Svchost.exe : dans C:/windows/

Résolu
Haraknos -  
Bonjour à tous,
c'est la deuxième fois que je fais appel à votre être et j'espère qu'encore une fois je serai entièrement satisfait !

Alors voilà, j'ai fait une rapide recherche de 3 heures sur le net pour trouver la réponse à mon problème qui est le suivant : comment peut-on supprimer un svchost qui n'est pas dans system32 et qui réaparait après l'avoir delet en mode sans echec (évidemment je n'ai pas trouvé la réponse).

J'ai 10 svchost dans mon gestionnaire de tâche, 6 ayant pour utilisateur "SYSTEM", 2 "SERVICE RESEAU", 1 "SERVICE LOCAL" et un dernier à mon nom d'utilisateur (c'est celui là qui, je pense, m'embête).

Je n'arrive pas à ouvrir certaines applications à cause de ce svchost comme firefox (j'arrive à les ouvrir en mode sans échec apres l'avoir supprimé). Si vous voulez le rapport de "HiJackThis" y a qu'à demander.

Encore merci pour votre attention et à bientôt !!

Haraknos
Configuration: Windows XP
Internet Explorer 7.0

53 réponses

Résumé de la discussion

Suppression d'un svchost non situé dans system32 et réapparaissant après suppression en mode sans échec constitue la problématique centrale, interdépendante des risques de réinfection et demande une réponse sûre. Plusieurs suggestions visent des outils dédiés et des manipulations ciblées, notamment ComboFix pour identifier et supprimer les traces, puis GenProc et OTMoveIt3 pour déplacer les éléments résiduels. D'autres recommandations portent sur le nettoyage des entrées de démarrage et des services suspects, la suppression des composants malveillants identifiés et la vérification des dossiers système. En complément, l’analyse des éléments générés par les outils et l’usage d’un détecteur de rootkit peuvent prévenir les réinfections futures dans l’environnement Windows et lors des sessions en ligne.

Bobot (l’IA à votre service)
  1. Utilisateur anonyme
    bonjour ;-))

    Télécharge sur le bureau" outil de diagnostic et reparation"
    ftp://ftp.commentcamarche.com/download/HJTInstall.exe

    =Double-clic dessus
    =Clic Do a system scan and save the log
    =Coller le rapport

    si problème voir l'aide
    http://perso.orange.fr/rginformatique/section%20virus/demohijack.htm
    0
    1. Haraknos Auteur
      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 10:55:49, on 09/11/2008
      Platform: Windows XP SP3 (WinNT 5.01.2600)
      MSIE: Internet Explorer v7.00 (7.00.6000.16735)
      Boot mode: Normal

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\Ati2evxx.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\Ati2evxx.exe
      C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
      C:\Program Files\Fichiers communs\Symantec Shared\AppCore\AppSvc32.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
      C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
      C:\WINDOWS\Explorer.EXE
      C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\slserv.exe
      C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\fxssvc.exe
      C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
      C:\Apps\Powercinema\PCMService.exe
      C:\apps\ABoard\ABoard.exe
      C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
      C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
      C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
      C:\apps\ABoard\AOSD.exe
      C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
      C:\WINDOWS\VM303_STI.EXE
      C:\WINDOWS\vsnpstd.exe
      C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
      C:\WINDOWS\RTHDCPL.EXE
      C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
      C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
      C:\Program Files\Messenger\msmsgs.exe
      C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe
      C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
      C:\Program Files\e-Carte Bleue Banque Populaire\ecbl-nxbp.exe
      c:\program files\fichiers communs\installshield\updateservice\isuspm.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\svchost.exe
      C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\agent.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
      C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
      C:\Program Files\Windows Live\Messenger\msnmsgr.exe
      C:\Program Files\MessengerDiscovery\MessengerDiscovery Live.exe
      C:\Program Files\Windows Live\Messenger\usnsvc.exe
      C:\Program Files\WowCartographe\WowCartographe.exe
      C:\Downloads\Software\HiJackThis.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.orange.fr/portail
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
      R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
      O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)
      O2 - BHO: Download Manager Browser Helper Object - {19C8E43B-07B3-49CB-BFFC-6777B593E6F8} - C:\PROGRA~1\FICHIE~1\fluxDVD\DOWNLO~1\XEBDLH~1.DLL
      O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Fichiers communs\Symantec Shared\coShared\Browser\1.0\NppBho.dll
      O2 - BHO: e-Carte Bleue Browser Helper Object - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} - C:\WINDOWS\system32\BhoECart.dll
      O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
      O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
      O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
      O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Documents and Settings\pierre\Mes documents\pierre.verdy\Free Download Manager\iefdm2.dll
      O3 - Toolbar: Afficher Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Fichiers communs\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
      O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
      O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
      O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
      O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAudPropShortcut.exe
      O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
      O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
      O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
      O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
      O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
      O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
      O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
      O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
      O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
      O4 - HKLM\..\Run: [BigDog303] C:\WINDOWS\VM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH)
      O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
      O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
      O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
      O4 - HKLM\..\Run: [ISUSPM Startup] "c:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" -startup
      O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
      O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
      O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
      O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
      O4 - HKLM\..\Run: [CanalPlayerHelper] C:\Program Files\Lecteur CANALPLAY\CanalPlayerHelper.exe
      O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
      O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
      O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon
      O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 52\axcmd.exe" /automount
      O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
      O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
      O4 - HKUS\S-1-5-21-3987325350-3101553100-1454181443-1011\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE" (User '?')
      O4 - HKUS\S-1-5-21-3987325350-3101553100-1454181443-1011\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 52\axcmd.exe" /automount (User '?')
      O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
      O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
      O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
      O4 - Global Startup: e-Carte Bleue Banque Populaire.lnk = C:\Program Files\e-Carte Bleue Banque Populaire\ecbl-nxbp.exe
      O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
      O8 - Extra context menu item: Tout télécharger avec Free Download Manager - file://C:\Documents and Settings\pierre\Mes documents\pierre.verdy\Free Download Manager\dlall.htm
      O8 - Extra context menu item: Translate with &Babylon - res://C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
      O8 - Extra context menu item: Télécharger avec Free Download Manager - file://C:\Documents and Settings\pierre\Mes documents\pierre.verdy\Free Download Manager\dllink.htm
      O8 - Extra context menu item: Télécharger la sélection avec Free Download Manager - file://C:\Documents and Settings\pierre\Mes documents\pierre.verdy\Free Download Manager\dlselected.htm
      O8 - Extra context menu item: Télécharger la vidéo avec Free Download Manager - file://C:\Documents and Settings\pierre\Mes documents\pierre.verdy\Free Download Manager\dlfvideo.htm
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
      O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
      O9 - Extra button: Stop Pub - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Program Files\JCA2000\StopPub\StopPub.exe
      O9 - Extra 'Tools' menuitem: Stop Pub - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Program Files\JCA2000\StopPub\StopPub.exe
      O9 - Extra button: Créer un Favori de l'appareil mobile - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
      O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
      O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
      O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
      O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\pierre\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk
      O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
      O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
      O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
      O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
      O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
      O15 - Trusted Zone: *.canalplay.com (HKLM)
      O15 - Trusted Zone: *.canalplusactive.com (HKLM)
      O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
      O16 - DPF: {051D0E35-F4E3-4C8D-B411-AB0875F4C683} (Anark Client 4.0 ActiveX Control) - http://install.anark.com/client/version4/windows-ie/en/AMClient.cab
      O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
      O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
      O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
      O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
      O16 - DPF: {4A85DBE0-BFB2-4119-8401-186A7C6EB653} - http://messenger.zone.msn.com/binary/MJSS.cab69309.cab
      O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
      O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v4.cab
      O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
      O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
      O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
      O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game13.zylom.com/activex/zylomgamesplayer.cab
      O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
      O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab
      O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
      O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://3dlifeplayer.dl.3dvia.com/player/install/installer.exe
      O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
      O16 - DPF: {EDFCB7CB-942C-4822-AF14-F0B687409848} (Image Uploader Control) - http://photoservice.photos.orange.fr/telechargement/ImageUploader4.cab
      O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
      O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
      O17 - HKLM\System\CCS\Services\Tcpip\..\{F15220B3-4AAE-4279-AB8B-9C11835EA883}: NameServer = 81.253.149.1 80.10.246.3
      O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
      O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
      O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
      O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
      O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
      O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
      O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\VAScanner\comHost.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
      O23 - Service: Validation de mot de passe Symantec IS (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
      O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
      O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
      O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
      O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
      O23 - Service: MysqlInventime - Unknown owner - c:\mysql\bin\mysqld-nt.exe
      O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
      O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
      O23 - Service: Service CANALPLAY - Canal+ Distribution - C:\Program Files\Lecteur CANALPLAY\CanalPlayService.exe
      O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
      O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
      O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
      O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\AppCore\AppSvc32.exe
      0
      1. Utilisateur anonyme
        Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau.
        http://downloads.andymanchesta.com/RemovalTools/SDFix.exe
        Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici :
        • Redémarre ton ordinateur
        • Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde).
        • A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.
        • Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".
        • Choisis ton compte.
        Déroule la liste des instructions ci-dessous :
        • Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script.
        • Appuie sur Y pour commencer le processus de nettoyage.
        • Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
        • Appuie sur une touche pour redémarrer le PC.
        • Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
        • Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
        • Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
        • Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
        • Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum
        0
        1. Haraknos Auteur
          [b]SDFix: Version 1.240 [/b]
          Run by pierre on 09/11/2008 at 11:14

          Microsoft Windows XP [version 5.1.2600]
          Running From: C:\Documents and Settings\pierre\Bureau\SDFix

          [b]Checking Services [/b]:

          Restoring Default Security Values
          Restoring Default Hosts File

          Rebooting

          [b]Checking Files [/b]:

          Trojan Files Found:

          C:\WINDOWS\photo album.zip - Deleted

          Could Not Remove C:\WINDOWS\svchost.exe

          Removing Temp Files

          [b]ADS Check [/b]:

          [b]Final Check [/b]:

          catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
          Rootkit scan 2008-11-09 11:40:26
          Windows 5.1.2600 Service Pack 3 NTFS

          scanning hidden processes ...

          scanning hidden services & system hive ...

