Svchost.exe

-----------\\ ToolBar S&D 1.2.8 XP/Vista

Microsoft Windows XP Professionnel ( v5.1.2600 )
X86-based PC ( Uniprocessor Free : Intel(R) Pentium(R) 4 CPU 2.40GHz )
BIOS : 686O2 v2.14
USER : mehdi ( Administrator )
BOOT : Normal boot
A:\ (USB)
C:\ (Local Disk) - NTFS - Total:9 Go (Free:2 Go)
D:\ (Local Disk) - NTFS - Total:27 Go (Free:10 Go)

"C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
Option : [1] ( 23/05/2009|15:41 )

-----------\\ Recherche de Fichiers / Dossiers ...

C:\WINDOWS\iun6002.exe
C:\Program Files\Mozilla Firefox\searchplugins\crawlersrch.xml

-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\WINDOWS\\System32\\blank.htm"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Bar"="http://www.crawler.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=60327"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
"Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"SearchAssistant"="http://www.crawler.com/search/ie.aspx?tb_id=60327"
"CustomizeSearch"="http://dnl.crawler.com/support/sa_customize.aspx?TbId=60327"

--------------------\\ Recherche d'autres infections

--------------------\\ Cracks & Keygens ..

C:\DOCUME~1\mehdi\Application Data\uTorrent\ABBYY FineReader v9.0.0.724 Professional Edition Multilanguage + Crack.1.torrent
C:\DOCUME~1\mehdi\Application Data\uTorrent\ABBYY FineReader v9.0.0.724 Professional Edition Multilanguage + Crack.torrent
C:\DOCUME~1\mehdi\Mes documents\Downloads\ABBYY FineReader v9.0.0.724 Professional Edition Multilanguage + Crack
C:\DOCUME~1\mehdi\Mes documents\Downloads\ABBYY FineReader v9.0.0.724 Professional Edition Multilanguage + Crack\ABBYY FineReader v9.0.0.724.uif
C:\DOCUME~1\mehdi\Mes documents\Downloads\ABBYY FineReader v9.0.0.724 Professional Edition Multilanguage + Crack\Readme.txt

1 - "C:\ToolBar SD\TB_1.txt" - 23/05/2009|15:41 - Option : [1]

-----------\\ Fin du rapport a 15:41:35,77

Re,

Tant pis ...

bonne continuation .

++

voila

Logfile of random's system information tool 1.06 (written by random/random)
Run by mehdi at 2009-05-23 15:16:25
Microsoft Windows XP Professionnel
System drive C: has 3 GB (28%) free of 10 GB
Total RAM: 247 MB (24% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:16:35, on 23/05/2009
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Menara\dslmon.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\mehdi\Mes documents\Downloads\Programs\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\mehdi.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.crawler.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=60327
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.zikanet.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60327
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60327
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.zikanet.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60327
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60327
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Menara
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Barre d'outils &Crawler - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [nodenable] C:\Program Files\eset\nodenable.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: DSLMON.lnk = C:\Program Files\Menara\dslmon.exe
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O17 - HKLM\System\CCS\Services\Tcpip\..\{F854CB82-2D5F-447E-9364-7B93EF06B020}: NameServer = 62.251.229.223 62.251.229.237
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe

Re,

Non , c'est pour voir ce que c'est pour faire la remonter ni plus ni moins..

++

Re,

Refait un log avec rsit STP.

++

dsl mes je l'avais supprimer avant ton 1er poste

dsl encore

Re,

Mais non , fallait le faire analyser sur "virustotal"..

pfffffffff

voila je suis parti ds system32 j trouver l'application puis je l'ai supprimer tt simplement

j telecharger spyware terminator et j lancer l'analyse

Bonjour,

Rends toi sur ce site :

https://www.virustotal.com/gui/

Clique sur parcourir et cherche ce fichier :

c:\windows\system32\zikpa.exe

Clique sur Send File.

Un rapport va s'élaborer ligne à ligne.

Attends la fin. Il doit comprendre la taille du fichier envoyé.

Sauvegarde le rapport avec le bloc-note.

Copie le dans ta réponse.

Egalement le lien.

Merci

a l'aide de regcleaner j trouver ke zika et une application ds system32 je lé effacer

je c pas

c un logiciel ???

