Virus conhost.exe et csrss.exe

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Version de la base de données: 7746

Windows 6.0.6001 Service Pack 1
Internet Explorer 7.0.6001.18000

19/09/2011 11:10:13
mbam-log-2011-09-19 (11-10-06).txt

Type d'examen: Examen rapide
Elément(s) analysé(s): 158335
Temps écoulé: 5 minute(s), 33 seconde(s)

Processus mémoire infecté(s): 3
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 2
Valeur(s) du Registre infectée(s): 4
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 5
Fichier(s) infecté(s): 10

Processus mémoire infecté(s):
c:\Users\Nanou\AppData\Roaming\dwm.exe (Backdoor.Cycbot) -> 2112 -> No action taken.
c:\Users\Nanou\AppData\Roaming\microsoft\conhost.exe (Trojan.Jorik) -> 2096 -> No action taken.
c:\Users\Nanou\AppData\Local\Temp\csrss.exe (Trojan.Agent) -> 5836 -> No action taken.

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A078F691-9C07-4AF2-BF43-35E79EECF8B7} (Adware.Softomate) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ScanQuery Service (Adware.ScanQuery) -> No action taken.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost (Trojan.Jorik) -> Value: conhost -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Load (Trojan.Agent) -> Value: Load -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Hijack.Shell.Gen) -> Value: Shell -> No action taken.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer (PUM.Bad.Proxy) -> Value: ProxyServer -> No action taken.

Elément(s) de données du Registre infecté(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Load (Trojan.Agent) -> Bad: (C:\Users\Nanou\AppData\Local\Temp\csrss.exe) Good: () -> No action taken.

Dossier(s) infecté(s):
c:\program files\mozilla firefox\extensions\{de9265d8-d55d-4286-9dc4-f8d8a0ca2f64} (Adware.ScanQuery) -> No action taken.
c:\program files\mozilla firefox\extensions\{de9265d8-d55d-4286-9dc4-f8d8a0ca2f64}\chrome (Adware.ScanQuery) -> No action taken.
c:\program files\mozilla firefox\extensions\{de9265d8-d55d-4286-9dc4-f8d8a0ca2f64}\defaults (Adware.ScanQuery) -> No action taken.
c:\program files\mozilla firefox\extensions\{de9265d8-d55d-4286-9dc4-f8d8a0ca2f64}\defaults\preferences (Adware.ScanQuery) -> No action taken.
c:\program files\scanquery (Adware.ScanQuery) -> No action taken.

Fichier(s) infecté(s):
c:\Users\Nanou\AppData\Roaming\dwm.exe (Backdoor.Cycbot) -> No action taken.
c:\Users\Nanou\AppData\Roaming\microsoft\conhost.exe (Trojan.Jorik) -> No action taken.
c:\$Recycle.Bin\s-1-5-21-2150492622-2118612641-2044946887-1000\$R9Z88TG.exe (Spyware.Agent) -> No action taken.
c:\$Recycle.Bin\s-1-5-21-2150492622-2118612641-2044946887-1000\$RMRNA48.exe (Trojan.Jorik) -> No action taken.
c:\$Recycle.Bin\s-1-5-21-2150492622-2118612641-2044946887-1000\$RMY9I0A.exe (Trojan.Jorik) -> No action taken.
c:\Users\Nanou\AppData\Local\Temp\csrss.exe (Trojan.Agent) -> No action taken.
c:\program files\mozilla firefox\extensions\{de9265d8-d55d-4286-9dc4-f8d8a0ca2f64}\chrome.manifest (Adware.ScanQuery) -> No action taken.
c:\program files\mozilla firefox\extensions\{de9265d8-d55d-4286-9dc4-f8d8a0ca2f64}\install.rdf (Adware.ScanQuery) -> No action taken.
c:\program files\mozilla firefox\extensions\{de9265d8-d55d-4286-9dc4-f8d8a0ca2f64}\chrome\scanquery.jar (Adware.ScanQuery) -> No action taken.
c:\program files\mozilla firefox\extensions\{de9265d8-d55d-4286-9dc4-f8d8a0ca2f64}\defaults\preferences\prefs.js (Adware.ScanQuery) -> No action taken.



