Svchost.exe : dans C:/windows/

Résolu
Haraknos -  
Bonjour à tous,
c'est la deuxième fois que je fais appel à votre être et j'espère qu'encore une fois je serai entièrement satisfait !

Alors voilà, j'ai fait une rapide recherche de 3 heures sur le net pour trouver la réponse à mon problème qui est le suivant : comment peut-on supprimer un svchost qui n'est pas dans system32 et qui réaparait après l'avoir delet en mode sans echec (évidemment je n'ai pas trouvé la réponse).

J'ai 10 svchost dans mon gestionnaire de tâche, 6 ayant pour utilisateur "SYSTEM", 2 "SERVICE RESEAU", 1 "SERVICE LOCAL" et un dernier à mon nom d'utilisateur (c'est celui là qui, je pense, m'embête).

Je n'arrive pas à ouvrir certaines applications à cause de ce svchost comme firefox (j'arrive à les ouvrir en mode sans échec apres l'avoir supprimé). Si vous voulez le rapport de "HiJackThis" y a qu'à demander.

Encore merci pour votre attention et à bientôt !!

Haraknos
Configuration: Windows XP
Internet Explorer 7.0

53 réponses

Résumé de la discussion

Suppression d'un svchost non situé dans system32 et réapparaissant après suppression en mode sans échec constitue la problématique centrale, interdépendante des risques de réinfection et demande une réponse sûre. Plusieurs suggestions visent des outils dédiés et des manipulations ciblées, notamment ComboFix pour identifier et supprimer les traces, puis GenProc et OTMoveIt3 pour déplacer les éléments résiduels. D'autres recommandations portent sur le nettoyage des entrées de démarrage et des services suspects, la suppression des composants malveillants identifiés et la vérification des dossiers système. En complément, l’analyse des éléments générés par les outils et l’usage d’un détecteur de rootkit peuvent prévenir les réinfections futures dans l’environnement Windows et lors des sessions en ligne.

Bobot (l’IA à votre service)
  2. Haraknos Auteur
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 10:55:49, on 09/11/2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16735)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
    C:\Program Files\Fichiers communs\Symantec Shared\AppCore\AppSvc32.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
    C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\slserv.exe
    C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\fxssvc.exe
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\Apps\Powercinema\PCMService.exe
    C:\apps\ABoard\ABoard.exe
    C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
    C:\apps\ABoard\AOSD.exe
    C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
    C:\WINDOWS\VM303_STI.EXE
    C:\WINDOWS\vsnpstd.exe
    C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
    C:\Program Files\e-Carte Bleue Banque Populaire\ecbl-nxbp.exe
    c:\program files\fichiers communs\installshield\updateservice\isuspm.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\svchost.exe
    C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\agent.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\MessengerDiscovery\MessengerDiscovery Live.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\Program Files\WowCartographe\WowCartographe.exe
    C:\Downloads\Software\HiJackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.orange.fr/portail
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)
    O2 - BHO: Download Manager Browser Helper Object - {19C8E43B-07B3-49CB-BFFC-6777B593E6F8} - C:\PROGRA~1\FICHIE~1\fluxDVD\DOWNLO~1\XEBDLH~1.DLL
    O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Fichiers communs\Symantec Shared\coShared\Browser\1.0\NppBho.dll
    O2 - BHO: e-Carte Bleue Browser Helper Object - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} - C:\WINDOWS\system32\BhoECart.dll
    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Documents and Settings\pierre\Mes documents\pierre.verdy\Free Download Manager\iefdm2.dll
    O3 - Toolbar: Afficher Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Fichiers communs\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAudPropShortcut.exe
    O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
    O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
    O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
    O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
    O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
    O4 - HKLM\..\Run: [BigDog303] C:\WINDOWS\VM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH)
    O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
    O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
    O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
    O4 - HKLM\..\Run: [ISUSPM Startup] "c:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" -startup
    O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
    O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
    O4 - HKLM\..\Run: [CanalPlayerHelper] C:\Program Files\Lecteur CANALPLAY\CanalPlayerHelper.exe
    O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon
    O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 52\axcmd.exe" /automount
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
    O4 - HKUS\S-1-5-21-3987325350-3101553100-1454181443-1011\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE" (User '?')
    O4 - HKUS\S-1-5-21-3987325350-3101553100-1454181443-1011\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 52\axcmd.exe" /automount (User '?')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: e-Carte Bleue Banque Populaire.lnk = C:\Program Files\e-Carte Bleue Banque Populaire\ecbl-nxbp.exe
    O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
    O8 - Extra context menu item: Tout télécharger avec Free Download Manager - file://C:\Documents and Settings\pierre\Mes documents\pierre.verdy\Free Download Manager\dlall.htm
    O8 - Extra context menu item: Translate with &Babylon - res://C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
    O8 - Extra context menu item: Télécharger avec Free Download Manager - file://C:\Documents and Settings\pierre\Mes documents\pierre.verdy\Free Download Manager\dllink.htm
    O8 - Extra context menu item: Télécharger la sélection avec Free Download Manager - file://C:\Documents and Settings\pierre\Mes documents\pierre.verdy\Free Download Manager\dlselected.htm
    O8 - Extra context menu item: Télécharger la vidéo avec Free Download Manager - file://C:\Documents and Settings\pierre\Mes documents\pierre.verdy\Free Download Manager\dlfvideo.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: Stop Pub - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Program Files\JCA2000\StopPub\StopPub.exe
    O9 - Extra 'Tools' menuitem: Stop Pub - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Program Files\JCA2000\StopPub\StopPub.exe
    O9 - Extra button: Créer un Favori de l'appareil mobile - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
    O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
    O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\pierre\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk
    O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
    O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
    O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
    O15 - Trusted Zone: *.canalplay.com (HKLM)
    O15 - Trusted Zone: *.canalplusactive.com (HKLM)
    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
    O16 - DPF: {051D0E35-F4E3-4C8D-B411-AB0875F4C683} (Anark Client 4.0 ActiveX Control) - http://install.anark.com/client/version4/windows-ie/en/AMClient.cab
    O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
    O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
    O16 - DPF: {4A85DBE0-BFB2-4119-8401-186A7C6EB653} - http://messenger.zone.msn.com/binary/MJSS.cab69309.cab
    O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
    O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v4.cab
    O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
    O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game13.zylom.com/activex/zylomgamesplayer.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://3dlifeplayer.dl.3dvia.com/player/install/installer.exe
    O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
    O16 - DPF: {EDFCB7CB-942C-4822-AF14-F0B687409848} (Image Uploader Control) - http://photoservice.photos.orange.fr/telechargement/ImageUploader4.cab
    O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
    O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{F15220B3-4AAE-4279-AB8B-9C11835EA883}: NameServer = 81.253.149.1 80.10.246.3
    O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
    O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\VAScanner\comHost.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Validation de mot de passe Symantec IS (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
    O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
    O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
    O23 - Service: MysqlInventime - Unknown owner - c:\mysql\bin\mysqld-nt.exe
    O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: Service CANALPLAY - Canal+ Distribution - C:\Program Files\Lecteur CANALPLAY\CanalPlayService.exe
    O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
    O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
    O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\AppCore\AppSvc32.exe
    1. Utilisateur anonyme
      Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau.
      http://downloads.andymanchesta.com/RemovalTools/SDFix.exe
      Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici :
      • Redémarre ton ordinateur
      • Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde).
      • A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.
      • Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".
      • Choisis ton compte.
      Déroule la liste des instructions ci-dessous :
      • Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script.
      • Appuie sur Y pour commencer le processus de nettoyage.
      • Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
      • Appuie sur une touche pour redémarrer le PC.
      • Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
      • Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
      • Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
      • Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
      • Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum
      1. Haraknos Auteur
        [b]SDFix: Version 1.240 [/b]
        Run by pierre on 09/11/2008 at 11:14

        Microsoft Windows XP [version 5.1.2600]
        Running From: C:\Documents and Settings\pierre\Bureau\SDFix

        [b]Checking Services [/b]:

        Restoring Default Security Values
        Restoring Default Hosts File

        Rebooting

        [b]Checking Files [/b]:

        Trojan Files Found:

        C:\WINDOWS\photo album.zip - Deleted

        Could Not Remove C:\WINDOWS\svchost.exe

        Removing Temp Files

        [b]ADS Check [/b]:

        [b]Final Check [/b]:

        catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
        Rootkit scan 2008-11-09 11:40:26
        Windows 5.1.2600 Service Pack 3 NTFS

        scanning hidden processes ...

        scanning hidden services & system hive ...

        [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
        "p0"="C:\Program Files\Alcohol Soft\Alcohol 52\"
        "h0"=dword:00000000
        "ujdew"=hex:65,00,48,ff,b5,3b,66,cd,da,87,1b,bb,69,33,03,2d,a2,f5,5f,bc,9b,..
        [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
        "h0"=dword:00000000
        "ujdew"=hex:e9,a0,05,0b,fd,33,bf,b5,5c,0a,04,69,e3,c3,b2,80,4c,08,7a,95,90,..
        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
        "s1"=dword:4a925792
        "s2"=dword:45ff8aaf
        "h0"=dword:00000001

        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
        "h0"=dword:00000000
        "ujdew"=hex:92,da,19,14,9b,8f,ac,15,b0,cd,b9,bd,20,2a,21,fb,76,a9,2e,53,d9,..
        "p0"="C:\Program Files\Alcohol Soft\Alcohol 52\"
        [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
        "h0"=dword:00000000
        "ujdew"=hex:92,da,19,14,9b,8f,ac,15,b0,cd,b9,bd,20,2a,21,fb,76,a9,2e,53,d9,..
        "p0"="C:\Program Files\Alcohol Soft\Alcohol 52\"

        scanning hidden registry entries ...

        scanning hidden files ...

        scan completed successfully
        hidden processes: 0
        hidden services: 0
        hidden files: 0

        [b]Remaining Services [/b]:

        Authorized Application Key Export:

        [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
        "%ProgramFiles%\\AOL 9.0\\aol.exe"="%ProgramFiles%\\AOL 9.0\\aol.exe:*:Enabled:AOL"
        "%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe"="%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe:*:Enabled:SPLINTER CELL PANDORA"
        "%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe"="%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe:*:Enabled:PANDORA"
        "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
        "C:\\APPS\\Inventime\\my.exe"="C:\\APPS\\Inventime\\my.exe:*:Enabled:INVENTIME"
        "C:\\Program Files\\LucasArts\\Star Wars JK II Jedi Outcast\\GameData\\jk2mp.exe"="C:\\Program Files\\LucasArts\\Star Wars JK II Jedi Outcast\\GameData\\jk2mp.exe:*:Enabled:jk2mp"
        "C:\\Program Files\\Microsoft ActiveSync\\WCESCOMM.EXE"="C:\\Program Files\\Microsoft ActiveSync\\WCESCOMM.EXE:*:Enabled:Connection Manager"
        "C:\\Program Files\\Microsoft ActiveSync\\WCESMGR.EXE"="C:\\Program Files\\Microsoft ActiveSync\\WCESMGR.EXE:*:Enabled:ActiveSync Application"
        "C:\\Program Files\\BitTorrent\\bittorrent.exe"="C:\\Program Files\\BitTorrent\\bittorrent.exe:*:Enabled:BitTorrent"
        "C:\\Program Files\\Lecteur CANALPLAY\\CanalPlayer.exe"="C:\\Program Files\\Lecteur CANALPLAY\\CanalPlayer.exe:*:Enabled:Lecteur CANALPLAY"
        "C:\\Program Files\\Lecteur CANALPLAY\\CanalPlayerHelper.exe"="C:\\Program Files\\Lecteur CANALPLAY\\CanalPlayerHelper.exe:*:Enabled:Lecteur CANALPLAY Helper"
        "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
        "C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"="C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe:*:Enabled:Assistance … distance - Windows Messenger et voix"
        "C:\\Program Files\\DiskTrix\\UltimateDefragLite\\UDefrag.exe"="C:\\Program Files\\DiskTrix\\UltimateDefragLite\\UDefrag.exe:*:Enabled:UltimateDefrag Lite"
        "C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
        "C:\\Program Files\\Sony Ericsson\\Sony Ericsson Media Manager 1.0\\MediaManager.exe"="C:\\Program Files\\Sony Ericsson\\Sony Ericsson Media Manager 1.0\\MediaManager.exe:*:Enabled:Sony Ericsson Media Manager 1.0"
        "C:\\Program Files\\ma-config.com\\maconfservice.exe"="C:\\Program Files\\ma-config.com\\maconfservice.exe:LocalSubNet:Enabled:maconfservice"
        "C:\\Documents and Settings\\guillaume\\Local Settings\\Temp\\stInstall.exe"="C:\\Documents and Settings\\guillaume\\Local Settings\\Temp\\stInstall.exe:*:Enabled:SpeedTouch Home Install Wizard"
        "C:\\Program Files\\Thomson\\ST330\\service\\st330service.exe"="C:\\Program Files\\Thomson\\ST330\\service\\st330service.exe:*:Enabled:ST330 service"
        "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
        "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

        [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
        "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
        "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
        "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
        "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

        [b]Remaining Files [/b]:

        C:\WINDOWS\svchost.exe Found

        File Backups: - C:\DOCUME~1\pierre\Bureau\SDFix\backups\backups.zip

        [b]Files with Hidden Attributes [/b]:

        Sun 23 Jul 2006 215 A.SHR --- "C:\BOOT.BAK"
        Tue 17 Jun 2008 65,536 A.SH. --- "C:\Program Files\MessengerDiscovery\AlertSkinInstaller.exe"
        Sun 22 Jun 2008 40,960 A.SH. --- "C:\Program Files\MessengerDiscovery\SpellCHK.exe"
        Wed 2 Dec 1998 143,360 A.SH. --- "C:\Program Files\MessengerDiscovery\unzip.dll"
        Mon 3 Mar 2008 61,440 A..H. --- "C:\Program Files\MSN Messenger\winmm.dll"
        Sun 2 Nov 2008 363,008 ..SHR --- "C:\Program Files\NetMeeting\nmwb.exe"
        Sun 2 Nov 2008 456,192 ..SHR --- "C:\Program Files\NetMeeting\Winlog.exe"
        Sun 17 Dec 2006 56 ..SHR --- "C:\WINDOWS\system32\AB84F81FEE.sys"
        Wed 3 May 2006 163,328 ..SHR --- "C:\WINDOWS\system32\flvDX.dll"
        Sat 24 Feb 2007 848 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys"
        Wed 21 Feb 2007 31,232 ..SHR --- "C:\WINDOWS\system32\msfDX.dll"
        Wed 1 Aug 2007 8,397,128 A..H. --- "C:\WINDOWS\system32\msway.dll"
        Sun 16 Mar 2008 216,064 ..SHR --- "C:\WINDOWS\system32\nbDX.dll"
        Fri 25 Aug 2006 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
        Sun 26 Jun 2005 616,448 ..SHR --- "C:\Program Files\eRightSoft\SUPER\cygwin1.dll"
        Tue 21 Jun 2005 45,568 ..SHR --- "C:\Program Files\eRightSoft\SUPER\cygz.dll"
        Thu 21 Aug 2008 72,704 ..SHR --- "C:\Program Files\eRightSoft\SUPER\Setup.exe"
        Tue 2 Oct 2007 15,872 A.SHR --- "C:\Program Files\eRightSoft\SUPER\_Setup.dll"
        Fri 25 Aug 2006 4,021,128 A..H. --- "C:\Program Files\InstallShield Installation Information\{E9E37358-E3E1-47BA-9E21-375EF3616BC9}\SetupEx.exe"
        Sun 19 Oct 2008 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
        Tue 4 Jun 2002 84,992 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\14_43260.dll"
        Tue 4 Jun 2002 44,032 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\28_83260.dll"
        Tue 10 Dec 2002 73,766 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\atrc3260.dll"
        Tue 10 Dec 2002 65,575 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\cook3260.dll"
        Sun 9 Jun 2002 36,864 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\ddnt3260.dll"
        Tue 4 Jun 2002 20,480 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\dnet3260.dll"
        Tue 10 Dec 2002 102,437 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv13260.dll"
        Tue 10 Dec 2002 176,165 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv23260.dll"
        Tue 10 Dec 2002 208,935 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv33260.dll"
        Tue 10 Dec 2002 217,127 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv43260.dll"
        Sun 9 Jun 2002 40,448 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\dspr3260.dll"
        Sat 3 Nov 2001 225,280 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\ivvideo.dll"
        Tue 10 Apr 2001 225,280 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\qtmlClient.dll"
        Fri 20 Feb 2004 232,960 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\raac.dll"
        Sun 9 Jun 2002 525,824 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rnco3260.dll"
        Tue 10 Dec 2002 245,805 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rnlt3260.dll"
        Tue 10 Dec 2002 45,093 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv103260.dll"
        Tue 10 Dec 2002 98,341 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv203260.dll"
        Tue 10 Dec 2002 94,247 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv303260.dll"
        Tue 10 Dec 2002 90,151 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv403260.dll"
        Tue 10 Dec 2002 102,439 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\sipr3260.dll"
        Sun 9 Jun 2002 49,152 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\tokr3260.dll"
        Thu 20 Mar 2008 5,632 ..SHR --- "C:\Program Files\eRightSoft\SUPER\spk\1stRun.exe"
        Fri 25 Aug 2006 4,348 A..H. --- "C:\Documents and Settings\berny\Mes documents\Ma musique\Sauvegarde de la licence\drmv1key.bak"
        Tue 29 Aug 2006 20 A..H. --- "C:\Documents and Settings\berny\Mes documents\Ma musique\Sauvegarde de la licence\drmv1lic.bak"
        Fri 25 Aug 2006 400 A.SH. --- "C:\Documents and Settings\berny\Mes documents\Ma musique\Sauvegarde de la licence\drmv2key.bak"
        Fri 12 Mar 2004 106,496 A..H. --- "C:\Program Files\Fichiers communs\aolshare\shell\fr\shellext.dll"
        Fri 15 Sep 2006 4,918 A..H. --- "C:\Documents and Settings\berny\Application Data\Microsoft\Office\Shortcut Bar\Off205.tmp"
        Sun 19 Oct 2008 39,475,233 A..H. --- "C:\Documents and Settings\berny\Local Settings\Application Data\Microsoft\Media Player\MusicType1VirginMegaFr\Downloads\000E8B05\BIT5E.tmp"

        [b]Finished![/b]

        Voila le rapport, mais le svchost est toujours là... =x
        2. Utilisateur anonyme
          et un virus msn ;-))

          ne t'inquiete pas l'autre resiste , mais j'ai un bon pied de biche !! lol

          Télécharges ComboFix à partir d'un de ces liens :

          http://download.bleepingcomputer.com/sUBs/ComboFix.exe
          https://forospyware.com
          http://www.geekstogo.com/forum/files/file/197-combofix-by-subs/

          Et important, enregistre le sur le bureau.

          Avant d'utiliser ComboFix :

          ► Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours.

          ► Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent géner fortement la procédure de recherche et de nettoyage de l'outil.

          Une fois fait, sur ton bureau double-clic sur Combofix.exe.

          - Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc.

          /!\ Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes.

          - En fin de scan il est possible que ComboFix ait besoin de redemarrer le pc pour finaliser la désinfection\recherche, laisses-le faire.

          - Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt)

          ► Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet.

          ► Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.
          1. Haraknos Auteur
            Merci pour la réponse, je test ca de suite mais je pourrai pas poster avant cet aprem pacque j'ai deux trois trucs à faire ^^

            Merci beaucoup pour les réponses, si ça marche je crois que je t'en serai longtemsp reconnaissant =D

            A bientot =D
            1. Utilisateur anonyme
              il y auras surement encore une manip a effectuer avant que tu ne sois totalement debarrassé de cette petite bete ;-)))
              1. Haraknos Auteur
                Bon j'ai regardé la manip et il marquait "supression des fichiers..." et à chaque fois il y avait svchost mais y a pas de log dans C:/ , il y en a un dans le dossier ComboFix et il n'y a preque rien marqué dedans =x

                ComboFix 08-11-07.01 - pierre 2008-11-09 12:25:17.1 - NTFSx86
                Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.510 [GMT 1:00]
                Lancé depuis: C:\Downloads\Software\ComboFix.exe
                * Un nouveau point de restauration a été créé
                .

                Voilà c'est tout ce qu'il y a marqué, et il y a encore svchost dans windows >_<

                J'attends la dernière manip x)
                1. Utilisateur anonyme
                  regarde ici C:\Combofix.txt

                  copie et colle le rapport entier stp
                  1. Haraknos Auteur
                    J'ai refais la manip et il m'a enfin créé un log :

                    ComboFix 08-11-07.01 - pierre 2008-11-09 12:41:14.2 - NTFSx86
                    Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.522 [GMT 1:00]
                    Lancé depuis: c:\documents and settings\pierre\Bureau\ComboFix.exe
                    .

                    (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
                    .

                    c:\windows\svchost.exe
                    .
                    ---- Previous Run -------
                    .
                    c:\documents and settings\Administrateur\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
                    c:\windows\svchost.exe

                    .
                    ((((((((((((((((((((((((((((( Fichiers créés du 2008-10-09 au 2008-11-09 ))))))))))))))))))))))))))))))))))))
                    .