[b]SDFix: Version 1.240 [/b]
Run by mehdi on 23/05/2009 at 14:11

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:

Restoring Default Security Values
Restoring Default Hosts File

Rebooting

[b]Checking Files [/b]:

Trojan Files Found:

C:\WINDOWS\system32\msvcrt2.dll - Deleted

Removing Temp Files

[b]ADS Check [/b]:

[b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-23 14:19:01
Windows 5.1.2600 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\System]
"OODEFRAG10.00.00.01WORKSTATION"="8455E435FC27637A98ED15D1D940AC82823FBA34BF3E11E51577620364109D740E4B91C3E5B2C78F8D233B83EA65CA1050DE09820471D6C8C09E68FCE6FE8C0ADBA4F5F777FEC73EDCC42D27A29A3E983FDCEF607FC468C88FEBD91AD0C646490E29E27FC56ADFB81A37D7179832AD46F7619BEEF21C3BA85D67BDE226FA2B2ED4605CEDB9DD7FCFEBA65C8D3B02B5E136566AB2EE5DB7CC1BDDCFC53FB49255F6181C3990C087FA8E0011A94DE4E6DD4B6CED935B753ABDCDDE01144790C602CFE08DBA590151D350F4FD6FE339C4CB1A15EC5EF15395A810BEF202BE2F8398CB8F51B27A11269B95FC63FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79335D575E7D6A3B98085D575E7D6A3B9808A9C6AECB7A5D140782269CB27516D45EA449CB2895039D4D11196FA681B348DF4E914E1F0360D1AE59E5DB950103424232CA5AAA5A44DD848388157BC5C4DD084FEDA14CDBA3C51AB680BD8412663BA74907AC7C622579726763391AE90E4E97B93AAD3C3031A560A9EB7976E4A82F66005C4DA04501028C7D8AD4317CFEE741137CFC69A82F2210A2F44DD3DCC2CB0BD0FA480D3E46C77C673567E5B21DBEE9C91020C713D4AEED773AF8FBFD4309D69AE6302E2D78619EADEBF44FE101A9AD2F24A93C5E71837161B1414172CC9F3E1FFA9A621330A8063A8C81F807D5435BF4BAB21D21651DC5FDA0EDE809158CE905629F7C98173CF6DEC89AE3C2DCE973B5ABD5B913A63B4B4EA4CCACB2668F36571E6044866C7D6C4C28CC8459E8C32E6D9F335392BEE094B7ACAEBA07A030B283837BF3CE0513131C82AAC1B063B4F67A98ED9C9FC8596805FC6736BDB3B5A45C3B97BA0246E6CB49064C7756C86A69A4662E41DDF82DC3E0AC5034B627AE0519C05E3CD6AC28AD3235CB777A29D2D912311FDC9892AFD5DEA8453EF115EA005267FC8EA94748811B65470470A820CECF727001BB6EF102742FA753972B7F7587D1273DF8B9FCC32B40E1D5AE7E4B834E7BD6B2D7FB4F5F7955DC65EFADC77B1CF80FC767BABFA66D43429953790FE461EC08E922BBE13A2D824BD9E770DE5955A9F09FBB15D111D1C092EC9D77E916423FC19473C189122F71E18A14DE260BDC860A2DE029311BAB5E0267F0ED9E6D8C3B4394C838EB1986348FC62977434342021C4C66E92813B195430ED565B6764200CE3DC25CF0391C2CC94F804B9EE478E66C4AFE5E3E7880350D5E7778F96EC5822D592700430BBC9209DB9882E78853CFC3EA01224183975D9948A6D87A486086A9A45D87D4611AF24A9413D50C7A102EF064E6E3451D5805A73056CB0AABBE2A9450F2EC58BC492D8D98B594433CCB48C5E251689FE10D76F9EB9E273FF1705940011ABC47D6C4F35878EB"

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

[b]Remaining Services [/b]:

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\\WINDOWS\\System32\\svcpr0xy.exe"="C:\\WINDOWS\\System32\\svcpr0xy.exe:*:Enabled:ServiceProxy"

[b]Remaining Files [/b]:

File Backups: - C:\SDFix\backups\backups.zip

[b]Files with Hidden Attributes [/b]:

Mon 7 Jan 2008 352 A..H. --- "C:\WINDOWS\nod32fixtemdono.reg"

