22 53,480 ----a-w C:\Documents and Settings\Elanakin\Application Data\GDIPFONTCACHEV1.DAT
2008-08-17 13:21 --------- d-----w C:\Program Files\MSECache
2008-08-14 18:12 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll
2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-18 20:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll
2008-07-18 20:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
2008-07-18 18:39 587,264 ----a-w C:\WINDOWS\WLXPGSS.SCR
2008-07-16 23:02 634,880 ------w C:\WINDOWS\system32\gpprefcl.dll
2008-07-11 15:29 94,208 ----a-w C:\WINDOWS\ScUnin.exe
.

------- Sigcheck -------

md5deep: C:\WINDOWS\system32\svchost.exe: Permission denied

2008-06-21 16:53 506368 8d52aedd07247b743a4d9bd372f69109 C:\WINDOWS\system32\winlogon.exe
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\MSMSGS.EXE" [2003-04-14 1498032]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 15360]
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-04-01 486856]
"TuneUp MemOptimizer"="C:\Program Files\TuneUp Utilities 2008\MemOptimizer.exe" [2008-06-20 154368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-03 13529088]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-03 86016]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd.exe" [2003-08-04 49152]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 241664]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"NeroFilterCheck"="C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe" [2008-06-19 570664]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-06-08 2221352]
"OODefragTray"="C:\WINDOWS\system32\oodtray.exe" [2007-06-28 2512128]
"nwiz"="nwiz.exe" [2008-05-03 C:\WINDOWS\system32\nwiz.exe]
"SoundMan"="SOUNDMAN.EXE" [2007-04-16 C:\WINDOWS\soundman.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 15360]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2003-09-16 237568]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="C:\\Documents and Settings\\All Users\\Application Data\\TuneUp Software\\TuneUp Utilities\\WinStyler\\tu_logonui.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=pgufxu.dll

[HKLM\~\startupfolder\C:^Documents and Settings^Elanakin^Menu Démarrer^Programmes^Démarrage^hamachi.lnk]
path=C:\Documents and Settings\Elanakin\Menu Démarrer\Programmes\Démarrage\hamachi.lnk
backup=C:\WINDOWS\pss\hamachi.lnkStartup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"D:\\Steam\\steamapps\\tom182_2\\team fortress 2\\hl2.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"D:\\Steam\\steamapps\\tom182_2\\day of defeat source\\hl2.exe"=
"D:\\Jeux\\World of Warcraft\\Repair.exe"=
"C:\\Program Files\\Hamachi\\hamachi.exe"=
"C:\\Program Files\\Sony\\Station\\Launchpad\\LaunchPad.exe"=
"C:\\Program Files\\LucasArts\\Star Wars JK II Jedi Outcast\\GameData\\jk2mp.exe"=
"D:\\Jeux\\Dofus\\Dofus.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"44979:TCP"= 44979:TCP:utorrent

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
R2 UxTuneUp;TuneUp Extension de thème;C:\WINDOWS\System32\svchost.exe [2004-08-19 14336]
R3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service;C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys [2008-06-25 43520]
S3 musbehco;musbehco;C:\DOCUME~1\Elanakin\LOCALS~1\Temp\musbehco.sys [ ]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-09-07 355584]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

*Newly Created Service* - PROCEXP90
.
Contenu du dossier 'Tâches planifiées'

2008-10-09 C:\WINDOWS\Tasks\Maintenance en 1 clic.job
- C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe [2008-06-20 09:23]
.
.
------- Examen supplémentaire -------
.
FireFox -: Profile - C:\Documents and Settings\Elanakin\Application Data\Mozilla\Firefox\Profiles\f26i7xlz.default\
FF -: plugin - C:\Documents and Settings\Elanakin\Application Data\Mozilla\Firefox\Profiles\f26i7xlz.default\extensions\{bb628310-0ab7-11db-9cd8-0800200c9a66}\plugins\nphardwaredetection.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-09 22:24:47
Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
Heure de fin: 2008-10-09 22:27:26
ComboFix-quarantined-files.txt 2008-10-09 20:27:17

Avant-CF: 16,171,958,272 octets libres
Après-CF: 16,174,522,368 octets libres

209 --- E O F --- 2008-09-23 09:45:38

Re,

oui, l'idée c'est bien de remplacer le fichier par celui du CD d'origine avec la console de récupération.

un peu de nettoyage avant :

Copie ou imprime les instructions avant

Déconnecte toi d'internet et ferme toutes tes applications.

Désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)

Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :

Driver::
musbehco

Rootkit::
C:\DOCUME~1\Elanakin\LOCALS~1\Temp\musbehco.sys

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=""

Enregistre ce fichier sous le nom CFscript

Fait un glisser/déposer de ce fichier CFscript sur le fichier ComboFix.exe

Clique sur le fichier CFscript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFscrïpt vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Réactive ton parefeu, ton antivirus, la garde de ton antispyware

Une fois le scan achevé, un rapport va s'afficher: poste son contenu.

Remets aussi un rapport Hijackthis

Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

Attention : cette manip a été fait pour cet ordi. Tout réutilisation peut endommager sévèrement le système d'exploitation.

ComboFix 08-10-08.05 - Elanakin 2008-10-10 17:12:08.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.651 [GMT 2:00]
Lancé depuis: C:\Documents and Settings\Elanakin\Bureau\ComboFix.exe
Commutateurs utilisés :: C:\Documents and Settings\Elanakin\Bureau\CFscript.txt
* Un nouveau point de restauration a été créé
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_MUSBEHCO
-------\Service_musbehco

((((((((((((((((((((((((((((( Fichiers créés du 2008-09-10 au 2008-10-10 ))))))))))))))))))))))))))))))))))))
.

2008-10-09 21:55 . 2008-10-09 21:55 362 --a------ C:\WINDOWS\Raccourci vers WINDOWS.lnk
2008-10-08 22:29 . 2008-10-08 22:29 <REP> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-10-07 09:36 . 2008-10-07 09:40 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\GrabIt
2008-10-07 08:56 . 2008-10-07 08:57 <REP> d-------- C:\Program Files\trend micro
2008-10-06 18:01 . 2008-10-06 18:49 <REP> d-------- C:\Program Files\SoundBase
2008-10-06 07:08 . 2008-10-06 18:31 <REP> d-------- C:\Program Files\AIMP2
2008-10-05 22:17 . 2008-10-05 22:18 <REP> d-------- C:\Program Files\Winamp
2008-10-05 22:17 . 2008-10-05 22:31 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\Winamp
2008-10-03 17:35 . 2008-10-03 17:35 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\LameFE
2008-10-03 07:19 . 2008-10-06 23:17 <REP> d-------- C:\Program Files\LameFE
2008-10-03 07:19 . 2008-10-03 07:23 <REP> d-------- C:\Documents and Settings\Elanakin\LameFE22
2008-09-28 12:59 . 2008-10-02 17:57 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\LimeWire
2008-09-28 12:55 . 2008-09-28 12:56 <REP> d-------- C:\Program Files\LimeWire
2008-09-24 14:48 . 2008-09-27 08:55 <REP> d-------- C:\Program Files\Trojan Remover
2008-09-23 12:12 . 2008-09-23 12:12 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\Windows Search
2008-09-23 11:54 . 2008-09-23 11:54 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\Windows Desktop Search
2008-09-23 11:53 . 2008-09-23 11:53 <REP> d-------- C:\WINDOWS\system32\GroupPolicy
2008-09-23 11:53 . 2008-09-23 11:53 <REP> d-------- C:\Program Files\Windows Desktop Search
2008-09-23 11:43 . 2008-09-23 11:43 <REP> d-------- C:\WINDOWS\system32\CatRoot_bak
2008-09-23 09:55 . 2008-09-23 09:57 <REP> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-09-23 09:55 . 2008-09-23 09:58 <REP> d-------- C:\Documents and Settings\All Users\Application Data\PassMark
2008-09-23 09:42 . 2008-09-23 10:34 6,203,424 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-09-23 09:42 . 2008-09-23 10:34 74,816 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-09-22 19:14 . 2008-09-22 19:22 <REP> d-------- C:\Documents and Settings\All Users\Application Data\nView_Profiles
2008-09-16 13:17 . 2008-09-16 13:17 <REP> d-------- C:\WINDOWS\Sun
2008-09-16 11:06 . 2008-09-16 11:06 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\Malwarebytes

