Des entrées ambigue au startup

Salut gen-hackman,

Je viens d'effectuer ce que tu m'as dit, j'ai vu encore que ces entrées en forme de carré et soohep.exe persistent. Par ailleurs, USBFix s'est bloqué a la fin du scan avec une erreur tels que affiché :
erreur:
szAppName : UsbFix.exe szAppVer : 3.3.6.1 szModName : hungapp
szModVer : 0.0.0.0 offset : 00000000
détails de l'erreur:
C:\DOCUME~1\UUR~1.MAR\LOCALS~1\Temp\WER5aed.dir00\UsbFix.exe.mdmp
C:\DOCUME~1\UUR~1.MAR\LOCALS~1\Temp\WER5aed.dir00\appcompat.txt

voici le rapport de USBFix:

############################## | UsbFix 7.035 | [Deletion]

User: U?UR (Administrator) # MARLEY [ ]
Updated 22/11/10 by El Desaparecido / C_XX
Started at 21:58:35 | 01/12/2010
Website: http://www.teamxscript.org
Contact: eldesaparecido@teamxscript.org

CPU: Intel(R) Pentium(R) M processor 1.70GHz
Microsoft Windows XP Professional (5.1.2600 32-Bit) # Service Pack 3
Internet Explorer 6.0.2900.5512

Windows Firewall: Enabled
RAM -> 238 Mb
C:\ (%systemdrive%) -> Fixed drive # 37 Gb (9 Mb free - 24%) [] # NTFS
F:\ -> Removable drive # 4 Gb (2 Mb free - 62%) [] # FAT32

################## | Files # Infected Folders |


Deleted ! C:\Documents and Settings\U?UR.MARLEY\ebbchwnh.exe
Deleted ! C:\WINDOWS\system32\ebbchwnh.exe
Deleted ! C:\Recycler\S-1-5-21-0044629290-0123819507-219096096-5386
Deleted ! C:\Recycler\S-1-5-21-0044765529-2887808770-288442461-6311
Deleted ! C:\Recycler\S-1-5-21-0950571379-7838780252-933500036-8083
Deleted ! C:\Recycler\S-1-5-21-1078081533-492894223-1957994488-1003
Deleted ! C:\Recycler\S-1-5-21-1215716771-6494785920-514718455-9839
Deleted ! C:\Recycler\S-1-5-21-1638715060-1268142041-950536441-8008
Deleted ! C:\Recycler\S-1-5-21-1807366701-3520463139-163213481-4097
Deleted ! C:\Recycler\S-1-5-21-2006505710-0932960453-188903409-5529
Deleted ! C:\Recycler\S-1-5-21-2394199499-2268493707-898062877-4959
Deleted ! C:\Recycler\S-1-5-21-3026800197-7666442271-718038896-0121
Deleted ! C:\Recycler\S-1-5-21-3212427308-4457815566-873635960-2844
Deleted ! C:\Recycler\S-1-5-21-3394462089-3468443757-1289024687-1003
Deleted ! C:\Recycler\S-1-5-21-43792566-3640036204-158851526-1006
Deleted ! C:\Recycler\S-1-5-21-4410934517-2226937856-787209093-0158
Deleted ! C:\Recycler\S-1-5-21-515967899-436374069-842925246-1003
Deleted ! C:\Recycler\S-1-5-21-5728251009-6781320663-556049709-1727
Deleted ! C:\Recycler\S-1-5-21-6171183864-7286780692-517241421-1555
Deleted ! C:\Recycler\S-1-5-21-6173461757-4514403944-038660624-1524
Deleted ! C:\Recycler\S-1-5-21-6887691038-4879781895-771044964-0921
Deleted ! C:\Recycler\S-1-5-21-7001030808-6474214180-031522585-7926
Deleted ! C:\Recycler\S-1-5-21-7844085361-6695326712-067630530-5614
Deleted ! C:\Recycler\S-1-5-21-8433168844-0233170084-158172527-1305
Deleted ! C:\Recycler\S-1-5-21-9372514936-2711189894-638836455-7056
Deleted ! C:\Recycler\S-1-5-21-9652121230-8319989802-601215879-6425
Deleted ! C:\autorun.inf

################## | Registry |

Deleted ! HKLM\software\microsoft\shared tools\msconfig\startupreg\MSConfig
Deleted ! HKLM\software\microsoft\windows nt\currentversion\winlogon|Taskman

################## | Mountpoints2 |

Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\D
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{9342e850-f944-11de-95c9-00c09fc1189c}

################## | Listing |

[30/11/2010 - 03:46:35 | D ] C:\18628-020410
[30/11/2010 - 03:22:03 | D ] C:\234
[06/03/2010 - 22:21:19 | D ] C:\6b6faabc2cabe2a24eef0f82
[29/11/2004 - 14:42:34 | N | 0] C:\AUTOEXEC.BAT
[08/10/2010 - 22:22:49 | N | 211] C:\Boot.bak
[29/11/2010 - 23:54:24 | N | 327] C:\boot.ini
[22/11/2001 - 13:00:00 | N | 4952] C:\Bootfont.bin
[29/11/2010 - 22:34:52 | D ] C:\cmdcons
[03/08/2004 - 23:00:00 | N | 260272] C:\cmldr
[29/11/2010 - 03:30:49 | D ] C:\Config.Msi
[29/11/2004 - 14:42:34 | N | 0] C:\CONFIG.SYS
[27/09/2010 - 17:38:39 | D ] C:\documents
[22/10/2010 - 01:46:26 | D ] C:\Documents and Settings
[08/10/2010 - 18:27:14 | ASH | 250073088] C:\hiberfil.sys
[25/10/2010 - 23:14:06 | D ] C:\Hotspot Shield
[29/11/2004 - 15:24:58 | D ] C:\I386
[06/12/2004 - 09:58:17 | D ] C:\Intel
[29/11/2004 - 14:42:34 | N | 0] C:\IO.SYS
[29/11/2004 - 14:42:34 | N | 0] C:\MSDOS.SYS
[07/02/2005 - 09:49:05 | RHD ] C:\MSOCache
[13/04/2008 - 08:43:04 | N | 47564] C:\NTDETECT.COM
[13/04/2008 - 10:32:06 | N | 250560] C:\ntldr
[01/12/2010 - 17:13:31 | ASH | 374341632] C:\pagefile.sys
[09/03/2010 - 06:28:35 | D ] C:\PFiles
[29/11/2010 - 03:28:27 | D ] C:\Program Files
[30/11/2010 - 03:37:14 | D ] C:\Qoobox
[01/12/2010 - 22:01:11 | SHD ] C:\RECYCLER
[29/11/2004 - 16:32:29 | D ] C:\SUPPORT
[07/02/2005 - 10:57:18 | N | 127] C:\SWSTAMP.TXT
[30/11/2010 - 03:41:09 | SHD ] C:\System Volume Information
[27/10/2010 - 19:32:57 | D ] C:\Temp
[01/12/2010 - 22:01:11 | D ] C:\UsbFix
[01/12/2010 - 22:01:17 | A | 2620] C:\UsbFix.txt
[29/11/2004 - 16:32:29 | D ] C:\VALUEADD
[01/12/2010 - 00:49:02 | D ] C:\WINDOWS
[30/11/2010 - 12:01:42 | N | 209608200] F:\TLMMREN.KnowN.part21.rar
[30/11/2010 - 12:17:22 | N | 209608200] F:\TLMMREN.KnowN.part22.rar
[30/11/2010 - 12:17:58 | N | 209608200] F:\TLMMREN.KnowN.part23.rar
[30/11/2010 - 12:33:40 | N | 209608200] F:\TLMMREN.KnowN.part24.rar
[30/11/2010 - 12:36:44 | N | 209608200] F:\TLMMREN.KnowN.part25.rar
[30/11/2010 - 12:51:40 | N | 209608200] F:\TLMMREN.KnowN.part26.rar
[30/11/2010 - 12:54:34 | N | 209608200] F:\TLMMREN.KnowN.part27.rar
[30/11/2010 - 12:55:38 | N | 38970734] F:\TLMMREN.KnowN.part28.rar

################## | Vaccin |

C:\Autorun.inf -> Folder created by UsbFix (El Desaparecido & C_XX)
F:\Autorun.inf -> Folder created by UsbFix (El Desaparecido & C_XX)

Salut gen-hackman,

Voici les liens aux raports générés par OTL qui ne s'executait sans etre bloqué sur mon ordi qu'en mode sans echec.