[b]Finished![/b]

le 2eme

INFO

info.txt logfile of random's system information tool 1.06 2009-05-23 13:31:40

======Uninstall list======

-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Flash Player Plugin-->C:\WINDOWS\System32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 9.1 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A91000000001}
Applian FLV Player-->"C:\WINDOWS\Applian FLV Player\uninstall.exe" "/U:C:\Program Files\FLV Player\Uninstall\uninstall.xml"
BT Engine 5.05-->"C:\Program Files\BT Engine\unins000.exe"
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
CounterStrike 1.6 from VSI (Version 1.02)-->C:\PROGRA~1\Valve\CSTRIK~1.6\UNWISE.EXE C:\PROGRA~1\Valve\CSTRIK~1.6\ins_cs16_vsi102.log
Defraggler (remove only)-->"C:\Program Files\Defraggler\uninst.exe"
ESET NOD32 Antivirus-->MsiExec.exe /I{1A3D8A23-3215-46B7-AB97-E304ADABFC18}
EVEREST Home Edition v2.20-->"C:\Program Files\Lavalys\EVEREST Home Edition\unins000.exe"
GOM Player-->"C:\Program Files\GRETECH\GomPlayer\Uninstall.exe"
HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Intel(R) Extreme Graphics Driver-->RUNDLL32.EXE C:\WINDOWS\System32\ialmrem.dll,UninstallW2KIGfx PCI\VEN_8086&DEV_2562
Internet Download Manager-->C:\Program Files\Internet Download Manager\Uninstall.exe
Kit de Connexion MENARA-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AB25E068-C7A2-482F-A3BC-588A5869844D}\setup.exe" -l0x40c ControlPanel
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Mozilla Firefox (3.0.5)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSN Messenger 7.5 pour W2k/XP-->MsiExec.exe /I{BAFD3C1E-03EC-11DA-BFBD-00065BBDC0B5}
NOD32 v3.x FiX 1.1 by TemDono (Free Updates - Expire in 2050)-->"C:\Program Files\ESET\ESET NOD32 Antivirus\unins000.exe"
Shareaza 2.4.0.0-->"C:\Program Files\Shareaza\Uninstall\unins000.exe"
SoundMAX-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F0A37341-D692-11D4-A984-009027EC0A9C}\Setup.exe"
Total Uninstall 5.4.0-->"C:\Program Files\Total Uninstall 5\unins000.exe"
Vista Rainbar 4.3-->C:\Program Files\Vista Rainbar\Uninstall.exe
VLC media player 0.9.8a-->C:\Program Files\VideoLAN\VLC\uninstall.exe
Windows Installer 3.1 (KB893803)-->"C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe"
WinRAR archiver-->C:\Program Files\WinRAR\uninstall.exe

======Hosts File======

127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com

======System event log======

Computer Name: MIIDO-C8P8OHXES
Event Code: 7036
Message: Le service Service COM de gravage de CD IMAPI est entré dans l'état : en cours d'exécution.

Record Number: 441
Source Name: Service Control Manager
Time Written: 20090416193207.000000+000
Event Type: Informations
User:

Computer Name: MIIDO-C8P8OHXES
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service Service COM de gravage de CD IMAPI.

Record Number: 440
Source Name: Service Control Manager
Time Written: 20090416193207.000000+000
Event Type: Informations
User: AUTORITE NT\SYSTEM

Computer Name: MIIDO-C8P8OHXES
Event Code: 20159
Message: La connexion à Menara ADSL effectuée par l'utilisateur fido_mar1@menara utilisant le périphérique ISDN8-0 a été déconnectée.

Record Number: 439
Source Name: RemoteAccess
Time Written: 20090416193159.000000+000
Event Type: Informations
User:

Computer Name: MIIDO-C8P8OHXES
Event Code: 7036
Message: Le service Compatibilité avec le Changement rapide d'utilisateur est entré dans l'état : en cours d'exécution.

Record Number: 438
Source Name: Service Control Manager
Time Written: 20090416193136.000000+000
Event Type: Informations
User:

Computer Name: MIIDO-C8P8OHXES
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service Compatibilité avec le Changement rapide d'utilisateur.