          [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
          "p0"="C:\Program Files\Alcohol Soft\Alcohol 52\"
          "h0"=dword:00000000
          "ujdew"=hex:65,00,48,ff,b5,3b,66,cd,da,87,1b,bb,69,33,03,2d,a2,f5,5f,bc,9b,..
          [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
          "h0"=dword:00000000
          "ujdew"=hex:e9,a0,05,0b,fd,33,bf,b5,5c,0a,04,69,e3,c3,b2,80,4c,08,7a,95,90,..
          [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
          "s1"=dword:4a925792
          "s2"=dword:45ff8aaf
          "h0"=dword:00000001

          [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
          "h0"=dword:00000000
          "ujdew"=hex:92,da,19,14,9b,8f,ac,15,b0,cd,b9,bd,20,2a,21,fb,76,a9,2e,53,d9,..
          "p0"="C:\Program Files\Alcohol Soft\Alcohol 52\"
          [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
          "h0"=dword:00000000
          "ujdew"=hex:92,da,19,14,9b,8f,ac,15,b0,cd,b9,bd,20,2a,21,fb,76,a9,2e,53,d9,..
          "p0"="C:\Program Files\Alcohol Soft\Alcohol 52\"

          scanning hidden registry entries ...

          scanning hidden files ...

          scan completed successfully
          hidden processes: 0
          hidden services: 0
          hidden files: 0

          [b]Remaining Services [/b]:

          Authorized Application Key Export:

          [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
          "%ProgramFiles%\\AOL 9.0\\aol.exe"="%ProgramFiles%\\AOL 9.0\\aol.exe:*:Enabled:AOL"
          "%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe"="%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe:*:Enabled:SPLINTER CELL PANDORA"
          "%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe"="%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe:*:Enabled:PANDORA"
          "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
          "C:\\APPS\\Inventime\\my.exe"="C:\\APPS\\Inventime\\my.exe:*:Enabled:INVENTIME"
          "C:\\Program Files\\LucasArts\\Star Wars JK II Jedi Outcast\\GameData\\jk2mp.exe"="C:\\Program Files\\LucasArts\\Star Wars JK II Jedi Outcast\\GameData\\jk2mp.exe:*:Enabled:jk2mp"
          "C:\\Program Files\\Microsoft ActiveSync\\WCESCOMM.EXE"="C:\\Program Files\\Microsoft ActiveSync\\WCESCOMM.EXE:*:Enabled:Connection Manager"
          "C:\\Program Files\\Microsoft ActiveSync\\WCESMGR.EXE"="C:\\Program Files\\Microsoft ActiveSync\\WCESMGR.EXE:*:Enabled:ActiveSync Application"
          "C:\\Program Files\\BitTorrent\\bittorrent.exe"="C:\\Program Files\\BitTorrent\\bittorrent.exe:*:Enabled:BitTorrent"
          "C:\\Program Files\\Lecteur CANALPLAY\\CanalPlayer.exe"="C:\\Program Files\\Lecteur CANALPLAY\\CanalPlayer.exe:*:Enabled:Lecteur CANALPLAY"
          "C:\\Program Files\\Lecteur CANALPLAY\\CanalPlayerHelper.exe"="C:\\Program Files\\Lecteur CANALPLAY\\CanalPlayerHelper.exe:*:Enabled:Lecteur CANALPLAY Helper"
          "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
          "C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"="C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe:*:Enabled:Assistance … distance - Windows Messenger et voix"
          "C:\\Program Files\\DiskTrix\\UltimateDefragLite\\UDefrag.exe"="C:\\Program Files\\DiskTrix\\UltimateDefragLite\\UDefrag.exe:*:Enabled:UltimateDefrag Lite"
          "C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
          "C:\\Program Files\\Sony Ericsson\\Sony Ericsson Media Manager 1.0\\MediaManager.exe"="C:\\Program Files\\Sony Ericsson\\Sony Ericsson Media Manager 1.0\\MediaManager.exe:*:Enabled:Sony Ericsson Media Manager 1.0"
          "C:\\Program Files\\ma-config.com\\maconfservice.exe"="C:\\Program Files\\ma-config.com\\maconfservice.exe:LocalSubNet:Enabled:maconfservice"
          "C:\\Documents and Settings\\guillaume\\Local Settings\\Temp\\stInstall.exe"="C:\\Documents and Settings\\guillaume\\Local Settings\\Temp\\stInstall.exe:*:Enabled:SpeedTouch Home Install Wizard"
          "C:\\Program Files\\Thomson\\ST330\\service\\st330service.exe"="C:\\Program Files\\Thomson\\ST330\\service\\st330service.exe:*:Enabled:ST330 service"
          "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
          "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

          [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
          "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
          "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
          "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
          "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

          [b]Remaining Files [/b]:

          C:\WINDOWS\svchost.exe Found

          File Backups: - C:\DOCUME~1\pierre\Bureau\SDFix\backups\backups.zip

          [b]Files with Hidden Attributes [/b]:

          Sun 23 Jul 2006 215 A.SHR --- "C:\BOOT.BAK"
          Tue 17 Jun 2008 65,536 A.SH. --- "C:\Program Files\MessengerDiscovery\AlertSkinInstaller.exe"
          Sun 22 Jun 2008 40,960 A.SH. --- "C:\Program Files\MessengerDiscovery\SpellCHK.exe"
          Wed 2 Dec 1998 143,360 A.SH. --- "C:\Program Files\MessengerDiscovery\unzip.dll"
          Mon 3 Mar 2008 61,440 A..H. --- "C:\Program Files\MSN Messenger\winmm.dll"
          Sun 2 Nov 2008 363,008 ..SHR --- "C:\Program Files\NetMeeting\nmwb.exe"
          Sun 2 Nov 2008 456,192 ..SHR --- "C:\Program Files\NetMeeting\Winlog.exe"
          Sun 17 Dec 2006 56 ..SHR --- "C:\WINDOWS\system32\AB84F81FEE.sys"
          Wed 3 May 2006 163,328 ..SHR --- "C:\WINDOWS\system32\flvDX.dll"
          Sat 24 Feb 2007 848 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys"
          Wed 21 Feb 2007 31,232 ..SHR --- "C:\WINDOWS\system32\msfDX.dll"
          Wed 1 Aug 2007 8,397,128 A..H. --- "C:\WINDOWS\system32\msway.dll"
          Sun 16 Mar 2008 216,064 ..SHR --- "C:\WINDOWS\system32\nbDX.dll"
          Fri 25 Aug 2006 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
          Sun 26 Jun 2005 616,448 ..SHR --- "C:\Program Files\eRightSoft\SUPER\cygwin1.dll"
          Tue 21 Jun 2005 45,568 ..SHR --- "C:\Program Files\eRightSoft\SUPER\cygz.dll"
          Thu 21 Aug 2008 72,704 ..SHR --- "C:\Program Files\eRightSoft\SUPER\Setup.exe"
          Tue 2 Oct 2007 15,872 A.SHR --- "C:\Program Files\eRightSoft\SUPER\_Setup.dll"
          Fri 25 Aug 2006 4,021,128 A..H. --- "C:\Program Files\InstallShield Installation Information\{E9E37358-E3E1-47BA-9E21-375EF3616BC9}\SetupEx.exe"
          Sun 19 Oct 2008 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
          Tue 4 Jun 2002 84,992 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\14_43260.dll"
          Tue 4 Jun 2002 44,032 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\28_83260.dll"
          Tue 10 Dec 2002 73,766 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\atrc3260.dll"
          Tue 10 Dec 2002 65,575 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\cook3260.dll"
          Sun 9 Jun 2002 36,864 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\ddnt3260.dll"
          Tue 4 Jun 2002 20,480 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\dnet3260.dll"
          Tue 10 Dec 2002 102,437 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv13260.dll"
          Tue 10 Dec 2002 176,165 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv23260.dll"
          Tue 10 Dec 2002 208,935 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv33260.dll"
          Tue 10 Dec 2002 217,127 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv43260.dll"
          Sun 9 Jun 2002 40,448 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\dspr3260.dll"
          Sat 3 Nov 2001 225,280 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\ivvideo.dll"
          Tue 10 Apr 2001 225,280 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\qtmlClient.dll"
          Fri 20 Feb 2004 232,960 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\raac.dll"
          Sun 9 Jun 2002 525,824 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rnco3260.dll"
          Tue 10 Dec 2002 245,805 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rnlt3260.dll"
          Tue 10 Dec 2002 45,093 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv103260.dll"
          Tue 10 Dec 2002 98,341 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv203260.dll"
          Tue 10 Dec 2002 94,247 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv303260.dll"
          Tue 10 Dec 2002 90,151 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv403260.dll"
          Tue 10 Dec 2002 102,439 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\sipr3260.dll"
          Sun 9 Jun 2002 49,152 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\tokr3260.dll"
          Thu 20 Mar 2008 5,632 ..SHR --- "C:\Program Files\eRightSoft\SUPER\spk\1stRun.exe"
          Fri 25 Aug 2006 4,348 A..H. --- "C:\Documents and Settings\berny\Mes documents\Ma musique\Sauvegarde de la licence\drmv1key.bak"
          Tue 29 Aug 2006 20 A..H. --- "C:\Documents and Settings\berny\Mes documents\Ma musique\Sauvegarde de la licence\drmv1lic.bak"
          Fri 25 Aug 2006 400 A.SH. --- "C:\Documents and Settings\berny\Mes documents\Ma musique\Sauvegarde de la licence\drmv2key.bak"
          Fri 12 Mar 2004 106,496 A..H. --- "C:\Program Files\Fichiers communs\aolshare\shell\fr\shellext.dll"
          Fri 15 Sep 2006 4,918 A..H. --- "C:\Documents and Settings\berny\Application Data\Microsoft\Office\Shortcut Bar\Off205.tmp"
          Sun 19 Oct 2008 39,475,233 A..H. --- "C:\Documents and Settings\berny\Local Settings\Application Data\Microsoft\Media Player\MusicType1VirginMegaFr\Downloads\000E8B05\BIT5E.tmp"

          [b]Finished![/b]

          Voila le rapport, mais le svchost est toujours là... =x
          0
          2. Utilisateur anonyme
            et un virus msn ;-))

            ne t'inquiete pas l'autre resiste , mais j'ai un bon pied de biche !! lol

            Télécharges ComboFix à partir d'un de ces liens :

            http://download.bleepingcomputer.com/sUBs/ComboFix.exe
            https://forospyware.com
            http://www.geekstogo.com/forum/files/file/197-combofix-by-subs/

            Et important, enregistre le sur le bureau.

            Avant d'utiliser ComboFix :

            ► Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours.

            ► Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent géner fortement la procédure de recherche et de nettoyage de l'outil.

            Une fois fait, sur ton bureau double-clic sur Combofix.exe.

            - Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc.

            /!\ Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes.

            - En fin de scan il est possible que ComboFix ait besoin de redemarrer le pc pour finaliser la désinfection\recherche, laisses-le faire.

            - Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt)

            ► Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet.

            ► Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.
            0
            1. Haraknos Auteur
              Merci pour la réponse, je test ca de suite mais je pourrai pas poster avant cet aprem pacque j'ai deux trois trucs à faire ^^

              Merci beaucoup pour les réponses, si ça marche je crois que je t'en serai longtemsp reconnaissant =D

              A bientot =D
              0
              1. Utilisateur anonyme
                il y auras surement encore une manip a effectuer avant que tu ne sois totalement debarrassé de cette petite bete ;-)))
                0
                1. Haraknos Auteur
                  Bon j'ai regardé la manip et il marquait "supression des fichiers..." et à chaque fois il y avait svchost mais y a pas de log dans C:/ , il y en a un dans le dossier ComboFix et il n'y a preque rien marqué dedans =x

                  ComboFix 08-11-07.01 - pierre 2008-11-09 12:25:17.1 - NTFSx86
                  Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.510 [GMT 1:00]
                  Lancé depuis: C:\Downloads\Software\ComboFix.exe
                  * Un nouveau point de restauration a été créé
                  .

                  Voilà c'est tout ce qu'il y a marqué, et il y a encore svchost dans windows >_<

                  J'attends la dernière manip x)
                  0
                  1. Utilisateur anonyme
                    regarde ici C:\Combofix.txt

                    copie et colle le rapport entier stp
                    0
                    1. Haraknos Auteur
                      J'ai refais la manip et il m'a enfin créé un log :

                      ComboFix 08-11-07.01 - pierre 2008-11-09 12:41:14.2 - NTFSx86
                      Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.522 [GMT 1:00]
                      Lancé depuis: c:\documents and settings\pierre\Bureau\ComboFix.exe
                      .

                      (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
                      .

                      c:\windows\svchost.exe
                      .
                      ---- Previous Run -------
                      .
                      c:\documents and settings\Administrateur\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
                      c:\windows\svchost.exe

                      .
                      ((((((((((((((((((((((((((((( Fichiers créés du 2008-10-09 au 2008-11-09 ))))))))))))))))))))))))))))))))))))
                      .