Lien fichier OTL.txt : http://www.cijoint.fr/cjlink.php?file=cj201012/ciji0l5Lu0.txt
Lien au fichier Extras.txt : http://www.cijoint.fr/cjlink.php?file=cj201012/cij0kC6hLG.txt

Salut,
Voici le lien a la page du premier ficihier analysé:
http://www.virustotal.com/file-scan/report.html?id=7ae9aae77884ac0baa2f8168b3ed4de0c0c9834a42d8e5a775f47a2c66cec237-1291317123

Et le deuixieme, malgré des efforts, il voulait pas monter dans le bateau, bloqueait la page de la site a chaque tentative avant meme qu'il aille se faire analyser. Donc, pas de raport du deuixieme. Je comprends pas.

Re,
Le rapport ci-dessous généré depuis l'éxécution du ComboFix en mode sans echec car il se bloquait en mode normal. Mais les inconnus en forme de carré existent encore mais apparemment il a degagé quelques infection mais pas la totalité car dans le menu startup il y a des entrées en "exe" bizarres. Voici le rapport de ComboFix:

ComboFix 10-12-02.01 - U?UR 02.12.2010 23:28:56.1.1 - x86 MINIMAL
Microsoft Windows XP Professional 5.1.2600.3.1254.90.1055.18.238.123 [GMT 2:00]
Running from: c:\documents and settings\U?UR.MARLEY\Desktop\ugur.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users.WINDOWS\Application Data\common.data
c:\documents and settings\U?UR.MARLEY\Application Data\Microsoft\zonekoozys.exe
c:\windows\system32\1055
c:\windows\Zxakoa.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_SSHNAS


((((((((((((((((((((((((( Files Created from 2010-11-02 to 2010-12-02 )))))))))))))))))))))))))))))))
.

2010-12-02 21:39 . 2010-12-02 21:39 -------- d-----w- c:\windows\system32\1055
2010-12-02 20:07 . 2010-12-02 20:07 -------- d-----w- c:\program files\Auralog
2010-12-02 20:04 . 2010-12-02 20:04 -------- d-----w- c:\windows\LastGood.Tmp
2010-12-02 20:04 . 2009-02-24 16:42 116736 ----a-w- c:\windows\system32\drivers\mcdbus.sys
2010-12-02 19:56 . 2010-12-02 19:56 438888 ----a-w- c:\program files\VDCsetup.exe
2010-12-01 19:57 . 2010-12-02 18:08 -------- d-----w- C:\UsbFix
2010-11-30 01:02 . 2010-11-30 01:22 -------- d-----w- C:\234
2010-11-29 19:31 . 2010-11-29 19:45 7168 ----a-w- c:\windows\system32\drivers\utezmtyx.sys
2010-11-29 19:31 . 2010-11-29 19:45 10240 ----a-w- c:\windows\system32\drivers\ujezmtyx.sys
2010-11-29 17:48 . 2009-10-22 10:54 37392 ----a-w- c:\windows\system32\drivers\10923642.sys
2010-11-29 17:48 . 2009-10-09 20:31 315408 ----a-w- c:\windows\system32\drivers\1092364.sys
2010-11-29 17:48 . 2009-09-25 14:59 128016 ----a-w- c:\windows\system32\drivers\10923641.sys
2010-11-29 01:30 . 2010-10-27 16:25 31552 ----a-w- c:\windows\system32\TURegOpt.exe
2010-11-29 01:30 . 2010-10-27 16:21 29504 ----a-w- c:\windows\system32\uxtuneup.dll
2010-11-29 01:29 . 2010-11-29 01:29 -------- d-----w- c:\documents and settings\U?UR.MARLEY\Application Data\TuneUp Software
2010-11-29 01:28 . 2010-11-29 01:35 -------- d-----w- c:\program files\TuneUp Utilities 2011
2010-11-29 01:27 . 2010-11-29 01:37 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\TuneUp Software
2010-11-29 01:27 . 2010-11-29 01:27 -------- d-sh--w- c:\documents and settings\All Users.WINDOWS\Application Data\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}
2010-11-28 17:21 . 2010-11-28 17:21 82944 ----a-w- c:\windows\system32\drivers\cbudfhcw.sys
2010-11-28 16:10 . 2010-11-10 08:19 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-11-28 16:10 . 2010-11-28 16:10 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-11-28 16:10 . 2010-11-10 08:19 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-11-28 14:38 . 2010-11-28 14:38 -------- d-----w- c:\program files\URUSoft
2010-11-28 01:24 . 2010-11-28 15:52 -------- d-----w- c:\documents and settings\U?UR.MARLEY\Application Data\Malwarebytes
2010-11-28 01:24 . 2010-11-28 15:52 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes
2010-11-28 00:10 . 2010-11-28 00:10 -------- d-----w- c:\documents and settings\U?UR.MARLEY\Application Data\TrojanHunter
2010-11-27 23:08 . 2010-11-27 23:08 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\TrojanHunter
2010-11-27 23:07 . 2010-12-02 19:30 -------- d-----w- c:\program files\TrojanHunter 5.3
2010-11-27 00:30 . 2008-04-14 06:00 221184 ----a-w- c:\windows\system32\wmpns.dll
2010-11-25 16:26 . 2010-11-25 16:26 -------- d-----w- c:\documents and settings\U?UR.MARLEY\Application Data\U3
2010-11-05 12:50 . 2010-11-05 12:50 -------- d-----w- c:\program files\MWSnap

