Lire un rapport usbfix
Bonjour, je repost le meme message mais juste un changement de titre car je ne suis pas sur que le précédent soit très parlant...désolé d'envahir le forum.
Voici le rapport usbfix
############################## | UsbFix V6.096 |
User : Saina (Administrateurs) # DD12SN3J
Update on 19/02/2010 by El Desaparecido , C_XX & Chimay8
Start at: 10:48:30 | 20/02/2010
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com
Intel(R) Pentium(R) Dual CPU E2180 @ 2.00GHz
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Enabled
AV : avast! antivirus 4.8.1368 [VPS 100219-1] 4.8.1368 [ Enabled | Updated ]
C:\ -> Disque fixe local # 294,73 Go (86 Go free) # NTFS
D:\ -> Disque CD-ROM
E:\ -> Disque amovible
F:\ -> Disque amovible
G:\ -> Disque amovible
H:\ -> Disque amovible
I:\ -> Disque fixe local # 298,05 Go (32,5 Go free) [STOREX] # FAT32
J:\ -> Disque amovible # 3,76 Go (813,16 Mo free) [SAINA] # FAT32
K:\ -> Disque amovible # 7,44 Go (3,33 Go free) [MAODAN] # FAT32
############################## | Processus actifs |
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\ICO.EXE
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\Fichiers communs\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\WINDOWS\system32\Pmxmiced.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Dell\MFP_DELL\deDvcStatus.exe
C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe
C:\Documents and Settings\Saina\cuawiiz.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Dell\MFP_DELL\deMntrService.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\WINDOWS\system32\FsUsbExService.Exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\PSIService.exe
C:\Program Files\Fichiers communs\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Fichiers communs\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
C:\Program Files\Java\jre6\bin\jucheck.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\msa.exe
C:\Program Files\Alwil Software\Avast4\ashSimpl.exe
C:\DOCUME~1\Saina\LOCALS~1\Temp\Rgu.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
################## | Elements infectieux |
C:\Documents and Settings\Saina\iexplore.exe
C:\Documents and Settings\Saina\iexplore.exe
C:\WINDOWS\msa.exe
C:\WINDOWS\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
C:\WINDOWS\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job
C:\WINDOWS\System32\sshnas21.dll
C:\DOCUME~1\Saina\LOCALS~1\Temp\a.dat
C:\DOCUME~1\Saina\LOCALS~1\Temp\b.dat
C:\DOCUME~1\Saina\LOCALS~1\Temp\Rgq.exe
C:\DOCUME~1\Saina\LOCALS~1\Temp\Rgr.exe
C:\DOCUME~1\Saina\LOCALS~1\Temp\Rgs.exe
C:\DOCUME~1\Saina\LOCALS~1\Temp\Rgt.exe
C:\DOCUME~1\Saina\LOCALS~1\Temp\Rgu.exe
C:\DOCUME~1\Saina\LOCALS~1\Temp\sshnas21.dll
C:\log.txt
C:\temp.txt
I:\autorun.inf
J:\autorun.inf
K:\autorun.inf
K:\Documents .lnk
K:\Music .lnk
K:\New Folder .lnk
K:\Passwords .lnk
K:\Pictures .lnk
K:\Video .lnk
################## | Registre |
[HKCU\SOFTWARE\Microsoft\Handle]
[HKCU\SOFTWARE\ROUA3O12PW]
[HKCU\SOFTWARE\TOY5KNQ8OC]
[HKCU\SOFTWARE\XML]
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "TOY5KNQ8OC"
[HKLM\SYSTEM\CurrentControlSet\Services\SSHNAS]
[HKLM\SYSTEM\ControlSet001\Services\SSHNAS]
[HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SSHNAS]
[HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_SSHNAS]
[HKLM\SYSTEM\ControlSet002\Enum\Root\LEGACY_SSHNAS]
################## | Mountpoints2 |
HKCU\..\..\Explorer\MountPoints2\{15307c1a-f504-11dd-a868-001d0997cb22}
Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL CUAWiiZ.EXe
HKCU\..\..\Explorer\MountPoints2\{1f830a60-d507-11dd-a83d-001d0997cb22}
Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL LeiOKE.Exe
HKCU\..\..\Explorer\MountPoints2\{4c5db614-b317-11dd-a80a-001d0997cb22}
Shell\Auto\command =AdobeR.exe e
Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AdobeR.exe e
HKCU\..\..\Explorer\MountPoints2\{899118c1-26b3-11de-a8bb-001d0997cb22}
Shell\Auto\command =AdobeR.exe e
Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AdobeR.exe e
HKCU\..\..\Explorer\MountPoints2\{899118c4-26b3-11de-a8bb-001d0997cb22}
Shell\Auto\command =Windows.scr
Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL
HKCU\..\..\Explorer\MountPoints2\{c61a3eed-0528-11df-a9bd-001d0997cb22}
Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL lEiOKe.eXE
################## | Vaccin |
(!) Cet ordinateur n'est pas vacciné !