                    2008-11-09 11:13 . 2008-11-09 11:13 579,584 --a------ c:\windows\system32\dllcache\user32.dll
                    2008-11-09 11:08 . 2008-11-09 11:08 <REP> d-------- c:\windows\ERUNT
                    2008-11-08 11:34 . 2008-11-08 11:34 <REP> d-------- c:\documents and settings\Administrateur\Application Data\ESTsoft
                    2008-11-07 21:52 . 2008-11-07 21:57 139,264 --a------ c:\windows\War3Unin.exe
                    2008-11-07 21:52 . 2008-11-07 21:59 76,572 --a------ c:\windows\War3Unin.dat
                    2008-11-07 21:52 . 2008-11-07 21:57 2,829 --a------ c:\windows\War3Unin.pif
                    2008-11-07 21:50 . 2008-11-08 21:01 <REP> d-------- c:\program files\Warcraft III
                    2008-11-02 19:47 . 2008-11-09 10:42 0 --a------ c:\windows\1.ini
                    2008-11-02 16:50 . 2008-11-02 16:50 106,496 --a------ c:\windows\system32\wowformf828_733.dll
                    2008-11-02 16:50 . 2008-11-02 16:50 20 --a------ c:\windows\syscheck
                    2008-10-29 17:54 . 2008-10-29 17:54 <REP> d-------- c:\windows\system32\fr
                    2008-10-29 17:54 . 2008-10-29 17:54 <REP> d-------- c:\windows\system32\bits
                    2008-10-29 17:54 . 2008-10-29 17:54 <REP> d-------- c:\windows\l2schemas
                    2008-10-29 17:52 . 2008-10-29 17:55 <REP> d-------- c:\windows\ServicePackFiles
                    2008-10-29 17:47 . 2008-10-29 17:47 <REP> d-------- c:\windows\EHome
                    2008-10-28 10:10 . 2008-10-28 10:10 <REP> d-------- c:\documents and settings\Administrateur\Application Data\OpenOffice.org2
                    2008-10-27 14:10 . 2008-10-27 14:12 <REP> d-------- c:\windows\system32\Adobe
                    2008-10-26 12:31 . 2008-10-26 12:33 <REP> d-------- c:\program files\Travian
                    2008-10-24 19:59 . 2008-10-15 17:35 337,408 --------- c:\windows\system32\dllcache\netapi32.dll
                    2008-10-19 20:44 . 2008-10-19 20:44 <REP> d-------- c:\documents and settings\All Users\Application Data\Downloaded Installations
                    2008-10-17 18:47 . 2008-10-17 18:47 <REP> d-------- c:\program files\OpenOffice.org 2.4
                    2008-10-17 11:33 . 2008-08-14 14:23 2,191,232 --------- c:\windows\system32\dllcache\ntoskrnl.exe
                    2008-10-17 11:33 . 2008-08-14 14:23 2,147,328 --------- c:\windows\system32\dllcache\ntkrnlmp.exe
                    2008-10-17 11:33 . 2008-08-14 14:23 2,068,096 --------- c:\windows\system32\dllcache\ntkrnlpa.exe
                    2008-10-17 11:33 . 2008-08-14 14:23 2,025,984 --------- c:\windows\system32\dllcache\ntkrpamp.exe
                    2008-10-17 11:32 . 2008-09-08 11:41 333,824 --------- c:\windows\system32\dllcache\srv.sys
                    2008-10-17 11:30 . 2008-09-15 16:26 1,846,528 --------- c:\windows\system32\dllcache\win32k.sys

                    .
                    (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                    .
                    2008-11-09 11:48 --------- d-----w c:\program files\Fichiers communs\Symantec Shared
                    2008-11-09 10:48 --------- d-----w c:\documents and settings\All Users\Application Data\TrackMania
                    2008-11-09 09:36 --------- d-----w c:\program files\Mozilla Thunderbird
                    2008-11-08 22:19 --------- d-----w c:\program files\Wanadoo
                    2008-11-08 20:43 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec
                    2008-11-08 19:55 4,224 ----a-w c:\windows\system32\drivers\beep.sys
                    2008-11-08 15:48 --------- d-----w c:\program files\GtkRadiant-1.4
                    2008-11-08 13:04 420 ----a-w c:\documents and settings\berny\Application Data\wklnhst.dat
                    2008-11-08 10:53 --------- d-----w c:\program files\The Cleaner
                    2008-10-31 16:24 716,272 ----a-w c:\windows\system32\drivers\sptd.sys
                    2008-10-29 05:09 --------- d-----w c:\program files\Google
                    2008-10-24 20:39 --------- d-----w c:\program files\Navilog1
                    2008-10-17 17:46 --------- d-----w c:\program files\OpenOffice.org 2.3
                    2008-10-17 17:43 --------- d-----w c:\program files\Java
                    2008-10-05 14:51 --------- d-----w c:\program files\MessengerDiscovery
                    2008-10-05 13:24 --------- d-----w c:\program files\Thomson
                    2008-10-05 13:14 40,320 ----a-w c:\windows\system32\drivers\steth.sys
                    2008-10-05 13:14 30,464 ----a-w c:\windows\system32\drivers\st330.sys
                    2008-10-05 13:14 16,128 ----a-w c:\windows\system32\drivers\lpwdm.sys
                    2008-10-05 13:14 12,672 ----a-w c:\windows\system32\drivers\stbus.sys
                    2008-10-05 13:03 --------- d-----w c:\program files\ma-config.com
                    2008-10-05 13:03 --------- d-----w c:\documents and settings\All Users\Application Data\ma-config.com
                    2008-10-04 15:32 --------- d-----w c:\program files\Virtools
                    2008-09-30 14:46 --------- d-----w c:\program files\Norton Internet Security
                    2008-09-28 14:18 805 ----a-w c:\windows\system32\drivers\SYMEVENT.INF
                    2008-09-28 14:18 123,952 ----a-w c:\windows\system32\drivers\SYMEVENT.SYS
                    2008-09-28 14:18 10,671 ----a-w c:\windows\system32\drivers\SYMEVENT.CAT
                    2008-09-28 14:18 --------- d-----w c:\program files\Symantec
                    2008-09-26 17:36 --------- d-----w c:\program files\Messenger Plus! Live
                    2007-11-17 09:25 63,552 ----a-w c:\documents and settings\guillaume\Application Data\GDIPFONTCACHEV1.DAT
                    2007-06-23 11:41 378 ----a-w c:\documents and settings\guillaume\Application Data\wklnhst.dat
                    2007-02-06 17:18 63,552 ----a-w c:\documents and settings\marine\Application Data\GDIPFONTCACHEV1.DAT
                    2006-12-17 16:11 56 --sh--r c:\windows\system32\AB84F81FEE.sys
                    2006-05-03 09:06 163,328 --sh--r c:\windows\system32\flvDX.dll
                    2007-02-24 09:10 848 --sha-w c:\windows\system32\KGyGaAvL.sys
                    2007-02-21 10:47 31,232 --sh--r c:\windows\system32\msfDX.dll
                    2008-03-16 12:30 216,064 --sh--r c:\windows\system32\nbDX.dll
                    .

                    ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
                    .
                    .
                    *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
                    REGEDIT4

                    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                    "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
                    "H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\WCESCOMM.EXE" [2005-01-19 405583]
                    "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
                    "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
                    "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-10-19 286720]

                    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                    "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-05 208952]
                    "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168]
                    "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168]
                    "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784]
                    "PCMService"="c:\apps\Powercinema\PCMService.exe" [2004-09-15 81920]
                    "ACTIVBOARD"="c:\apps\ABoard\ABoard.exe" [2003-05-02 24576]
                    "SpeedTouch USB Diagnostics"="c:\program files\Thomson\SpeedTouch USB\Dragdiag.exe" [2003-09-05 878080]
                    "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2004-02-12 49152]
                    "HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 241664]
                    "ccApp"="c:\program files\Fichiers communs\Symantec Shared\ccApp.exe" [2007-01-09 115816]
                    "osCheck"="c:\program files\Norton Internet Security\osCheck.exe" [2006-09-05 26248]
                    "BigDog303"="c:\windows\VM303_STI.EXE" [2006-02-27 61440]
                    "WOOWATCH"="c:\progra~1\Wanadoo\Watch.exe" [2003-10-16 20480]
                    "snpstd"="c:\windows\vsnpstd.exe" [2004-06-10 286720]
                    "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
                    "ISUSPM Startup"="c:\program files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" [2005-08-11 249856]
                    "ISUSScheduler"="c:\program files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2005-08-11 81920]
                    "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-10-19 286720]
                    "Symantec PIF AlertEng"="c:\program files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 583048]
                    "Raccourci vers la page des propriétés de High Definition Audio"="HDAudPropShortcut.exe" [2004-03-17 c:\windows\system32\Hdaudpropshortcut.exe]
                    "ATIPTA"="atiptaxx.exe" [2006-02-22 c:\windows\system32\atiptaxx.exe]
                    "High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 c:\windows\system32\HdAShCut.exe]
                    "RTHDCPL"="RTHDCPL.EXE" [2006-03-14 c:\windows\RTHDCPL.exe]

                    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                    "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

                    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
                    "VIDC.I420"= i420vfw.dll
                    "VIDC.X264"= x264vfw.dll
                    "VIDC.HFYU"= huffyuv.dll
                    "vidc.iv41"= ir41_32.dll
                    "vidc.i263"= i263_32.drv
                    "msacm.l3fhg"= mp3fhg.acm
                    "msacm.divxa32"= divxa32.acm
                    "msacm.imc"= imc32.acm
                    "MSACM.CEGSM"= mobilev.acm

                    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^e-Carte Bleue Banque Populaire.lnk]
                    path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\e-Carte Bleue Banque Populaire.lnk
                    backup=c:\windows\pss\e-Carte Bleue Banque Populaire.lnkCommon Startup

                    [HKLM\~\startupfolder\C:^Documents and Settings^pierre^Menu Démarrer^Programmes^Démarrage^Anti-Pub.lnk]
                    path=c:\documents and settings\pierre\Menu Démarrer\Programmes\Démarrage\Anti-Pub.lnk
                    backup=c:\windows\pss\Anti-Pub.lnkStartup

                    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MessagerStarter Wanadoo]
                    --a------ 2003-04-11 16:06 32768 c:\progra~1\MESSAG~1\StartMessager.exe

                    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
                    --a------ 2008-04-14 03:34 1695232 c:\program files\Messenger\msmsgs.exe

                    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WooCnxMon]
                    --a------ 2003-10-16 17:07 24576 c:\progra~1\Wanadoo\CnxMon.exe

                    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOWATCH]
                    --------- 2003-10-16 17:07 20480 c:\progra~1\Wanadoo\Watch.exe

                    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
                    "DisableMonitoring"=dword:00000001

                    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
                    "DisableMonitoring"=dword:00000001

                    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
                    "DisableMonitoring"=dword:00000001

                    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
                    "EnableFirewall"= 0 (0x0)

                    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                    "%ProgramFiles%\\AOL 9.0\\aol.exe"=
                    "%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe"=
                    "%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe"=
                    "%windir%\\system32\\sessmgr.exe"=
                    "c:\\APPS\\Inventime\\my.exe"=
                    "c:\\Program Files\\LucasArts\\Star Wars JK II Jedi Outcast\\GameData\\jk2mp.exe"=
                    "c:\\Program Files\\Microsoft ActiveSync\\WCESCOMM.EXE"=
                    "c:\\Program Files\\Microsoft ActiveSync\\WCESMGR.EXE"=
                    "c:\\Program Files\\Lecteur CANALPLAY\\CanalPlayer.exe"=
                    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
                    "c:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
                    "c:\\Program Files\\Messenger\\msmsgs.exe"=
                    "c:\\Program Files\\Sony Ericsson\\Sony Ericsson Media Manager 1.0\\MediaManager.exe"=
                    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
                    "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

                    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
                    "10155:TCP"= 10155:TCP:BitComet 10155 TCP
                    "10155:UDP"= 10155:UDP:BitComet 10155 UDP