                      2008-11-09 11:13 . 2008-11-09 11:13 579,584 --a------ c:\windows\system32\dllcache\user32.dll
                      2008-11-09 11:08 . 2008-11-09 11:08 <REP> d-------- c:\windows\ERUNT
                      2008-11-08 11:34 . 2008-11-08 11:34 <REP> d-------- c:\documents and settings\Administrateur\Application Data\ESTsoft
                      2008-11-07 21:52 . 2008-11-07 21:57 139,264 --a------ c:\windows\War3Unin.exe
                      2008-11-07 21:52 . 2008-11-07 21:59 76,572 --a------ c:\windows\War3Unin.dat
                      2008-11-07 21:52 . 2008-11-07 21:57 2,829 --a------ c:\windows\War3Unin.pif
                      2008-11-07 21:50 . 2008-11-08 21:01 <REP> d-------- c:\program files\Warcraft III
                      2008-11-02 19:47 . 2008-11-09 10:42 0 --a------ c:\windows\1.ini
                      2008-11-02 16:50 . 2008-11-02 16:50 106,496 --a------ c:\windows\system32\wowformf828_733.dll
                      2008-11-02 16:50 . 2008-11-02 16:50 20 --a------ c:\windows\syscheck
                      2008-10-29 17:54 . 2008-10-29 17:54 <REP> d-------- c:\windows\system32\fr
                      2008-10-29 17:54 . 2008-10-29 17:54 <REP> d-------- c:\windows\system32\bits
                      2008-10-29 17:54 . 2008-10-29 17:54 <REP> d-------- c:\windows\l2schemas
                      2008-10-29 17:52 . 2008-10-29 17:55 <REP> d-------- c:\windows\ServicePackFiles
                      2008-10-29 17:47 . 2008-10-29 17:47 <REP> d-------- c:\windows\EHome
                      2008-10-28 10:10 . 2008-10-28 10:10 <REP> d-------- c:\documents and settings\Administrateur\Application Data\OpenOffice.org2
                      2008-10-27 14:10 . 2008-10-27 14:12 <REP> d-------- c:\windows\system32\Adobe
                      2008-10-26 12:31 . 2008-10-26 12:33 <REP> d-------- c:\program files\Travian
                      2008-10-24 19:59 . 2008-10-15 17:35 337,408 --------- c:\windows\system32\dllcache\netapi32.dll
                      2008-10-19 20:44 . 2008-10-19 20:44 <REP> d-------- c:\documents and settings\All Users\Application Data\Downloaded Installations
                      2008-10-17 18:47 . 2008-10-17 18:47 <REP> d-------- c:\program files\OpenOffice.org 2.4
                      2008-10-17 11:33 . 2008-08-14 14:23 2,191,232 --------- c:\windows\system32\dllcache\ntoskrnl.exe
                      2008-10-17 11:33 . 2008-08-14 14:23 2,147,328 --------- c:\windows\system32\dllcache\ntkrnlmp.exe
                      2008-10-17 11:33 . 2008-08-14 14:23 2,068,096 --------- c:\windows\system32\dllcache\ntkrnlpa.exe
                      2008-10-17 11:33 . 2008-08-14 14:23 2,025,984 --------- c:\windows\system32\dllcache\ntkrpamp.exe
                      2008-10-17 11:32 . 2008-09-08 11:41 333,824 --------- c:\windows\system32\dllcache\srv.sys
                      2008-10-17 11:30 . 2008-09-15 16:26 1,846,528 --------- c:\windows\system32\dllcache\win32k.sys

                      .
                      (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                      .
                      2008-11-09 11:48 --------- d-----w c:\program files\Fichiers communs\Symantec Shared
                      2008-11-09 10:48 --------- d-----w c:\documents and settings\All Users\Application Data\TrackMania
                      2008-11-09 09:36 --------- d-----w c:\program files\Mozilla Thunderbird
                      2008-11-08 22:19 --------- d-----w c:\program files\Wanadoo
                      2008-11-08 20:43 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec
                      2008-11-08 19:55 4,224 ----a-w c:\windows\system32\drivers\beep.sys
                      2008-11-08 15:48 --------- d-----w c:\program files\GtkRadiant-1.4
                      2008-11-08 13:04 420 ----a-w c:\documents and settings\berny\Application Data\wklnhst.dat
                      2008-11-08 10:53 --------- d-----w c:\program files\The Cleaner
                      2008-10-31 16:24 716,272 ----a-w c:\windows\system32\drivers\sptd.sys
                      2008-10-29 05:09 --------- d-----w c:\program files\Google
                      2008-10-24 20:39 --------- d-----w c:\program files\Navilog1
                      2008-10-17 17:46 --------- d-----w c:\program files\OpenOffice.org 2.3
                      2008-10-17 17:43 --------- d-----w c:\program files\Java
                      2008-10-05 14:51 --------- d-----w c:\program files\MessengerDiscovery
                      2008-10-05 13:24 --------- d-----w c:\program files\Thomson
                      2008-10-05 13:14 40,320 ----a-w c:\windows\system32\drivers\steth.sys
                      2008-10-05 13:14 30,464 ----a-w c:\windows\system32\drivers\st330.sys
                      2008-10-05 13:14 16,128 ----a-w c:\windows\system32\drivers\lpwdm.sys
                      2008-10-05 13:14 12,672 ----a-w c:\windows\system32\drivers\stbus.sys
                      2008-10-05 13:03 --------- d-----w c:\program files\ma-config.com
                      2008-10-05 13:03 --------- d-----w c:\documents and settings\All Users\Application Data\ma-config.com
                      2008-10-04 15:32 --------- d-----w c:\program files\Virtools
                      2008-09-30 14:46 --------- d-----w c:\program files\Norton Internet Security
                      2008-09-28 14:18 805 ----a-w c:\windows\system32\drivers\SYMEVENT.INF
                      2008-09-28 14:18 123,952 ----a-w c:\windows\system32\drivers\SYMEVENT.SYS
                      2008-09-28 14:18 10,671 ----a-w c:\windows\system32\drivers\SYMEVENT.CAT
                      2008-09-28 14:18 --------- d-----w c:\program files\Symantec
                      2008-09-26 17:36 --------- d-----w c:\program files\Messenger Plus! Live
                      2007-11-17 09:25 63,552 ----a-w c:\documents and settings\guillaume\Application Data\GDIPFONTCACHEV1.DAT
                      2007-06-23 11:41 378 ----a-w c:\documents and settings\guillaume\Application Data\wklnhst.dat
                      2007-02-06 17:18 63,552 ----a-w c:\documents and settings\marine\Application Data\GDIPFONTCACHEV1.DAT
                      2006-12-17 16:11 56 --sh--r c:\windows\system32\AB84F81FEE.sys
                      2006-05-03 09:06 163,328 --sh--r c:\windows\system32\flvDX.dll
                      2007-02-24 09:10 848 --sha-w c:\windows\system32\KGyGaAvL.sys
                      2007-02-21 10:47 31,232 --sh--r c:\windows\system32\msfDX.dll
                      2008-03-16 12:30 216,064 --sh--r c:\windows\system32\nbDX.dll
                      .

                      ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
                      .
                      .
                      *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
                      REGEDIT4

                      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                      "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
                      "H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\WCESCOMM.EXE" [2005-01-19 405583]
                      "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
                      "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
                      "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-10-19 286720]

                      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                      "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-05 208952]
                      "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168]
                      "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168]
                      "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784]
                      "PCMService"="c:\apps\Powercinema\PCMService.exe" [2004-09-15 81920]
                      "ACTIVBOARD"="c:\apps\ABoard\ABoard.exe" [2003-05-02 24576]
                      "SpeedTouch USB Diagnostics"="c:\program files\Thomson\SpeedTouch USB\Dragdiag.exe" [2003-09-05 878080]
                      "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2004-02-12 49152]
                      "HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 241664]
                      "ccApp"="c:\program files\Fichiers communs\Symantec Shared\ccApp.exe" [2007-01-09 115816]
                      "osCheck"="c:\program files\Norton Internet Security\osCheck.exe" [2006-09-05 26248]
                      "BigDog303"="c:\windows\VM303_STI.EXE" [2006-02-27 61440]
                      "WOOWATCH"="c:\progra~1\Wanadoo\Watch.exe" [2003-10-16 20480]
                      "snpstd"="c:\windows\vsnpstd.exe" [2004-06-10 286720]
                      "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
                      "ISUSPM Startup"="c:\program files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" [2005-08-11 249856]
                      "ISUSScheduler"="c:\program files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2005-08-11 81920]
                      "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-10-19 286720]
                      "Symantec PIF AlertEng"="c:\program files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 583048]
                      "Raccourci vers la page des propriétés de High Definition Audio"="HDAudPropShortcut.exe" [2004-03-17 c:\windows\system32\Hdaudpropshortcut.exe]
                      "ATIPTA"="atiptaxx.exe" [2006-02-22 c:\windows\system32\atiptaxx.exe]
                      "High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 c:\windows\system32\HdAShCut.exe]
                      "RTHDCPL"="RTHDCPL.EXE" [2006-03-14 c:\windows\RTHDCPL.exe]

                      [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                      "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

                      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
                      "VIDC.I420"= i420vfw.dll
                      "VIDC.X264"= x264vfw.dll
                      "VIDC.HFYU"= huffyuv.dll
                      "vidc.iv41"= ir41_32.dll
                      "vidc.i263"= i263_32.drv
                      "msacm.l3fhg"= mp3fhg.acm
                      "msacm.divxa32"= divxa32.acm
                      "msacm.imc"= imc32.acm
                      "MSACM.CEGSM"= mobilev.acm

                      [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^e-Carte Bleue Banque Populaire.lnk]
                      path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\e-Carte Bleue Banque Populaire.lnk
                      backup=c:\windows\pss\e-Carte Bleue Banque Populaire.lnkCommon Startup

                      [HKLM\~\startupfolder\C:^Documents and Settings^pierre^Menu Démarrer^Programmes^Démarrage^Anti-Pub.lnk]
                      path=c:\documents and settings\pierre\Menu Démarrer\Programmes\Démarrage\Anti-Pub.lnk
                      backup=c:\windows\pss\Anti-Pub.lnkStartup

                      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MessagerStarter Wanadoo]
                      --a------ 2003-04-11 16:06 32768 c:\progra~1\MESSAG~1\StartMessager.exe

                      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
                      --a------ 2008-04-14 03:34 1695232 c:\program files\Messenger\msmsgs.exe

                      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WooCnxMon]
                      --a------ 2003-10-16 17:07 24576 c:\progra~1\Wanadoo\CnxMon.exe

                      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOWATCH]
                      --------- 2003-10-16 17:07 20480 c:\progra~1\Wanadoo\Watch.exe

                      [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
                      "DisableMonitoring"=dword:00000001

                      [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
                      "DisableMonitoring"=dword:00000001

                      [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
                      "DisableMonitoring"=dword:00000001

                      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
                      "EnableFirewall"= 0 (0x0)

                      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                      "%ProgramFiles%\\AOL 9.0\\aol.exe"=
                      "%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe"=
                      "%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe"=
                      "%windir%\\system32\\sessmgr.exe"=
                      "c:\\APPS\\Inventime\\my.exe"=
                      "c:\\Program Files\\LucasArts\\Star Wars JK II Jedi Outcast\\GameData\\jk2mp.exe"=
                      "c:\\Program Files\\Microsoft ActiveSync\\WCESCOMM.EXE"=
                      "c:\\Program Files\\Microsoft ActiveSync\\WCESMGR.EXE"=
                      "c:\\Program Files\\Lecteur CANALPLAY\\CanalPlayer.exe"=
                      "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
                      "c:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
                      "c:\\Program Files\\Messenger\\msmsgs.exe"=
                      "c:\\Program Files\\Sony Ericsson\\Sony Ericsson Media Manager 1.0\\MediaManager.exe"=
                      "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
                      "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