Record Number: 437
Source Name: Service Control Manager
Time Written: 20090416193136.000000+000
Event Type: Informations
User: AUTORITE NT\SYSTEM

=====Application event log=====

Computer Name: MIIDO-C8P8OHXES
Event Code: 4354
Message: Le système d'événements de COM+ n'a pas pu déclencher la méthode ConnectionMade de l'abonnement {6F0657B8-D704-4E53-8ACF-E2A1F0FA4F8E}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}. L'abonné a renvoyé HRESULT 80004001.
Record Number: 198
Source Name: EventSystem
Time Written: 20090430214010.000000+000
Event Type: Avertissement
User:

Computer Name: MIIDO-C8P8OHXES
Event Code: 4354
Message: Le système d'événements de COM+ n'a pas pu déclencher la méthode ConnectionMade de l'abonnement {6F0657B8-D704-4E53-8ACF-E2A1F0FA4F8E}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}. L'abonné a renvoyé HRESULT 80004001.
Record Number: 197
Source Name: EventSystem
Time Written: 20090430202515.000000+000
Event Type: Avertissement
User:

Computer Name: MIIDO-C8P8OHXES
Event Code: 2001
Message: Le service EAPOL a été démarré correctement

Record Number: 196
Source Name: EAPOL
Time Written: 20090430202419.000000+000
Event Type: Informations
User:

Computer Name: MIIDO-C8P8OHXES
Event Code: 2001
Message: Le service EAPOL a été démarré correctement

Record Number: 195
Source Name: EAPOL
Time Written: 20090430174807.000000+000
Event Type: Informations
User:

Computer Name: MIIDO-C8P8OHXES
Event Code: 2001
Message: Le service EAPOL a été démarré correctement

Record Number: 194
Source Name: EAPOL
Time Written: 20090430161536.000000+000
Event Type: Informations
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem
"windir"=%SystemRoot%
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 2 Stepping 7, GenuineIntel
"PROCESSOR_REVISION"=0207
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP

-----------------EOF-----------------

je vous remercie tt les 2

quand je ctrl+alt+suppr ds processus je trouve plein de svchost.exe ki consomme mes ressources apres un ptit tour ds gogle j'ai lus des sujet ils disais ke c1 virus mes bon........

voila mes 2 rapport

LOG

Logfile of random's system information tool 1.06 (written by random/random)
Run by mehdi at 2009-05-23 13:30:39
Microsoft Windows XP Professionnel
System drive C: has 3 GB (30%) free of 10 GB
Total RAM: 247 MB (62% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:31:36, on 23/05/2009
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Menara\dslmon.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Documents and Settings\mehdi\Mes documents\Downloads\Programs\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\mehdi.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.zikanet.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.zikanet.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Menara
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [zika] c:\windows\system32\zikpa.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [zika] c:\windows\system32\zikpa.exe
O4 - HKCU\..\Run: [nodenable] C:\Program Files\eset\nodenable.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: DSLMON.lnk = C:\Program Files\Menara\dslmon.exe
O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

oui je dis pas le contraire mais a la base il pensé que svchost.exe était le trojan c'est pour cela que j'ai mis l'annotation

Svchost.exe n'est pas un virus ....

SVCHOST est un processus générique, qui sert à lancer des services contenus
dans des DLL.

Au démarrage, SVCHOST scrute le contenu de la clef :
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost

Des entrées de type REG_MULTI_SZ contiennent une énumération de services à
lancer.

Il est donc normal d'en avoir plusieurs.

Sous Windows XP vous pouvez taper tasklist /SVC en ligne de commande pour avoir la liste des services qui fonctionnent.

Sous Windows Windows NT4 et Windows 2000, vous pouvez utiliser la commande tlist

voila

Malwarebytes' Anti-Malware 1.36
Version de la base de données: 2169
Windows 5.1.2600

23/05/2009 13:14:10
mbam-log-2009-05-23 (13-14-10).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 111710
Temps écoulé: 17 minute(s), 5 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 8
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 6

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sysdrv32 (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sysdrv32 (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sysdrv32 (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\port135sik (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\fcn (Rogue.Residue) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i386si (Rootkit.Spamtool) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\systemntmi (Rootkit.Spamtool) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nicsk32 (Rootkit.Agent) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\System Volume Information\_restore{D6C2FBA0-35AF-4DA2-A258-703A127A55B8}\RP51\A0054639.sys (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D6C2FBA0-35AF-4DA2-A258-703A127A55B8}\RP51\A0054640.sys (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D6C2FBA0-35AF-4DA2-A258-703A127A55B8}\RP51\A0054650.sys (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D6C2FBA0-35AF-4DA2-A258-703A127A55B8}\RP51\A0054651.sys (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D6C2FBA0-35AF-4DA2-A258-703A127A55B8}\RP51\A0054673.scr (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\sysdrv32.sys (Backdoor.Bot) -> Quarantined and deleted successfully.

dsl pour le retard je ram tropp

pouvez vous m'aider svp