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-10 14:52 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\uTorrent
2008-10-07 15:56 --------- d-----w C:\Program Files\Malwarebytes' Anti-Malware
2008-09-16 08:27 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-15 19:10 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\dvdcss
2008-09-13 11:02 --------- d-----w C:\Program Files\LucasArts
2008-09-09 22:04 38,528 ----a-w C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-09-09 22:03 17,200 ----a-w C:\WINDOWS\system32\drivers\mbam.sys
2008-09-08 01:01 --------- d-----w C:\Program Files\Windows Live
2008-09-07 18:04 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\TuneUp Software
2008-09-07 18:03 --------- d-----w C:\Program Files\ESET
2008-09-07 13:08 --------- d-----w C:\Program Files\TuneUp Utilities 2008
2008-09-07 13:04 --------- d-----w C:\Documents and Settings\All Users\Application Data\TuneUp Software
2008-09-07 13:02 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-09-07 13:02 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-09-07 12:58 --------- d-----w C:\Program Files\OO Software
2008-09-07 09:29 --------- d-----w C:\Program Files\uTorrent
2008-09-07 09:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-09-07 09:10 --------- d-----w C:\Program Files\Microsoft SQL Server Compact Edition
2008-09-06 16:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-09-05 15:06 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-09-05 06:56 --------- d-----w C:\Program Files\Fichiers communs\BitDefender
2008-09-04 19:32 --------- d-----w C:\Program Files\BitDefender
2008-09-04 19:17 --------- d-----w C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-09-01 14:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\TomTom
2008-09-01 14:12 --------- d-----w C:\Program Files\TomTom HOME
2008-09-01 10:49 --------- d-----w C:\Program Files\Lavasoft
2008-09-01 10:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-08-31 12:03 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\Nero
2008-08-31 11:52 --------- d-----w C:\Program Files\Fichiers communs\Nero
2008-08-31 11:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\Nero
2008-08-31 11:47 --------- d-----w C:\Program Files\Nero
2008-08-31 10:06 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\TomTom
2008-08-31 09:23 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\InstallShield
2008-08-31 09:21 --------- d-----w C:\Program Files\TomTom DesktopSuite
2008-08-31 08:30 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\Ahead
2008-08-31 08:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ahead
2008-08-31 08:00 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\Canneverbe_Limited
2008-08-31 07:38 --------- d-----w C:\Program Files\StarWarsGalaxies
2008-08-31 06:56 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2008-08-30 07:21 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\Petroglyph
2008-08-27 08:15 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-08-25 20:31 --------- d-----w C:\Program Files\Fichiers communs\Logitech
2008-08-25 20:30 --------- d-----w C:\Program Files\Fichiers communs\Logishrd
2008-08-19 12:15 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-08-19 08:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\LogiShrd
2008-08-19 07:43 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\Logitech
2008-08-19 07:42 0 ---ha-w C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-08-19 07:42 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_LUsbFilt_01005.Wdf
2008-08-19 07:42 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
2008-08-19 07:39 --------- d-----w C:\Program Files\Logitech
2008-08-17 13:22 53,480 ----a-w C:\Documents and Settings\Elanakin\Application Data\GDIPFONTCACHEV1.DAT
2008-08-17 13:21 --------- d-----w C:\Program Files\MSECache
2008-07-18 18:39 587,264 ----a-w C:\WINDOWS\WLXPGSS.SCR
2008-07-11 15:29 94,208 ----a-w C:\WINDOWS\ScUnin.exe
.