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-12-02 19:40 . 2010-10-09 16:36 436792 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-10-20 16:10 . 2010-10-20 16:10 73728 ----a-w- c:\windows\system32\javacpl.cpl
2010-10-20 16:10 . 2010-10-20 16:10 472808 ----a-w- c:\windows\system32\deployJava1.dll
2010-10-18 08:00 . 2010-10-20 23:03 108032 ----a-w- c:\windows\system32\ff_vfw.dll
2010-10-09 18:44 . 2010-10-09 18:42 1736081 ----a-w- c:\documents and settings\U?UR.MARLEY\Application Data\winrar3.93.exe
2010-09-22 19:19 . 2010-09-22 19:19 32768 ----a-w- c:\windows\system32\drivers\taphss.sys
2010-09-20 12:51 . 2010-09-20 12:51 499712 ----a-w- c:\windows\system32\msvcp71.dll
2010-09-20 12:51 . 2010-09-20 12:51 348160 ----a-w- c:\windows\system32\msvcr71.dll
2010-09-09 14:15 . 2010-10-08 20:04 369664 ----a-w- c:\windows\system32\html.iec
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"THGuard"="c:\program files\TrojanHunter 5.3\THGuard.exe" [2010-10-23 1070360]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2010-11-10 443728]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKLM\~\startupfolder\C:^Documents and Settings^U?UR.MARLEY^Start Menu^Programlar^Ba?lang?ç^001hyab.exe]
path=c:\documents and settings\U?UR.MARLEY\Start Menu\Programlar\Ba?lang?ç\001hyab.exe
backup=c:\windows\pss\001hyab.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^U?UR.MARLEY^Start Menu^Programlar^Ba?lang?ç^01fkmzz.exe]
path=c:\documents and settings\U?UR.MARLEY\Start Menu\Programlar\Ba?lang?ç\01fkmzz.exe
backup=c:\windows\pss\01fkmzz.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^U?UR.MARLEY^Start Menu^Programlar^Ba?lang?ç^01ypjws.exe]
path=c:\documents and settings\U?UR.MARLEY\Start Menu\Programlar\Ba?lang?ç\01ypjws.exe
backup=c:\windows\pss\01ypjws.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^U?UR.MARLEY^Start Menu^Programlar^Ba?lang?ç^55acvdy.exe]
path=c:\documents and settings\U?UR.MARLEY\Start Menu\Programlar\Ba?lang?ç\55acvdy.exe
backup=c:\windows\pss\55acvdy.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^U?UR.MARLEY^Start Menu^Programlar^Ba?lang?ç^acvdygbj.exe]
path=c:\documents and settings\U?UR.MARLEY\Start Menu\Programlar\Ba?lang?ç\acvdygbj.exe
backup=c:\windows\pss\acvdygbj.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^U?UR.MARLEY^Start Menu^Programlar^Ba?lang?ç^d01ypjws5mb.exe]
path=c:\documents and settings\U?UR.MARLEY\Start Menu\Programlar\Ba?lang?ç\d01ypjws5mb.exe
backup=c:\windows\pss\d01ypjws5mb.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^U?UR.MARLEY^Start Menu^Programlar^Ba?lang?ç^ebd00bjmip.exe]
path=c:\documents and settings\U?UR.MARLEY\Start Menu\Programlar\Ba?lang?ç\ebd00bjmip.exe
backup=c:\windows\pss\ebd00bjmip.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^U?UR.MARLEY^Start Menu^Programlar^Ba?lang?ç^fua55grbmw.exe]
path=c:\documents and settings\U?UR.MARLEY\Start Menu\Programlar\Ba?lang?ç\fua55grbmw.exe
backup=c:\windows\pss\fua55grbmw.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^U?UR.MARLEY^Start Menu^Programlar^Ba?lang?ç^pakv5qabmw.exe]
path=c:\documents and settings\U?UR.MARLEY\Start Menu\Programlar\Ba?lang?ç\pakv5qabmw.exe
backup=c:\windows\pss\pakv5qabmw.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^U?UR.MARLEY^Start Menu^Programlar^Ba?lang?ç^setup_9.0.0.722_29.11.2010_08-16.lnk]
path=c:\documents and settings\U?UR.MARLEY\Start Menu\Programlar\Ba?lang?ç\setup_9.0.0.722_29.11.2010_08-16.lnk
backup=c:\windows\pss\setup_9.0.0.722_29.11.2010_08-16.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^U?UR.MARLEY^Start Menu^Programlar^Ba?lang?ç^ybdx00tvya.exe]
path=c:\documents and settings\U?UR.MARLEY\Start Menu\Programlar\Ba?lang?ç\ybdx00tvya.exe
backup=c:\windows\pss\ybdx00tvya.exeStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]
???? [?]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Run]
???? [?]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-09-20 20:07 932288 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-09-23 01:47 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2010-04-16 19:10 3872080 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Registry Cleaner Scheduler]
2010-10-08 19:00 1401224 ----a-w- c:\program files\CleanMyPC\Registry Cleaner\RCHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpeedUpMyPC]
2010-06-25 10:26 67960 ----a-w- c:\program files\Uniblue\SpeedUpMyPC\Launcher.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=

R0 10923642;10923642 Boot Guard Driver;c:\windows\system32\drivers\10923642.sys [29.11.2010 19:48 37392]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [09.10.2010 18:36 436792]
R1 10923641;10923641;c:\windows\system32\drivers\10923641.sys [29.11.2010 19:48 128016]
R1 setup_9.0.0.722_29.11.2010_08-16drv;setup_9.0.0.722_29.11.2010_08-16drv;c:\windows\system32\drivers\1092364.sys [29.11.2010 19:48 315408]
R1 SMBHC;Microsoft SM Yolu Ana Denetleyici Sürücüsü;c:\windows\system32\drivers\smbhc.sys [17.08.2001 22:57 6784]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [28.11.2010 18:10 363344]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe [27.10.2010 18:23 1483072]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [28.11.2010 18:10 20952]
R3 SMBBATT;Microsoft Ak?ll? Pil Sürücüsü;c:\windows\system32\drivers\smbbatt.sys [13.04.2008 13:36 16000]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys [07.10.2010 13:34 10064]
S2 cbudfhcw;cbudfhcw;c:\windows\system32\drivers\cbudfhcw.sys [28.11.2010 19:21 82944]
S2 xrqoecbo;xrqoecbo; [x]
S2 yieymy1t5o;BsHelpCS;c:\documents and settings\U?UR.MARLEY\Application Data\Microsoft\gyzykav.exe --> c:\documents and settings\U?UR.MARLEY\Application Data\Microsoft\gyzykav.exe [?]
S3 nosGetPlusHelper;getPlus(R) Helper 3004;c:\windows\System32\svchost.exe -k nosGetPlusHelper [08.10.2010 22:06 14336]
S3 utezmtyx;AVZ Kernel Driver;c:\windows\system32\drivers\utezmtyx.sys [29.11.2010 21:31 7168]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
nosGetPlusHelper REG_MULTI_SZ nosGetPlusHelper

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
.
------- Supplementary Scan -------
.
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\U?UR.MARLEY\Application Data\Mozilla\Firefox\Profiles\n1dvxvd5.default\
FF - prefs.js: browser.startup.homepage - hxxp://go.microsoft.com/fwlink/?LinkId=69157
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - Extension: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Extension: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Extension: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Extension: FlashGot: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34} - c:\documents and settings\U?UR.MARLEY\Application Data\Mozilla\Firefox\Profiles\n1dvxvd5.default\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}
FF - Extension: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - c:\documents and settings\U?UR.MARLEY\Application Data\Mozilla\Firefox\Profiles\n1dvxvd5.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}

---- FIREFOX POLICIES ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.
- - - - ORPHANS REMOVED - - - -

SafeBoot-bgdvemun
SafeBoot-cbudfhcw
SafeBoot-nrngxqfd
SafeBoot-nyywtuvw.sys
SafeBoot-pnpnmqzd
SafeBoot-unvmdumr
SafeBoot-xrqoecbo
MSConfigStartUp-AlcoholAutomount - c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe
MSConfigStartUp-pugamaj - c:\documents and settings\U?UR.MARLEY\Application Data\Microsoft\soohep.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-12-02 23:42
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2010-12-02 23:49:05 - machine was rebooted
ComboFix-quarantined-files.txt 2010-12-02 21:48

Pre-Run: 9.452.777.472 bayt bo?
Post-Run: 9.702.739.968 bayt bo?

- - End Of File - - FAAB9735A5A70D1DDC119A1C1C751284

A +

Voici les entrées inconnues en demonstration au lien:

http://www.cijoint.fr/cjlink.php?file=cj201012/cij5km5z8F.jpg

Re,
Voici le rapport du ComboFix avec l'analyse par le script qu'on a créé, mais les truck "carrés???" sont encore la apparemment:
ComboFix 10-12-02.06 - U?UR 03.12.2010 22:30:36.1.1 - x86 MINIMAL
Microsoft Windows XP Professional 5.1.2600.3.1254.90.1055.18.238.133 [GMT 2:00]
Running from: c:\documents and settings\U?UR.MARLEY\Desktop\ugur.exe
Command switches used :: c:\documents and settings\U?UR.MARLEY\Desktop\CFScript.txt

FILE ::
"c:\documents and settings\U?UR.MARLEY\Application Data\Microsoft\gyzykav.exe"
"c:\documents and settings\U?UR.MARLEY\Application Data\winrar3.93.exe"
"c:\windows\system32\drivers\cbudfhcw.sys"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users.WINDOWS\Application Data\common.data
c:\documents and settings\U?UR.MARLEY\Application Data\winrar3.93.exe
C:\Install.exe
c:\windows\system32\1055
c:\windows\system32\drivers\cbudfhcw.sys

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_CBUDFHCW
-------\Legacy_XRQOECBO
-------\Legacy_YIEYMY1T5O
-------\Service_cbudfhcw
-------\Service_xrqoecbo
-------\Service_yieymy1t5o


((((((((((((((((((((((((( Files Created from 2010-11-03 to 2010-12-03 )))))))))))))))))))))))))))))))
.