################## | ! Fin du rapport # UsbFix V6.096 ! |
Configuration: Windows XP / Firefox 3.5.8
Voici le rapport usbfix
############################## | UsbFix V6.096 |
User : Saina (Administrateurs) # DD12SN3J
Update on 19/02/2010 by El Desaparecido , C_XX & Chimay8
Start at: 10:48:30 | 20/02/2010
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com
Intel(R) Pentium(R) Dual CPU E2180 @ 2.00GHz
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Enabled
AV : avast! antivirus 4.8.1368 [VPS 100219-1] 4.8.1368 [ Enabled | Updated ]
C:\ -> Disque fixe local # 294,73 Go (86 Go free) # NTFS
D:\ -> Disque CD-ROM
E:\ -> Disque amovible
F:\ -> Disque amovible
G:\ -> Disque amovible
H:\ -> Disque amovible
I:\ -> Disque fixe local # 298,05 Go (32,5 Go free) [STOREX] # FAT32
J:\ -> Disque amovible # 3,76 Go (813,16 Mo free) [SAINA] # FAT32
K:\ -> Disque amovible # 7,44 Go (3,33 Go free) [MAODAN] # FAT32
############################## | Processus actifs |
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\ICO.EXE
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\Fichiers communs\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\WINDOWS\system32\Pmxmiced.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Dell\MFP_DELL\deDvcStatus.exe
C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe
C:\Documents and Settings\Saina\cuawiiz.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Dell\MFP_DELL\deMntrService.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\WINDOWS\system32\FsUsbExService.Exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\PSIService.exe
C:\Program Files\Fichiers communs\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Fichiers communs\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
C:\Program Files\Java\jre6\bin\jucheck.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\msa.exe
C:\Program Files\Alwil Software\Avast4\ashSimpl.exe
C:\DOCUME~1\Saina\LOCALS~1\Temp\Rgu.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
################## | Elements infectieux |
C:\Documents and Settings\Saina\iexplore.exe
C:\Documents and Settings\Saina\iexplore.exe
C:\WINDOWS\msa.exe
C:\WINDOWS\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
C:\WINDOWS\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job
C:\WINDOWS\System32\sshnas21.dll
C:\DOCUME~1\Saina\LOCALS~1\Temp\a.dat
C:\DOCUME~1\Saina\LOCALS~1\Temp\b.dat
C:\DOCUME~1\Saina\LOCALS~1\Temp\Rgq.exe
C:\DOCUME~1\Saina\LOCALS~1\Temp\Rgr.exe
C:\DOCUME~1\Saina\LOCALS~1\Temp\Rgs.exe
C:\DOCUME~1\Saina\LOCALS~1\Temp\Rgt.exe
C:\DOCUME~1\Saina\LOCALS~1\Temp\Rgu.exe
C:\DOCUME~1\Saina\LOCALS~1\Temp\sshnas21.dll
C:\log.txt
C:\temp.txt
I:\autorun.inf
J:\autorun.inf
K:\autorun.inf
K:\Documents .lnk
K:\Music .lnk
K:\New Folder .lnk
K:\Passwords .lnk
K:\Pictures .lnk
K:\Video .lnk
################## | Registre |
[HKCU\SOFTWARE\Microsoft\Handle]
[HKCU\SOFTWARE\ROUA3O12PW]
[HKCU\SOFTWARE\TOY5KNQ8OC]
[HKCU\SOFTWARE\XML]
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "TOY5KNQ8OC"
[HKLM\SYSTEM\CurrentControlSet\Services\SSHNAS]
[HKLM\SYSTEM\ControlSet001\Services\SSHNAS]
[HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SSHNAS]
[HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_SSHNAS]
[HKLM\SYSTEM\ControlSet002\Enum\Root\LEGACY_SSHNAS]
################## | Mountpoints2 |
HKCU\..\..\Explorer\MountPoints2\{15307c1a-f504-11dd-a868-001d0997cb22}
Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL CUAWiiZ.EXe
HKCU\..\..\Explorer\MountPoints2\{1f830a60-d507-11dd-a83d-001d0997cb22}
Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL LeiOKE.Exe
HKCU\..\..\Explorer\MountPoints2\{4c5db614-b317-11dd-a80a-001d0997cb22}
Shell\Auto\command =AdobeR.exe e
Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AdobeR.exe e
HKCU\..\..\Explorer\MountPoints2\{899118c1-26b3-11de-a8bb-001d0997cb22}
Shell\Auto\command =AdobeR.exe e
Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AdobeR.exe e
HKCU\..\..\Explorer\MountPoints2\{899118c4-26b3-11de-a8bb-001d0997cb22}
Shell\Auto\command =Windows.scr
Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL
HKCU\..\..\Explorer\MountPoints2\{c61a3eed-0528-11df-a9bd-001d0997cb22}
Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL lEiOKe.eXE
################## | Vaccin |
(!) Cet ordinateur n'est pas vacciné !
################## | ! Fin du rapport # UsbFix V6.096 ! |
Configuration: Windows XP / Firefox 3.5.8
Configuration: Windows XP / Firefox 3.5.8
