PC trés infecté

Résolu
Balboa99 -  
Bonjour

Ce PC plante régulièrement. J'ai lancé Housecall et TFC

Voici un rapport ZHPdiag

https://www.cjoint.com/?CFrvTo7KjIk

Merci pour votre aide

25 réponses

Résumé de la discussion

Un plantage récurrent du PC a été signalé et le fil réunit des rapports et scans préliminaires tels que HouseCall, TFC et ZHPDiag pour diagnostiquer l'origine du problème. Des solutions variées ont été proposées pour nettoyer le système et générer des rapports, notamment UsbFix, Delfix et OTL, avec instructions d'exécution en tant qu’administrateur et localisation des fichiers de log. En parallèle, certains participants recommandent de vérifier les périphériques externes et de privilégier l’analyse des résultats sans publier des données trop longues ni publiques ni sensibles. Dernière nuance utile, la discussion insiste sur l’importance d’héberger les rapports volumineux sur des services externes et d’interpréter les résultats avec prudence avant toute publication, afin d’éviter les réinfections.

Bobot (l’IA à votre service)
  1. g3n-h@ckm@n
    ca serait bien que quelqu'un de serieux s'y mette car là c'est du n'importe quoi comme on vient de me le signaler en MP
    2
    1. afideg Contributeur sécurité
      Hello Gen ,

      On me l'a également signalé.

      Il faudra bien un jour y mettre ordre.
      Or ce sont 2 membres dont nous ne savons rien connaître sur leur statut de Helper.
      Bonjour les dégâts aux PC des internautes en difficulté passagère !

      Al.
      0
  2. g3n-h@ckm@n
    ok rocky ^^ (Balboa99)

    fais ce qui suit ca sent le brontok :

    ▶ Téléchargez UsbFix (créé par El Desaparecido) sur votre Bureau.

    ▶ Si votre antivirus affiche une alerte, ignorez-la et désactivez l'antivirus temporairement.
    ▶ Branchez toutes vos sources de données externes à votre PC (clé USB, disque dur externe, etc...) sans les ouvrir.
    ▶ Double cliquez sur UsbFix.exe. (pour les utilisateurs de windows Vista , windows 7 , windows 8 , clique droit => executer en tant qu'administrateur"

    ▶ Cliquez sur [Suppression].
    ▶ Laissez travailler l'outil.

    ▶ À la fin du scan, un rapport va s'afficher, postez-le dans votre prochaine réponse sur le forum.

    ▶ Le rapport est aussi sauvegardé à la racine du disque système ( C:\UsbFix.txt ).

    2
    1. g3n-h@ckm@n
      re

      et ben c'était pas ca :)

      ==

      Télécharge ici :OTL

      ▶ enregistre le sur ton Bureau.

      si tu as XP => double clique
      si tu as Vista ou windows 7 / 8 => clic droit "executer en tant que...."

      sur OTL.exe pour le lancer.

      ▶ => Clique ici pour voir la Configuration

      ▶ Copie et colle le contenu de ce qui suit en gras dans la partie inférieure d'OTL "Personnalisation"


      HKCU\Software
      HKLM\Software
      HKCU\Software\Microsoft\Command Processor /s
      %Homedrive%\*
      %Homedrive%\*.
      %Userprofile%\*
      %Userprofile%\*.
      %Allusersprofile%\*
      %Allusersprofile%\*.
      %LocalAppData%\*
      %LocalAppData%\*.
      %Userprofile%\Local Settings\Application Data\*
      %Userprofile%\Local Settings\Application Data\*.
      %programFiles%\*
      %programFiles%\*.
      %Systemroot%\Installer\*.
      %Systemroot%\Temp\*.exe /s
      %systemroot%\system32\*.dll /lockedfiles
      %systemroot%\system32\*.exe /lockedfiles
      %systemroot%\system32\*.in*
      %systemroot%\Tasks\*
      %systemroot%\Tasks\*.
      %systemroot%\system32\Tasks\*
      %systemroot%\system32\Tasks\*.
      %systemroot%\system32\drivers\*.sy* /lockedfiles
      %systemroot%\system32\config\*.exe /s
      %Systemroot%\ServiceProfiles\*.exe /s
      %systemroot%\system32\*.sys
      dir C:\ /S /A:L /C
      msconfig
      activex
      /md5start
      explorer.exe
      winlogon.exe
      wininit.exe
      volsnap.sys
      atapi.sys
      ndisuio.sys
      ndis.sys
      cdrom.sys
      i8042prt.sys
      iastor.sys
      tdx.sys
      netbt.sys
      afd.sys
      /md5stop
      netsvcs
      safebootminimal
      safebootnetwork
      CREATERESTOREPOINT

