Utilisateur indésirable?

Ordinoob · le 4 septembre 2008

Oui, les rapports sont dans mon post d'avant, en tout 4 rapports dedans. Les 2 fichiers en question n'ont pas été trouvés.

chrifleur · le 4 septembre 2008

Avis aux autres lecteurs, ce code a été rédigé spécialement pour cet utilisateur, il serait dangereux de le réutiliser sur votre ordinateur !

/!\ Désactive ton antivirus / antispyware résident / TeaTimer de Spybot (si présent)

Désactiver les protections résidentes - Tutoriel

http://forum.pcastuces.com/desactiver_les_...entes-f31s4.htm

Sélectionne et copie (Ctrl+C) le texte (en bleu) ci-dessous :

KillAll::

Driver::

38f1b4w7

asbp2poa

Registry::

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ESENT\Process\cuciquud]

[HKEY_USERS\S-1-5-21-1316576355-2183960598-615534113-1008\Software\Microsoft\Windows\ShellNoRoam\MUICache]

"C:\\WINDOWS\\system32\\cuciquud.exe"=-

[HKEY_USERS\S-1-5-21-1316576355-2183960598-615534113-1006\Software\Microsoft\Windows\ShellNoRoam\MUICache]

"C:\\Documents and Settings\\Frédérique\\Application Data\\Microsoft\\kokukequoo.exe"=-

[HKEY_USERS\S-1-5-21-1316576355-2183960598-615534113-1006\Software\Microsoft\Windows\ShellNoRoam\MUICache]

"C:\\WINDOWS\\system32\\kokukequoo.exe"=-

[HKEY_USERS\S-1-5-21-1316576355-2183960598-615534113-1008\Software\Microsoft\Windows\ShellNoRoam\MUICache]

"C:\\WINDOWS\\system32\\kokukequoo.exe"=-

File::

c:\Documents and Settings\LocalService\Application Data\Microsoft\kokukequoo.exe

C:\WINDOWS\system32\cuciquud.exe

C:\DOCUME~1\FRDRIQ~1\LOCALS~1\Temp\f0YmHzHK

C:\DOCUME~1\PAUL-E~1\LOCALS~1\Temp\asbp2poa.sys

C:\WINDOWS\system32\WinSys.exeOuvre le Bloc-Notes puis colle (Ctrl+V) le texte précédemment copié. (Bloc-Notes: démarrer > Tous les programmes > Accessoires > Bloc-Notes...)

Sauvegarde ce fichier sous le nom de: CFScript.txt

Comme l'image le montre, fais glisser CFScript.txt sur ComboFix.exe

Une fenêtre bleue va apparaître; au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises, c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Une fois le scan achevé, un rapport va s'afficher: poste son contenu dans ton prochain message.

Si le fichier ne s'ouvre pas, tu le trouveras dans -> C:\ComboFix.txt

ceci a été intentionnellement rédigé pour CET utilisateur.

si vous n'êtes pas CET utilisateur, NE PAS appliquer ces directives : elles pourraient endommager votre système.

Ordinoob · le 5 septembre 2008

j'ai fait un scan avec avira antivir qui m'a trouvé 10x le mme virus (le fameux kokukequo)..

Ci joint le rapport.

Avira AntiVir Personal

Report file date: jeudi 4 septembre 2008 22:42

Scanning for 1598352 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic

Serial number: 0000149996-ADJIE-0001

Platform: Windows XP

Windows version: (Service Pack 3) [5.1.2600]

Boot mode: Normally booted

Username: SYSTEM

Computer name: WHAOUUU

Version information:

