Bonjour,
mon pc est infecté, j'ai alors fait usb fix :
############################## | UsbFix V6.086 |
User : Propriétaire (Administrateurs) # PAULCHEVIGNARD
Update on 03/02/2010 by El Desaparecido , C_XX & Chimay8
Start at: 13:44:20 | 03/02/2010
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com
Intel(R) Pentium(R) 4 CPU 2.80GHz
Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Enabled
AV : avast! antivirus 4.8.1351 [VPS 100203-0] 4.8.1351 [ (!) Disabled | Updated ]
C:\ -> Disque fixe local # 145,46 Go (47,57 Go free) # NTFS
D:\ -> Disque CD-ROM
E:\ -> Disque CD-ROM
F:\ -> Disque amovible # 1,91 Go (1,02 Go free) [FANNY] # FAT
############################## | Processus actifs |
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\MarkAny\ContentSafer\MAAgent.exe
C:\Program Files\Search Settings\SearchSettings.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Propriétaire\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Application Updater\ApplicationUpdater.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\iTunes\iTunes.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
################## | Elements infectieux |
C:\WINDOWS\System32\olhrwef.exe
C:\autorun.inf
C:\autorun.inf -> fichier appelé : "C:\gyn.cmd" ( Présent ! )
C:\gyn.cmd
F:\autorun.inf
F:\autorun.inf -> fichier appelé : "F:\gyn.cmd" ( Présent ! )
F:\gyn.cmd
################## | Registre |
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "cdoosoft"
[HKLM\SOFTWARE\Classes\CLSID\MADOWN]
[HKCR\CLSID\MADOWN]
[HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_KAVSYS]
[HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_KAVSYS]
[HKLM\SYSTEM\ControlSet003\Enum\Root\LEGACY_KAVSYS]
################## | Mountpoints2 |
HKCU\..\..\Explorer\MountPoints2\G
Shell\AutoRun\command =G:\gyn.cmd
Shell\open\Command =G:\gyn.cmd
HKCU\..\..\Explorer\MountPoints2\{4b60bd36-4c2e-11de-aa44-0011114da71e}
Shell\AutoRun\command =F:\gyn.cmd
Shell\open\Command =F:\gyn.cmd
HKCU\..\..\Explorer\MountPoints2\{5b45e3fc-f882-11de-add5-0011114da71e}
Shell\AutoRun\command =F:\gyn.cmd
Shell\open\Command =F:\gyn.cmd
HKCU\..\..\Explorer\MountPoints2\{69b14443-161d-11de-a940-0011114da71e}
Shell\AutoRun\command =gyn.cmd
Shell\open\Command =F:\gyn.cmd
HKCU\..\..\Explorer\MountPoints2\{80f11920-3a1f-11de-a9e4-0011114da71e}
Shell\AutoRun\command =E:\gyn.cmd
Shell\open\Command =E:\gyn.cmd
HKCU\..\..\Explorer\MountPoints2\{a6a6ebd4-1336-11de-a935-0011114da71e}
Shell\AutoRun\command =G:\gyn.cmd
Shell\open\Command =G:\gyn.cmd
HKCU\..\..\Explorer\MountPoints2\{b13b6a42-0e95-11df-ae42-0011114da71e}
Shell\AutoRun\command =G:\gyn.cmd
Shell\open\Command =G:\gyn.cmd
HKCU\..\..\Explorer\MountPoints2\{e14b8c32-1c6d-11de-a95e-0011114da71e}
Shell\AutoRun\command =F:\gyn.cmd
Shell\open\Command =F:\gyn.cmd
HKCU\..\..\Explorer\MountPoints2\{e70ca8b8-784d-11de-ab00-0011114da71e}
Shell\AutoRun\command =F:\gyn.cmd
Shell\open\Command =F:\gyn.cmd
################## | ! Fin du rapport # UsbFix V6.086 ! |
voila !!
Afficher la suite