      ▶ Clic sur Analyse.

      A la fin du scan, le Bloc-Notes va s'ouvrir avec le rapport (OTL.txt).

      Ce fichier est sur ton Bureau (en général C:\Documents and settings\le_nom_de_ta_session\<Bureau ou Desktop>\OTL.txt)

      ▶▶▶ NE LE POSTE PAS SUR LE FORUM (il est trop long)

      heberge OTL.txt et extra.txt sur https://www.cjoint.com/ et donne les liens
      1
      1. g3n-h@ckm@n
        ok tu me feras le plaisir de mettre ton lecteur "H:\" que tu n'avais pas mis et de refaire une suppression avec usbfix

        tu as mis ce lecteur depuis, et tu as reinfecté la machine avec

        ==

        ATTENTION !!! : Script personnalisé pour cette machine uniquement , ne pas reproduire !!

        si tu as XP => double clique
        si tu as Vista ou windows 7 => clic droit "executer en tant que...."

        sur OTL.exe pour le lancer.

        ▶Copie la liste qui se trouve en gras ci-dessous,

        ▶ colle-la dans la zone sous "Personnalisation" :


        :processes
        explorer.exe
        iexplore.exe
        firefox.exe
        msnmsgr.exe
        Teatimer.exe
        safari.exe
        opera.exe
        rundll32.exe

        :OTL
        IE - HKU\S-1-5-21-3194007295-2266635485-1072483425-1008\..\SearchScopes\{6B7E39E9-FEBB-40EB-904C-5CF4D6F32DC5}: "URL" = http://www.search.ask.com/?l=dis{searchTerms}&locale=&apn_ptnrs=U3&apn_dtid=OSJ000
        FF - user.js - File not found
        CHR - plugin: Java Deployment Toolkit 6.0.260.3 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll
        CHR - plugin: Java Platform SE 6 U26 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
        O3 - HKLM\..\Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - No CLSID value found.
        O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
        O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
        O33 - MountPoints2\{8f2588b3-fb66-11de-9506-001f3c2ee192}\Shell\AUtoPlaY\CommAnd - "" = H:\rndj.exe
        O33 - MountPoints2\{8f2588b3-fb66-11de-9506-001f3c2ee192}\Shell\AutoRun\command - "" = H:\rndj.exe
        O33 - MountPoints2\{8f2588b3-fb66-11de-9506-001f3c2ee192}\Shell\ExPlore\COMmAnd - "" = H:\rndj.exe
        O33 - MountPoints2\{8f2588b3-fb66-11de-9506-001f3c2ee192}\Shell\opEn\CoMmAND - "" = H:\rndj.exe
        [1 D:\Henry\Mes documents\*.tmp files -> D:\Henry\Mes documents\*.tmp -> ]

        :Reg
        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
        "Alcmtr"=-
        ""=-
        "IMJPMIG8.1"=-
        "iTunesHelper"=-
        "MSPY2002"=-
        "PHIME2002A"=-
        "PHIME2002ASync"=-
        [-HKEY_LOCAL_MACHINE\Software\BrowserChoice]

        :Files
        C:\Documents and Settings\All Users\Application Data\vot03.pad
        C:\Documents and Settings\All Users\Application Data\vot03.js
        C:\Documents and Settings\All Users\Application Data\dco81do.dat
        C:\*.sqm
        C:\Program Files\Spybot - Search & Destroy

        :commands
        [emptytemp]

        ▶ Clique sur "Correction" pour lancer la suppression.