                    R0 ViBus;ViBus;c:\windows\system32\DRIVERS\ViBus.sys [2007-12-07 16896]
                    R0 videX32;videX32;c:\windows\system32\DRIVERS\videX32.sys [2007-09-21 9216]
                    R0 ViPrt;VIA SATA IDE Device Driver;c:\windows\system32\DRIVERS\ViPrt.sys [2007-12-07 52736]
                    R2 SBKUPNT;SBKUPNT;c:\windows\system32\Drivers\SBKUPNT.SYS [2001-07-13 14976]
                    R2 wowsystemcode;Remote TCP/IP;c:\windows\System32\svchost.exe [2008-04-14 14336]
                    S2 RPCH;Remote Procedure Call (HPM);c:\program files\NetMeeting\nmwb.exe [2008-11-02 363008]
                    S2 RPCHE;Remote Procedure Call (RPCE);c:\program files\NetMeeting\Winlog.exe [2008-11-02 456192]
                    S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [2008-09-02 191656]
                    S3 s916bus;Sony Ericsson Device 916 driver (WDM);c:\windows\system32\DRIVERS\s916bus.sys [2007-11-02 83496]
                    S3 s916mdfl;Sony Ericsson Device 916 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s916mdfl.sys [2007-11-02 15016]
                    S3 s916mdm;Sony Ericsson Device 916 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s916mdm.sys [2007-11-02 109992]
                    S3 s916mgmt;Sony Ericsson Device 916 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s916mgmt.sys [2007-11-02 103976]
                    S3 s916obex;Sony Ericsson Device 916 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s916obex.sys [2007-11-02 100008]
                    S3 Service CANALPLAY;Service CANALPLAY;c:\program files\Lecteur CANALPLAY\CanalPlayService.exe [2008-06-20 436096]
                    S3 ST330;ST330;c:\windows\system32\drivers\st330.sys [2008-10-05 30464]
                    S3 STBUS;STBUS;c:\windows\system32\drivers\stbus.sys [2008-10-05 12672]
                    S3 STETH;SpeedTouch Ethernet Adapter NT Driver;c:\windows\system32\DRIVERS\steth.sys [2008-10-05 40320]
                    S3 usbscan;Pilote de scanneur USB;c:\windows\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
                    S3 USBSTOR;Pilote de stockage de masse USB;c:\windows\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]

                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
                    wowsystemcode

                    *Newly Created Service* - COMHOST
                    .
                    Contenu du dossier 'Tâches planifiées'

                    2008-07-25 c:\windows\Tasks\AppleSoftwareUpdate.job
                    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:57]

                    2008-11-01 c:\windows\Tasks\Norton Internet Security - Analyse système complète - berny.job
                    - c:\progra~1\NORTON~1\NORTON~1\Navw32.exe [2006-09-06 22:38]

                    2007-11-01 c:\windows\Tasks\Norton Internet Security - Analyse système complète - laurence.job
                    - c:\progra~1\NORTON~1\NORTON~1\Navw32.exe [2006-09-06 22:38]

                    2006-07-23 c:\windows\Tasks\Rappel d'enregistrement 3.job
                    - c:\windows\system32\OOBE\oobebaln.exe [2008-04-14 03:34]

                    2008-11-08 c:\windows\Tasks\WebReg 20081031155349.job
                    - c:\program files\HP\Digital Imaging\bin\hpqwrg.exe [2004-05-28 21:47]
                    .
                    - - - - ORPHELINS SUPPRIMES - - - -

                    HKLM-Run-CanalPlayerHelper - c:\program files\Lecteur CANALPLAY\CanalPlayerHelper.exe
                    MSConfigStartUp-CanalPlayerHelper - c:\program files\Lecteur CANALPLAY\CanalPlayerHelper.exe
                    MSConfigStartUp-Pando - c:\program files\Pando Networks\Pando\Pando.exe
                    MSConfigStartUp-Picasa Media Detector - c:\program files\Picasa2\PicasaMediaDetector.exe
                    MSConfigStartUp-PlayerKiosquePlus - c:\program files\Lecteur CANALPLAY\PlayerKiosquePlus.exe

                    .
                    ------- Examen supplémentaire -------
                    .
                    FireFox -: Profile - c:\documents and settings\guillaume\Application Data\Mozilla\Firefox\Profiles\zurs9etv.default\
                    FireFox -: prefs.js - STARTUP.HOMEPAGE - about:blank
                    FF -: plugin - c:\documents and settings\guillaume\Application Data\Mozilla\Firefox\Profiles\zurs9etv.default\extensions\{bb628310-0ab7-11db-9cd8-0800200c9a66}\plugins\nphardwaredetection.dll
                    FF -: plugin - c:\program files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
                    FF -: plugin - c:\program files\DivX\DivX Content Uploader\npUpload.dll
                    FF -: plugin - c:\program files\Fichiers communs\fluxDVD\APIX\NPAPIX.dll
                    FF -: plugin - c:\program files\Fichiers communs\fluxDVD\BrowserIntegration\NPFluxBrowserHelper.dll
                    FF -: plugin - c:\program files\Fichiers communs\mpDRM\NPMPDRM.dll
                    FF -: plugin - c:\program files\ma-config.com\nphardwaredetection.dll
                    FF -: plugin - c:\program files\Mozilla Firefox\plugins\NPAPIX.dll
                    FF -: plugin - c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
                    FF -: plugin - c:\program files\Mozilla Firefox\plugins\NPFluxBrowserHelper.dll
                    FF -: plugin - c:\program files\Mozilla Firefox\plugins\npmozax.dll
                    FF -: plugin - c:\program files\Mozilla Firefox\plugins\NPMPDRM.dll
                    FF -: plugin - c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
                    FF -: plugin - c:\program files\Virtools\3D Life Player\npvirtools.dll
                    .

                    **************************************************************************

                    catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                    Rootkit scan 2008-11-09 12:48:56
                    Windows 5.1.2600 Service Pack 3 NTFS

                    Recherche de processus cachés ...

                    Recherche d'éléments en démarrage automatique cachés ...

                    Recherche de fichiers cachés ...

                    c:\windows\svchost.exe 23552 bytes executable

                    Scan terminé avec succès
                    Fichiers cachés: 1

                    **************************************************************************

                    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\MysqlInventime]
                    "ImagePath"="c:\mysql\bin\mysqld-nt MysqlInventime"
                    .
                    ------------------------ Autres processus actifs ------------------------
                    .
                    c:\windows\system32\ati2evxx.exe
                    c:\program files\Fichiers communs\Symantec Shared\ccSvcHst.exe
                    c:\windows\system32\ati2evxx.exe
                    c:\program files\Fichiers communs\Symantec Shared\AppCore\AppSvc32.exe
                    c:\progra~1\FICHIE~1\AOL\ACS\AOLacsd.exe
                    c:\program files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
                    c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe
                    c:\windows\system32\slserv.exe
                    c:\program files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
                    c:\windows\system32\fxssvc.exe
                    c:\windows\svchost.exe
                    c:\apps\ABOARD\AOSD.EXE
                    c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
                    c:\program files\e-Carte Bleue Banque Populaire\ecbl-nxbp.exe
                    c:\progra~1\FICHIE~1\INSTAL~1\UPDATE~1\agent.exe
                    c:\program files\MessengerDiscovery\MessengerDiscovery Live.exe
                    c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
                    .
                    **************************************************************************
                    .
                    Heure de fin: 2008-11-09 12:57:12 - La machine a redémarré [guillaume]
                    ComboFix-quarantined-files.txt 2008-11-09 11:57:05

                    Avant-CF: 113,237,475,328 octets libres
                    Après-CF: 113,554,079,744 octets libres

                    272 --- E O F --- 2008-10-30 09:01:29

                    Voilà ouf merci =D (svchost toujours présent dans windows)
                    1. Utilisateur anonyme
                      Ouvre le Bloc-Notes puis colle le texte copié.
                      (Démarrer\Tous les programmes\Accessoires\Bloc notes.)
                      Sauvegarde ce fichier sous le nom de CFScript.txt.

                      Copie le texte en gras : ci-dessous :

                      KillAl::

                      files::
                      c:\windows\svchost.exe
                      c:\documents and settings\Administrateur\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
                      c:\documents and settings\guillaume\Application Data\wklnhst.dat
                      c:\windows\system32\AB84F81FEE.sys

                      registry::
                      -HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
                      wowsystemcode


                      fait Glisser maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :

                      http://serveur1.archive-host.com/membres/up/1366464061/CFScript.gif

                      Cela va relancer Combofix,

                      Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

                      Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

                      Ne touche à rien tant que le scan n'est pas terminé.

                      Après redémarrage, poste le contenu du rapport Combofix.txt accompagné d'un rapport Hijackthis.

                      S'il n'y a pas de rédémarrage, poste quand même les rapports.
                      1. Haraknos Auteur
                        Voilà le new log :

                        ComboFix 08-11-07.01 - pierre 2008-11-09 13:41:50.3 - NTFSx86
                        Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.498 [GMT 1:00]
                        Lancé depuis: c:\documents and settings\pierre\Bureau\ComboFix.exe
                        Commutateurs utilisés :: c:\documents and settings\pierre\Bureau\CFScript.txt
                        * Un nouveau point de restauration a été créé
                        .

                        (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
                        .

                        c:\windows\svchost.exe

                        .
                        ((((((((((((((((((((((((((((( Fichiers créés du 2008-10-09 au 2008-11-09 ))))))))))))))))))))))))))))))))))))
                        .

                        2008-11-09 13:49 . 2008-11-09 13:49 23,552 --a------ c:\windows\svchost.exe
                        2008-11-09 11:13 . 2008-11-09 11:13 579,584 --a------ c:\windows\system32\dllcache\user32.dll
                        2008-11-09 11:08 . 2008-11-09 11:08 <REP> d-------- c:\windows\ERUNT
                        2008-11-08 11:34 . 2008-11-08 11:34 <REP> d-------- c:\documents and settings\Administrateur\Application Data\ESTsoft
                        2008-11-07 21:52 . 2008-11-07 21:57 139,264 --a------ c:\windows\War3Unin.exe
                        2008-11-07 21:52 . 2008-11-07 21:59 76,572 --a------ c:\windows\War3Unin.dat
                        2008-11-07 21:52 . 2008-11-07 21:57 2,829 --a------ c:\windows\War3Unin.pif
                        2008-11-07 21:50 . 2008-11-09 13:04 <REP> d-------- c:\program files\Warcraft III
                        2008-11-02 19:47 . 2008-11-09 10:42 0 --a------ c:\windows\1.ini
                        2008-11-02 16:50 . 2008-11-02 16:50 106,496 --a------ c:\windows\system32\wowformf828_733.dll
                        2008-11-02 16:50 . 2008-11-02 16:50 20 --a------ c:\windows\syscheck
                        2008-10-29 17:54 . 2008-10-29 17:54 <REP> d-------- c:\windows\system32\fr
                        2008-10-29 17:54 . 2008-10-29 17:54 <REP> d-------- c:\windows\system32\bits
                        2008-10-29 17:54 . 2008-10-29 17:54 <REP> d-------- c:\windows\l2schemas
                        2008-10-29 17:52 . 2008-10-29 17:55 <REP> d-------- c:\windows\ServicePackFiles
                        2008-10-29 17:47 . 2008-10-29 17:47 <REP> d-------- c:\windows\EHome
                        2008-10-28 10:10 . 2008-10-28 10:10 <REP> d-------- c:\documents and settings\Administrateur\Application Data\OpenOffice.org2
                        2008-10-27 14:10 . 2008-10-27 14:12 <REP> d-------- c:\windows\system32\Adobe
                        2008-10-26 12:31 . 2008-10-26 12:33 <REP> d-------- c:\program files\Travian
                        2008-10-25 21:36 . 2008-10-27 10:50 <REP> d-------- c:\documents and settings\pierre\dwhelper
                        2008-10-24 19:59 . 2008-10-15 17:35 337,408 --------- c:\windows\system32\dllcache\netapi32.dll
                        2008-10-19 20:44 . 2008-10-19 20:44 <REP> d-------- c:\documents and settings\All Users\Application Data\Downloaded Installations
                        2008-10-17 18:47 . 2008-10-17 18:47 <REP> d-------- c:\program files\OpenOffice.org 2.4
                        2008-10-17 11:33 . 2008-08-14 14:23 2,191,232 --------- c:\windows\system32\dllcache\ntoskrnl.exe
                        2008-10-17 11:33 . 2008-08-14 14:23 2,147,328 --------- c:\windows\system32\dllcache\ntkrnlmp.exe
                        2008-10-17 11:33 . 2008-08-14 14:23 2,068,096 --------- c:\windows\system32\dllcache\ntkrnlpa.exe
                        2008-10-17 11:33 . 2008-08-14 14:23 2,025,984 --------- c:\windows\system32\dllcache\ntkrpamp.exe
                        2008-10-17 11:32 . 2008-09-08 11:41 333,824 --------- c:\windows\system32\dllcache\srv.sys
                        2008-10-17 11:30 . 2008-09-15 16:26 1,846,528 --------- c:\windows\system32\dllcache\win32k.sys