------- Sigcheck -------

md5deep: C:\WINDOWS\system32\svchost.exe: Permission denied

2008-06-21 16:53 506368 8d52aedd07247b743a4d9bd372f69109 C:\WINDOWS\system32\winlogon.exe
.
((((((((((((((((((((((((((((( snapshot@2008-10-09_22.26.50.78 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-10-20 18:02:28 163,328 ----a-w C:\WINDOWS\erdnt\subs\ERDNT.EXE
+ 2008-10-10 15:15:49 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_514.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\MSMSGS.EXE" [2003-04-14 1498032]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 15360]
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-04-01 486856]
"TuneUp MemOptimizer"="C:\Program Files\TuneUp Utilities 2008\MemOptimizer.exe" [2008-06-20 154368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-03 13529088]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-03 86016]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd.exe" [2003-08-04 49152]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 241664]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"NeroFilterCheck"="C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe" [2008-06-19 570664]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-06-08 2221352]
"OODefragTray"="C:\WINDOWS\system32\oodtray.exe" [2007-06-28 2512128]
"nwiz"="nwiz.exe" [2008-05-03 C:\WINDOWS\system32\nwiz.exe]
"SoundMan"="SOUNDMAN.EXE" [2007-04-16 C:\WINDOWS\soundman.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 15360]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2003-09-16 237568]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="C:\\Documents and Settings\\All Users\\Application Data\\TuneUp Software\\TuneUp Utilities\\WinStyler\\tu_logonui.exe"

[HKLM\~\startupfolder\C:^Documents and Settings^Elanakin^Menu Démarrer^Programmes^Démarrage^hamachi.lnk]
path=C:\Documents and Settings\Elanakin\Menu Démarrer\Programmes\Démarrage\hamachi.lnk
backup=C:\WINDOWS\pss\hamachi.lnkStartup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"D:\\Steam\\steamapps\\tom182_2\\team fortress 2\\hl2.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"D:\\Steam\\steamapps\\tom182_2\\day of defeat source\\hl2.exe"=
"D:\\Jeux\\World of Warcraft\\Repair.exe"=
"C:\\Program Files\\Hamachi\\hamachi.exe"=
"C:\\Program Files\\Sony\\Station\\Launchpad\\LaunchPad.exe"=
"C:\\Program Files\\LucasArts\\Star Wars JK II Jedi Outcast\\GameData\\jk2mp.exe"=
"D:\\Jeux\\Dofus\\Dofus.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"44979:TCP"= 44979:TCP:utorrent

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
R2 UxTuneUp;TuneUp Extension de thème;C:\WINDOWS\System32\svchost.exe [2004-08-19 14336]
R3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-09-07 355584]
S3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service;C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys [2008-06-25 43520]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contenu du dossier 'Tâches planifiées'

2008-10-10 C:\WINDOWS\Tasks\Maintenance en 1 clic.job
- C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe [2008-06-20 09:23]
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-10 17:16:44
Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
------------------------ Autres processus actifs ------------------------
.
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\oodag.exe
C:\Program Files\TuneUp Utilities 2008\OneClick.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\searchindexer.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\TuneUp Utilities 2008\RegistryCleaner.exe
C:\WINDOWS\system32\searchprotocolhost.exe
C:\WINDOWS\system32\searchfilterhost.exe
.
**************************************************************************
.
Heure de fin: 2008-10-10 17:22:49 - La machine a redémarré
ComboFix-quarantined-files.txt 2008-10-10 15:22:43
ComboFix2.txt 2008-10-09 20:27:27

Avant-CF: 16 170 676 224 octets libres
Après-CF: 16,072,957,952 octets libres

208 --- E O F --- 2008-09-23 09:45:38

Rapport hijackthis

ComboFix 08-10-08.05 - Elanakin 2008-10-10 17:12:08.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.651 [GMT 2:00]
Lancé depuis: C:\Documents and Settings\Elanakin\Bureau\ComboFix.exe
Commutateurs utilisés :: C:\Documents and Settings\Elanakin\Bureau\CFscript.txt
* Un nouveau point de restauration a été créé
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_MUSBEHCO
-------\Service_musbehco

((((((((((((((((((((((((((((( Fichiers créés du 2008-09-10 au 2008-10-10 ))))))))))))))))))))))))))))))))))))
.