        ▶ Poste le rapport qui logiquement s'ouvrira tout seul en fin de travail appres le redemarrage.

        1
        2. g3n-h@ckm@n
          re

          on les branche et ils sont automatiquement détectés
          1
          1. g3n-h@ckm@n
            tu refais une suppression avec usbfix en branchant tous tes périphériques comme demandé ils sont infectés
            1
            1. g3n-h@ckm@n
              il semblerait que tu ne te décides pas à brancher tes supports externes....
              1
              1. g3n-h@ckm@n
                et tu n'as rien d'autre ? disque dur externe etc ????? à ce que j'ai cru comprendre si....
                1
                1. g3n-h@ckm@n
                  d'ac cite les soucis qu il te reste que je situe un peu
                  1
                  1. g3n-h@ckm@n
                    non c'est pas utile tu peux faire le menage

                    https://forums-fec.be/entraide/viewtopic.php?f=11&t=229

                    ¤¤¤¤¤¤¤¤¤¤_Pre_Scan_Concept_¤¤¤¤¤¤¤¤¤¤
                    Windows 8 => meme flop que Vista X 10
                    1
                    2. Balboa99 Auteur
                      Voici le rapport Malwarebytes

                      Malwarebytes Anti-Malware 1.75.0.1300
                      www.malwarebytes.org

                      Version de la base de données: v2013.06.17.05

                      Windows XP Service Pack 3 x86 NTFS
                      Internet Explorer 8.0.6001.18702
                      Henry :: ACER-564DF136B7 [administrateur]

                      17.06.2013 21:59:18
                      mbam-log-2013-06-17 (21-59-18).txt

                      Type d'examen: Examen rapide
                      Options d'examen activées: Mémoire | Démarrage | Registre | Système de fichiers | Heuristique/Extra | Heuristique/Shuriken | PUP | PUM
                      Options d'examen désactivées: P2P
                      Elément(s) analysé(s): 238657
                      Temps écoulé: 9 minute(s), 4 seconde(s)

                      Processus mémoire détecté(s): 0
                      (Aucun élément nuisible détecté)

                      Module(s) mémoire détecté(s): 0
                      (Aucun élément nuisible détecté)

                      Clé(s) du Registre détectée(s): 1
                      HKCU\SOFTWARE\g043oqxanu (Trojan.FakeAlert) -> Mis en quarantaine et supprimé avec succès.

                      Valeur(s) du Registre détectée(s): 0
                      (Aucun élément nuisible détecté)

                      Elément(s) de données du Registre détecté(s): 0
                      (Aucun élément nuisible détecté)

                      Dossier(s) détecté(s): 0
                      (Aucun élément nuisible détecté)

                      Fichier(s) détecté(s): 6
                      C:\Documents and Settings\All Users\Application Data\dsgsdgdsgdsgw.pad (Exploit.Drop.GSA) -> Mis en quarantaine et supprimé avec succès.
                      C:\Documents and Settings\All Users\Application Data\lsass.exe (Trojan.Delf) -> Mis en quarantaine et supprimé avec succès.
                      C:\Documents and Settings\Henry\Menu Démarrer\Programmes\Démarrage\ctfmon.lnk (Trojan.Ransom.Gen) -> Mis en quarantaine et supprimé avec succès.
                      C:\Documents and Settings\All Users\Application Data\2433f433 (Trojan.Agent.TPL) -> Mis en quarantaine et supprimé avec succès.
                      C:\Documents and Settings\Henry\Application Data\2433f433 (Trojan.Agent.TPL) -> Mis en quarantaine et supprimé avec succès.
                      C:\Documents and Settings\Henry\Local Settings\Application Data\2433f433 (Trojan.Agent.TPL) -> Mis en quarantaine et supprimé avec succès.