                      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
                      "10155:TCP"= 10155:TCP:BitComet 10155 TCP
                      "10155:UDP"= 10155:UDP:BitComet 10155 UDP

                      R0 ViBus;ViBus;c:\windows\system32\DRIVERS\ViBus.sys [2007-12-07 16896]
                      R0 videX32;videX32;c:\windows\system32\DRIVERS\videX32.sys [2007-09-21 9216]
                      R0 ViPrt;VIA SATA IDE Device Driver;c:\windows\system32\DRIVERS\ViPrt.sys [2007-12-07 52736]
                      R2 SBKUPNT;SBKUPNT;c:\windows\system32\Drivers\SBKUPNT.SYS [2001-07-13 14976]
                      R2 wowsystemcode;Remote TCP/IP;c:\windows\System32\svchost.exe [2008-04-14 14336]
                      S2 RPCH;Remote Procedure Call (HPM);c:\program files\NetMeeting\nmwb.exe [2008-11-02 363008]
                      S2 RPCHE;Remote Procedure Call (RPCE);c:\program files\NetMeeting\Winlog.exe [2008-11-02 456192]
                      S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [2008-09-02 191656]
                      S3 s916bus;Sony Ericsson Device 916 driver (WDM);c:\windows\system32\DRIVERS\s916bus.sys [2007-11-02 83496]
                      S3 s916mdfl;Sony Ericsson Device 916 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s916mdfl.sys [2007-11-02 15016]
                      S3 s916mdm;Sony Ericsson Device 916 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s916mdm.sys [2007-11-02 109992]
                      S3 s916mgmt;Sony Ericsson Device 916 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s916mgmt.sys [2007-11-02 103976]
                      S3 s916obex;Sony Ericsson Device 916 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s916obex.sys [2007-11-02 100008]
                      S3 Service CANALPLAY;Service CANALPLAY;c:\program files\Lecteur CANALPLAY\CanalPlayService.exe [2008-06-20 436096]
                      S3 ST330;ST330;c:\windows\system32\drivers\st330.sys [2008-10-05 30464]
                      S3 STBUS;STBUS;c:\windows\system32\drivers\stbus.sys [2008-10-05 12672]
                      S3 STETH;SpeedTouch Ethernet Adapter NT Driver;c:\windows\system32\DRIVERS\steth.sys [2008-10-05 40320]
                      S3 usbscan;Pilote de scanneur USB;c:\windows\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
                      S3 USBSTOR;Pilote de stockage de masse USB;c:\windows\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]

                      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
                      wowsystemcode

                      *Newly Created Service* - COMHOST
                      .
                      Contenu du dossier 'Tâches planifiées'

                      2008-07-25 c:\windows\Tasks\AppleSoftwareUpdate.job
                      - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:57]

                      2008-11-01 c:\windows\Tasks\Norton Internet Security - Analyse système complète - berny.job
                      - c:\progra~1\NORTON~1\NORTON~1\Navw32.exe [2006-09-06 22:38]

                      2007-11-01 c:\windows\Tasks\Norton Internet Security - Analyse système complète - laurence.job
                      - c:\progra~1\NORTON~1\NORTON~1\Navw32.exe [2006-09-06 22:38]

                      2006-07-23 c:\windows\Tasks\Rappel d'enregistrement 3.job
                      - c:\windows\system32\OOBE\oobebaln.exe [2008-04-14 03:34]

                      2008-11-08 c:\windows\Tasks\WebReg 20081031155349.job
                      - c:\program files\HP\Digital Imaging\bin\hpqwrg.exe [2004-05-28 21:47]
                      .
                      - - - - ORPHELINS SUPPRIMES - - - -

                      HKLM-Run-CanalPlayerHelper - c:\program files\Lecteur CANALPLAY\CanalPlayerHelper.exe
                      MSConfigStartUp-CanalPlayerHelper - c:\program files\Lecteur CANALPLAY\CanalPlayerHelper.exe
                      MSConfigStartUp-Pando - c:\program files\Pando Networks\Pando\Pando.exe
                      MSConfigStartUp-Picasa Media Detector - c:\program files\Picasa2\PicasaMediaDetector.exe
                      MSConfigStartUp-PlayerKiosquePlus - c:\program files\Lecteur CANALPLAY\PlayerKiosquePlus.exe

                      .
                      ------- Examen supplémentaire -------
                      .
                      FireFox -: Profile - c:\documents and settings\guillaume\Application Data\Mozilla\Firefox\Profiles\zurs9etv.default\
                      FireFox -: prefs.js - STARTUP.HOMEPAGE - about:blank
                      FF -: plugin - c:\documents and settings\guillaume\Application Data\Mozilla\Firefox\Profiles\zurs9etv.default\extensions\{bb628310-0ab7-11db-9cd8-0800200c9a66}\plugins\nphardwaredetection.dll
                      FF -: plugin - c:\program files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
                      FF -: plugin - c:\program files\DivX\DivX Content Uploader\npUpload.dll
                      FF -: plugin - c:\program files\Fichiers communs\fluxDVD\APIX\NPAPIX.dll
                      FF -: plugin - c:\program files\Fichiers communs\fluxDVD\BrowserIntegration\NPFluxBrowserHelper.dll
                      FF -: plugin - c:\program files\Fichiers communs\mpDRM\NPMPDRM.dll
                      FF -: plugin - c:\program files\ma-config.com\nphardwaredetection.dll
                      FF -: plugin - c:\program files\Mozilla Firefox\plugins\NPAPIX.dll
                      FF -: plugin - c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
                      FF -: plugin - c:\program files\Mozilla Firefox\plugins\NPFluxBrowserHelper.dll
                      FF -: plugin - c:\program files\Mozilla Firefox\plugins\npmozax.dll
                      FF -: plugin - c:\program files\Mozilla Firefox\plugins\NPMPDRM.dll
                      FF -: plugin - c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
                      FF -: plugin - c:\program files\Virtools\3D Life Player\npvirtools.dll
                      .

                      **************************************************************************

                      catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                      Rootkit scan 2008-11-09 12:48:56
                      Windows 5.1.2600 Service Pack 3 NTFS

                      Recherche de processus cachés ...

                      Recherche d'éléments en démarrage automatique cachés ...

                      Recherche de fichiers cachés ...

                      c:\windows\svchost.exe 23552 bytes executable

                      Scan terminé avec succès
                      Fichiers cachés: 1

                      **************************************************************************

                      [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\MysqlInventime]
                      "ImagePath"="c:\mysql\bin\mysqld-nt MysqlInventime"
                      .
                      ------------------------ Autres processus actifs ------------------------
                      .
                      c:\windows\system32\ati2evxx.exe
                      c:\program files\Fichiers communs\Symantec Shared\ccSvcHst.exe
                      c:\windows\system32\ati2evxx.exe
                      c:\program files\Fichiers communs\Symantec Shared\AppCore\AppSvc32.exe
                      c:\progra~1\FICHIE~1\AOL\ACS\AOLacsd.exe
                      c:\program files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
                      c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe
                      c:\windows\system32\slserv.exe
                      c:\program files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
                      c:\windows\system32\fxssvc.exe
                      c:\windows\svchost.exe
                      c:\apps\ABOARD\AOSD.EXE
                      c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
                      c:\program files\e-Carte Bleue Banque Populaire\ecbl-nxbp.exe
                      c:\progra~1\FICHIE~1\INSTAL~1\UPDATE~1\agent.exe
                      c:\program files\MessengerDiscovery\MessengerDiscovery Live.exe
                      c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
                      .
                      **************************************************************************
                      .
                      Heure de fin: 2008-11-09 12:57:12 - La machine a redémarré [guillaume]
                      ComboFix-quarantined-files.txt 2008-11-09 11:57:05

                      Avant-CF: 113,237,475,328 octets libres
                      Après-CF: 113,554,079,744 octets libres

                      272 --- E O F --- 2008-10-30 09:01:29

                      Voilà ouf merci =D (svchost toujours présent dans windows)
                      0
                      1. Utilisateur anonyme
                        Ouvre le Bloc-Notes puis colle le texte copié.
                        (Démarrer\Tous les programmes\Accessoires\Bloc notes.)
                        Sauvegarde ce fichier sous le nom de CFScript.txt.

                        Copie le texte en gras : ci-dessous :

                        KillAl::

                        files::
                        c:\windows\svchost.exe
                        c:\documents and settings\Administrateur\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
                        c:\documents and settings\guillaume\Application Data\wklnhst.dat
                        c:\windows\system32\AB84F81FEE.sys

                        registry::
                        -HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
                        wowsystemcode


                        fait Glisser maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :

                        http://serveur1.archive-host.com/membres/up/1366464061/CFScript.gif

                        Cela va relancer Combofix,

                        Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

                        Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

                        Ne touche à rien tant que le scan n'est pas terminé.

                        Après redémarrage, poste le contenu du rapport Combofix.txt accompagné d'un rapport Hijackthis.

                        S'il n'y a pas de rédémarrage, poste quand même les rapports.
                        0
                        1. Haraknos Auteur
                          Voilà le new log :

                          ComboFix 08-11-07.01 - pierre 2008-11-09 13:41:50.3 - NTFSx86
                          Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.498 [GMT 1:00]
                          Lancé depuis: c:\documents and settings\pierre\Bureau\ComboFix.exe
                          Commutateurs utilisés :: c:\documents and settings\pierre\Bureau\CFScript.txt
                          * Un nouveau point de restauration a été créé
                          .

                          (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
                          .

                          c:\windows\svchost.exe

                          .
                          ((((((((((((((((((((((((((((( Fichiers créés du 2008-10-09 au 2008-11-09 ))))))))))))))))))))))))))))))))))))
                          .

