Infection par Zwangi

############################## | UsbFix V 7.087 | [Listing]

Utilisateur: charly boy (Administrateur) # PC
Mis à jour le 05/04/2012 par El Desaparecido
Lancé à 11:38:19 | 20/04/2012

Site Web: https://www.sosvirus.net/
Fichier suspect ? : http://eldesaparecido.com/upload.html
Contact: contact@eldesaparecido.com

PC: Acer (Aspire 5610Z ) (X86-based PC) # Notebook
CPU: Genuine Intel(R) CPU T2080 @ 1.73GHz (1733)
RAM -> [ Total : 1021 | Free : 93 ]
BIOS: Ver 1.00PARTTBLP
BOOT: Normal boot

OS: Microsoft® Windows Vista(TM) Édition Familiale Premium (6.0.6001 32-Bit) # Service Pack 1
WB: Windows Internet Explorer 7.0.6001.18000

SC: Security Center Service [ Enabled ]
WU: Windows Update Service [ Enabled ]
AV: Microsoft Security Essentials [ Enabled | Updated ]
FW: Windows FireWall Service [ Enabled ]

C:\ (%systemdrive%) -> Disque fixe # 70 Go (7 Go libre(s) - 11%) [ACER] # NTFS
D:\ -> Disque fixe # 70 Go (47 Go libre(s) - 67%) [DATA] # NTFS
E:\ -> CD-ROM

################## | Listing |

[19/12/2007 - 22:38:48 | HD ] C:\$RECYCLE.BIN
[28/03/2007 - 07:43:30 | A | 3380] C:\-20070328.log
[16/04/2011 - 16:00:20 | HD ] C:\Acer
[18/09/2006 - 23:43:36 | A | 24] C:\autoexec.bat
[28/03/2007 - 15:42:06 | HD ] C:\Book
[19/04/2012 - 23:33:16 | SHD ] C:\Boot
[19/01/2008 - 09:45:45 | RASH | 333203] C:\bootmgr
[28/03/2007 - 15:44:11 | RAS | 8192] C:\BOOTSECT.BAK
[19/04/2012 - 21:36:02 | HD ] C:\Config.Msi
[18/09/2006 - 23:43:37 | A | 10] C:\config.sys
[02/11/2006 - 15:02:03 | HD ] C:\Documents and Settings
[16/04/2011 - 16:00:46 | HD ] C:\DRV
[29/09/2010 - 18:36:52 | D ] C:\found.000
[22/09/2007 - 12:55:49 | HD ] C:\HiTRUSTDrive
[20/06/2008 - 14:36:29 | RASH | 0] C:\IO.SYS
[27/06/2008 - 19:00:04 | H | 8682] C:\MessengerStyleSheet.xsl
[20/06/2008 - 14:36:29 | RASH | 0] C:\MSDOS.SYS
[08/01/2009 - 00:27:48 | HD ] C:\MSOCache
[23/09/2007 - 19:19:36 | HD ] C:\MyWorks
[19/04/2012 - 23:23:47 | ASH | 1385566208] C:\pagefile.sys
[19/04/2012 - 23:15:58 | D ] C:\PerfLogs
[19/04/2012 - 19:55:56 | RD ] C:\Program Files
[19/04/2012 - 18:10:08 | HD ] C:\ProgramData
[31/05/2011 - 15:41:48 | HD ] C:\ProgramESC
[19/04/2011 - 00:28:00 | HD ] C:\Programs
[28/03/2007 - 07:15:21 | A | 420] C:\RHDSetup.log
[20/06/2008 - 14:37:19 | A | 90] C:\Setup.log
[17/11/2009 - 21:48:25 | AH | 232] C:\sqmdata00.sqm
[19/11/2009 - 02:56:52 | AH | 232] C:\sqmdata01.sqm
[26/11/2009 - 23:59:10 | AH | 232] C:\sqmdata02.sqm
[17/11/2009 - 21:48:25 | AH | 244] C:\sqmnoopt00.sqm
[19/11/2009 - 02:56:52 | AH | 244] C:\sqmnoopt01.sqm
[26/11/2009 - 23:59:10 | AH | 244] C:\sqmnoopt02.sqm
[20/04/2012 - 02:11:49 | SHD ] C:\System Volume Information
[08/11/2008 - 22:01:17 | HD ] C:\temp
[28/03/2007 - 07:53:23 | A | 0] C:\Trace.log
[20/04/2012 - 11:38:21 | D ] C:\UsbFix
[20/04/2012 - 11:38:06 | A | 2874] C:\UsbFix.txt
[10/03/2008 - 01:07:32 | RD ] C:\Users
[19/04/2012 - 23:33:42 | D ] C:\Windows
[25/05/2010 - 04:13:34 | HD ] C:\WINNT
[19/04/2012 - 20:15:52 | D ] C:\ZHP
[31/03/2008 - 00:44:54 | HD ] C:\ZIK
[22/09/2007 - 12:08:14 | HD ] D:\$RECYCLE.BIN
[11/10/2010 - 19:36:59 | A | 0] D:\31df38
[31/05/2011 - 14:33:26 | HD ] D:\Artiste inconnu
[29/11/2008 - 23:18:44 | HD ] D:\erData
[08/01/2009 - 00:30:23 | HD ] D:\IDE
[31/05/2011 - 14:37:37 | HD ] D:\MOROCCO
[29/10/2007 - 14:12:26 | HD ] D:\MSOCache
[20/09/2010 - 19:24:44 | HD ] D:\PICTURES
[24/05/2007 - 09:26:59 | SHD ] D:\System Volume Information
[31/05/2011 - 14:42:04 | HD ] D:\ZIK