                        .
                        (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                        .
                        2008-11-09 12:48 --------- d-----w c:\program files\Fichiers communs\Symantec Shared
                        2008-11-09 11:58 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec
                        2008-11-09 11:22 --------- d-----w c:\documents and settings\pierre\Application Data\Free Download Manager
                        2008-11-09 10:48 --------- d-----w c:\documents and settings\All Users\Application Data\TrackMania
                        2008-11-09 09:36 --------- d-----w c:\program files\Mozilla Thunderbird
                        2008-11-08 22:19 --------- d-----w c:\program files\Wanadoo
                        2008-11-08 19:55 4,224 ----a-w c:\windows\system32\drivers\beep.sys
                        2008-11-08 15:48 --------- d-----w c:\program files\GtkRadiant-1.4
                        2008-11-08 13:04 420 ----a-w c:\documents and settings\berny\Application Data\wklnhst.dat
                        2008-11-08 10:53 --------- d-----w c:\program files\The Cleaner
                        2008-10-31 16:24 716,272 ----a-w c:\windows\system32\drivers\sptd.sys
                        2008-10-29 05:09 --------- d-----w c:\program files\Google
                        2008-10-24 20:39 --------- d-----w c:\program files\Navilog1
                        2008-10-17 17:46 --------- d-----w c:\program files\OpenOffice.org 2.3
                        2008-10-17 17:43 --------- d-----w c:\program files\Java
                        2008-10-05 14:51 --------- d-----w c:\program files\MessengerDiscovery
                        2008-10-05 13:24 --------- d-----w c:\program files\Thomson
                        2008-10-05 13:14 40,320 ----a-w c:\windows\system32\drivers\steth.sys
                        2008-10-05 13:14 30,464 ----a-w c:\windows\system32\drivers\st330.sys
                        2008-10-05 13:14 16,128 ----a-w c:\windows\system32\drivers\lpwdm.sys
                        2008-10-05 13:14 12,672 ----a-w c:\windows\system32\drivers\stbus.sys
                        2008-10-05 13:03 --------- d-----w c:\program files\ma-config.com
                        2008-10-05 13:03 --------- d-----w c:\documents and settings\All Users\Application Data\ma-config.com
                        2008-10-04 15:32 --------- d-----w c:\program files\Virtools
                        2008-09-30 14:46 --------- d-----w c:\program files\Norton Internet Security
                        2008-09-28 14:18 805 ----a-w c:\windows\system32\drivers\SYMEVENT.INF
                        2008-09-28 14:18 123,952 ----a-w c:\windows\system32\drivers\SYMEVENT.SYS
                        2008-09-28 14:18 10,671 ----a-w c:\windows\system32\drivers\SYMEVENT.CAT
                        2008-09-28 14:18 --------- d-----w c:\program files\Symantec
                        2008-09-26 17:36 --------- d-----w c:\program files\Messenger Plus! Live
                        2007-11-17 09:25 63,552 ----a-w c:\documents and settings\guillaume\Application Data\GDIPFONTCACHEV1.DAT
                        2007-06-23 11:41 378 ----a-w c:\documents and settings\guillaume\Application Data\wklnhst.dat
                        2007-02-06 17:18 63,552 ----a-w c:\documents and settings\marine\Application Data\GDIPFONTCACHEV1.DAT
                        2006-12-17 16:11 56 --sh--r c:\windows\system32\AB84F81FEE.sys
                        2006-05-03 09:06 163,328 --sh--r c:\windows\system32\flvDX.dll
                        2007-02-24 09:10 848 --sha-w c:\windows\system32\KGyGaAvL.sys
                        2007-02-21 10:47 31,232 --sh--r c:\windows\system32\msfDX.dll
                        2008-03-16 12:30 216,064 --sh--r c:\windows\system32\nbDX.dll
                        .

                        ((((((((((((((((((((((((((((( snapshot@2008-11-09_12.56.35,57 )))))))))))))))))))))))))))))))))))))))))
                        .
                        - 2008-11-09 11:52:57 64,200 ----a-w c:\windows\system32\perfc009.dat
                        + 2008-11-09 12:52:47 64,084 ----a-w c:\windows\system32\perfc009.dat
                        - 2008-11-09 11:52:58 77,908 ----a-w c:\windows\system32\perfc00C.dat
                        + 2008-11-09 12:52:47 77,760 ----a-w c:\windows\system32\perfc00C.dat
                        - 2008-11-09 11:52:57 407,670 ----a-w c:\windows\system32\perfh009.dat
                        + 2008-11-09 12:52:47 407,362 ----a-w c:\windows\system32\perfh009.dat
                        - 2008-11-09 11:52:58 475,866 ----a-w c:\windows\system32\perfh00C.dat
                        + 2008-11-09 12:52:47 475,488 ----a-w c:\windows\system32\perfh00C.dat
                        .
                        ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
                        .
                        .
                        *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
                        REGEDIT4

                        [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                        "H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\WCESCOMM.EXE" [2005-01-19 405583]
                        "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
                        "Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" [2008-02-20 360448]
                        "AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 52\axcmd.exe" [2008-03-20 216520]

                        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                        "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-05 208952]
                        "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168]
                        "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168]
                        "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784]
                        "PCMService"="c:\apps\Powercinema\PCMService.exe" [2004-09-15 81920]
                        "ACTIVBOARD"="c:\apps\ABoard\ABoard.exe" [2003-05-02 24576]
                        "SpeedTouch USB Diagnostics"="c:\program files\Thomson\SpeedTouch USB\Dragdiag.exe" [2003-09-05 878080]
                        "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2004-02-12 49152]
                        "HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 241664]
                        "ccApp"="c:\program files\Fichiers communs\Symantec Shared\ccApp.exe" [2007-01-09 115816]
                        "osCheck"="c:\program files\Norton Internet Security\osCheck.exe" [2006-09-05 26248]
                        "BigDog303"="c:\windows\VM303_STI.EXE" [2006-02-27 61440]
                        "WOOWATCH"="c:\progra~1\Wanadoo\Watch.exe" [2003-10-16 20480]
                        "snpstd"="c:\windows\vsnpstd.exe" [2004-06-10 286720]
                        "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
                        "ISUSPM Startup"="c:\program files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" [2005-08-11 249856]
                        "ISUSScheduler"="c:\program files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2005-08-11 81920]
                        "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-10-19 286720]
                        "Symantec PIF AlertEng"="c:\program files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 583048]
                        "Raccourci vers la page des propriétés de High Definition Audio"="HDAudPropShortcut.exe" [2004-03-17 c:\windows\system32\Hdaudpropshortcut.exe]
                        "ATIPTA"="atiptaxx.exe" [2006-02-22 c:\windows\system32\atiptaxx.exe]
                        "High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 c:\windows\system32\HdAShCut.exe]
                        "RTHDCPL"="RTHDCPL.EXE" [2006-03-14 c:\windows\RTHDCPL.exe]

                        [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                        "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

                        c:\documents and settings\Administrateur\Menu D‚marrer\Programmes\D‚marrage\
                        OpenOffice.org 2.4.lnk - c:\program files\OpenOffice.org 2.4\program\quickstart.exe [2008-01-21 393216]

                        c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
                        Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 29696]
                        e-Carte Bleue Banque Populaire.lnk - c:\program files\e-Carte Bleue Banque Populaire\ecbl-nxbp.exe [2008-07-05 278528]

                        [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
                        "VIDC.I420"= i420vfw.dll
                        "VIDC.X264"= x264vfw.dll
                        "VIDC.HFYU"= huffyuv.dll
                        "vidc.iv41"= ir41_32.dll
                        "vidc.i263"= i263_32.drv
                        "msacm.l3fhg"= mp3fhg.acm
                        "msacm.divxa32"= divxa32.acm
                        "msacm.imc"= imc32.acm
                        "MSACM.CEGSM"= mobilev.acm

                        [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^e-Carte Bleue Banque Populaire.lnk]
                        path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\e-Carte Bleue Banque Populaire.lnk
                        backup=c:\windows\pss\e-Carte Bleue Banque Populaire.lnkCommon Startup

                        [HKLM\~\startupfolder\C:^Documents and Settings^pierre^Menu Démarrer^Programmes^Démarrage^Anti-Pub.lnk]
                        path=c:\documents and settings\pierre\Menu Démarrer\Programmes\Démarrage\Anti-Pub.lnk
                        backup=c:\windows\pss\Anti-Pub.lnkStartup

                        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MessagerStarter Wanadoo]
                        --a------ 2003-04-11 16:06 32768 c:\progra~1\MESSAG~1\StartMessager.exe

                        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
                        --a------ 2008-04-14 03:34 1695232 c:\program files\Messenger\msmsgs.exe

                        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WooCnxMon]
                        --a------ 2003-10-16 17:07 24576 c:\progra~1\Wanadoo\CnxMon.exe

                        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOWATCH]
                        --------- 2003-10-16 17:07 20480 c:\progra~1\Wanadoo\Watch.exe

                        [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
                        "DisableMonitoring"=dword:00000001

                        [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
                        "DisableMonitoring"=dword:00000001

                        [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
                        "DisableMonitoring"=dword:00000001

                        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
                        "EnableFirewall"= 0 (0x0)

                        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                        "%ProgramFiles%\\AOL 9.0\\aol.exe"=
                        "%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe"=
                        "%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe"=
                        "%windir%\\system32\\sessmgr.exe"=
                        "c:\\APPS\\Inventime\\my.exe"=
                        "c:\\Program Files\\LucasArts\\Star Wars JK II Jedi Outcast\\GameData\\jk2mp.exe"=
                        "c:\\Program Files\\Microsoft ActiveSync\\WCESCOMM.EXE"=
                        "c:\\Program Files\\Microsoft ActiveSync\\WCESMGR.EXE"=
                        "c:\\Program Files\\Lecteur CANALPLAY\\CanalPlayer.exe"=
                        "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
                        "c:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
                        "c:\\Program Files\\Messenger\\msmsgs.exe"=
                        "c:\\Program Files\\Sony Ericsson\\Sony Ericsson Media Manager 1.0\\MediaManager.exe"=
                        "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
                        "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