2010-12-03 20:39 . 2010-12-03 20:39 -------- d-----w- c:\windows\system32\1055
2010-12-03 13:42 . 2010-12-03 13:42 -------- d-----w- c:\program files\Auralog
2010-12-02 23:44 . 2010-12-02 23:51 -------- d-----w- c:\documents and settings\U?UR.MARLEY\Application Data\DAEMON Tools Lite
2010-12-02 23:43 . 2010-12-02 23:44 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\DAEMON Tools Lite
2010-12-02 22:53 . 2010-05-21 06:14 186392 ----a-w- c:\windows\system32\drivers\vdrv1000.sys
2010-12-02 22:53 . 2010-03-10 14:34 13952 ----a-w- c:\windows\system32\drivers\HH10Help.sys
2010-12-02 22:52 . 2010-12-02 22:55 -------- d-s---w- c:\documents and settings\U?UR.MARLEY\Application Data\Virtual CD v10
2010-12-02 22:52 . 2004-07-13 08:58 315392 ----a-w- c:\windows\system32\NCTAudioPlayer2.dll
2010-12-02 22:52 . 2004-07-13 08:57 1843200 ----a-w- c:\windows\system32\NCTAudioFile2.dll
2010-12-02 22:51 . 2010-12-02 22:52 -------- d-----w- c:\program files\Virtual CD v10
2010-12-02 22:50 . 2010-12-02 22:50 -------- d-----w- c:\documents and settings\U?UR.MARLEY\Application Data\InstallShield
2010-12-02 20:04 . 2009-02-24 16:42 116736 ----a-w- c:\windows\system32\drivers\mcdbus.sys
2010-12-02 19:56 . 2010-12-02 19:56 438888 ----a-w- c:\program files\VDCsetup.exe
2010-12-01 19:57 . 2010-12-02 18:08 -------- d-----w- C:\UsbFix
2010-11-30 01:02 . 2010-11-30 01:22 -------- d-----w- C:\234
2010-11-29 19:31 . 2010-11-29 19:45 7168 ----a-w- c:\windows\system32\drivers\utezmtyx.sys
2010-11-29 19:31 . 2010-11-29 19:45 10240 ----a-w- c:\windows\system32\drivers\ujezmtyx.sys
2010-11-29 17:48 . 2009-10-22 10:54 37392 ----a-w- c:\windows\system32\drivers\10923642.sys
2010-11-29 17:48 . 2009-10-09 20:31 315408 ----a-w- c:\windows\system32\drivers\1092364.sys
2010-11-29 17:48 . 2009-09-25 14:59 128016 ----a-w- c:\windows\system32\drivers\10923641.sys
2010-11-29 01:30 . 2010-10-27 16:25 31552 ----a-w- c:\windows\system32\TURegOpt.exe
2010-11-29 01:30 . 2010-10-27 16:21 29504 ----a-w- c:\windows\system32\uxtuneup.dll
2010-11-29 01:29 . 2010-11-29 01:29 -------- d-----w- c:\documents and settings\U?UR.MARLEY\Application Data\TuneUp Software
2010-11-29 01:28 . 2010-11-29 01:35 -------- d-----w- c:\program files\TuneUp Utilities 2011
2010-11-29 01:27 . 2010-11-29 01:37 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\TuneUp Software
2010-11-29 01:27 . 2010-11-29 01:27 -------- d-sh--w- c:\documents and settings\All Users.WINDOWS\Application Data\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}
2010-11-28 16:10 . 2010-11-10 08:19 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-11-28 16:10 . 2010-11-28 16:10 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-11-28 16:10 . 2010-11-10 08:19 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-11-28 14:38 . 2010-11-28 14:38 -------- d-----w- c:\program files\URUSoft
2010-11-28 01:24 . 2010-11-28 15:52 -------- d-----w- c:\documents and settings\U?UR.MARLEY\Application Data\Malwarebytes
2010-11-28 01:24 . 2010-11-28 15:52 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes
2010-11-28 00:10 . 2010-11-28 00:10 -------- d-----w- c:\documents and settings\U?UR.MARLEY\Application Data\TrojanHunter
2010-11-27 23:08 . 2010-11-27 23:08 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\TrojanHunter
2010-11-27 23:07 . 2010-12-02 19:30 -------- d-----w- c:\program files\TrojanHunter 5.3
2010-11-27 00:30 . 2008-04-14 06:00 221184 ----a-w- c:\windows\system32\wmpns.dll
2010-11-25 16:26 . 2010-11-25 16:26 -------- d-----w- c:\documents and settings\U?UR.MARLEY\Application Data\U3
2010-11-06 09:37 . 2010-11-06 09:37 103864 ----a-w- c:\program files\Mozilla Firefox\plugins\nppdf32.dll
2010-11-06 09:37 . 2010-11-06 09:37 103864 ----a-w- c:\program files\Internet Explorer\PLUGINS\nppdf32.dll
2010-11-05 12:50 . 2010-11-05 12:50 -------- d-----w- c:\program files\MWSnap

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-12-02 19:40 . 2010-10-09 16:36 436792 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-10-20 16:10 . 2010-10-20 16:10 73728 ----a-w- c:\windows\system32\javacpl.cpl
2010-10-20 16:10 . 2010-10-20 16:10 472808 ----a-w- c:\windows\system32\deployJava1.dll
2010-10-18 08:00 . 2010-10-20 23:03 108032 ----a-w- c:\windows\system32\ff_vfw.dll
2010-09-22 19:19 . 2010-09-22 19:19 32768 ----a-w- c:\windows\system32\drivers\taphss.sys
2010-09-20 12:51 . 2010-09-20 12:51 499712 ----a-w- c:\windows\system32\msvcp71.dll
2010-09-20 12:51 . 2010-09-20 12:51 348160 ----a-w- c:\windows\system32\msvcr71.dll
2010-09-09 14:15 . 2010-10-08 20:04 369664 ----a-w- c:\windows\system32\html.iec
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"THGuard"="c:\program files\TrojanHunter 5.3\THGuard.exe" [2010-10-23 1070360]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2010-11-10 443728]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKLM\~\startupfolder\C:^Documents and Settings^U?UR.MARLEY^Start Menu^Programlar^Ba?lang?ç^001hyab.exe]

[HKLM\~\startupfolder\C:^Documents and Settings^U?UR.MARLEY^Start Menu^Programlar^Ba?lang?ç^01fkmzz.exe]

[HKLM\~\startupfolder\C:^Documents and Settings^U?UR.MARLEY^Start Menu^Programlar^Ba?lang?ç^01ypjws.exe]

[HKLM\~\startupfolder\C:^Documents and Settings^U?UR.MARLEY^Start Menu^Programlar^Ba?lang?ç^55acvdy.exe]

[HKLM\~\startupfolder\C:^Documents and Settings^U?UR.MARLEY^Start Menu^Programlar^Ba?lang?ç^acvdygbj.exe]

[HKLM\~\startupfolder\C:^Documents and Settings^U?UR.MARLEY^Start Menu^Programlar^Ba?lang?ç^d01ypjws5mb.exe]

[HKLM\~\startupfolder\C:^Documents and Settings^U?UR.MARLEY^Start Menu^Programlar^Ba?lang?ç^ebd00bjmip.exe]

[HKLM\~\startupfolder\C:^Documents and Settings^U?UR.MARLEY^Start Menu^Programlar^Ba?lang?ç^fua55grbmw.exe]

[HKLM\~\startupfolder\C:^Documents and Settings^U?UR.MARLEY^Start Menu^Programlar^Ba?lang?ç^MagicDisc.lnk]

[HKLM\~\startupfolder\C:^Documents and Settings^U?UR.MARLEY^Start Menu^Programlar^Ba?lang?ç^pakv5qabmw.exe]