################## | E.O.F |

Tu as utilisé l'option "Recherche" d'UsbFix ?

la première fois il a planté voici le rapport,

############################## | UsbFix V 7.087 | [Recherche]

Utilisateur: charly boy (Administrateur) # PC
Mis à jour le 05/04/2012 par El Desaparecido
Lancé à 11:56:36 | 20/04/2012

Site Web: https://www.sosvirus.net/
Fichier suspect ? : http://eldesaparecido.com/upload.html
Contact: contact@eldesaparecido.com

PC: Acer (Aspire 5610Z ) (X86-based PC) # Notebook
CPU: Genuine Intel(R) CPU T2080 @ 1.73GHz (1733)
RAM -> [ Total : 1021 | Free : 99 ]
BIOS: Ver 1.00PARTTBLP
BOOT: Normal boot

OS: Microsoft® Windows Vista(TM) Édition Familiale Premium (6.0.6001 32-Bit) # Service Pack 1
WB: Windows Internet Explorer 7.0.6001.18000

SC: Security Center Service [ Enabled ]
WU: Windows Update Service [ Enabled ]
AV: Microsoft Security Essentials [ Enabled | Updated ]
FW: Windows FireWall Service [ Enabled ]

C:\ (%systemdrive%) -> Disque fixe # 70 Go (8 Go libre(s) - 11%) [ACER] # NTFS
D:\ -> Disque fixe # 70 Go (47 Go libre(s) - 67%) [DATA] # NTFS
E:\ -> CD-ROM

################## | Processus Actif |

C:\Windows\system32\csrss.exe (428)
C:\Windows\system32\csrss.exe (476)
C:\Windows\system32\wininit.exe (484)
C:\Windows\system32\winlogon.exe (524)
C:\Windows\system32\services.exe (564)
C:\Windows\system32\lsass.exe (576)
C:\Windows\system32\lsm.exe (584)
C:\Windows\system32\svchost.exe (744)
C:\Windows\system32\svchost.exe (804)
C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (880)
C:\Windows\System32\svchost.exe (1012)
C:\Windows\System32\svchost.exe (1036)
C:\Windows\system32\svchost.exe (1056)
C:\Windows\system32\SLsvc.exe (1200)
C:\Windows\system32\svchost.exe (1312)
C:\Windows\system32\svchost.exe (1448)
C:\Windows\System32\spoolsv.exe (1640)
C:\Windows\system32\svchost.exe (1664)
C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (1856)
C:\Acer\ALaunch\ALaunchSvc.exe (1888)
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (1928)
C:\Program Files\Bonjour\mDNSResponder.exe (1948)
C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe (1976)
C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe (284)
C:\Acer\Empowering Technology\eNet\eNet Service.exe (356)
C:\Program Files\Common Files\LightScribe\LSSrvc.exe (888)
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE (1156)
C:\Acer\Mobility Center\MobilityService.exe (1356)
C:\Windows\system32\svchost.exe (1748)
C:\Program Files\CyberLink\Shared Files\RichVideo.exe (1868)
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (1972)
C:\Windows\system32\svchost.exe (1336)
C:\Windows\System32\svchost.exe (1572)
C:\Windows\system32\SearchIndexer.exe (1776)
C:\Windows\system32\DRIVERS\xaudio.exe (2260)
C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe (2276)
C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe (2336)
C:\Windows\system32\svchost.exe (2688)
C:\Windows\Explorer.EXE (3392)
C:\Windows\system32\Dwm.exe (2884)
C:\Windows\system32\taskeng.exe (2868)
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (3128)
C:\Program Files\Launch Manager\LManager.exe (3248)
C:\Program Files\Common Files\Real\Update_OB\realsched.exe (3092)
C:\ProgramESC\Microsoft Office 2007\Office12\GrooveMonitor.exe (1228)
C:\Program Files\iTunes\iTunesHelper.exe (1568)
C:\Windows\WindowsMobile\wmdSync.exe (2120)
C:\Program Files\Microsoft Security Client\msseces.exe (1900)
C:\Windows\system32\wbem\unsecapp.exe (2840)
C:\Windows\System32\rundll32.exe (3796)
C:\Windows\system32\wbem\wmiprvse.exe (3224)
C:\Program Files\Windows Sidebar\sidebar.exe (2968)
C:\Windows\ehome\ehtray.exe (2932)
C:\Program Files\Modem Samsung SCH-U209\SamsungPnPServiceManager.exe (3788)
C:\Windows\ehome\ehmsas.exe (1128)
C:\Acer\Empowering Technology\ENET\ENMTRAY.EXE (2752)
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE (4032)
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE (2212)
C:\Program Files\iPod\bin\iPodService.exe (1172)
C:\Windows\system32\wbem\wmiprvse.exe (3336)
C:\Windows\System32\wsqmcons.exe (4444)
C:\Windows\system32\taskeng.exe (5500)
C:\Program Files\Mozilla Firefox\firefox.exe (5220)
C:\Program Files\Mozilla Firefox\plugin-container.exe (1688)
C:\Windows\system32\conime.exe (6052)
C:\Windows\system32\taskeng.exe (3276)
C:\UsbFix\Go.exe (5708)