                        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
                        "10155:TCP"= 10155:TCP:BitComet 10155 TCP
                        "10155:UDP"= 10155:UDP:BitComet 10155 UDP

                        R0 ViBus;ViBus;c:\windows\system32\DRIVERS\ViBus.sys [2007-12-07 16896]
                        R0 videX32;videX32;c:\windows\system32\DRIVERS\videX32.sys [2007-09-21 9216]
                        R0 ViPrt;VIA SATA IDE Device Driver;c:\windows\system32\DRIVERS\ViPrt.sys [2007-12-07 52736]
                        R2 SBKUPNT;SBKUPNT;c:\windows\system32\Drivers\SBKUPNT.SYS [2001-07-13 14976]
                        R2 wowsystemcode;Remote TCP/IP;c:\windows\System32\svchost.exe [2008-04-14 14336]
                        S2 RPCH;Remote Procedure Call (HPM);c:\program files\NetMeeting\nmwb.exe [2008-11-02 363008]
                        S2 RPCHE;Remote Procedure Call (RPCE);c:\program files\NetMeeting\Winlog.exe [2008-11-02 456192]
                        S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [2008-09-02 191656]
                        S3 s916bus;Sony Ericsson Device 916 driver (WDM);c:\windows\system32\DRIVERS\s916bus.sys [2007-11-02 83496]
                        S3 s916mdfl;Sony Ericsson Device 916 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s916mdfl.sys [2007-11-02 15016]
                        S3 s916mdm;Sony Ericsson Device 916 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s916mdm.sys [2007-11-02 109992]
                        S3 s916mgmt;Sony Ericsson Device 916 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s916mgmt.sys [2007-11-02 103976]
                        S3 s916obex;Sony Ericsson Device 916 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s916obex.sys [2007-11-02 100008]
                        S3 Service CANALPLAY;Service CANALPLAY;c:\program files\Lecteur CANALPLAY\CanalPlayService.exe [2008-06-20 436096]
                        S3 ST330;ST330;c:\windows\system32\drivers\st330.sys [2008-10-05 30464]
                        S3 STBUS;STBUS;c:\windows\system32\drivers\stbus.sys [2008-10-05 12672]
                        S3 STETH;SpeedTouch Ethernet Adapter NT Driver;c:\windows\system32\DRIVERS\steth.sys [2008-10-05 40320]
                        S3 usbscan;Pilote de scanneur USB;c:\windows\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
                        S3 USBSTOR;Pilote de stockage de masse USB;c:\windows\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]

                        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
                        wowsystemcode

                        *Newly Created Service* - COMHOST
                        .
                        Contenu du dossier 'Tâches planifiées'

                        2008-07-25 c:\windows\Tasks\AppleSoftwareUpdate.job
                        - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:57]

                        2008-11-01 c:\windows\Tasks\Norton Internet Security - Analyse système complète - berny.job
                        - c:\progra~1\NORTON~1\NORTON~1\Navw32.exe [2006-09-06 22:38]

                        2007-11-01 c:\windows\Tasks\Norton Internet Security - Analyse système complète - laurence.job
                        - c:\progra~1\NORTON~1\NORTON~1\Navw32.exe [2006-09-06 22:38]

                        2006-07-23 c:\windows\Tasks\Rappel d'enregistrement 3.job
                        - c:\windows\system32\OOBE\oobebaln.exe [2008-04-14 03:34]

                        2008-11-08 c:\windows\Tasks\WebReg 20081031155349.job
                        - c:\program files\HP\Digital Imaging\bin\hpqwrg.exe [2004-05-28 21:47]
                        .

                        **************************************************************************

                        catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                        Rootkit scan 2008-11-09 13:48:49
                        Windows 5.1.2600 Service Pack 3 NTFS

                        Recherche de processus cachés ...

                        Recherche d'éléments en démarrage automatique cachés ...

                        Recherche de fichiers cachés ...

                        c:\windows\svchost.exe 23552 bytes executable

                        Scan terminé avec succès
                        Fichiers cachés: 1

                        **************************************************************************

                        [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\MysqlInventime]
                        "ImagePath"="c:\mysql\bin\mysqld-nt MysqlInventime"
                        .
                        ------------------------ Autres processus actifs ------------------------
                        .
                        c:\windows\system32\ati2evxx.exe
                        c:\program files\Fichiers communs\Symantec Shared\ccSvcHst.exe
                        c:\windows\system32\ati2evxx.exe
                        c:\program files\Fichiers communs\Symantec Shared\AppCore\AppSvc32.exe
                        c:\progra~1\FICHIE~1\AOL\ACS\AOLacsd.exe
                        c:\program files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
                        c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe
                        c:\program files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
                        c:\windows\system32\fxssvc.exe
                        c:\windows\svchost.exe
                        c:\apps\ABOARD\AOSD.EXE
                        c:\windows\system32\rasautou.exe
                        .
                        **************************************************************************
                        .
                        Heure de fin: 2008-11-09 13:58:26 - La machine a redémarré [pierre]
                        ComboFix-quarantined-files.txt 2008-11-09 12:58:20
                        ComboFix2.txt 2008-11-09 11:57:13

                        Avant-CF: 113,580,703,744 octets libres
                        Après-CF: 113,558,798,336 octets libres

                        257 --- E O F --- 2008-10-30 09:01:29

                        SVCHost est toujours dans windows =x
                        1. Haraknos Auteur
                          Et voilà le log de HiJackThis :

                          Logfile of Trend Micro HijackThis v2.0.2
                          Scan saved at 14:02:00, on 09/11/2008
                          Platform: Windows XP SP3 (WinNT 5.01.2600)
                          MSIE: Internet Explorer v7.00 (7.00.6000.16735)
                          Boot mode: Normal

                          Running processes:
                          C:\WINDOWS\System32\smss.exe
                          C:\WINDOWS\system32\winlogon.exe
                          C:\WINDOWS\system32\services.exe
                          C:\WINDOWS\system32\lsass.exe
                          C:\WINDOWS\system32\Ati2evxx.exe
                          C:\WINDOWS\system32\svchost.exe
                          C:\WINDOWS\System32\svchost.exe
                          C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
                          C:\WINDOWS\system32\Ati2evxx.exe
                          C:\Program Files\Fichiers communs\Symantec Shared\AppCore\AppSvc32.exe
                          C:\WINDOWS\system32\spoolsv.exe
                          C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
                          C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
                          C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
                          C:\WINDOWS\system32\svchost.exe
                          C:\WINDOWS\system32\svchost.exe
                          C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
                          C:\WINDOWS\system32\svchost.exe
                          C:\WINDOWS\system32\fxssvc.exe
                          C:\WINDOWS\System32\svchost.exe
                          C:\WINDOWS\svchost.exe
                          C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
                          C:\Apps\Powercinema\PCMService.exe
                          C:\apps\ABoard\ABoard.exe
                          C:\apps\ABoard\AOSD.exe
                          C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
                          C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
                          C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
                          C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
                          C:\WINDOWS\VM303_STI.EXE
                          C:\WINDOWS\vsnpstd.exe
                          C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
                          C:\WINDOWS\RTHDCPL.EXE
                          C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
                          C:\Program Files\Messenger\msmsgs.exe
                          C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe
                          C:\Program Files\e-Carte Bleue Banque Populaire\ecbl-nxbp.exe
                          C:\WINDOWS\explorer.exe
                          C:\Program Files\internet explorer\iexplore.exe
                          C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
                          C:\Downloads\Software\HiJackThis.exe

                          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
                          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                          R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                          R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
                          O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)
                          O2 - BHO: Download Manager Browser Helper Object - {19C8E43B-07B3-49CB-BFFC-6777B593E6F8} - C:\PROGRA~1\FICHIE~1\fluxDVD\DOWNLO~1\XEBDLH~1.DLL
                          O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Fichiers communs\Symantec Shared\coShared\Browser\1.0\NppBho.dll
                          O2 - BHO: e-Carte Bleue Browser Helper Object - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} - C:\WINDOWS\system32\BhoECart.dll
                          O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
                          O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                          O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                          O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                          O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Documents and Settings\pierre\Mes documents\pierre.verdy\Free Download Manager\iefdm2.dll
                          O3 - Toolbar: Afficher Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Fichiers communs\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
                          O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
                          O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
                          O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
                          O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAudPropShortcut.exe
                          O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
                          O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
                          O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
                          O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
                          O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
                          O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
                          O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
                          O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
                          O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
                          O4 - HKLM\..\Run: [BigDog303] C:\WINDOWS\VM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH)
                          O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
                          O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
                          O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
                          O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" -startup
                          O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
                          O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
                          O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
                          O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                          O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
                          O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
                          O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
                          O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon
                          O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 52\axcmd.exe" /automount
                          O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
                          O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
                          O4 - HKUS\S-1-5-21-3987325350-3101553100-1454181443-1011\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE" (User '?')
                          O4 - HKUS\S-1-5-21-3987325350-3101553100-1454181443-1011\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 52\axcmd.exe" /automount (User '?')
                          O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
                          O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                          O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                          O4 - Global Startup: e-Carte Bleue Banque Populaire.lnk = C:\Program Files\e-Carte Bleue Banque Populaire\ecbl-nxbp.exe
                          O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
                          O8 - Extra context menu item: Tout télécharger avec Free Download Manager - file://C:\Documents and Settings\pierre\Mes documents\pierre.verdy\Free Download Manager\dlall.htm
                          O8 - Extra context menu item: Translate with &Babylon - res://C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
                          O8 - Extra context menu item: Télécharger avec Free Download Manager - file://C:\Documents and Settings\pierre\Mes documents\pierre.verdy\Free Download Manager\dllink.htm
                          O8 - Extra context menu item: Télécharger la sélection avec Free Download Manager - file://C:\Documents and Settings\pierre\Mes documents\pierre.verdy\Free Download Manager\dlselected.htm
                          O8 - Extra context menu item: Télécharger la vidéo avec Free Download Manager - file://C:\Documents and Settings\pierre\Mes documents\pierre.verdy\Free Download Manager\dlfvideo.htm
                          O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                          O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                          O9 - Extra button: Créer un Favori de l'appareil mobile - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
                          O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
                          O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
                          O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
                          O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\pierre\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk
                          O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
                          O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
                          O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                          O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                          O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
                          O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
                          O15 - Trusted Zone: *.canalplay.com (HKLM)
                          O15 - Trusted Zone: *.canalplusactive.com (HKLM)
                          O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
                          O16 - DPF: {051D0E35-F4E3-4C8D-B411-AB0875F4C683} (Anark Client 4.0 ActiveX Control) - http://install.anark.com/client/version4/windows-ie/en/AMClient.cab
                          O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
                          O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
                          O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
                          O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
                          O16 - DPF: {4A85DBE0-BFB2-4119-8401-186A7C6EB653} - http://messenger.zone.msn.com/binary/MJSS.cab69309.cab
                          O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
                          O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v4.cab
                          O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
                          O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
                          O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
                          O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game13.zylom.com/activex/zylomgamesplayer.cab
                          O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
                          O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab
                          O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
                          O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://3dlifeplayer.dl.3dvia.com/player/install/installer.exe
                          O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
                          O16 - DPF: {EDFCB7CB-942C-4822-AF14-F0B687409848} (Image Uploader Control) - http://photoservice.photos.orange.fr/telechargement/ImageUploader4.cab
                          O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
                          O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
                          O17 - HKLM\System\CCS\Services\Tcpip\..\{F15220B3-4AAE-4279-AB8B-9C11835EA883}: NameServer = 81.253.149.9 80.10.246.132
                          O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
                          O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
                          O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
                          O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
                          O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
                          O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
                          O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\VAScanner\comHost.exe
                          O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
                          O23 - Service: Validation de mot de passe Symantec IS (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
                          O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
                          O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
                          O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
                          O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
                          O23 - Service: MysqlInventime - Unknown owner - c:\mysql\bin\mysqld-nt.exe
                          O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
                          O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
                          O23 - Service: Service CANALPLAY - Canal+ Distribution - C:\Program Files\Lecteur CANALPLAY\CanalPlayService.exe
                          O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
                          O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
                          O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
                          O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\AppCore\AppSvc32.exe
                          1. Utilisateur anonyme
                            okay , il est collant le morpion !! lol bon je vais avoir besoin de deux rapport

                            Télécharge Toolbar-S&D (Team IDN) sur ton Bureau.
                            https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2

                            * Lance l'installation du programme en exécutant le fichier téléchargé.
                            * Double-clique maintenant sur le raccourci de Toolbar-S&D.
                            * Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.
                            * Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche.
                            * Poste le rapport généré. (C:\TB.txt)

                            ensuite deuxieme rapport

                            Télécharge ici :

                            http://images.malwareremoval.com/random/RSIT.exe

                            random's system information tool (RSIT) par andom/random et sauvegarde-le sur le Bureau.