[HKLM\~\startupfolder\C:^Documents and Settings^U?UR.MARLEY^Start Menu^Programlar^Ba?lang?ç^setup_9.0.0.722_29.11.2010_08-16.lnk]
path=c:\documents and settings\U?UR.MARLEY\Start Menu\Programlar\Ba?lang?ç\setup_9.0.0.722_29.11.2010_08-16.lnk
backup=c:\windows\pss\setup_9.0.0.722_29.11.2010_08-16.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^U?UR.MARLEY^Start Menu^Programlar^Ba?lang?ç^ybdx00tvya.exe]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]
???? [?]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Run]
???? [?]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-09-20 20:07 932288 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-09-23 01:47 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSConfig]
2008-04-14 06:00 171008 ----a-w- c:\windows\pchealth\helpctr\binaries\msconfig.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2010-04-16 19:10 3872080 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Registry Cleaner Scheduler]
2010-10-08 19:00 1401224 ----a-w- c:\program files\CleanMyPC\Registry Cleaner\RCHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpeedUpMyPC]
2010-06-25 10:26 67960 ----a-w- c:\program files\Uniblue\SpeedUpMyPC\Launcher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VC10Player]
2010-11-01 12:18 411464 ----a-w- c:\program files\Virtual CD v10\System\VC10Play.exe

R3 HH10Help.sys;HH10Help.sys;c:\windows\system32\drivers\HH10Help.sys [2010-03-10 13952]
R3 nosGetPlusHelper;getPlus(R) Helper 3004;c:\windows\System32\svchost.exe [2008-04-14 14336]
R3 utezmtyx;AVZ Kernel Driver;c:\windows\system32\Drivers\utezmtyx.sys [2010-11-29 7168]
S0 10923642;10923642 Boot Guard Driver;c:\windows\system32\DRIVERS\10923642.sys [2009-10-22 37392]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-12-02 436792]
S1 10923641;10923641;c:\windows\system32\DRIVERS\10923641.sys [2009-09-25 128016]
S1 setup_9.0.0.722_29.11.2010_08-16drv;setup_9.0.0.722_29.11.2010_08-16drv;c:\windows\system32\DRIVERS\1092364.sys [2009-10-09 315408]
S1 SMBHC;Microsoft SM Yolu Ana Denetleyici Sürücüsü;c:\windows\system32\DRIVERS\SMBHC.sys [2001-11-22 6784]
S1 vdrv1000;vdrv1000;c:\windows\system32\DRIVERS\vdrv1000.sys [2010-05-21 186392]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2010-11-10 363344]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe [2010-10-27 1483072]
S2 VC10SecS;Virtual CD v10 Management Service;c:\program files\Virtual CD v10\System\VC10SecS.exe [2010-11-01 144712]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2010-11-10 20952]
S3 SMBBATT;Microsoft Ak?ll? Pil Sürücüsü;c:\windows\system32\DRIVERS\SMBBATT.sys [2008-04-14 16000]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys [2010-10-07 10064]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
nosGetPlusHelper REG_MULTI_SZ nosGetPlusHelper

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
.
------- Supplementary Scan -------
.
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\U?UR.MARLEY\Application Data\Mozilla\Firefox\Profiles\n1dvxvd5.default\
FF - prefs.js: browser.startup.homepage - hxxp://go.microsoft.com/fwlink/?LinkId=69157
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - Extension: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Extension: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Extension: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Extension: FlashGot: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34} - c:\documents and settings\U?UR.MARLEY\Application Data\Mozilla\Firefox\Profiles\n1dvxvd5.default\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}
FF - Extension: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - c:\documents and settings\U?UR.MARLEY\Application Data\Mozilla\Firefox\Profiles\n1dvxvd5.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}

---- FIREFOX POLICIES ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-12-03 22:40
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\wscntfy.exe
c:\program files\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\imapi.exe
.
**************************************************************************
.
Completion time: 2010-12-03 22:47:56 - machine was rebooted
ComboFix-quarantined-files.txt 2010-12-03 20:47
ComboFix2.txt 2010-12-02 21:49

Pre-Run: 6.144.544.768 bayt bo?
Post-Run: 6.136.045.568 bayt bo?

- - End Of File - - 9098CFF55B6E575B7AF69D66609FA82A

Par ailleurs, je demande sur un truck. Les entrées en "exe" qui s'affichait auparavant sur startup de msconfig - pas les 2 trucks "carré??carré?" - telles que 001hyab.exe, 01fkmzz.exe, 01ypjws.exe, 55acvdy.exe .....................pakv5qabmw.exe que j'ai corrigées avec le regedit du logiciel CleanMyPC, j'ai remarqué qu'elles s'affichent en haut dans le rapport ComboFix sous rubrique ((((( Reg Loading Points ))))))) comme par exemple ci-dessous, bien qu'elles ne sont plus sur le startup du mscnfig. Est-ce que tout va bien avec? Moi, personellement j'ai pas bcp de connaissances sur les composants du rapport de ComboFix.

[HKLM\~\startupfolder\C:^Documents and Settings^U?UR.MARLEY^Start Menu^Programlar^Ba?lang?ç^001hyab.exe]

[HKLM\~\startupfolder\C:^Documents and Settings^U?UR.MARLEY^Start Menu^Programlar^Ba?lang?ç^01fkmzz.exe]
........................
.....................
.....................
...................

[HKLM\~\startupfolder\C:^Documents and Settings^U?UR.MARLEY^Start Menu^Programlar^Ba?lang?ç^ybdx00tvya.exe]

Salut,
Les 2 trucks composés des carrés et des ??? ont encore dans startup de msconfig malhereusement. Par contre j'ai remarqué dans le startup du logicel CleanMyPC que ces deux entrées sont localisés en WIN.INI.
Voici le raport d'analyse de Malwarebytes:

Malwarebytes' Anti-Malware 1.50
www.malwarebytes.org

Version de la base de données: 5214

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

04.12.2010 04:03:45
mbam-log-2010-12-04 (04-03-45).txt

Type d'examen: Examen complet (C:\|)
Elément(s) analysé(s): 216482
Temps écoulé: 47 minute(s), 44 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 3

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
c:\documents and settings\u?ur.marley\Desktop\virus removal tool\setup_9.0.0.722_29.11.2010_08-16\avz_quarantine\2010-11-29\avz00001.dta (Trojan.Kryptik) -> Delete on reboot.
c:\Qoobox\quarantine\C\documents and settings\u?ur.marley\application data\microsoft\zonekoozys.exe.vir (Trojan.Kryptik) -> Quarantined and deleted successfully.
c:\documents and settings\u?ur.marley\application data\BG0Ai.txt (Malware.Trace) -> Quarantined and deleted successfully.

Bon weekend,

Salut,
En effet, ce chemin qui fait référence au 01fkmzz.exe au startup(Ba?lang?ç) n'existe plus ainsi que les autres comme ;

"""""[HKLM\~\startupfolder\C:^Documents and Settings^U?UR.MARLEY^Start Menu^Programlar^Ba?lang?ç^001hyab.exe]

[HKLM\~\startupfolder\C:^Documents and Settings^U?UR.MARLEY^Start Menu^Programlar^Ba?lang?ç^01fkmzz.exe]
........................
.....................

[HKLM\~\startupfolder\C:^Documents and Settings^U?UR.MARLEY^Start Menu^Programlar^Ba?lang?ç^ybdx00tvya.exe]"""""

-------Mais pourkoi ils sont encore affichés dans le rapport de ComboFix sous "((((( Reg Loading Points )))))))"?

------------------------Les problemes qui existent encore sont:

1-) [HKLM\~\startupfolder\C:^Documents and Settings^U?UR.MARLEY^Start Menu^Programlar^Ba?lang?ç^setup_9.0.0.722_29.11.2010_08-16.lnk]
path=c:\documents and settings\U?UR.MARLEY\Start Menu\Programlar\Ba?lang?ç\setup_9.0.0.722_29.11.2010_08-16.lnk
backup=c:\windows\pss\setup_9.0.0.722_29.11.2010_08-16.lnkStartup

"""P.S. 1 "": Ne t'en fait pas pour les "?" dans ce chemin ci-dessus. C'est des lettres qui existentpas en langues françaises. Je pourrais les corriger sur mon clavier au cas ou si tu ecris un script.

2-) [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]
???? [?]

3-) [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Run]
???? [?]