Voila se que j'ai trouvé :)

voila j'ai supprimé le tout et redémarré le pc j'ai ensuite refait une analyse puis plus rien ensuit je suis allé sur mozila il me demandé de changé le proxy j'ai remi utiliser les paramétres proxy du system quand je coup mozila et le reouvre il me remé les proxy 127.0.0.1 :(


Pour finir le probléme et presque resolut mon autre probléme et que je ne peu pas posé de question sur le forum avec mon pc car il ne me permé pas de les envoyer

{"res":false,"ID":-1,"cat":0,"msgs":[["critical","Veuillez activer Javascript"]],"msg":"Une erreur est survenue pendant l'enregistrement.","mode":"newc","html":"","acjs":"document.getElementById(\"__sid\").value=\"58e4878ed3e43aec5732fc44211a3184d6b6cbd7\";eval(function(p,a,c,k,e,d){e=function(c){return(c35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(\/^\/,String)){while(c--){d[e(c)]=k[c]||e(c)}k=[function(e){return d[e]}];e=function(){return'\\\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\\\b'+e(c)+'\\\\b','g'),k[c])}}return p}('A Q=[\\'2e\\',\\'2d\\',\\'2c\\',\\'b\\',\\'2a\\',\\'2b\\',\\'2f\\',\\'2g\\',\\'2l\\'];A K=[\\'2k\\',\\'2j\\',\\'2h\\',\\'2i\\',\\'29\\',\\'28\\',\\'20\\',\\'1Z\\',\\'y\\',\\'1Y\\',\\'1W\\',\\'p\\',\\'j\\'];A R=[\\'1X\\',\\'21\\',\\'22\\',\\'27\\',\\'26\\',\\'25\\',\\'23\\',\\'24\\',\\'2m\\'];A I=[\\'b\\',\\'2n\\',\\'2G\\',\\'t\\',\\'2F\\',\\'2E\\',\\'2C\\',\\'k\\',\\'u\\',\\'h\\',\\'2D\\',\\'l\\'];A D=[\\'2H\\',\\'L\\',\\'2I\\',\\'2N\\',\\'2M\\',\\'2L\\',\\'2J\\',\\'p\\',\\'2K\\',\\'2B\\'];A E=[\\'2A\\',\\'1V\\',\\'2r\\',\\'s\\',\\'h\\',\\'2q\\',\\'2o\\',\\'2p\\',\\'2t\\',\\'2u\\',\\'2z\\',\\'u\\',\\'k\\',\\'2y\\',\\'2x\\'];A F=[\\'2v\\',\\'2w\\',\\'2O\\',\\'13\\',\\'N\\',\\'1f\\',\\'O\\',\\'1c\\',\\'1o\\',\\'1q\\',\\'1r\\',\\'1m\\',\\'1l\\',\\'1p\\'];A J=[\\'x\\',\\'1k\\',\\'1j\\',\\'1i\\',\\'1n\\',\\'1g\\',\\'1s\\',\\'18\\',\\'x\\',\\'o\\',\\'16\\',\\'y\\'];A S=[\\'12\\',\\'19\\',\\'1d\\',\\'1b\\',\\'1a\\',\\'1e\\',\\'17\\',\\'M\\',\\'d\\',\\'1h\\',\\'1U\\',\\'1M\\',\\'1L\\',\\'y\\',\\'1K\\',\\'1I\\'];A G=[\\'1J\\',\\'1N\\',\\'n\\',\\'1O\\',\\'1T\\',\\'1S\\',\\'1R\\',\\'1t\\',\\'q\\',\\'1P\\',\\'1Q\\',\\'1H\\',\\'1G\\',\\'f\\',\\'1y\\',\\'1x\\'];A H=[\\'r\\',\\'1w\\',\\'1u\\',\\'h\\',\\'1v\\',\\'1z\\',\\'y\\',\\'l\\',\\'1A\\',\\'t\\',\\'u\\',\\'1F\\'];A P=[\\'1E\\',\\'1D\\',\\'1B\\',\\'1C\\',\\'u\\',\\'r\\',\\'a\\',\\'2s\\',\\'d\\',\\'2U\\'];A Z=[\\'w\\',\\'3F\\',\\'f\\',\\'3E\\',\\'3D\\',\\'3G\\',\\'3H\\',\\'3J\\',\\'3L\\',\\'3I\\',\\'3C\\',\\'3B\\',\\'2P\\'];A