                            Double-clique sur RSIT.exe afin de lancer RSIT.

                            Lis le contenu de l'écran Disclaimer puis clique sur Continue (si tu acceptes les conditions).

                            Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.

                            Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront.

                            Poste le contenu de log.txt
                            1. Haraknos Auteur
                              Jvais prendre mon train pour aller bosser cette semaine, je pourrai pas faire la manip avant samedi prochain >_< Encore merci pour l'aide, je ferai tout ça le week prochain !! Merci beaucoup ! Et bonne semaine =D
                              2. Haraknos
                                Me revoilà donc, avec un virus qui met HS toujours plus de programmes...

                                Voici le premier rapport :

                                -----------\\ ToolBar S&D 1.2.4 XP/Vista

                                Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
                                X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) 4 CPU 3.00GHz )
                                BIOS : Default System BIOS
                                USER : pierre ( Administrator )
                                BOOT : Normal boot
                                A:\ (USB)
                                C:\ (Local Disk) - NTFS - Total:149 Go (Free:105 Go)
                                D:\ (CD or DVD)
                                E:\ (Local Disk) - NTFS - Total:186 Go (Free:159 Go)
                                F:\ (CD or DVD)

                                "C:\ToolBar SD" ( MAJ : 27-10-2008|09:25 )
                                Option : [1] ( 14/11/2008|16:04 )

                                -----------\\ Recherche de Fichiers / Dossiers ...

                                C:\WINDOWS\svchost.exe
                                1. Haraknos
                                  Et voilà maintenant le deuxième rapport :

                                  Logfile of random's system information tool 1.04 (written by random/random)
                                  Run by pierre at 2008-11-14 16:05:15
                                  Microsoft Windows XP Édition familiale Service Pack 3
                                  System drive C: has 108 GB (71%) free of 153 GB
                                  Total RAM: 1023 MB (48% free)

                                  Logfile of Trend Micro HijackThis v2.0.2
                                  Scan saved at 16:07:40, on 14/11/2008
                                  Platform: Windows XP SP3 (WinNT 5.01.2600)
                                  MSIE: Internet Explorer v7.00 (7.00.6000.16735)
                                  Boot mode: Normal

                                  Running processes:
                                  C:\WINDOWS\System32\smss.exe
                                  C:\WINDOWS\system32\winlogon.exe
                                  C:\WINDOWS\system32\services.exe
                                  C:\WINDOWS\system32\lsass.exe
                                  C:\WINDOWS\system32\Ati2evxx.exe
                                  C:\WINDOWS\system32\svchost.exe
                                  C:\WINDOWS\System32\svchost.exe
                                  C:\WINDOWS\system32\Ati2evxx.exe
                                  C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
                                  C:\Program Files\Fichiers communs\Symantec Shared\AppCore\AppSvc32.exe
                                  C:\WINDOWS\system32\spoolsv.exe
                                  C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
                                  C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
                                  C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
                                  C:\WINDOWS\system32\svchost.exe
                                  C:\WINDOWS\system32\slserv.exe
                                  C:\WINDOWS\system32\svchost.exe
                                  C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
                                  C:\WINDOWS\system32\svchost.exe
                                  C:\WINDOWS\system32\fxssvc.exe
                                  C:\WINDOWS\System32\svchost.exe
                                  C:\WINDOWS\Explorer.EXE
                                  C:\WINDOWS\svchost.exe
                                  C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
                                  C:\Apps\Powercinema\PCMService.exe
                                  C:\apps\ABoard\ABoard.exe
                                  C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
                                  C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
                                  C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
                                  C:\apps\ABoard\AOSD.exe
                                  C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
                                  C:\WINDOWS\VM303_STI.EXE
                                  C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
                                  C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
                                  C:\WINDOWS\RTHDCPL.EXE
                                  C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
                                  C:\Program Files\Messenger\msmsgs.exe
                                  C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe
                                  C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
                                  C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
                                  C:\Program Files\internet explorer\iexplore.exe
                                  C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
                                  C:\WINDOWS\system32\cmd.exe
                                  C:\Documents and Settings\pierre\Local Settings\Temporary Internet Files\Content.IE5\C2TJW4GI\RSIT[1].exe
                                  C:\Downloads\Software\pierre.exe
                                  C:\WINDOWS\system32\cmd.exe
                                  C:\WINDOWS\system32\cmd.exe
                                  C:\WINDOWS\system32\findstr.exe
                                  C:\WINDOWS\system32\find.exe
                                  C:\WINDOWS\system32\find.exe

                                  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
                                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                                  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                                  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                                  R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
                                  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)
                                  O2 - BHO: Download Manager Browser Helper Object - {19C8E43B-07B3-49CB-BFFC-6777B593E6F8} - C:\PROGRA~1\FICHIE~1\fluxDVD\DOWNLO~1\XEBDLH~1.DLL
                                  O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Fichiers communs\Symantec Shared\coShared\Browser\1.0\NppBho.dll
                                  O2 - BHO: e-Carte Bleue Browser Helper Object - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} - C:\WINDOWS\system32\BhoECart.dll
                                  O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
                                  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                                  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                                  O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                                  O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Documents and Settings\pierre\Mes documents\pierre.verdy\Free Download Manager\iefdm2.dll
                                  O3 - Toolbar: Afficher Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Fichiers communs\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
                                  O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
                                  O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
                                  O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
                                  O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAudPropShortcut.exe
                                  O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
                                  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
                                  O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
                                  O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
                                  O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
                                  O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
                                  O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
                                  O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
                                  O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
                                  O4 - HKLM\..\Run: [BigDog303] C:\WINDOWS\VM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH)
                                  O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
                                  O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
                                  O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" -startup
                                  O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
                                  O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
                                  O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
                                  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                                  O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
                                  O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
                                  O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
                                  O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon
                                  O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 52\axcmd.exe" /automount
                                  O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
                                  O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
                                  O4 - HKUS\S-1-5-21-3987325350-3101553100-1454181443-1011\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE" (User '?')
                                  O4 - HKUS\S-1-5-21-3987325350-3101553100-1454181443-1011\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 52\axcmd.exe" /automount (User '?')
                                  O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
                                  O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                                  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                                  O4 - Global Startup: e-Carte Bleue Banque Populaire.lnk = E:\e-Carte Bleue Banque Populaire\ecbl-nxbp.exe
                                  O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
                                  O8 - Extra context menu item: Tout télécharger avec Free Download Manager - file://C:\Documents and Settings\pierre\Mes documents\pierre.verdy\Free Download Manager\dlall.htm
                                  O8 - Extra context menu item: Translate with &Babylon - res://C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
                                  O8 - Extra context menu item: Télécharger avec Free Download Manager - file://C:\Documents and Settings\pierre\Mes documents\pierre.verdy\Free Download Manager\dllink.htm
                                  O8 - Extra context menu item: Télécharger la sélection avec Free Download Manager - file://C:\Documents and Settings\pierre\Mes documents\pierre.verdy\Free Download Manager\dlselected.htm
                                  O8 - Extra context menu item: Télécharger la vidéo avec Free Download Manager - file://C:\Documents and Settings\pierre\Mes documents\pierre.verdy\Free Download Manager\dlfvideo.htm
                                  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                                  O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                                  O9 - Extra button: Créer un Favori de l'appareil mobile - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
                                  O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
                                  O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
                                  O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
                                  O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\pierre\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk
                                  O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
                                  O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
                                  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                                  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                                  O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
                                  O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
                                  O15 - Trusted Zone: *.canalplay.com (HKLM)
                                  O15 - Trusted Zone: *.canalplusactive.com (HKLM)
                                  O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
                                  O16 - DPF: {051D0E35-F4E3-4C8D-B411-AB0875F4C683} (Anark Client 4.0 ActiveX Control) - http://install.anark.com/client/version4/windows-ie/en/AMClient.cab
                                  O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
                                  O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
                                  O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
                                  O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
                                  O16 - DPF: {4A85DBE0-BFB2-4119-8401-186A7C6EB653} - http://messenger.zone.msn.com/binary/MJSS.cab69309.cab
                                  O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
                                  O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v4.cab
                                  O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
                                  O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
                                  O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
                                  O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game13.zylom.com/activex/zylomgamesplayer.cab
                                  O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
                                  O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab
                                  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
                                  O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://3dlifeplayer.dl.3dvia.com/player/install/installer.exe
                                  O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
                                  O16 - DPF: {EDFCB7CB-942C-4822-AF14-F0B687409848} (Image Uploader Control) - http://photoservice.photos.orange.fr/telechargement/ImageUploader4.cab
                                  O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
                                  O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
                                  O17 - HKLM\System\CCS\Services\Tcpip\..\{F15220B3-4AAE-4279-AB8B-9C11835EA883}: NameServer = 81.253.149.9 80.10.246.132
                                  O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
                                  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
                                  O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
                                  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
                                  O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
                                  O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
                                  O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\VAScanner\comHost.exe
                                  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
                                  O23 - Service: Validation de mot de passe Symantec IS (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
                                  O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
                                  O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
                                  O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
                                  O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
                                  O23 - Service: MysqlInventime - Unknown owner - c:\mysql\bin\mysqld-nt.exe
                                  O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
                                  O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
                                  O23 - Service: Service CANALPLAY - Canal+ Distribution - C:\Program Files\Lecteur CANALPLAY\CanalPlayService.exe
                                  O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
                                  O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
                                  O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
                                  O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\AppCore\AppSvc32.exe
                                  1. Utilisateur anonyme
                                    bonjour , supprime ta version de sdfix puis telecharge celle ci et recommence stp

                                    Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau.
                                    http://downloads.andymanchesta.com/RemovalTools/SDFix.exe
                                    Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici :
                                    • Redémarre ton ordinateur
                                    • Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde).
                                    • A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.
                                    • Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".
                                    • Choisis ton compte.
                                    Déroule la liste des instructions ci-dessous :
                                    • Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script.
                                    • Appuie sur Y pour commencer le processus de nettoyage.
                                    • Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
                                    • Appuie sur une touche pour redémarrer le PC.
                                    • Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
                                    • Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
                                    • Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
                                    • Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
                                    • Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum
                                    1. Haraknos
                                      Voilà enfin le scan ^^

                                      [b]SDFix: Version 1.240 [/b]
                                      Run by pierre on 14/11/2008 at 18:45

                                      Microsoft Windows XP [version 5.1.2600]
                                      Running From: C:\Documents and Settings\pierre\Bureau\SDFix

                                      [b]Checking Services [/b]:

                                      Restoring Default Security Values
                                      Restoring Default Hosts File

                                      Rebooting

                                      [b]Checking Files [/b]:

                                      Trojan Files Found:

                                      Could Not Remove C:\WINDOWS\svchost.exe

                                      Removing Temp Files

                                      [b]ADS Check [/b]:

                                      [b]Final Check [/b]:

                                      catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                                      Rootkit scan 2008-11-14 19:03:34
                                      Windows 5.1.2600 Service Pack 3 NTFS

                                      scanning hidden processes ...