"""P.S. 2"": ces deux "????" s'affichent aussi sur mon ordi tels qu'ils sont ici.

refais un CFScript avec ceci dedans :

KillAll::

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Run]

Salut,
Chapeau!!!
Aucun problem au niveau des ambiguités et des virus. Merci beaucoup our ton aide gen-hackman.
Est-ce necessaire que je fasse une verification au cas ou il manque des fichiers de windows vu qu'on a supprimé pas mal des dossiers et des folders infectés, pour les retablir avec les bons avec cd windows?
A+ et bon weekend

Salut,
Voici le rapport, en fait, c'est le tout dernier depuis le script que j'ai effctué pour un dossier. L'avant dernier que j'ai effectué avec ton script que tu m'as envoyé dans ton message prcédent pour supprimer les deux registre avec des "carré??carré" a donné du bon résultat donc, les a suprimés, mais ce rapport-la il s'est fait automatiquement substitué par le tout dernier que voici; ton avis stp sur ce qu'il faudrait faire prochainement?

ComboFix 10-12-02.06 - U?UR 04.12.2010 17:29:47.3.1 - x86 MINIMAL
Microsoft Windows XP Professional 5.1.2600.3.1254.90.1055.18.238.146 [GMT 2:00]
Running from: c:\documents and settings\U?UR.MARLEY\Desktop\ugur.exe
Command switches used :: c:\documents and settings\U?UR.MARLEY\Desktop\CFScript.txt

FILE ::
"c:\docume~1\UUR~1.MAR\Desktop\VIRUSR~1\SETUP_~1.201\startup.exe"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\UUR~1.MAR\Desktop\VIRUSR~1\SETUP_~1.201\startup.exe
c:\windows\system32\1055

.
((((((((((((((((((((((((( Files Created from 2010-11-04 to 2010-12-04 )))))))))))))))))))))))))))))))
.

2010-12-04 15:37 . 2010-12-04 15:37 -------- d-----w- c:\windows\system32\1055
2010-12-03 13:42 . 2010-12-03 13:42 -------- d-----w- c:\program files\Auralog
2010-12-02 23:44 . 2010-12-02 23:51 -------- d-----w- c:\documents and settings\U?UR.MARLEY\Application Data\DAEMON Tools Lite
2010-12-02 23:43 . 2010-12-02 23:44 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\DAEMON Tools Lite
2010-12-02 22:53 . 2010-05-21 06:14 186392 ----a-w- c:\windows\system32\drivers\vdrv1000.sys
2010-12-02 22:53 . 2010-03-10 14:34 13952 ----a-w- c:\windows\system32\drivers\HH10Help.sys
2010-12-02 22:52 . 2010-12-02 22:55 -------- d-s---w- c:\documents and settings\U?UR.MARLEY\Application Data\Virtual CD v10
2010-12-02 22:52 . 2004-07-13 08:58 315392 ----a-w- c:\windows\system32\NCTAudioPlayer2.dll
2010-12-02 22:52 . 2004-07-13 08:57 1843200 ----a-w- c:\windows\system32\NCTAudioFile2.dll
2010-12-02 22:51 . 2010-12-02 22:52 -------- d-----w- c:\program files\Virtual CD v10
2010-12-02 22:50 . 2010-12-02 22:50 -------- d-----w- c:\documents and settings\U?UR.MARLEY\Application Data\InstallShield
2010-12-02 20:04 . 2009-02-24 16:42 116736 ----a-w- c:\windows\system32\drivers\mcdbus.sys
2010-12-02 19:56 . 2010-12-02 19:56 438888 ----a-w- c:\program files\VDCsetup.exe
2010-12-01 19:57 . 2010-12-02 18:08 -------- d-----w- C:\UsbFix
2010-11-30 01:02 . 2010-11-30 01:22 -------- d-----w- C:\234
2010-11-29 19:31 . 2010-11-29 19:45 7168 ----a-w- c:\windows\system32\drivers\utezmtyx.sys
2010-11-29 19:31 . 2010-11-29 19:45 10240 ----a-w- c:\windows\system32\drivers\ujezmtyx.sys
2010-11-29 17:48 . 2009-10-22 10:54 37392 ----a-w- c:\windows\system32\drivers\10923642.sys
2010-11-29 17:48 . 2009-10-09 20:31 315408 ----a-w- c:\windows\system32\drivers\1092364.sys
2010-11-29 17:48 . 2009-09-25 14:59 128016 ----a-w- c:\windows\system32\drivers\10923641.sys
2010-11-29 01:30 . 2010-10-27 16:25 31552 ----a-w- c:\windows\system32\TURegOpt.exe
2010-11-29 01:30 . 2010-10-27 16:21 29504 ----a-w- c:\windows\system32\uxtuneup.dll
2010-11-29 01:29 . 2010-11-29 01:29 -------- d-----w- c:\documents and settings\U?UR.MARLEY\Application Data\TuneUp Software
2010-11-29 01:28 . 2010-11-29 01:35 -------- d-----w- c:\program files\TuneUp Utilities 2011
2010-11-29 01:27 . 2010-11-29 01:37 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\TuneUp Software
2010-11-29 01:27 . 2010-11-29 01:27 -------- d-sh--w- c:\documents and settings\All Users.WINDOWS\Application Data\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}
2010-11-28 16:10 . 2010-11-29 15:42 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-11-28 16:10 . 2010-12-04 01:03 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-11-28 16:10 . 2010-11-29 15:42 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-11-28 14:38 . 2010-11-28 14:38 -------- d-----w- c:\program files\URUSoft
2010-11-28 01:24 . 2010-11-28 15:52 -------- d-----w- c:\documents and settings\U?UR.MARLEY\Application Data\Malwarebytes
2010-11-28 01:24 . 2010-11-28 15:52 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes
2010-11-28 00:10 . 2010-11-28 00:10 -------- d-----w- c:\documents and settings\U?UR.MARLEY\Application Data\TrojanHunter
2010-11-27 23:08 . 2010-11-27 23:08 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\TrojanHunter
2010-11-27 23:07 . 2010-12-02 19:30 -------- d-----w- c:\program files\TrojanHunter 5.3
2010-11-27 00:30 . 2008-04-14 06:00 221184 ----a-w- c:\windows\system32\wmpns.dll
2010-11-25 16:26 . 2010-11-25 16:26 -------- d-----w- c:\documents and settings\U?UR.MARLEY\Application Data\U3
2010-11-06 09:37 . 2010-11-06 09:37 103864 ----a-w- c:\program files\Mozilla Firefox\plugins\nppdf32.dll
2010-11-06 09:37 . 2010-11-06 09:37 103864 ----a-w- c:\program files\Internet Explorer\PLUGINS\nppdf32.dll
2010-11-05 12:50 . 2010-11-05 12:50 -------- d-----w- c:\program files\MWSnap

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-12-02 19:40 . 2010-10-09 16:36 436792 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-10-20 16:10 . 2010-10-20 16:10 73728 ----a-w- c:\windows\system32\javacpl.cpl
2010-10-20 16:10 . 2010-10-20 16:10 472808 ----a-w- c:\windows\system32\deployJava1.dll
2010-10-18 08:00 . 2010-10-20 23:03 108032 ----a-w- c:\windows\system32\ff_vfw.dll
2010-09-22 19:19 . 2010-09-22 19:19 32768 ----a-w- c:\windows\system32\drivers\taphss.sys
2010-09-20 12:51 . 2010-09-20 12:51 499712 ----a-w- c:\windows\system32\msvcp71.dll
2010-09-20 12:51 . 2010-09-20 12:51 348160 ----a-w- c:\windows\system32\msvcr71.dll
2010-09-09 14:15 . 2010-10-08 20:04 369664 ----a-w- c:\windows\system32\html.iec
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"THGuard"="c:\program files\TrojanHunter 5.3\THGuard.exe" [2010-10-23 1070360]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2010-11-29 443728]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKLM\~\startupfolder\C:^Documents and Settings^U?UR.MARLEY^Start Menu^Programlar^Ba?lang?ç^setup_9.0.0.722_29.11.2010_08-16.lnk]

[HKLM\~\startupfolder\C:^Documents and Settings^U?UR.MARLEY^Start Menu^Programlar^Ba?lang?ç^001hyab.exe]