2008-10-09 21:55 . 2008-10-09 21:55 362 --a------ C:\WINDOWS\Raccourci vers WINDOWS.lnk
2008-10-08 22:29 . 2008-10-08 22:29 <REP> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-10-07 09:36 . 2008-10-07 09:40 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\GrabIt
2008-10-07 08:56 . 2008-10-07 08:57 <REP> d-------- C:\Program Files\trend micro
2008-10-06 18:01 . 2008-10-06 18:49 <REP> d-------- C:\Program Files\SoundBase
2008-10-06 07:08 . 2008-10-06 18:31 <REP> d-------- C:\Program Files\AIMP2
2008-10-05 22:17 . 2008-10-05 22:18 <REP> d-------- C:\Program Files\Winamp
2008-10-05 22:17 . 2008-10-05 22:31 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\Winamp
2008-10-03 17:35 . 2008-10-03 17:35 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\LameFE
2008-10-03 07:19 . 2008-10-06 23:17 <REP> d-------- C:\Program Files\LameFE
2008-10-03 07:19 . 2008-10-03 07:23 <REP> d-------- C:\Documents and Settings\Elanakin\LameFE22
2008-09-28 12:59 . 2008-10-02 17:57 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\LimeWire
2008-09-28 12:55 . 2008-09-28 12:56 <REP> d-------- C:\Program Files\LimeWire
2008-09-24 14:48 . 2008-09-27 08:55 <REP> d-------- C:\Program Files\Trojan Remover
2008-09-23 12:12 . 2008-09-23 12:12 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\Windows Search
2008-09-23 11:54 . 2008-09-23 11:54 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\Windows Desktop Search
2008-09-23 11:53 . 2008-09-23 11:53 <REP> d-------- C:\WINDOWS\system32\GroupPolicy
2008-09-23 11:53 . 2008-09-23 11:53 <REP> d-------- C:\Program Files\Windows Desktop Search
2008-09-23 11:43 . 2008-09-23 11:43 <REP> d-------- C:\WINDOWS\system32\CatRoot_bak
2008-09-23 09:55 . 2008-09-23 09:57 <REP> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-09-23 09:55 . 2008-09-23 09:58 <REP> d-------- C:\Documents and Settings\All Users\Application Data\PassMark
2008-09-23 09:42 . 2008-09-23 10:34 6,203,424 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-09-23 09:42 . 2008-09-23 10:34 74,816 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-09-22 19:14 . 2008-09-22 19:22 <REP> d-------- C:\Documents and Settings\All Users\Application Data\nView_Profiles
2008-09-16 13:17 . 2008-09-16 13:17 <REP> d-------- C:\WINDOWS\Sun
2008-09-16 11:06 . 2008-09-16 11:06 <REP> d-------- C:\Documents and Settings\Elanakin\Application Data\Malwarebytes