                          2008-11-09 13:49 . 2008-11-09 13:49 23,552 --a------ c:\windows\svchost.exe
                          2008-11-09 11:13 . 2008-11-09 11:13 579,584 --a------ c:\windows\system32\dllcache\user32.dll
                          2008-11-09 11:08 . 2008-11-09 11:08 <REP> d-------- c:\windows\ERUNT
                          2008-11-08 11:34 . 2008-11-08 11:34 <REP> d-------- c:\documents and settings\Administrateur\Application Data\ESTsoft
                          2008-11-07 21:52 . 2008-11-07 21:57 139,264 --a------ c:\windows\War3Unin.exe
                          2008-11-07 21:52 . 2008-11-07 21:59 76,572 --a------ c:\windows\War3Unin.dat
                          2008-11-07 21:52 . 2008-11-07 21:57 2,829 --a------ c:\windows\War3Unin.pif
                          2008-11-07 21:50 . 2008-11-09 13:04 <REP> d-------- c:\program files\Warcraft III
                          2008-11-02 19:47 . 2008-11-09 10:42 0 --a------ c:\windows\1.ini
                          2008-11-02 16:50 . 2008-11-02 16:50 106,496 --a------ c:\windows\system32\wowformf828_733.dll
                          2008-11-02 16:50 . 2008-11-02 16:50 20 --a------ c:\windows\syscheck
                          2008-10-29 17:54 . 2008-10-29 17:54 <REP> d-------- c:\windows\system32\fr
                          2008-10-29 17:54 . 2008-10-29 17:54 <REP> d-------- c:\windows\system32\bits
                          2008-10-29 17:54 . 2008-10-29 17:54 <REP> d-------- c:\windows\l2schemas
                          2008-10-29 17:52 . 2008-10-29 17:55 <REP> d-------- c:\windows\ServicePackFiles
                          2008-10-29 17:47 . 2008-10-29 17:47 <REP> d-------- c:\windows\EHome
                          2008-10-28 10:10 . 2008-10-28 10:10 <REP> d-------- c:\documents and settings\Administrateur\Application Data\OpenOffice.org2
                          2008-10-27 14:10 . 2008-10-27 14:12 <REP> d-------- c:\windows\system32\Adobe
                          2008-10-26 12:31 . 2008-10-26 12:33 <REP> d-------- c:\program files\Travian
                          2008-10-25 21:36 . 2008-10-27 10:50 <REP> d-------- c:\documents and settings\pierre\dwhelper
                          2008-10-24 19:59 . 2008-10-15 17:35 337,408 --------- c:\windows\system32\dllcache\netapi32.dll
                          2008-10-19 20:44 . 2008-10-19 20:44 <REP> d-------- c:\documents and settings\All Users\Application Data\Downloaded Installations
                          2008-10-17 18:47 . 2008-10-17 18:47 <REP> d-------- c:\program files\OpenOffice.org 2.4
                          2008-10-17 11:33 . 2008-08-14 14:23 2,191,232 --------- c:\windows\system32\dllcache\ntoskrnl.exe
                          2008-10-17 11:33 . 2008-08-14 14:23 2,147,328 --------- c:\windows\system32\dllcache\ntkrnlmp.exe
                          2008-10-17 11:33 . 2008-08-14 14:23 2,068,096 --------- c:\windows\system32\dllcache\ntkrnlpa.exe
                          2008-10-17 11:33 . 2008-08-14 14:23 2,025,984 --------- c:\windows\system32\dllcache\ntkrpamp.exe
                          2008-10-17 11:32 . 2008-09-08 11:41 333,824 --------- c:\windows\system32\dllcache\srv.sys
                          2008-10-17 11:30 . 2008-09-15 16:26 1,846,528 --------- c:\windows\system32\dllcache\win32k.sys

                          .
                          (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                          .
                          2008-11-09 12:48 --------- d-----w c:\program files\Fichiers communs\Symantec Shared
                          2008-11-09 11:58 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec
                          2008-11-09 11:22 --------- d-----w c:\documents and settings\pierre\Application Data\Free Download Manager
                          2008-11-09 10:48 --------- d-----w c:\documents and settings\All Users\Application Data\TrackMania
                          2008-11-09 09:36 --------- d-----w c:\program files\Mozilla Thunderbird
                          2008-11-08 22:19 --------- d-----w c:\program files\Wanadoo
                          2008-11-08 19:55 4,224 ----a-w c:\windows\system32\drivers\beep.sys
                          2008-11-08 15:48 --------- d-----w c:\program files\GtkRadiant-1.4
                          2008-11-08 13:04 420 ----a-w c:\documents and settings\berny\Application Data\wklnhst.dat
                          2008-11-08 10:53 --------- d-----w c:\program files\The Cleaner
                          2008-10-31 16:24 716,272 ----a-w c:\windows\system32\drivers\sptd.sys
                          2008-10-29 05:09 --------- d-----w c:\program files\Google
                          2008-10-24 20:39 --------- d-----w c:\program files\Navilog1
                          2008-10-17 17:46 --------- d-----w c:\program files\OpenOffice.org 2.3
                          2008-10-17 17:43 --------- d-----w c:\program files\Java
                          2008-10-05 14:51 --------- d-----w c:\program files\MessengerDiscovery
                          2008-10-05 13:24 --------- d-----w c:\program files\Thomson
                          2008-10-05 13:14 40,320 ----a-w c:\windows\system32\drivers\steth.sys
                          2008-10-05 13:14 30,464 ----a-w c:\windows\system32\drivers\st330.sys
                          2008-10-05 13:14 16,128 ----a-w c:\windows\system32\drivers\lpwdm.sys
                          2008-10-05 13:14 12,672 ----a-w c:\windows\system32\drivers\stbus.sys
                          2008-10-05 13:03 --------- d-----w c:\program files\ma-config.com
                          2008-10-05 13:03 --------- d-----w c:\documents and settings\All Users\Application Data\ma-config.com
                          2008-10-04 15:32 --------- d-----w c:\program files\Virtools
                          2008-09-30 14:46 --------- d-----w c:\program files\Norton Internet Security
                          2008-09-28 14:18 805 ----a-w c:\windows\system32\drivers\SYMEVENT.INF
                          2008-09-28 14:18 123,952 ----a-w c:\windows\system32\drivers\SYMEVENT.SYS
                          2008-09-28 14:18 10,671 ----a-w c:\windows\system32\drivers\SYMEVENT.CAT
                          2008-09-28 14:18 --------- d-----w c:\program files\Symantec
                          2008-09-26 17:36 --------- d-----w c:\program files\Messenger Plus! Live
                          2007-11-17 09:25 63,552 ----a-w c:\documents and settings\guillaume\Application Data\GDIPFONTCACHEV1.DAT
                          2007-06-23 11:41 378 ----a-w c:\documents and settings\guillaume\Application Data\wklnhst.dat
                          2007-02-06 17:18 63,552 ----a-w c:\documents and settings\marine\Application Data\GDIPFONTCACHEV1.DAT
                          2006-12-17 16:11 56 --sh--r c:\windows\system32\AB84F81FEE.sys
                          2006-05-03 09:06 163,328 --sh--r c:\windows\system32\flvDX.dll
                          2007-02-24 09:10 848 --sha-w c:\windows\system32\KGyGaAvL.sys
                          2007-02-21 10:47 31,232 --sh--r c:\windows\system32\msfDX.dll
                          2008-03-16 12:30 216,064 --sh--r c:\windows\system32\nbDX.dll
                          .

                          ((((((((((((((((((((((((((((( snapshot@2008-11-09_12.56.35,57 )))))))))))))))))))))))))))))))))))))))))
                          .
                          - 2008-11-09 11:52:57 64,200 ----a-w c:\windows\system32\perfc009.dat
                          + 2008-11-09 12:52:47 64,084 ----a-w c:\windows\system32\perfc009.dat
                          - 2008-11-09 11:52:58 77,908 ----a-w c:\windows\system32\perfc00C.dat
                          + 2008-11-09 12:52:47 77,760 ----a-w c:\windows\system32\perfc00C.dat
                          - 2008-11-09 11:52:57 407,670 ----a-w c:\windows\system32\perfh009.dat
                          + 2008-11-09 12:52:47 407,362 ----a-w c:\windows\system32\perfh009.dat
                          - 2008-11-09 11:52:58 475,866 ----a-w c:\windows\system32\perfh00C.dat
                          + 2008-11-09 12:52:47 475,488 ----a-w c:\windows\system32\perfh00C.dat
                          .
                          ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
                          .
                          .
                          *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
                          REGEDIT4

                          [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                          "H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\WCESCOMM.EXE" [2005-01-19 405583]
                          "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
                          "Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" [2008-02-20 360448]
                          "AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 52\axcmd.exe" [2008-03-20 216520]

                          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                          "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-05 208952]
                          "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168]
                          "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168]
                          "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784]
                          "PCMService"="c:\apps\Powercinema\PCMService.exe" [2004-09-15 81920]
                          "ACTIVBOARD"="c:\apps\ABoard\ABoard.exe" [2003-05-02 24576]
                          "SpeedTouch USB Diagnostics"="c:\program files\Thomson\SpeedTouch USB\Dragdiag.exe" [2003-09-05 878080]
                          "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2004-02-12 49152]
                          "HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 241664]
                          "ccApp"="c:\program files\Fichiers communs\Symantec Shared\ccApp.exe" [2007-01-09 115816]
                          "osCheck"="c:\program files\Norton Internet Security\osCheck.exe" [2006-09-05 26248]
                          "BigDog303"="c:\windows\VM303_STI.EXE" [2006-02-27 61440]
                          "WOOWATCH"="c:\progra~1\Wanadoo\Watch.exe" [2003-10-16 20480]
                          "snpstd"="c:\windows\vsnpstd.exe" [2004-06-10 286720]
                          "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
                          "ISUSPM Startup"="c:\program files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" [2005-08-11 249856]
                          "ISUSScheduler"="c:\program files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2005-08-11 81920]
                          "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-10-19 286720]
                          "Symantec PIF AlertEng"="c:\program files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 583048]
                          "Raccourci vers la page des propriétés de High Definition Audio"="HDAudPropShortcut.exe" [2004-03-17 c:\windows\system32\Hdaudpropshortcut.exe]
                          "ATIPTA"="atiptaxx.exe" [2006-02-22 c:\windows\system32\atiptaxx.exe]
                          "High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 c:\windows\system32\HdAShCut.exe]
                          "RTHDCPL"="RTHDCPL.EXE" [2006-03-14 c:\windows\RTHDCPL.exe]

                          [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                          "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

                          c:\documents and settings\Administrateur\Menu D‚marrer\Programmes\D‚marrage\
                          OpenOffice.org 2.4.lnk - c:\program files\OpenOffice.org 2.4\program\quickstart.exe [2008-01-21 393216]

                          c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
                          Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 29696]
                          e-Carte Bleue Banque Populaire.lnk - c:\program files\e-Carte Bleue Banque Populaire\ecbl-nxbp.exe [2008-07-05 278528]

                          [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
                          "VIDC.I420"= i420vfw.dll
                          "VIDC.X264"= x264vfw.dll
                          "VIDC.HFYU"= huffyuv.dll
                          "vidc.iv41"= ir41_32.dll
                          "vidc.i263"= i263_32.drv
                          "msacm.l3fhg"= mp3fhg.acm
                          "msacm.divxa32"= divxa32.acm
                          "msacm.imc"= imc32.acm
                          "MSACM.CEGSM"= mobilev.acm

                          [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^e-Carte Bleue Banque Populaire.lnk]
                          path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\e-Carte Bleue Banque Populaire.lnk
                          backup=c:\windows\pss\e-Carte Bleue Banque Populaire.lnkCommon Startup

                          [HKLM\~\startupfolder\C:^Documents and Settings^pierre^Menu Démarrer^Programmes^Démarrage^Anti-Pub.lnk]
                          path=c:\documents and settings\pierre\Menu Démarrer\Programmes\Démarrage\Anti-Pub.lnk
                          backup=c:\windows\pss\Anti-Pub.lnkStartup

                          [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MessagerStarter Wanadoo]
                          --a------ 2003-04-11 16:06 32768 c:\progra~1\MESSAG~1\StartMessager.exe

                          [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
                          --a------ 2008-04-14 03:34 1695232 c:\program files\Messenger\msmsgs.exe

                          [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WooCnxMon]
                          --a------ 2003-10-16 17:07 24576 c:\progra~1\Wanadoo\CnxMon.exe

                          [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOWATCH]
                          --------- 2003-10-16 17:07 20480 c:\progra~1\Wanadoo\Watch.exe

                          [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
                          "DisableMonitoring"=dword:00000001

                          [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
                          "DisableMonitoring"=dword:00000001

                          [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
                          "DisableMonitoring"=dword:00000001

                          [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
                          "EnableFirewall"= 0 (0x0)