                                      scanning hidden services & system hive ...

                                      [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
                                      "p0"="C:\Program Files\Alcohol Soft\Alcohol 52\"
                                      "h0"=dword:00000000
                                      "ujdew"=hex:65,00,48,ff,b5,3b,66,cd,da,87,1b,bb,69,33,03,2d,a2,f5,5f,bc,9b,..
                                      [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
                                      "h0"=dword:00000000
                                      "ujdew"=hex:e9,a0,05,0b,fd,33,bf,b5,5c,0a,04,69,e3,c3,b2,80,4c,08,7a,95,90,..
                                      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
                                      "s1"=dword:4a925792
                                      "s2"=dword:45ff8aaf
                                      "h0"=dword:00000001

                                      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
                                      "h0"=dword:00000000
                                      "ujdew"=hex:8a,9a,09,1b,05,76,cb,08,34,78,65,91,3e,5a,df,cd,62,4a,31,6a,af,..
                                      "p0"="C:\Program Files\Alcohol Soft\Alcohol 52\"
                                      [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
                                      "h0"=dword:00000000
                                      "ujdew"=hex:8a,9a,09,1b,05,76,cb,08,34,78,65,91,3e,5a,df,cd,62,4a,31,6a,af,..
                                      "p0"="C:\Program Files\Alcohol Soft\Alcohol 52\"

                                      scanning hidden registry entries ...

                                      scanning hidden files ...

                                      scan completed successfully
                                      hidden processes: 0
                                      hidden services: 0
                                      hidden files: 0

                                      [b]Remaining Services [/b]:

                                      Authorized Application Key Export:

                                      [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
                                      "%ProgramFiles%\\AOL 9.0\\aol.exe"="%ProgramFiles%\\AOL 9.0\\aol.exe:*:Enabled:AOL"
                                      "%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe"="%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe:*:Enabled:SPLINTER CELL PANDORA"
                                      "%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe"="%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe:*:Enabled:PANDORA"
                                      "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
                                      "C:\\APPS\\Inventime\\my.exe"="C:\\APPS\\Inventime\\my.exe:*:Enabled:INVENTIME"
                                      "C:\\Program Files\\LucasArts\\Star Wars JK II Jedi Outcast\\GameData\\jk2mp.exe"="C:\\Program Files\\LucasArts\\Star Wars JK II Jedi Outcast\\GameData\\jk2mp.exe:*:Enabled:jk2mp"
                                      "C:\\Program Files\\Microsoft ActiveSync\\WCESCOMM.EXE"="C:\\Program Files\\Microsoft ActiveSync\\WCESCOMM.EXE:*:Enabled:Connection Manager"
                                      "C:\\Program Files\\Microsoft ActiveSync\\WCESMGR.EXE"="C:\\Program Files\\Microsoft ActiveSync\\WCESMGR.EXE:*:Enabled:ActiveSync Application"
                                      "C:\\Program Files\\Lecteur CANALPLAY\\CanalPlayer.exe"="C:\\Program Files\\Lecteur CANALPLAY\\CanalPlayer.exe:*:Enabled:Lecteur CANALPLAY"
                                      "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
                                      "C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"="C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe:*:Enabled:Assistance … distance - Windows Messenger et voix"
                                      "C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
                                      "C:\\Program Files\\Sony Ericsson\\Sony Ericsson Media Manager 1.0\\MediaManager.exe"="C:\\Program Files\\Sony Ericsson\\Sony Ericsson Media Manager 1.0\\MediaManager.exe:*:Enabled:Sony Ericsson Media Manager 1.0"
                                      "C:\\Program Files\\ma-config.com\\maconfservice.exe"="C:\\Program Files\\ma-config.com\\maconfservice.exe:LocalSubNet:Enabled:maconfservice"
                                      "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
                                      "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

                                      [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
                                      "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
                                      "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
                                      "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
                                      "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

                                      [b]Remaining Files [/b]:

                                      C:\WINDOWS\svchost.exe Found

                                      File Backups: - C:\DOCUME~1\pierre\Bureau\SDFix\backups\backups.zip

                                      [b]Files with Hidden Attributes [/b]:

                                      Sun 23 Jul 2006 215 A.SHR --- "C:\BOOT.BAK"
                                      Tue 17 Jun 2008 65,536 A.SH. --- "C:\Program Files\MessengerDiscovery\AlertSkinInstaller.exe"
                                      Sun 22 Jun 2008 40,960 A.SH. --- "C:\Program Files\MessengerDiscovery\SpellCHK.exe"
                                      Wed 2 Dec 1998 143,360 A.SH. --- "C:\Program Files\MessengerDiscovery\unzip.dll"
                                      Mon 3 Mar 2008 61,440 A..H. --- "C:\Program Files\MSN Messenger\winmm.dll"
                                      Sun 2 Nov 2008 363,008 ..SHR --- "C:\Program Files\NetMeeting\nmwb.exe"
                                      Sun 2 Nov 2008 456,192 ..SHR --- "C:\Program Files\NetMeeting\Winlog.exe"
                                      Sun 17 Dec 2006 56 ..SHR --- "C:\WINDOWS\system32\AB84F81FEE.sys"
                                      Wed 3 May 2006 163,328 ..SHR --- "C:\WINDOWS\system32\flvDX.dll"
                                      Sat 24 Feb 2007 848 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys"
                                      Wed 21 Feb 2007 31,232 ..SHR --- "C:\WINDOWS\system32\msfDX.dll"
                                      Wed 1 Aug 2007 8,397,128 A..H. --- "C:\WINDOWS\system32\msway.dll"
                                      Sun 16 Mar 2008 216,064 ..SHR --- "C:\WINDOWS\system32\nbDX.dll"
                                      Fri 25 Aug 2006 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
                                      Sun 26 Jun 2005 616,448 ..SHR --- "C:\Program Files\eRightSoft\SUPER\cygwin1.dll"
                                      Tue 21 Jun 2005 45,568 ..SHR --- "C:\Program Files\eRightSoft\SUPER\cygz.dll"
                                      Thu 21 Aug 2008 72,704 ..SHR --- "C:\Program Files\eRightSoft\SUPER\Setup.exe"
                                      Tue 2 Oct 2007 15,872 A.SHR --- "C:\Program Files\eRightSoft\SUPER\_Setup.dll"
                                      Fri 25 Aug 2006 4,021,128 A..H. --- "C:\Program Files\InstallShield Installation Information\{E9E37358-E3E1-47BA-9E21-375EF3616BC9}\SetupEx.exe"
                                      Sun 19 Oct 2008 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
                                      Tue 4 Jun 2002 84,992 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\14_43260.dll"
                                      Tue 4 Jun 2002 44,032 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\28_83260.dll"
                                      Tue 10 Dec 2002 73,766 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\atrc3260.dll"
                                      Tue 10 Dec 2002 65,575 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\cook3260.dll"
                                      Sun 9 Jun 2002 36,864 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\ddnt3260.dll"
                                      Tue 4 Jun 2002 20,480 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\dnet3260.dll"
                                      Tue 10 Dec 2002 102,437 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv13260.dll"
                                      Tue 10 Dec 2002 176,165 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv23260.dll"
                                      Tue 10 Dec 2002 208,935 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv33260.dll"
                                      Tue 10 Dec 2002 217,127 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv43260.dll"
                                      Sun 9 Jun 2002 40,448 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\dspr3260.dll"
                                      Sat 3 Nov 2001 225,280 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\ivvideo.dll"
                                      Tue 10 Apr 2001 225,280 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\qtmlClient.dll"
                                      Fri 20 Feb 2004 232,960 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\raac.dll"
                                      Sun 9 Jun 2002 525,824 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rnco3260.dll"
                                      Tue 10 Dec 2002 245,805 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rnlt3260.dll"
                                      Tue 10 Dec 2002 45,093 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv103260.dll"
                                      Tue 10 Dec 2002 98,341 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv203260.dll"
                                      Tue 10 Dec 2002 94,247 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv303260.dll"
                                      Tue 10 Dec 2002 90,151 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv403260.dll"
                                      Tue 10 Dec 2002 102,439 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\sipr3260.dll"
                                      Sun 9 Jun 2002 49,152 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\tokr3260.dll"
                                      Thu 20 Mar 2008 5,632 ..SHR --- "C:\Program Files\eRightSoft\SUPER\spk\1stRun.exe"
                                      Fri 25 Aug 2006 4,348 A..H. --- "C:\Documents and Settings\berny\Mes documents\Ma musique\Sauvegarde de la licence\drmv1key.bak"
                                      Tue 29 Aug 2006 20 A..H. --- "C:\Documents and Settings\berny\Mes documents\Ma musique\Sauvegarde de la licence\drmv1lic.bak"
                                      Fri 25 Aug 2006 400 A.SH. --- "C:\Documents and Settings\berny\Mes documents\Ma musique\Sauvegarde de la licence\drmv2key.bak"
                                      Fri 12 Mar 2004 106,496 A..H. --- "C:\Program Files\Fichiers communs\aolshare\shell\fr\shellext.dll"
                                      Fri 15 Sep 2006 4,918 A..H. --- "C:\Documents and Settings\berny\Application Data\Microsoft\Office\Shortcut Bar\Off205.tmp"
                                      Sun 19 Oct 2008 39,475,233 A..H. --- "C:\Documents and Settings\berny\Local Settings\Application Data\Microsoft\Media Player\MusicType1VirginMegaFr\Downloads\000E8B05\BIT5E.tmp"

                                      [b]Finished![/b]

                                      =)
                                      • 1
                                      • 2
                                      • 3

                                      Discussions similaires

                                      problem svchost.exe (netsvcs)
                                      souzouker

                                      41 réponses
                                      svchost network svc qui utilise toute la bande passante
                                      irrash

                                      3 réponses
                                      Infection svchost.exe !! Que faire ?
                                      truman23

                                      18 réponses
                                      svchost.exe [netsvcs] et son utilisation massive du CPU
                                      Utilisateur anonyme

                                      2 réponses
                                      svchost.exe
                                      lilou

                                      59 réponses