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-10 14:52 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\uTorrent
2008-10-07 15:56 --------- d-----w C:\Program Files\Malwarebytes' Anti-Malware
2008-09-16 08:27 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-15 19:10 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\dvdcss
2008-09-13 11:02 --------- d-----w C:\Program Files\LucasArts
2008-09-09 22:04 38,528 ----a-w C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-09-09 22:03 17,200 ----a-w C:\WINDOWS\system32\drivers\mbam.sys
2008-09-08 01:01 --------- d-----w C:\Program Files\Windows Live
2008-09-07 18:04 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\TuneUp Software
2008-09-07 18:03 --------- d-----w C:\Program Files\ESET
2008-09-07 13:08 --------- d-----w C:\Program Files\TuneUp Utilities 2008
2008-09-07 13:04 --------- d-----w C:\Documents and Settings\All Users\Application Data\TuneUp Software
2008-09-07 13:02 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-09-07 13:02 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-09-07 12:58 --------- d-----w C:\Program Files\OO Software
2008-09-07 09:29 --------- d-----w C:\Program Files\uTorrent
2008-09-07 09:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-09-07 09:10 --------- d-----w C:\Program Files\Microsoft SQL Server Compact Edition
2008-09-06 16:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-09-05 15:06 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-09-05 06:56 --------- d-----w C:\Program Files\Fichiers communs\BitDefender
2008-09-04 19:32 --------- d-----w C:\Program Files\BitDefender
2008-09-04 19:17 --------- d-----w C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-09-01 14:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\TomTom
2008-09-01 14:12 --------- d-----w C:\Program Files\TomTom HOME
2008-09-01 10:49 --------- d-----w C:\Program Files\Lavasoft
2008-09-01 10:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-08-31 12:03 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\Nero
2008-08-31 11:52 --------- d-----w C:\Program Files\Fichiers communs\Nero
2008-08-31 11:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\Nero
2008-08-31 11:47 --------- d-----w C:\Program Files\Nero
2008-08-31 10:06 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\TomTom
2008-08-31 09:23 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\InstallShield
2008-08-31 09:21 --------- d-----w C:\Program Files\TomTom DesktopSuite
2008-08-31 08:30 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\Ahead
2008-08-31 08:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ahead
2008-08-31 08:00 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\Canneverbe_Limited
2008-08-31 07:38 --------- d-----w C:\Program Files\StarWarsGalaxies
2008-08-31 06:56 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2008-08-30 07:21 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\Petroglyph
2008-08-27 08:15 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-08-25 20:31 --------- d-----w C:\Program Files\Fichiers communs\Logitech
2008-08-25 20:30 --------- d-----w C:\Program Files\Fichiers communs\Logishrd
2008-08-19 12:15 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-08-19 08:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\LogiShrd
2008-08-19 07:43 --------- d-----w C:\Documents and Settings\Elanakin\Application Data\Logitech
2008-08-19 07:42 0 ---ha-w C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-08-19 07:42 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_LUsbFilt_01005.Wdf
2008-08-19 07:42 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
2008-08-19 07:39 --------- d-----w C:\Program Files\Logitech
2008-08-17 13:22 53,480 ----a-w C:\Documents and Settings\Elanakin\Application Data\GDIPFONTCACHEV1.DAT
2008-08-17 13:21 --------- d-----w C:\Program Files\MSECache
2008-07-18 18:39 587,264 ----a-w C:\WINDOWS\WLXPGSS.SCR
2008-07-11 15:29 94,208 ----a-w C:\WINDOWS\ScUnin.exe
.

------- Sigcheck -------

md5deep: C:\WINDOWS\system32\svchost.exe: Permission denied

2008-06-21 16:53 506368 8d52aedd07247b743a4d9bd372f69109 C:\WINDOWS\system32\winlogon.exe
.
((((((((((((((((((((((((((((( snapshot@2008-10-09_22.26.50.78 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-10-20 18:02:28 163,328 ----a-w C:\WINDOWS\erdnt\subs\ERDNT.EXE
+ 2008-10-10 15:15:49 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_514.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\MSMSGS.EXE" [2003-04-14 1498032]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 15360]
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-04-01 486856]
"TuneUp MemOptimizer"="C:\Program Files\TuneUp Utilities 2008\MemOptimizer.exe" [2008-06-20 154368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-03 13529088]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-03 86016]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd.exe" [2003-08-04 49152]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 241664]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"NeroFilterCheck"="C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe" [2008-06-19 570664]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-06-08 2221352]
"OODefragTray"="C:\WINDOWS\system32\oodtray.exe" [2007-06-28 2512128]
"nwiz"="nwiz.exe" [2008-05-03 C:\WINDOWS\system32\nwiz.exe]
"SoundMan"="SOUNDMAN.EXE" [2007-04-16 C:\WINDOWS\soundman.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 15360]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2003-09-16 237568]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="C:\\Documents and Settings\\All Users\\Application Data\\TuneUp Software\\TuneUp Utilities\\WinStyler\\tu_logonui.exe"