                          [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                          "%ProgramFiles%\\AOL 9.0\\aol.exe"=
                          "%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe"=
                          "%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe"=
                          "%windir%\\system32\\sessmgr.exe"=
                          "c:\\APPS\\Inventime\\my.exe"=
                          "c:\\Program Files\\LucasArts\\Star Wars JK II Jedi Outcast\\GameData\\jk2mp.exe"=
                          "c:\\Program Files\\Microsoft ActiveSync\\WCESCOMM.EXE"=
                          "c:\\Program Files\\Microsoft ActiveSync\\WCESMGR.EXE"=
                          "c:\\Program Files\\Lecteur CANALPLAY\\CanalPlayer.exe"=
                          "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
                          "c:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
                          "c:\\Program Files\\Messenger\\msmsgs.exe"=
                          "c:\\Program Files\\Sony Ericsson\\Sony Ericsson Media Manager 1.0\\MediaManager.exe"=
                          "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
                          "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

                          [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
                          "10155:TCP"= 10155:TCP:BitComet 10155 TCP
                          "10155:UDP"= 10155:UDP:BitComet 10155 UDP

                          R0 ViBus;ViBus;c:\windows\system32\DRIVERS\ViBus.sys [2007-12-07 16896]
                          R0 videX32;videX32;c:\windows\system32\DRIVERS\videX32.sys [2007-09-21 9216]
                          R0 ViPrt;VIA SATA IDE Device Driver;c:\windows\system32\DRIVERS\ViPrt.sys [2007-12-07 52736]
                          R2 SBKUPNT;SBKUPNT;c:\windows\system32\Drivers\SBKUPNT.SYS [2001-07-13 14976]
                          R2 wowsystemcode;Remote TCP/IP;c:\windows\System32\svchost.exe [2008-04-14 14336]
                          S2 RPCH;Remote Procedure Call (HPM);c:\program files\NetMeeting\nmwb.exe [2008-11-02 363008]
                          S2 RPCHE;Remote Procedure Call (RPCE);c:\program files\NetMeeting\Winlog.exe [2008-11-02 456192]
                          S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [2008-09-02 191656]
                          S3 s916bus;Sony Ericsson Device 916 driver (WDM);c:\windows\system32\DRIVERS\s916bus.sys [2007-11-02 83496]
                          S3 s916mdfl;Sony Ericsson Device 916 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s916mdfl.sys [2007-11-02 15016]
                          S3 s916mdm;Sony Ericsson Device 916 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s916mdm.sys [2007-11-02 109992]
                          S3 s916mgmt;Sony Ericsson Device 916 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s916mgmt.sys [2007-11-02 103976]
                          S3 s916obex;Sony Ericsson Device 916 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s916obex.sys [2007-11-02 100008]
                          S3 Service CANALPLAY;Service CANALPLAY;c:\program files\Lecteur CANALPLAY\CanalPlayService.exe [2008-06-20 436096]
                          S3 ST330;ST330;c:\windows\system32\drivers\st330.sys [2008-10-05 30464]
                          S3 STBUS;STBUS;c:\windows\system32\drivers\stbus.sys [2008-10-05 12672]
                          S3 STETH;SpeedTouch Ethernet Adapter NT Driver;c:\windows\system32\DRIVERS\steth.sys [2008-10-05 40320]
                          S3 usbscan;Pilote de scanneur USB;c:\windows\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
                          S3 USBSTOR;Pilote de stockage de masse USB;c:\windows\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]

                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
                          wowsystemcode

                          *Newly Created Service* - COMHOST
                          .
                          Contenu du dossier 'Tâches planifiées'

                          2008-07-25 c:\windows\Tasks\AppleSoftwareUpdate.job
                          - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:57]

                          2008-11-01 c:\windows\Tasks\Norton Internet Security - Analyse système complète - berny.job
                          - c:\progra~1\NORTON~1\NORTON~1\Navw32.exe [2006-09-06 22:38]

                          2007-11-01 c:\windows\Tasks\Norton Internet Security - Analyse système complète - laurence.job
                          - c:\progra~1\NORTON~1\NORTON~1\Navw32.exe [2006-09-06 22:38]

                          2006-07-23 c:\windows\Tasks\Rappel d'enregistrement 3.job
                          - c:\windows\system32\OOBE\oobebaln.exe [2008-04-14 03:34]

                          2008-11-08 c:\windows\Tasks\WebReg 20081031155349.job
                          - c:\program files\HP\Digital Imaging\bin\hpqwrg.exe [2004-05-28 21:47]
                          .

                          **************************************************************************

                          catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                          Rootkit scan 2008-11-09 13:48:49
                          Windows 5.1.2600 Service Pack 3 NTFS

                          Recherche de processus cachés ...

                          Recherche d'éléments en démarrage automatique cachés ...

                          Recherche de fichiers cachés ...

                          c:\windows\svchost.exe 23552 bytes executable

                          Scan terminé avec succès
                          Fichiers cachés: 1

                          **************************************************************************

                          [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\MysqlInventime]
                          "ImagePath"="c:\mysql\bin\mysqld-nt MysqlInventime"
                          .
                          ------------------------ Autres processus actifs ------------------------
                          .
                          c:\windows\system32\ati2evxx.exe
                          c:\program files\Fichiers communs\Symantec Shared\ccSvcHst.exe
                          c:\windows\system32\ati2evxx.exe
                          c:\program files\Fichiers communs\Symantec Shared\AppCore\AppSvc32.exe
                          c:\progra~1\FICHIE~1\AOL\ACS\AOLacsd.exe
                          c:\program files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
                          c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe
                          c:\program files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
                          c:\windows\system32\fxssvc.exe
                          c:\windows\svchost.exe
                          c:\apps\ABOARD\AOSD.EXE
                          c:\windows\system32\rasautou.exe
                          .
                          **************************************************************************
                          .
                          Heure de fin: 2008-11-09 13:58:26 - La machine a redémarré [pierre]
                          ComboFix-quarantined-files.txt 2008-11-09 12:58:20
                          ComboFix2.txt 2008-11-09 11:57:13

                          Avant-CF: 113,580,703,744 octets libres
                          Après-CF: 113,558,798,336 octets libres

                          257 --- E O F --- 2008-10-30 09:01:29

                          SVCHost est toujours dans windows =x
                          0
                          1. Haraknos Auteur
                            Et voilà le log de HiJackThis :

                            Logfile of Trend Micro HijackThis v2.0.2
                            Scan saved at 14:02:00, on 09/11/2008
                            Platform: Windows XP SP3 (WinNT 5.01.2600)
                            MSIE: Internet Explorer v7.00 (7.00.6000.16735)
                            Boot mode: Normal

                            Running processes:
                            C:\WINDOWS\System32\smss.exe
                            C:\WINDOWS\system32\winlogon.exe
                            C:\WINDOWS\system32\services.exe
                            C:\WINDOWS\system32\lsass.exe
                            C:\WINDOWS\system32\Ati2evxx.exe
                            C:\WINDOWS\system32\svchost.exe
                            C:\WINDOWS\System32\svchost.exe
                            C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
                            C:\WINDOWS\system32\Ati2evxx.exe
                            C:\Program Files\Fichiers communs\Symantec Shared\AppCore\AppSvc32.exe
                            C:\WINDOWS\system32\spoolsv.exe
                            C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
                            C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
                            C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
                            C:\WINDOWS\system32\svchost.exe
                            C:\WINDOWS\system32\svchost.exe
                            C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
                            C:\WINDOWS\system32\svchost.exe
                            C:\WINDOWS\system32\fxssvc.exe
                            C:\WINDOWS\System32\svchost.exe
                            C:\WINDOWS\svchost.exe
                            C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
                            C:\Apps\Powercinema\PCMService.exe
                            C:\apps\ABoard\ABoard.exe
                            C:\apps\ABoard\AOSD.exe
                            C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
                            C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
                            C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
                            C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
                            C:\WINDOWS\VM303_STI.EXE
                            C:\WINDOWS\vsnpstd.exe
                            C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
                            C:\WINDOWS\RTHDCPL.EXE
                            C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
                            C:\Program Files\Messenger\msmsgs.exe
                            C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe
                            C:\Program Files\e-Carte Bleue Banque Populaire\ecbl-nxbp.exe
                            C:\WINDOWS\explorer.exe
                            C:\Program Files\internet explorer\iexplore.exe
                            C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
                            C:\Downloads\Software\HiJackThis.exe

                            R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
                            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                            R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                            R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                            R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
                            O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)
                            O2 - BHO: Download Manager Browser Helper Object - {19C8E43B-07B3-49CB-BFFC-6777B593E6F8} - C:\PROGRA~1\FICHIE~1\fluxDVD\DOWNLO~1\XEBDLH~1.DLL
                            O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Fichiers communs\Symantec Shared\coShared\Browser\1.0\NppBho.dll
                            O2 - BHO: e-Carte Bleue Browser Helper Object - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} - C:\WINDOWS\system32\BhoECart.dll
                            O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
                            O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                            O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                            O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                            O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Documents and Settings\pierre\Mes documents\pierre.verdy\Free Download Manager\iefdm2.dll
                            O3 - Toolbar: Afficher Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Fichiers communs\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
                            O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
                            O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
                            O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
                            O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAudPropShortcut.exe
                            O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
                            O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
                            O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
                            O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
                            O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
                            O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
                            O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
                            O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
                            O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
                            O4 - HKLM\..\Run: [BigDog303] C:\WINDOWS\VM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH)
                            O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
                            O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
                            O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
                            O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" -startup
                            O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
                            O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
                            O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
                            O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                            O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
                            O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
                            O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
                            O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon
                            O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 52\axcmd.exe" /automount
                            O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
                            O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
                            O4 - HKUS\S-1-5-21-3987325350-3101553100-1454181443-1011\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE" (User '?')
                            O4 - HKUS\S-1-5-21-3987325350-3101553100-1454181443-1011\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 52\axcmd.exe" /automount (User '?')
                            O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
                            O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                            O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                            O4 - Global Startup: e-Carte Bleue Banque Populaire.lnk = C:\Program Files\e-Carte Bleue Banque Populaire\ecbl-nxbp.exe
                            O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
                            O8 - Extra context menu item: Tout télécharger avec Free Download Manager - file://C:\Documents and Settings\pierre\Mes documents\pierre.verdy\Free Download Manager\dlall.htm
                            O8 - Extra context menu item: Translate with &Babylon - res://C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
                            O8 - Extra context menu item: Télécharger avec Free Download Manager - file://C:\Documents and Settings\pierre\Mes documents\pierre.verdy\Free Download Manager\dllink.htm
                            O8 - Extra context menu item: Télécharger la sélection avec Free Download Manager - file://C:\Documents and Settings\pierre\Mes documents\pierre.verdy\Free Download Manager\dlselected.htm
                            O8 - Extra context menu item: Télécharger la vidéo avec Free Download Manager - file://C:\Documents and Settings\pierre\Mes documents\pierre.verdy\Free Download Manager\dlfvideo.htm
                            O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                            O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                            O9 - Extra button: Créer un Favori de l'appareil mobile - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
                            O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
                            O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
                            O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
                            O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\pierre\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk
                            O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
                            O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
                            O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                            O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                            O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
                            O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
                            O15 - Trusted Zone: *.canalplay.com (HKLM)
                            O15 - Trusted Zone: *.canalplusactive.com (HKLM)
                            O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
                            O16 - DPF: {051D0E35-F4E3-4C8D-B411-AB0875F4C683} (Anark Client 4.0 ActiveX Control) - http://install.anark.com/client/version4/windows-ie/en/AMClient.cab
                            O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
                            O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
                            O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
                            O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
                            O16 - DPF: {4A85DBE0-BFB2-4119-8401-186A7C6EB653} - http://messenger.zone.msn.com/binary/MJSS.cab69309.cab
                            O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
                            O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v4.cab
                            O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
                            O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
                            O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
                            O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game13.zylom.com/activex/zylomgamesplayer.cab
                            O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
                            O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab
                            O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
                            O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://3dlifeplayer.dl.3dvia.com/player/install/installer.exe
                            O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
                            O16 - DPF: {EDFCB7CB-942C-4822-AF14-F0B687409848} (Image Uploader Control) - http://photoservice.photos.orange.fr/telechargement/ImageUploader4.cab
                            O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
                            O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
                            O17 - HKLM\System\CCS\Services\Tcpip\..\{F15220B3-4AAE-4279-AB8B-9C11835EA883}: NameServer = 81.253.149.9 80.10.246.132
                            O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
                            O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
                            O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
                            O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
                            O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
                            O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
                            O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\VAScanner\comHost.exe
                            O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
                            O23 - Service: Validation de mot de passe Symantec IS (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
                            O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
                            O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
                            O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
                            O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
                            O23 - Service: MysqlInventime - Unknown owner - c:\mysql\bin\mysqld-nt.exe
                            O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
                            O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
                            O23 - Service: Service CANALPLAY - Canal+ Distribution - C:\Program Files\Lecteur CANALPLAY\CanalPlayService.exe
                            O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
                            O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
                            O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
                            O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\AppCore\AppSvc32.exe
                            0
                            1. Utilisateur anonyme
                              okay , il est collant le morpion !! lol bon je vais avoir besoin de deux rapport