################## | Éléments infectieux |

Présent! C:\Users\CHARLY~1\AppData\Local\Temp\RtkBtMnt.exe
Présent! C:\Windows\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job
Présent! C:\Users\charly boy\AppData\Local\Temp\RtkBtMnt.exe

################## | Mabezat |

Présent! C:\Users\charly boy\AppData\Roaming\tazebama

################## | Registre |

Présent! HKCU\Software\Microsoft\Handle
Présent! HKCU\Software\ROUA3O12PW
Présent! HKCU\Software\TOY5KNQ8OC
Présent! HKCU\Software\XML
Présent! HKCU\Software\Microsoft\Windows\CurrentVersion\Run|TOY5KNQ8OC

################## | Mountpoints2 |

HKCU\.\.\.\.\Explorer\MountPoints2\G
Shell\AutoRun\Command = G:\LaunchU3.exe -a

HKCU\.\.\.\.\Explorer\MountPoints2\I
Shell\AutoRun\Command = I:\m2nl.bat
Shell\explore\Command = I:\m2nl.bat
Shell\open\Command = I:\m2nl.bat

HKCU\.\.\.\.\Explorer\MountPoints2\{03c4b015-dea7-11dd-95cf-0016d4d62a01}
Shell\AutoRun\Command = H:\
Shell\explore\Command = RECYCLED\INFO.exe
Shell\open\Command = RECYCLED\INFO.exe

HKCU\.\.\.\.\Explorer\MountPoints2\{03c4b01a-dea7-11dd-95cf-0016d4d62a01}
Shell\AutoRun\Command = F:\LaunchU3.exe -a

HKCU\.\.\.\.\Explorer\MountPoints2\{0aaa957f-cb41-11df-8931-e1ba4e7ef569}
Shell\AutoRun\Command = F:\AutoRun.exe

HKCU\.\.\.\.\Explorer\MountPoints2\{0f29c38a-6903-11dc-b039-99e411788850}
Shell\Auto\Command = F:\Start.exe
Shell\AutoRun\Command = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\Start.exe

HKCU\.\.\.\.\Explorer\MountPoints2\{12c5a61e-bd44-11dc-afa4-0016d4d62a01}
Shell\AutoRun\Command = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL antihost.exe

HKCU\.\.\.\.\Explorer\MountPoints2\{1b98f100-5a40-11de-8303-00197e57d3ca}
Shell\Autoplay\Command = F:\plawrv.pif
Shell\AutoRun\Command = F:\plawrv.pif
Shell\EXploRe\Command = F:\plawrv.pif
Shell\OpeN\Command = F:\plawrv.pif

HKCU\.\.\.\.\Explorer\MountPoints2\{30d009cf-f3ca-11de-9f6a-0016d4d62a01}
Shell\auto\Command = F:\Thumbs.com
Shell\AutoRun\Command = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\Thumbs.com