[HKLM\~\startupfolder\C:^Documents and Settings^Elanakin^Menu Démarrer^Programmes^Démarrage^hamachi.lnk]
path=C:\Documents and Settings\Elanakin\Menu Démarrer\Programmes\Démarrage\hamachi.lnk
backup=C:\WINDOWS\pss\hamachi.lnkStartup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"D:\\Steam\\steamapps\\tom182_2\\team fortress 2\\hl2.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"D:\\Steam\\steamapps\\tom182_2\\day of defeat source\\hl2.exe"=
"D:\\Jeux\\World of Warcraft\\Repair.exe"=
"C:\\Program Files\\Hamachi\\hamachi.exe"=
"C:\\Program Files\\Sony\\Station\\Launchpad\\LaunchPad.exe"=
"C:\\Program Files\\LucasArts\\Star Wars JK II Jedi Outcast\\GameData\\jk2mp.exe"=
"D:\\Jeux\\Dofus\\Dofus.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"44979:TCP"= 44979:TCP:utorrent

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
R2 UxTuneUp;TuneUp Extension de thème;C:\WINDOWS\System32\svchost.exe [2004-08-19 14336]
R3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-09-07 355584]
S3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service;C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys [2008-06-25 43520]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contenu du dossier 'Tâches planifiées'

2008-10-10 C:\WINDOWS\Tasks\Maintenance en 1 clic.job
- C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe [2008-06-20 09:23]
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-10 17:16:44
Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
------------------------ Autres processus actifs ------------------------
.
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\oodag.exe
C:\Program Files\TuneUp Utilities 2008\OneClick.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\searchindexer.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\TuneUp Utilities 2008\RegistryCleaner.exe
C:\WINDOWS\system32\searchprotocolhost.exe
C:\WINDOWS\system32\searchfilterhost.exe
.
**************************************************************************
.
Heure de fin: 2008-10-10 17:22:49 - La machine a redémarré
ComboFix-quarantined-files.txt 2008-10-10 15:22:43
ComboFix2.txt 2008-10-09 20:27:27

Avant-CF: 16 170 676 224 octets libres
Après-CF: 16,072,957,952 octets libres

208 --- E O F --- 2008-09-23 09:45:38

Re,

OK,

j'ai besoin d'infos :

à quelle lettre correspond ton lecteur de CD ?

Sur ton CD Windows, quel chemin faut-il faire pour accéder à svchost.ex_ ?

Pour la 2ème question, insère ton CD windows et cherche svchost dans le CD (D: ou E: ou ...)

F:\I386

Bonjour,

bon, bin quand faut y aller, faut y aller !

Ouvre ce lien : http://www.zebulon.fr/dossiers/61-2-installation-console-recuperation-disque.html

et parcours le afin de voir ce qu'est la console de récupération.

Quand tu le sentiras, fais redémarrer l'ordi.

Normalement, on te demande de choisir entre un démarrage normal et le démarrage sur la console.

Tu choisis la console.

Si on te demande un mot de passe et que tu n'en as pas mis, tu cliques sur Entrée.

Quand la console est démarrée et que tu as l'invite de commamnde, tu insères le CD de XP.

Puis tu tapes :

Expand F:\i386\SVCHOST.ex_ C:\Windows\System32\SVCHOST.exe

On va te demander confirmation. Tu confirmes.

Tu redémarres en mode normal.

Problème résolu ?

Re,

des nouvelles ?

C'est bon je ne saurais te remercier assez pour ton aide :)

Bonjour,

ça marche, plus d'alertes, le scan est propre ?

Yep plus aucun souci :=)

Re,

OK,

nettoyage des outils :

Télécharge ToolsCleaner par A.Rothstein & dj QUIOU sur ton Bureau.

http://pc-system.fr/
hxxp://a-rothstein.changelog.fr/TC/ToolsCleaner2.exe
hxxp://pagesperso-orange.fr/AceRothstein/ToolsCleaner2.exe

Clique sur Recherche et laisse le scan se terminer.

Clique, sur Suppression pour finaliser.

Tu peux, si tu le souhaites, te servir des Options facultatives.

Clique sur Quitter, pour que le rapport puisse se créer.

Poste moi le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur( C:\).

=========

Les indications du post 50 correspondent bien à ce que tu as du faire ? Tu n'as pas eu de surprise ?

Il y avait exactement ce qu'il fallait pour réussir ?

Tes réponses vont me permettre d'améliorer mon utilisation de cette procédure que je maîtrise encore mal.

Merci.

La je suis chez mon père jusque Samedi je fais donc ca Samedi

Bonsoir,

aucun problème.