[HKLM\~\startupfolder\C:^Documents and Settings^U?UR.MARLEY^Start Menu^Programlar^Ba?lang?ç^01fkmzz.exe]

[HKLM\~\startupfolder\C:^Documents and Settings^U?UR.MARLEY^Start Menu^Programlar^Ba?lang?ç^01ypjws.exe]

[HKLM\~\startupfolder\C:^Documents and Settings^U?UR.MARLEY^Start Menu^Programlar^Ba?lang?ç^55acvdy.exe]

[HKLM\~\startupfolder\C:^Documents and Settings^U?UR.MARLEY^Start Menu^Programlar^Ba?lang?ç^acvdygbj.exe]

[HKLM\~\startupfolder\C:^Documents and Settings^U?UR.MARLEY^Start Menu^Programlar^Ba?lang?ç^d01ypjws5mb.exe]

[HKLM\~\startupfolder\C:^Documents and Settings^U?UR.MARLEY^Start Menu^Programlar^Ba?lang?ç^ebd00bjmip.exe]

[HKLM\~\startupfolder\C:^Documents and Settings^U?UR.MARLEY^Start Menu^Programlar^Ba?lang?ç^fua55grbmw.exe]

[HKLM\~\startupfolder\C:^Documents and Settings^U?UR.MARLEY^Start Menu^Programlar^Ba?lang?ç^MagicDisc.lnk]

[HKLM\~\startupfolder\C:^Documents and Settings^U?UR.MARLEY^Start Menu^Programlar^Ba?lang?ç^pakv5qabmw.exe]

[HKLM\~\startupfolder\C:^Documents and Settings^U?UR.MARLEY^Start Menu^Programlar^Ba?lang?ç^ybdx00tvya.exe]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-09-20 20:07 932288 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-09-23 01:47 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSConfig]
2008-04-14 06:00 171008 ----a-w- c:\windows\pchealth\helpctr\binaries\msconfig.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2010-04-16 19:10 3872080 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Registry Cleaner Scheduler]
2010-10-08 19:00 1401224 ----a-w- c:\program files\CleanMyPC\Registry Cleaner\RCHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpeedUpMyPC]
2010-06-25 10:26 67960 ----a-w- c:\program files\Uniblue\SpeedUpMyPC\Launcher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VC10Player]
2010-11-01 12:18 411464 ----a-w- c:\program files\Virtual CD v10\System\VC10Play.exe

R0 10923642;10923642 Boot Guard Driver;c:\windows\system32\drivers\10923642.sys [29.11.2010 19:48 37392]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [09.10.2010 18:36 436792]
R1 10923641;10923641;c:\windows\system32\drivers\10923641.sys [29.11.2010 19:48 128016]
R1 setup_9.0.0.722_29.11.2010_08-16drv;setup_9.0.0.722_29.11.2010_08-16drv;c:\windows\system32\drivers\1092364.sys [29.11.2010 19:48 315408]
R1 SMBHC;Microsoft SM Yolu Ana Denetleyici Sürücüsü;c:\windows\system32\drivers\smbhc.sys [17.08.2001 22:57 6784]
R1 vdrv1000;vdrv1000;c:\windows\system32\drivers\vdrv1000.sys [03.12.2010 00:53 186392]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [28.11.2010 18:10 363344]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [28.11.2010 18:10 20952]
R3 SMBBATT;Microsoft Ak?ll? Pil Sürücüsü;c:\windows\system32\drivers\smbbatt.sys [13.04.2008 13:36 16000]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys [07.10.2010 13:34 10064]
S3 HH10Help.sys;HH10Help.sys;c:\windows\system32\drivers\HH10Help.sys [03.12.2010 00:53 13952]
S3 utezmtyx;AVZ Kernel Driver;c:\windows\system32\drivers\utezmtyx.sys [29.11.2010 21:31 7168]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
nosGetPlusHelper REG_MULTI_SZ nosGetPlusHelper

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
.
------- Supplementary Scan -------
.
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\U?UR.MARLEY\Application Data\Mozilla\Firefox\Profiles\n1dvxvd5.default\
FF - prefs.js: browser.startup.homepage - hxxp://go.microsoft.com/fwlink/?LinkId=69157
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - Extension: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Extension: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Extension: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Extension: FlashGot: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34} - c:\documents and settings\U?UR.MARLEY\Application Data\Mozilla\Firefox\Profiles\n1dvxvd5.default\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}
FF - Extension: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - c:\documents and settings\U?UR.MARLEY\Application Data\Mozilla\Firefox\Profiles\n1dvxvd5.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}

---- FIREFOX POLICIES ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-12-04 17:38
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe
c:\program files\Virtual CD v10\System\VC10SecS.exe
c:\windows\system32\wscntfy.exe
c:\program files\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe
c:\windows\system32\wbem\wmiapsrv.exe
.
**************************************************************************
.
Completion time: 2010-12-04 17:45:14 - machine was rebooted
ComboFix-quarantined-files.txt 2010-12-04 15:45
ComboFix2.txt 2010-12-04 15:03
ComboFix3.txt 2010-12-03 20:47
ComboFix4.txt 2010-12-02 21:49

Pre-Run: 6.113.153.024 bayt bo?
Post-Run: 6.106.816.512 bayt bo?

- - End Of File - - 852518F9BAFD4B517F77589D3BCC2505

Mais ce classeur 1055, je suppose qu'il s'est suprimé au cours de l'execution de ComboFix. Il est vide, j'ai vérifié. Pkoi, Trojan Hunter c'est malvaillant?

je pense qu'oon peut largement plus faire confiance à Malwarebytes

Oui, pas besoin de 2 capotes:)) je le desinstallerais. Et pour 1055, il faudrait que je ressources le systeme par CD windows ou pas?

non il ne me semble pas que ce dossier fasse partie de windows

ok, merci encore..
ciao

ouvre le registre

demarrer/executer puis tape : Regedit puis entrée

deroule l'arborescence avec les petits "+" :

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\

clic gauche sur startupFolder puis colonne de droite, supprime tout ce qui a un rapport avec ces .exe bizarres

Ils sont tous supprimés ces truks. Voici le rapport ComboFix dessus:
J'espere pas de probleme depuis;


ComboFix 10-12-09.04 - U?UR 10.12.2010 22:14:26.5.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1254.90.1055.18.238.112 [GMT 2:00]
Running from: c:\documents and settings\U?UR.MARLEY\Desktop\ugur.exe
.

((((((((((((((((((((((((( Files Created from 2010-11-10 to 2010-12-10 )))))))))))))))))))))))))))))))
.