                              Télécharge Toolbar-S&D (Team IDN) sur ton Bureau.
                              https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2

                              * Lance l'installation du programme en exécutant le fichier téléchargé.
                              * Double-clique maintenant sur le raccourci de Toolbar-S&D.
                              * Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.
                              * Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche.
                              * Poste le rapport généré. (C:\TB.txt)

                              ensuite deuxieme rapport

                              Télécharge ici :

                              http://images.malwareremoval.com/random/RSIT.exe

                              random's system information tool (RSIT) par andom/random et sauvegarde-le sur le Bureau.

                              Double-clique sur RSIT.exe afin de lancer RSIT.

                              Lis le contenu de l'écran Disclaimer puis clique sur Continue (si tu acceptes les conditions).

                              Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.

                              Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront.

                              Poste le contenu de log.txt
                              0
                              1. Haraknos Auteur
                                Jvais prendre mon train pour aller bosser cette semaine, je pourrai pas faire la manip avant samedi prochain >_< Encore merci pour l'aide, je ferai tout ça le week prochain !! Merci beaucoup ! Et bonne semaine =D
                                0
                                1. Utilisateur anonyme
                                  okay bon courage pour ta semaine , a samedi .
                                  0
                                  1. Haraknos
                                    Me revoilà donc, avec un virus qui met HS toujours plus de programmes...

                                    Voici le premier rapport :

                                    -----------\\ ToolBar S&D 1.2.4 XP/Vista

                                    Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
                                    X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) 4 CPU 3.00GHz )
                                    BIOS : Default System BIOS
                                    USER : pierre ( Administrator )
                                    BOOT : Normal boot
                                    A:\ (USB)
                                    C:\ (Local Disk) - NTFS - Total:149 Go (Free:105 Go)
                                    D:\ (CD or DVD)
                                    E:\ (Local Disk) - NTFS - Total:186 Go (Free:159 Go)
                                    F:\ (CD or DVD)

                                    "C:\ToolBar SD" ( MAJ : 27-10-2008|09:25 )
                                    Option : [1] ( 14/11/2008|16:04 )

                                    -----------\\ Recherche de Fichiers / Dossiers ...

                                    C:\WINDOWS\svchost.exe
                                    0
                                    1. Haraknos
                                      Et voilà maintenant le deuxième rapport :

                                      Logfile of random's system information tool 1.04 (written by random/random)
                                      Run by pierre at 2008-11-14 16:05:15
                                      Microsoft Windows XP Édition familiale Service Pack 3
                                      System drive C: has 108 GB (71%) free of 153 GB
                                      Total RAM: 1023 MB (48% free)

                                      Logfile of Trend Micro HijackThis v2.0.2
                                      Scan saved at 16:07:40, on 14/11/2008
                                      Platform: Windows XP SP3 (WinNT 5.01.2600)
                                      MSIE: Internet Explorer v7.00 (7.00.6000.16735)
                                      Boot mode: Normal

                                      Running processes:
                                      C:\WINDOWS\System32\smss.exe
                                      C:\WINDOWS\system32\winlogon.exe
                                      C:\WINDOWS\system32\services.exe
                                      C:\WINDOWS\system32\lsass.exe
                                      C:\WINDOWS\system32\Ati2evxx.exe
                                      C:\WINDOWS\system32\svchost.exe
                                      C:\WINDOWS\System32\svchost.exe
                                      C:\WINDOWS\system32\Ati2evxx.exe
                                      C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
                                      C:\Program Files\Fichiers communs\Symantec Shared\AppCore\AppSvc32.exe
                                      C:\WINDOWS\system32\spoolsv.exe
                                      C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
                                      C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
                                      C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
                                      C:\WINDOWS\system32\svchost.exe
                                      C:\WINDOWS\system32\slserv.exe
                                      C:\WINDOWS\system32\svchost.exe
                                      C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
                                      C:\WINDOWS\system32\svchost.exe
                                      C:\WINDOWS\system32\fxssvc.exe
                                      C:\WINDOWS\System32\svchost.exe
                                      C:\WINDOWS\Explorer.EXE
                                      C:\WINDOWS\svchost.exe
                                      C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
                                      C:\Apps\Powercinema\PCMService.exe
                                      C:\apps\ABoard\ABoard.exe
                                      C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
                                      C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
                                      C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
                                      C:\apps\ABoard\AOSD.exe
                                      C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
                                      C:\WINDOWS\VM303_STI.EXE
                                      C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
                                      C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
                                      C:\WINDOWS\RTHDCPL.EXE
                                      C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
                                      C:\Program Files\Messenger\msmsgs.exe
                                      C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe
                                      C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
                                      C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
                                      C:\Program Files\internet explorer\iexplore.exe
                                      C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
                                      C:\WINDOWS\system32\cmd.exe
                                      C:\Documents and Settings\pierre\Local Settings\Temporary Internet Files\Content.IE5\C2TJW4GI\RSIT[1].exe
                                      C:\Downloads\Software\pierre.exe
                                      C:\WINDOWS\system32\cmd.exe
                                      C:\WINDOWS\system32\cmd.exe
                                      C:\WINDOWS\system32\findstr.exe
                                      C:\WINDOWS\system32\find.exe
                                      C:\WINDOWS\system32\find.exe

                                      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
                                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                                      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                                      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                                      R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
                                      O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)
                                      O2 - BHO: Download Manager Browser Helper Object - {19C8E43B-07B3-49CB-BFFC-6777B593E6F8} - C:\PROGRA~1\FICHIE~1\fluxDVD\DOWNLO~1\XEBDLH~1.DLL
                                      O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Fichiers communs\Symantec Shared\coShared\Browser\1.0\NppBho.dll
                                      O2 - BHO: e-Carte Bleue Browser Helper Object - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} - C:\WINDOWS\system32\BhoECart.dll
                                      O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
                                      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                                      O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                                      O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                                      O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Documents and Settings\pierre\Mes documents\pierre.verdy\Free Download Manager\iefdm2.dll
                                      O3 - Toolbar: Afficher Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Fichiers communs\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
                                      O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
                                      O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
                                      O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
                                      O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAudPropShortcut.exe
                                      O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
                                      O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
                                      O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
                                      O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
                                      O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
                                      O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
                                      O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
                                      O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
                                      O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
                                      O4 - HKLM\..\Run: [BigDog303] C:\WINDOWS\VM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH)
                                      O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
                                      O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
                                      O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" -startup
                                      O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
                                      O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
                                      O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
                                      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                                      O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
                                      O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
                                      O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
                                      O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon
                                      O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 52\axcmd.exe" /automount
                                      O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
                                      O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
                                      O4 - HKUS\S-1-5-21-3987325350-3101553100-1454181443-1011\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE" (User '?')
                                      O4 - HKUS\S-1-5-21-3987325350-3101553100-1454181443-1011\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 52\axcmd.exe" /automount (User '?')
                                      O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
                                      O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                                      O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                                      O4 - Global Startup: e-Carte Bleue Banque Populaire.lnk = E:\e-Carte Bleue Banque Populaire\ecbl-nxbp.exe
                                      O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
                                      O8 - Extra context menu item: Tout télécharger avec Free Download Manager - file://C:\Documents and Settings\pierre\Mes documents\pierre.verdy\Free Download Manager\dlall.htm
                                      O8 - Extra context menu item: Translate with &Babylon - res://C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
                                      O8 - Extra context menu item: Télécharger avec Free Download Manager - file://C:\Documents and Settings\pierre\Mes documents\pierre.verdy\Free Download Manager\dllink.htm
                                      O8 - Extra context menu item: Télécharger la sélection avec Free Download Manager - file://C:\Documents and Settings\pierre\Mes documents\pierre.verdy\Free Download Manager\dlselected.htm
                                      O8 - Extra context menu item: Télécharger la vidéo avec Free Download Manager - file://C:\Documents and Settings\pierre\Mes documents\pierre.verdy\Free Download Manager\dlfvideo.htm
                                      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                                      O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                                      O9 - Extra button: Créer un Favori de l'appareil mobile - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
                                      O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
                                      O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
                                      O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
                                      O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\pierre\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk
                                      O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
                                      O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
                                      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                                      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                                      O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
                                      O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
                                      O15 - Trusted Zone: *.canalplay.com (HKLM)
                                      O15 - Trusted Zone: *.canalplusactive.com (HKLM)
                                      O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
                                      O16 - DPF: {051D0E35-F4E3-4C8D-B411-AB0875F4C683} (Anark Client 4.0 ActiveX Control) - http://install.anark.com/client/version4/windows-ie/en/AMClient.cab
                                      O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
                                      O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
                                      O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
                                      O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
                                      O16 - DPF: {4A85DBE0-BFB2-4119-8401-186A7C6EB653} - http://messenger.zone.msn.com/binary/MJSS.cab69309.cab
                                      O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
                                      O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v4.cab
                                      O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
                                      O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
                                      O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
                                      O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game13.zylom.com/activex/zylomgamesplayer.cab
                                      O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
                                      O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab
                                      O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
                                      O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://3dlifeplayer.dl.3dvia.com/player/install/installer.exe
                                      O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
                                      O16 - DPF: {EDFCB7CB-942C-4822-AF14-F0B687409848} (Image Uploader Control) - http://photoservice.photos.orange.fr/telechargement/ImageUploader4.cab
                                      O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
                                      O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
                                      O17 - HKLM\System\CCS\Services\Tcpip\..\{F15220B3-4AAE-4279-AB8B-9C11835EA883}: NameServer = 81.253.149.9 80.10.246.132
                                      O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
                                      O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
                                      O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
                                      O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
                                      O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
                                      O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
                                      O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\VAScanner\comHost.exe
                                      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
                                      O23 - Service: Validation de mot de passe Symantec IS (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
                                      O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
                                      O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
                                      O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
                                      O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
                                      O23 - Service: MysqlInventime - Unknown owner - c:\mysql\bin\mysqld-nt.exe
                                      O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
                                      O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
                                      O23 - Service: Service CANALPLAY - Canal+ Distribution - C:\Program Files\Lecteur CANALPLAY\CanalPlayService.exe
                                      O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
                                      O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
                                      O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
                                      O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\AppCore\AppSvc32.exe
                                      0
                                      1. Utilisateur anonyme
                                        bonjour , supprime ta version de sdfix puis telecharge celle ci et recommence stp

                                        Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau.
                                        http://downloads.andymanchesta.com/RemovalTools/SDFix.exe
                                        Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici :
                                        • Redémarre ton ordinateur
                                        • Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde).
                                        • A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.
                                        • Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".
                                        • Choisis ton compte.
                                        Déroule la liste des instructions ci-dessous :
                                        • Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script.
                                        • Appuie sur Y pour commencer le processus de nettoyage.
                                        • Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
                                        • Appuie sur une touche pour redémarrer le PC.
                                        • Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
                                        • Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
                                        • Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
                                        • Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
                                        • Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum
                                        0
                                        1. Haraknos
                                          Voilà enfin le scan ^^

                                          [b]SDFix: Version 1.240 [/b]
                                          Run by pierre on 14/11/2008 at 18:45

                                          Microsoft Windows XP [version 5.1.2600]
                                          Running From: C:\Documents and Settings\pierre\Bureau\SDFix

                                          [b]Checking Services [/b]:

                                          Restoring Default Security Values
                                          Restoring Default Hosts File

                                          Rebooting

                                          [b]Checking Files [/b]:

                                          Trojan Files Found:

                                          Could Not Remove C:\WINDOWS\svchost.exe

                                          Removing Temp Files

                                          [b]ADS Check [/b]:

                                          [b]Final Check [/b]:

                                          catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                                          Rootkit scan 2008-11-14 19:03:34
                                          Windows 5.1.2600 Service Pack 3 NTFS

                                          scanning hidden processes ...