BUILD.DAT : 8.1.0.331 16934 Bytes 12/08/2008 11:46:00

AVSCAN.EXE : 8.1.4.7 315649 Bytes 26/06/2008 08:57:53

AVSCAN.DLL : 8.1.4.0 40705 Bytes 26/05/2008 07:56:40

LUKE.DLL : 8.1.4.5 164097 Bytes 12/06/2008 12:44:19

LUKERES.DLL : 8.1.4.0 12033 Bytes 26/05/2008 07:58:52

ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 10:33:34

ANTIVIR1.VDF : 7.0.5.1 8182784 Bytes 24/06/2008 13:54:15

ANTIVIR2.VDF : 7.0.6.94 2998784 Bytes 31/08/2008 20:40:42

ANTIVIR3.VDF : 7.0.6.118 179712 Bytes 04/09/2008 20:40:45

Engineversion : 8.1.1.28

AEVDF.DLL : 8.1.0.5 102772 Bytes 25/02/2008 09:58:21

AESCRIPT.DLL : 8.1.0.70 319866 Bytes 04/09/2008 20:40:59

AESCN.DLL : 8.1.0.23 119156 Bytes 10/07/2008 12:44:49

AERDL.DLL : 8.1.1.1 397683 Bytes 04/09/2008 20:40:57

AEPACK.DLL : 8.1.2.1 364917 Bytes 15/07/2008 12:58:35

AEOFFICE.DLL : 8.1.0.23 196987 Bytes 04/09/2008 20:40:55

AEHEUR.DLL : 8.1.0.51 1397111 Bytes 04/09/2008 20:40:54

AEHELP.DLL : 8.1.0.15 115063 Bytes 10/07/2008 12:44:48

AEGEN.DLL : 8.1.0.36 315764 Bytes 04/09/2008 20:40:49

AEEMU.DLL : 8.1.0.7 430452 Bytes 31/07/2008 08:33:21

AECORE.DLL : 8.1.1.11 172406 Bytes 04/09/2008 20:40:48

AEBB.DLL : 8.1.0.1 53617 Bytes 10/07/2008 12:44:48

AVWINLL.DLL : 1.0.0.12 15105 Bytes 09/07/2008 08:40:05

AVPREF.DLL : 8.0.2.0 38657 Bytes 16/05/2008 09:28:01

AVREP.DLL : 8.0.0.2 98344 Bytes 04/09/2008 20:40:46

AVREG.DLL : 8.0.0.1 33537 Bytes 09/05/2008 11:26:40

AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:23

AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 12/06/2008 12:27:49

SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02

SMTPLIB.DLL : 1.2.0.23 28929 Bytes 12/06/2008 12:49:40

NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:10

RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 12/06/2008 13:48:07

RCTEXT.DLL : 8.0.52.0 86273 Bytes 27/06/2008 13:34:37

Configuration settings for the scan:

Jobname..........................: Complete system scan

Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp

Logging..........................: low

Primary action...................: interactive

Secondary action.................: ignore

Scan master boot sector..........: on

Scan boot sector.................: on

Boot sectors.....................: C:,

Process scan.....................: on

Scan registry....................: on

Search for rootkits..............: off

Scan all files...................: Intelligent file selection

Scan archives....................: on

Recursion depth..................: 20

Smart extensions.................: on

Macro heuristic..................: on

File heuristic...................: medium

Start of the scan: jeudi 4 septembre 2008 22:42

The scan of running processes will be started

Scan process 'avscan.exe' - '1' Module(s) have been scanned

Scan process 'avcenter.exe' - '1' Module(s) have been scanned

Scan process 'avgnt.exe' - '1' Module(s) have been scanned

Scan process 'avguard.exe' - '1' Module(s) have been scanned

Scan process 'sched.exe' - '1' Module(s) have been scanned

Scan process 'SpybotSD.exe' - '1' Module(s) have been scanned

Scan process 'wuauclt.exe' - '1' Module(s) have been scanned

Scan process 'COCIManager.exe' - '1' Module(s) have been scanned

Scan process 'KHALMNPR.exe' - '1' Module(s) have been scanned

Scan process 'KEM.exe' - '1' Module(s) have been scanned

Scan process 'dlbcserv.exe' - '1' Module(s) have been scanned

Scan process 'GoogleToolbarNotifier.exe' - '1' Module(s) have been scanned

Scan process 'CTXFISPI.EXE' - '1' Module(s) have been scanned

Scan process 'avgas.exe' - '1' Module(s) have been scanned

Scan process 'rundll32.exe' - '1' Module(s) have been scanned

Scan process 'LCDMedia.exe' - '1' Module(s) have been scanned

Scan process 'LCDPop3.exe' - '1' Module(s) have been scanned

Scan process 'LCDClock.exe' - '1' Module(s) have been scanned

Scan process 'LCDCountdown.exe' - '1' Module(s) have been scanned

Scan process 'Communications_Helper.exe' - '1' Module(s) have been scanned

Scan process 'ehmsas.exe' - '1' Module(s) have been scanned

Scan process 'Quickcam.exe' - '1' Module(s) have been scanned

Scan process 'LGDCore.exe' - '1' Module(s) have been scanned

Scan process 'LCDMon.exe' - '1' Module(s) have been scanned

Scan process 'CTHELPER.EXE' - '1' Module(s) have been scanned

Scan process 'tfswctrl.exe' - '1' Module(s) have been scanned

Scan process 'DVDLauncher.exe' - '1' Module(s) have been scanned

Scan process 'ehtray.exe' - '1' Module(s) have been scanned

Scan process 'ctfmon.exe' - '1' Module(s) have been scanned

Scan process 'mcagent.exe' - '1' Module(s) have been scanned

Scan process 'SiteAdv.exe' - '1' Module(s) have been scanned

Scan process 'jusched.exe' - '1' Module(s) have been scanned

Scan process 'VolPanel.exe' - '1' Module(s) have been scanned

Scan process 'DLLML.exe' - '1' Module(s) have been scanned

Scan process 'explorer.exe' - '1' Module(s) have been scanned

Scan process 'LVComSer.exe' - '1' Module(s) have been scanned

Scan process 'winlogon.exe' - '1' Module(s) have been scanned

Scan process 'csrss.exe' - '1' Module(s) have been scanned

Scan process 'WLLoginProxy.exe' - '1' Module(s) have been scanned

Scan process 'iexplore.exe' - '1' Module(s) have been scanned

Scan process 'AcroRd32.exe' - '1' Module(s) have been scanned

Scan process 'WINWORD.EXE' - '1' Module(s) have been scanned

Scan process 'COCIManager.exe' - '1' Module(s) have been scanned

Scan process 'KHALMNPR.exe' - '1' Module(s) have been scanned

Scan process 'KEM.exe' - '1' Module(s) have been scanned

Scan process 'dlbcserv.exe' - '1' Module(s) have been scanned

Scan process 'GoogleToolbarNotifier.exe' - '1' Module(s) have been scanned

Scan process 'steam.exe' - '1' Module(s) have been scanned

Scan process 'mcsysmon.exe' - '1' Module(s) have been scanned

Scan process 'ctfmon.exe' - '1' Module(s) have been scanned

Scan process 'avgas.exe' - '1' Module(s) have been scanned

Scan process 'rundll32.exe' - '1' Module(s) have been scanned

Scan process 'LCDMedia.exe' - '1' Module(s) have been scanned

Scan process 'LCDPop3.exe' - '1' Module(s) have been scanned

Scan process 'LCDCountdown.exe' - '1' Module(s) have been scanned

Scan process 'LCDClock.exe' - '1' Module(s) have been scanned

Scan process 'EKIJ5000MUI.exe' - '1' Module(s) have been scanned

Scan process 'Communications_Helper.exe' - '1' Module(s) have been scanned

Scan process 'Quickcam.exe' - '1' Module(s) have been scanned

Scan process 'LGDCore.exe' - '1' Module(s) have been scanned

Scan process 'LCDMon.exe' - '1' Module(s) have been scanned

Scan process 'ehmsas.exe' - '1' Module(s) have been scanned

Scan process 'CTHELPER.EXE' - '1' Module(s) have been scanned

Scan process 'tfswctrl.exe' - '1' Module(s) have been scanned

Scan process 'DVDLauncher.exe' - '1' Module(s) have been scanned

Scan process 'ehtray.exe' - '1' Module(s) have been scanned

Scan process 'McAfeeDataBackup.exe' - '1' Module(s) have been scanned

Scan process 'CTXFISPI.EXE' - '1' Module(s) have been scanned

Scan process 'SiteAdv.exe' - '1' Module(s) have been scanned

Scan process 'jusched.exe' - '1' Module(s) have been scanned

Scan process 'VolPanel.exe' - '1' Module(s) have been scanned

Scan process 'DLLML.exe' - '1' Module(s) have been scanned

Scan process 'explorer.exe' - '1' Module(s) have been scanned

Scan process 'mcagent.exe' - '1' Module(s) have been scanned

Scan process 'alg.exe' - '1' Module(s) have been scanned

Scan process 'dllhost.exe' - '1' Module(s) have been scanned

Scan process 'mcrdsvc.exe' - '1' Module(s) have been scanned

Scan process 'UAService7.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'PnkBstrA.exe' - '1' Module(s) have been scanned

Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned

Scan process 'msksrver.exe' - '1' Module(s) have been scanned

Scan process 'MpfSrv.exe' - '1' Module(s) have been scanned

Scan process 'Mcshield.exe' - '1' Module(s) have been scanned

Scan process 'McProxy.exe' - '1' Module(s) have been scanned

Scan process 'McNASvc.exe' - '1' Module(s) have been scanned

Scan process 'mcmscsvc.exe' - '1' Module(s) have been scanned

Scan process 'MBackMonitor.exe' - '1' Module(s) have been scanned

Scan process 'LVComSer.exe' - '1' Module(s) have been scanned

Scan process 'KodakSvc.exe' - '1' Module(s) have been scanned

Scan process 'ehSched.exe' - '1' Module(s) have been scanned

Scan process 'ehrecvr.exe' - '1' Module(s) have been scanned

Scan process 'CTSVCCDA.EXE' - '1' Module(s) have been scanned

Scan process 'guard.exe' - '0' Module(s) have been scanned

Scan process 'LEXPPS.EXE' - '1' Module(s) have been scanned

Scan process 'LVPrcSrv.exe' - '1' Module(s) have been scanned

Scan process 'spoolsv.exe' - '1' Module(s) have been scanned

Scan process 'LEXBCES.EXE' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'lsass.exe' - '1' Module(s) have been scanned

Scan process 'services.exe' - '1' Module(s) have been scanned

Scan process 'winlogon.exe' - '1' Module(s) have been scanned

Scan process 'csrss.exe' - '1' Module(s) have been scanned

Scan process 'smss.exe' - '1' Module(s) have been scanned

109 processes with 109 modules were scanned

Starting master boot sector scan:

Master boot sector HD0

[iNFO] No virus was found!

Master boot sector HD1

[iNFO] No virus was found!

[WARNING] System error [21]: Le périphérique n'est pas prêt.

Master boot sector HD2

[iNFO] No virus was found!

[WARNING] System error [21]: Le périphérique n'est pas prêt.

Master boot sector HD3

[iNFO] No virus was found!

[WARNING] System error [21]: Le périphérique n'est pas prêt.

Master boot sector HD4

[iNFO] No virus was found!

[WARNING] System error [21]: Le périphérique n'est pas prêt.

Start scanning boot sectors:

Boot sector 'C:\'

[iNFO] No virus was found!

Starting to scan the registry.

The registry was scanned ( '69' files ).

Starting the file scan:

Begin scan in 'C:\'

C:\hiberfil.sys

[WARNING] The file could not be opened!

C:\pagefile.sys

[WARNING] The file could not be opened!

C:\Documents and Settings\LocalService\Application Data\Microsoft\kokukequoo.exe

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

[NOTE] The file was deleted!

C:\Documents and Settings\Paul-Emile\Local Settings\Temporary Internet Files\Content.IE5\ZYSD4F4Z\enavweb[1].cab

[0] Archive type: CAB (Microsoft)

--> navex32a.dll

[WARNING] No further files can be extracted from this archive. The archive will be closed

C:\Documents and Settings\Valérian\Local Settings\Temp\hoonapezy.tmp

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

[NOTE] The file was deleted!

C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP1002\A0410372.exe

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

[NOTE] The file was deleted!

C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP1002\A0410374.exe

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

[NOTE] The file was deleted!

C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP1003\A0411398.exe

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

[NOTE] The file was moved to '48f4620c.qua'!

C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP1003\A0411409.exe

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

[NOTE] The file was deleted!

C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP1003\A0412429.exe

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

[NOTE] The file was deleted!

C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP1008\A0412593.exe

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

[NOTE] The file was deleted!

C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP1023\A0418544.exe

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

[NOTE] The file was deleted!

C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP998\A0409720.exe

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

[NOTE] The file was deleted!

C:\WINDOWS\system32\drivers\sptd.sys

[WARNING] The file could not be opened!

C:\WINDOWS\system32\drivers\sptd9533.sys

[WARNING] The file could not be opened!

C:\_OTMoveIt\MovedFiles\09022008_211037\Documents and Settings\Frédérique\Application Data\Microsoft\kokukequoo.exe

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

[NOTE] The file was deleted!

End of the scan: vendredi 5 septembre 2008 00:57

Used time: 2:14:54 Hour(s)

The scan has been done completely.

10258 Scanning directories

468161 Files were scanned

11 viruses and/or unwanted programs were found

0 Files were classified as suspicious:

10 files were deleted

0 files were repaired

1 files were moved to quarantine

0 files were renamed

4 Files cannot be scanned

468146 Files not concerned

8142 Archives were scanned

9 Warnings

11 Notes