2010-12-10 19:52 . 2010-12-10 19:52 -------- d-----w- c:\windows\system32\1055
2010-12-06 15:30 . 2008-04-14 07:00 21504 -c--a-w- c:\windows\system32\dllcache\hidserv.dll
2010-12-06 15:30 . 2008-04-14 07:00 21504 ----a-w- c:\windows\system32\hidserv.dll
2010-12-03 13:42 . 2010-12-03 13:42 -------- d-----w- c:\program files\Auralog
2010-12-02 23:44 . 2010-12-02 23:51 -------- d-----w- c:\documents and settings\U?UR.MARLEY\Application Data\DAEMON Tools Lite
2010-12-02 23:43 . 2010-12-02 23:44 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\DAEMON Tools Lite
2010-12-02 22:53 . 2010-05-21 06:14 186392 ----a-w- c:\windows\system32\drivers\vdrv1000.sys
2010-12-02 22:53 . 2010-03-10 14:34 13952 ----a-w- c:\windows\system32\drivers\HH10Help.sys
2010-12-02 22:52 . 2010-12-02 22:55 -------- d-s---w- c:\documents and settings\U?UR.MARLEY\Application Data\Virtual CD v10
2010-12-02 22:52 . 2004-07-13 08:58 315392 ----a-w- c:\windows\system32\NCTAudioPlayer2.dll
2010-12-02 22:52 . 2004-07-13 08:57 1843200 ----a-w- c:\windows\system32\NCTAudioFile2.dll
2010-12-02 22:51 . 2010-12-02 22:52 -------- d-----w- c:\program files\Virtual CD v10
2010-12-02 22:50 . 2010-12-02 22:50 -------- d-----w- c:\documents and settings\U?UR.MARLEY\Application Data\InstallShield
2010-12-02 20:04 . 2009-02-24 16:42 116736 ----a-w- c:\windows\system32\drivers\mcdbus.sys
2010-12-02 19:56 . 2010-12-02 19:56 438888 ----a-w- c:\program files\VDCsetup.exe
2010-12-01 19:57 . 2010-12-10 19:29 -------- d-----w- C:\UsbFix
2010-11-30 01:02 . 2010-11-30 01:22 -------- d-----w- C:\234
2010-11-29 19:31 . 2010-11-29 19:45 7168 ----a-w- c:\windows\system32\drivers\utezmtyx.sys
2010-11-29 19:31 . 2010-11-29 19:45 10240 ----a-w- c:\windows\system32\drivers\ujezmtyx.sys
2010-11-29 17:48 . 2009-10-22 10:54 37392 ----a-w- c:\windows\system32\drivers\10923642.sys
2010-11-29 17:48 . 2009-10-09 20:31 315408 ----a-w- c:\windows\system32\drivers\1092364.sys
2010-11-29 17:48 . 2009-09-25 14:59 128016 ----a-w- c:\windows\system32\drivers\10923641.sys
2010-11-29 01:30 . 2010-10-27 16:25 31552 ----a-w- c:\windows\system32\TURegOpt.exe
2010-11-29 01:30 . 2010-10-27 16:21 29504 ----a-w- c:\windows\system32\uxtuneup.dll
2010-11-29 01:29 . 2010-11-29 01:29 -------- d-----w- c:\documents and settings\U?UR.MARLEY\Application Data\TuneUp Software
2010-11-29 01:28 . 2010-11-29 01:35 -------- d-----w- c:\program files\TuneUp Utilities 2011
2010-11-29 01:27 . 2010-11-29 01:37 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\TuneUp Software
2010-11-29 01:27 . 2010-11-29 01:27 -------- d-sh--w- c:\documents and settings\All Users.WINDOWS\Application Data\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}
2010-11-28 16:10 . 2010-11-29 15:42 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-11-28 16:10 . 2010-12-04 01:03 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-11-28 16:10 . 2010-11-29 15:42 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-11-28 14:38 . 2010-11-28 14:38 -------- d-----w- c:\program files\URUSoft
2010-11-28 01:24 . 2010-11-28 15:52 -------- d-----w- c:\documents and settings\U?UR.MARLEY\Application Data\Malwarebytes
2010-11-28 01:24 . 2010-11-28 15:52 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes
2010-11-28 00:10 . 2010-11-28 00:10 -------- d-----w- c:\documents and settings\U?UR.MARLEY\Application Data\TrojanHunter
2010-11-27 00:30 . 2008-04-14 06:00 221184 ----a-w- c:\windows\system32\wmpns.dll
2010-11-25 16:26 . 2010-11-25 16:26 -------- d-----w- c:\documents and settings\U?UR.MARLEY\Application Data\U3

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-12-02 19:40 . 2010-10-09 16:36 436792 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-10-20 16:10 . 2010-10-20 16:10 73728 ----a-w- c:\windows\system32\javacpl.cpl
2010-10-20 16:10 . 2010-10-20 16:10 472808 ----a-w- c:\windows\system32\deployJava1.dll
2010-10-18 08:00 . 2010-10-20 23:03 108032 ----a-w- c:\windows\system32\ff_vfw.dll
2010-09-22 19:19 . 2010-09-22 19:19 32768 ----a-w- c:\windows\system32\drivers\taphss.sys
2010-09-20 12:51 . 2010-09-20 12:51 499712 ----a-w- c:\windows\system32\msvcp71.dll
2010-09-20 12:51 . 2010-09-20 12:51 348160 ----a-w- c:\windows\system32\msvcr71.dll
.

((((((((((((((((((((((((((((( SnapShot@2010-12-10_19.23.19 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-12-10 19:52 . 2010-12-10 19:52 16384 c:\windows\temp\Perflib_Perfdata_518.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2010-11-29 443728]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-09-20 20:07 932288 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-09-23 01:47 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2010-04-16 19:10 3872080 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Registry Cleaner Scheduler]
2010-10-08 19:00 1401224 ----a-w- c:\program files\CleanMyPC\Registry Cleaner\RCHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpeedUpMyPC]
2010-06-25 10:26 67960 ----a-w- c:\program files\Uniblue\SpeedUpMyPC\Launcher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VC10Player]
2010-11-01 12:18 411464 ----a-w- c:\program files\Virtual CD v10\System\VC10Play.exe

R0 10923642;10923642 Boot Guard Driver;c:\windows\system32\drivers\10923642.sys [29.11.2010 19:48 37392]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [09.10.2010 18:36 436792]
R1 10923641;10923641;c:\windows\system32\drivers\10923641.sys [29.11.2010 19:48 128016]
R1 setup_9.0.0.722_29.11.2010_08-16drv;setup_9.0.0.722_29.11.2010_08-16drv;c:\windows\system32\drivers\1092364.sys [29.11.2010 19:48 315408]
R1 SMBHC;Microsoft SM Yolu Ana Denetleyici Sürücüsü;c:\windows\system32\drivers\smbhc.sys [17.08.2001 22:57 6784]
R1 vdrv1000;vdrv1000;c:\windows\system32\drivers\vdrv1000.sys [03.12.2010 00:53 186392]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [28.11.2010 18:10 363344]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe [27.10.2010 18:23 1483072]
R2 VC10SecS;Virtual CD v10 Management Service;c:\program files\Virtual CD v10\System\VC10SecS.exe [03.12.2010 00:51 144712]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [28.11.2010 18:10 20952]
R3 SMBBATT;Microsoft Ak?ll? Pil Sürücüsü;c:\windows\system32\drivers\smbbatt.sys [13.04.2008 13:36 16000]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys [07.10.2010 13:34 10064]
S3 HH10Help.sys;HH10Help.sys;c:\windows\system32\drivers\HH10Help.sys [03.12.2010 00:53 13952]
S3 nosGetPlusHelper;getPlus(R) Helper 3004;c:\windows\System32\svchost.exe -k nosGetPlusHelper [08.10.2010 22:06 14336]
S3 utezmtyx;AVZ Kernel Driver;c:\windows\system32\drivers\utezmtyx.sys [29.11.2010 21:31 7168]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
nosGetPlusHelper REG_MULTI_SZ nosGetPlusHelper

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
.
------- Supplementary Scan -------
.
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\U?UR.MARLEY\Application Data\Mozilla\Firefox\Profiles\n1dvxvd5.default\
FF - prefs.js: browser.startup.homepage - hxxp://go.microsoft.com/fwlink/?LinkId=69157
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - Extension: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Extension: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Extension: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Extension: FlashGot: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34} - c:\documents and settings\U?UR.MARLEY\Application Data\Mozilla\Firefox\Profiles\n1dvxvd5.default\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}
FF - Extension: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - c:\documents and settings\U?UR.MARLEY\Application Data\Mozilla\Firefox\Profiles\n1dvxvd5.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}

---- FIREFOX POLICIES ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-12-10 22:26
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
Completion time: 2010-12-10 22:29:45
ComboFix-quarantined-files.txt 2010-12-10 20:29
ComboFix2.txt 2010-12-10 19:25
ComboFix3.txt 2010-12-04 15:45
ComboFix4.txt 2010-12-04 15:03
ComboFix5.txt 2010-12-10 20:10

Pre-Run: 3.745.951.744 bayt bo?
Post-Run: 3.738.300.416 bayt bo?

- - End Of File - - D18588EE23A0C27CCB61FE4E844E6910

Pour te demander et savoir s'il s'est passé quelquechose d'infectueuse depuis la derniere execution du ComboFix. Pkoi?

meme sans ecrire des script, juste avec l'execution ordinaire aussi? Par ailleurs, tout va bien selon le raport?

ok merci