HKCU\.\.\.\.\Explorer\MountPoints2\{3bdb950f-1b86-11dd-9198-0016d4d62a01}
Shell\AutoRun\Command = G:\LaunchU3.exe -a

HKCU\.\.\.\.\Explorer\MountPoints2\{3e550ff5-fbca-11de-843d-0016d4d62a01}
Shell\auto\Command = F:\Thumbs.com
Shell\AutoRun\Command = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\Thumbs.com

HKCU\.\.\.\.\Explorer\MountPoints2\{4b885fd1-94af-11de-900e-0016d4d62a01}
Shell\Auto\Command = F:\Start.exe
Shell\AutoRun\Command = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\Start.exe

HKCU\.\.\.\.\Explorer\MountPoints2\{4fff7fd2-ed9f-11de-9b8b-00197e57d3ca}
Shell\AutoRun\Command = F:\Setup.exe

HKCU\.\.\.\.\Explorer\MountPoints2\{50f6408a-92c3-11dd-bb94-0016d4d62a01}
Shell\AutoRun\Command = I:\m2nl.bat
Shell\explore\Command = I:\m2nl.bat
Shell\open\Command = I:\m2nl.bat

HKCU\.\.\.\.\Explorer\MountPoints2\{7aef91e2-7338-11de-994e-0016d4d62a01}
Shell\Auto\Command = Start.exe
Shell\AutoRun\Command = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Start.exe

HKCU\.\.\.\.\Explorer\MountPoints2\{81a0e974-aa53-11dd-9835-b7f687e3950a}
Shell\Auto\Command = H:\AdobeR.exe e
Shell\AutoRun\Command = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL H:\AdobeR.exe e

HKCU\.\.\.\.\Explorer\MountPoints2\{934ddaa8-f2e2-11de-a0be-b787678765f4}
Shell\auto\Command = F:\Thumbs.com
Shell\AutoRun\Command = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\Thumbs.com

HKCU\.\.\.\.\Explorer\MountPoints2\{93b706cc-f60a-11de-8e62-c521b2c84dd7}
Shell\auto\Command = F:\Thumbs.com
Shell\AutoRun\Command = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\Thumbs.com

HKCU\.\.\.\.\Explorer\MountPoints2\{b33cebf1-9150-11dc-a683-0016d4d62a01}
Shell\Auto\Command = AdobeR.exe e
Shell\AutoRun\Command = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AdobeR.exe e

HKCU\.\.\.\.\Explorer\MountPoints2\{c8972d00-373d-11de-94e7-0016d4d62a01}
Shell\Auto\Command = F:\Start.exe
Shell\AutoRun\Command = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\Start.exe

HKCU\.\.\.\.\Explorer\MountPoints2\{c8d22818-efa9-11de-b9be-0016d4d62a01}
Shell\auto\Command = F:\Thumbs.com
Shell\AutoRun\Command = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\Thumbs.com

HKCU\.\.\.\.\Explorer\MountPoints2\{d57759f4-c84c-11dd-a060-bf6b8cabbcc8}
Shell\Auto\Command = AdobeR.exe e
Shell\AutoRun\Command = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AdobeR.exe e

HKCU\.\.\.\.\Explorer\MountPoints2\{d57759f9-c84c-11dd-a060-bf6b8cabbcc8}
Shell\AutoRun\Command = G:\LaunchU3.exe -a

HKCU\.\.\.\.\Explorer\MountPoints2\{e14e5294-b972-11de-ba02-00197e57d3ca}
Shell\auto\Command = G:\Thumbs.com
Shell\AutoRun\Command = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL G:\Thumbs.com

HKCU\.\.\.\.\Explorer\MountPoints2\{f06f7480-fd55-11de-a7b8-0016d4d62a01}
Shell\AutoRun\Command = F:\SWLauncher.exe

HKCU\.\.\.\.\Explorer\MountPoints2\{f06f74c4-fd55-11de-a7b8-0016d4d62a01}
Shell\auto\Command = F:\Thumbs.com
Shell\AutoRun\Command = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\Thumbs.com



################## | Vaccin |

(!) Cet ordinateur n'est pas vacciné!

################## | E.O.F |

Tu n'as pas de clé USB ?

Relance UsbFix, utilise l'option "Suppression" et poste le rapport.

l'ordinateur que j'utilise et dans une colocation donc les clé usb ne sont pas a ma disposition. il faut absolument en mettre une? je fait la suppression.
.