Y=[\\'3w\\',\\'3v\\',\\'3u\\',\\'3x\\',\\'3y\\',\\'3A\\',\\'3z\\',\\'3K\\',\\'d\\',\\'3Z\\',\\'3Y\\',\\'N\\'];A T=[\\'3X\\',\\'41\\',\\'40\\',\\'3W\\',\\'3U\\',\\'3M\\',\\'3P\\',\\'f\\',\\'M\\',\\'b\\',\\'3Q\\',\\'3T\\',\\'3S\\',\\'g\\'];A U=[\\'k\\',\\'3R\\',\\'3N\\',\\'3O\\',\\'3V\\',\\'3s\\',\\'32\\',\\'31\\',\\'30\\',\\'33\\',\\'34\\'];A V=[\\'37\\',\\'36\\',\\'35\\',\\'2Z\\',\\'2Y\\',\\'2S\\',\\'2R\\',\\'i\\',\\'2Q\\',\\'g\\',\\'2T\\',\\'O\\',\\'3t\\',\\'z\\',\\'2X\\'];A W=[\\'a\\',\\'2W\\',\\'2V\\',\\'38\\',\\'c\\',\\'u\\',\\'39\\',\\'3m\\',\\'3l\\',\\'3k\\',\\'3n\\',\\'3o\\',\\'3r\\',\\'3q\\'];A X=[\\'l\\',\\'l\\',\\'3p\\',\\'3j\\',\\'3i\\',\\'3c\\',\\'z\\',\\'3b\\',\\'3a\\',\\'3d\\',\\'L\\',\\'w\\',\\'i\\',\\'3e\\',\\'y\\'];3h=B(){C[\\'c\\',\\'c\\',\\'m\\',\\'f\\',\\'o\\',\\'r\\',\\'m\\',\\'s\\',\\'u\\',\\'b\\',\\'m\\',\\'i\\',\\'t\\',\\'t\\',\\'o\\',\\'k\\',\\'e\\',\\'n\\'].3g(\\'\\')};3f=B(){C v(Q,6)+v(K,2)+v(R,1)+v(I,7)+v(D,9)+v(E,14)+v(F,5)+v(J,0)+v(S,15)+v(G,8)+v(H,4)+v(P,1)+v(Z,6)+v(Y,7)+v(T,3)+v(U,3)+v(V,10)+v(W,9)+v(X,11)};v=B(a,b){C a[b]};',62,250,'|||||||||||||||||||||||||||||||w384506e|||||var|function|return|b119ed749|h5525a|yfc289e53|nd52f316d|y7197ae|m39ef175|rcb13911fd|t08d921f1afa79b|l0|a2|je|p6|v07cf4|b704e361ddbec6|k51c032df349|p37edf4c8919a|feb95e2c129b876|ead77451a16b|n45239426e9fc5|e09ed6b7f4|f9275d8555ad|w60f5209|h0a9e37e8c4fbfb|||ff6|od0|||je8f9|eed|z5314|z9c|g9|ba|zd5|d9cc4|x0a1|y4|ke|zde54|q5ba8|j3d1|m1f0f|rda|d50|pc86f|r4cad|qdfcc|i550|mde|j81|r4eec|kc4|z9|z228a|i7196|n2a|gfe6|l5|k6e|td758|wa|k2d|la6a9|t7d1|bdd6|qb86f|p0b|v630|g46d|ib|n428|o1|d3f1|yb|p99|f8e|e63b2|dc6e2|r20|w3329|h99b|k514|z6f3|zb659|b8eb6|h9|e56|f2|dcac2|uef0b|te3d4|i75ba|h7|h12|n3c2|vf9|fde9f|x0|k67|u3b|y24|lb|x0f4|jc4d6|j6213|ua19|q46f7|ceba3|s1e|fefc|e177|s29f|z1|le8|h60|f736c|nf12|c4|t1|ud4c|qd|se9dd|v4|z62|xf8|rd9c|y0813|j3e|y8ae7|u73|d3300|pbf7|g209|kf1a3|b69e|pc02|g781c|o0cf5|s3076|fe71|tb|w8f53|pacc|s372|y386|pfb|nd6a|t1e5d|y6|v151d|c7|ob35|e23|z24b|df7|g5|f1b|x561|l528c|j23d|la63221006ef63|join|t6b73ae0a430c6|ta99|z96|y7d7b|lba2f|fee2|a3c59|we5a0|q146|zbdff|v9ed0|w981|xddf6|v9a|tfae6|g109|o73|k2c|t6f|y3|s42e2|yf37c|l1e2f|jb7|q899|ef1f8|y1|he5c5|t5dd6|n6|zb6ab|oef|d8b78|e77|p6d50|k9|a4|ifcfa|k5f|p21c7|kd1da|l95|t8d8d|tbd|u1|w21a9|e7d83'.split('|'),0,{}))\ndocument.getElementById('__chi_newc23185564').name=t6b73ae0a430c6();document.getElementById('__chi_newc23185564').value=la63221006ef63();"} (xval is not defined)

up?