                                          scanning hidden services & system hive ...

                                          [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
                                          "p0"="C:\Program Files\Alcohol Soft\Alcohol 52\"
                                          "h0"=dword:00000000
                                          "ujdew"=hex:65,00,48,ff,b5,3b,66,cd,da,87,1b,bb,69,33,03,2d,a2,f5,5f,bc,9b,..
                                          [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
                                          "h0"=dword:00000000
                                          "ujdew"=hex:e9,a0,05,0b,fd,33,bf,b5,5c,0a,04,69,e3,c3,b2,80,4c,08,7a,95,90,..
                                          [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
                                          "s1"=dword:4a925792
                                          "s2"=dword:45ff8aaf
                                          "h0"=dword:00000001

                                          [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
                                          "h0"=dword:00000000
                                          "ujdew"=hex:8a,9a,09,1b,05,76,cb,08,34,78,65,91,3e,5a,df,cd,62,4a,31,6a,af,..
                                          "p0"="C:\Program Files\Alcohol Soft\Alcohol 52\"
                                          [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
                                          "h0"=dword:00000000
                                          "ujdew"=hex:8a,9a,09,1b,05,76,cb,08,34,78,65,91,3e,5a,df,cd,62,4a,31,6a,af,..
                                          "p0"="C:\Program Files\Alcohol Soft\Alcohol 52\"

                                          scanning hidden registry entries ...

                                          scanning hidden files ...

                                          scan completed successfully
                                          hidden processes: 0
                                          hidden services: 0
                                          hidden files: 0

                                          [b]Remaining Services [/b]:

                                          Authorized Application Key Export:

                                          [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
                                          "%ProgramFiles%\\AOL 9.0\\aol.exe"="%ProgramFiles%\\AOL 9.0\\aol.exe:*:Enabled:AOL"
                                          "%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe"="%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe:*:Enabled:SPLINTER CELL PANDORA"
                                          "%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe"="%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe:*:Enabled:PANDORA"
                                          "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
                                          "C:\\APPS\\Inventime\\my.exe"="C:\\APPS\\Inventime\\my.exe:*:Enabled:INVENTIME"
                                          "C:\\Program Files\\LucasArts\\Star Wars JK II Jedi Outcast\\GameData\\jk2mp.exe"="C:\\Program Files\\LucasArts\\Star Wars JK II Jedi Outcast\\GameData\\jk2mp.exe:*:Enabled:jk2mp"
                                          "C:\\Program Files\\Microsoft ActiveSync\\WCESCOMM.EXE"="C:\\Program Files\\Microsoft ActiveSync\\WCESCOMM.EXE:*:Enabled:Connection Manager"
                                          "C:\\Program Files\\Microsoft ActiveSync\\WCESMGR.EXE"="C:\\Program Files\\Microsoft ActiveSync\\WCESMGR.EXE:*:Enabled:ActiveSync Application"
                                          "C:\\Program Files\\Lecteur CANALPLAY\\CanalPlayer.exe"="C:\\Program Files\\Lecteur CANALPLAY\\CanalPlayer.exe:*:Enabled:Lecteur CANALPLAY"
                                          "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
                                          "C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"="C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe:*:Enabled:Assistance … distance - Windows Messenger et voix"
                                          "C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
                                          "C:\\Program Files\\Sony Ericsson\\Sony Ericsson Media Manager 1.0\\MediaManager.exe"="C:\\Program Files\\Sony Ericsson\\Sony Ericsson Media Manager 1.0\\MediaManager.exe:*:Enabled:Sony Ericsson Media Manager 1.0"
                                          "C:\\Program Files\\ma-config.com\\maconfservice.exe"="C:\\Program Files\\ma-config.com\\maconfservice.exe:LocalSubNet:Enabled:maconfservice"
                                          "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
                                          "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

                                          [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
                                          "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
                                          "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
                                          "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
                                          "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

                                          [b]Remaining Files [/b]:

                                          C:\WINDOWS\svchost.exe Found

                                          File Backups: - C:\DOCUME~1\pierre\Bureau\SDFix\backups\backups.zip

                                          [b]Files with Hidden Attributes [/b]:

                                          Sun 23 Jul 2006 215 A.SHR --- "C:\BOOT.BAK"
                                          Tue 17 Jun 2008 65,536 A.SH. --- "C:\Program Files\MessengerDiscovery\AlertSkinInstaller.exe"
                                          Sun 22 Jun 2008 40,960 A.SH. --- "C:\Program Files\MessengerDiscovery\SpellCHK.exe"
                                          Wed 2 Dec 1998 143,360 A.SH. --- "C:\Program Files\MessengerDiscovery\unzip.dll"
                                          Mon 3 Mar 2008 61,440 A..H. --- "C:\Program Files\MSN Messenger\winmm.dll"
                                          Sun 2 Nov 2008 363,008 ..SHR --- "C:\Program Files\NetMeeting\nmwb.exe"
                                          Sun 2 Nov 2008 456,192 ..SHR --- "C:\Program Files\NetMeeting\Winlog.exe"
                                          Sun 17 Dec 2006 56 ..SHR --- "C:\WINDOWS\system32\AB84F81FEE.sys"
                                          Wed 3 May 2006 163,328 ..SHR --- "C:\WINDOWS\system32\flvDX.dll"
                                          Sat 24 Feb 2007 848 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys"
                                          Wed 21 Feb 2007 31,232 ..SHR --- "C:\WINDOWS\system32\msfDX.dll"
                                          Wed 1 Aug 2007 8,397,128 A..H. --- "C:\WINDOWS\system32\msway.dll"
                                          Sun 16 Mar 2008 216,064 ..SHR --- "C:\WINDOWS\system32\nbDX.dll"
                                          Fri 25 Aug 2006 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
                                          Sun 26 Jun 2005 616,448 ..SHR --- "C:\Program Files\eRightSoft\SUPER\cygwin1.dll"
                                          Tue 21 Jun 2005 45,568 ..SHR --- "C:\Program Files\eRightSoft\SUPER\cygz.dll"
                                          Thu 21 Aug 2008 72,704 ..SHR --- "C:\Program Files\eRightSoft\SUPER\Setup.exe"
                                          Tue 2 Oct 2007 15,872 A.SHR --- "C:\Program Files\eRightSoft\SUPER\_Setup.dll"
                                          Fri 25 Aug 2006 4,021,128 A..H. --- "C:\Program Files\InstallShield Installation Information\{E9E37358-E3E1-47BA-9E21-375EF3616BC9}\SetupEx.exe"
                                          Sun 19 Oct 2008 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
                                          Tue 4 Jun 2002 84,992 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\14_43260.dll"
                                          Tue 4 Jun 2002 44,032 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\28_83260.dll"
                                          Tue 10 Dec 2002 73,766 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\atrc3260.dll"
                                          Tue 10 Dec 2002 65,575 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\cook3260.dll"
                                          Sun 9 Jun 2002 36,864 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\ddnt3260.dll"
                                          Tue 4 Jun 2002 20,480 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\dnet3260.dll"
                                          Tue 10 Dec 2002 102,437 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv13260.dll"
                                          Tue 10 Dec 2002 176,165 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv23260.dll"
                                          Tue 10 Dec 2002 208,935 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv33260.dll"
                                          Tue 10 Dec 2002 217,127 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv43260.dll"
                                          Sun 9 Jun 2002 40,448 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\dspr3260.dll"
                                          Sat 3 Nov 2001 225,280 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\ivvideo.dll"
                                          Tue 10 Apr 2001 225,280 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\qtmlClient.dll"
                                          Fri 20 Feb 2004 232,960 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\raac.dll"
                                          Sun 9 Jun 2002 525,824 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rnco3260.dll"
                                          Tue 10 Dec 2002 245,805 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rnlt3260.dll"
                                          Tue 10 Dec 2002 45,093 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv103260.dll"
                                          Tue 10 Dec 2002 98,341 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv203260.dll"
                                          Tue 10 Dec 2002 94,247 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv303260.dll"
                                          Tue 10 Dec 2002 90,151 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv403260.dll"
                                          Tue 10 Dec 2002 102,439 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\sipr3260.dll"
                                          Sun 9 Jun 2002 49,152 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\tokr3260.dll"
                                          Thu 20 Mar 2008 5,632 ..SHR --- "C:\Program Files\eRightSoft\SUPER\spk\1stRun.exe"
                                          Fri 25 Aug 2006 4,348 A..H. --- "C:\Documents and Settings\berny\Mes documents\Ma musique\Sauvegarde de la licence\drmv1key.bak"
                                          Tue 29 Aug 2006 20 A..H. --- "C:\Documents and Settings\berny\Mes documents\Ma musique\Sauvegarde de la licence\drmv1lic.bak"
                                          Fri 25 Aug 2006 400 A.SH. --- "C:\Documents and Settings\berny\Mes documents\Ma musique\Sauvegarde de la licence\drmv2key.bak"
                                          Fri 12 Mar 2004 106,496 A..H. --- "C:\Program Files\Fichiers communs\aolshare\shell\fr\shellext.dll"
                                          Fri 15 Sep 2006 4,918 A..H. --- "C:\Documents and Settings\berny\Application Data\Microsoft\Office\Shortcut Bar\Off205.tmp"
                                          Sun 19 Oct 2008 39,475,233 A..H. --- "C:\Documents and Settings\berny\Local Settings\Application Data\Microsoft\Media Player\MusicType1VirginMegaFr\Downloads\000E8B05\BIT5E.tmp"

                                          [b]Finished![/b]

                                          =)
                                          0
                                          • 1
                                          • 2
                                          • 3

                                          Discussions similaires

                                          problem svchost.exe (netsvcs)
                                          souzouker

                                          41 réponses
                                          svchost network svc qui utilise toute la bande passante
                                          irrash

                                          3 réponses
                                          Infection svchost.exe !! Que faire ?
                                          truman23

                                          18 réponses
                                          svchost.exe [netsvcs] et son utilisation massive du CPU
                                          Utilisateur anonyme

                                          2 réponses
                                          svchost.exe
                                          lilou

                                          59 réponses