                      (fin)
                      0
                      1. Balboa99 Auteur
                        Bonjour,

                        Voici le rapport

                        ############################## | UsbFix V 7.127 | [Suppression]

                        Utilisateur: Henry (Administrateur) # ACER-564DF136B7
                        Mis à jour le 05/06/2013 par El Desaparecido
                        Lancé à 18:18:38 | 18/06/2013

                        Site Web: https://www.sosvirus.net/
                        Upload Malware: http://upload.sosvirus.org/
                        Contact: contact@sosvirus.org

                        PC: Acer (Extensa 7620 ) (X86-based PC)
                        CPU: Intel(R) Core(TM)2 Duo CPU T5750 @ 2.00GHz (1994)
                        RAM -> [Total : 2046 | Free : 1243]
                        BIOS: Ver 1.00PARTTBL
                        BOOT: Normal boot

                        OS: Microsoft Windows XP Professionnel (5.1.2600 32-Bit) # Service Pack 3
                        WB: Windows Internet Explorer 8.0.6001.18702

                        SC: Security Center Service [Enabled]
                        WU: Windows Update Service [Enabled]
                        FW: Windows FireWall Service [Enabled]

                        C:\ (%systemdrive%) -> Disque fixe # 113 Go (86 Go libre(s) - 76%) [ACER] # NTFS
                        D:\ -> Disque fixe # 114 Go (113 Go libre(s) - 99%) [ACERDATA] # FAT32
                        E:\ -> CD-ROM

                        ################## | El Desaparecido Section |

                        HKLM\SOFTWARE | Run : [preload] - C:\Windows\RUNXMLPL.exe
                        HKLM\SOFTWARE | Run : [IAAnotif] - "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
                        HKLM\SOFTWARE | Run : [SynTPStart] - C:\Program Files\Synaptics\SynTP\SynTPStart.exe
                        HKLM\SOFTWARE | Run : [RTHDCPL] - RTHDCPL.EXE
                        HKLM\SOFTWARE | Run : [Alcmtr] - ALCMTR.EXE
                        HKLM\SOFTWARE | Run : [AzMixerSel] - C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
                        HKLM\SOFTWARE | Run : [IMJPMIG8.1] - "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
                        HKLM\SOFTWARE | Run : [MSPY2002] - C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
                        HKLM\SOFTWARE | Run : [PHIME2002ASync] - C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
                        HKLM\SOFTWARE | Run : [PHIME2002A] - C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
                        HKLM\SOFTWARE | Run : [StartCCC] - "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
                        HKLM\SOFTWARE | Run : [Acer ePresentation HPD] - C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
                        HKLM\SOFTWARE | Run : [ePower_DMC] - C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
                        HKLM\SOFTWARE | Run : [Boot] - C:\Acer\Empowering Technology\ePower\Boot.exe
                        HKLM\SOFTWARE | Run : [eRecoveryService] - C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
                        HKLM\SOFTWARE | Run : [LManager] - C:\PROGRA~1\LAUNCH~1\LManager.exe
                        HKLM\SOFTWARE | Run : [Kernel and Hardware Abstraction Layer] - KHALMNPR.EXE
                        HKLM\SOFTWARE | Run : [avast5] - C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
                        HKLM\SOFTWARE | Run : [HP Software Update] - C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
                        HKLM\SOFTWARE | Run : [] -
                        HKLM\SOFTWARE | Run : [APSDaemon] - "C:\Program Files\Fichiers communs\Apple\Apple Application Support\APSDaemon.exe"
                        HKLM\SOFTWARE | Run : [iTunesHelper] - "C:\Program Files\iTunes\iTunesHelper.exe"
                        HKLM\SOFTWARE | Run : [Adobe ARM] - "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
                        HKLM\SOFTWARE | RunOnce : [] -
                        HKU\S-1-5-19\SOFTWARE | Run : [CTFMON.EXE] - C:\WINDOWS\system32\CTFMON.EXE
                        HKU\S-1-5-20\SOFTWARE | Run : [CTFMON.EXE] - C:\WINDOWS\system32\CTFMON.EXE
                        HKU\S-1-5-21-3194007295-2266635485-1072483425-1008\SOFTWARE | Run : [ctfmon.exe] - C:\WINDOWS\system32\ctfmon.exe
                        HKU\S-1-5-21-3194007295-2266635485-1072483425-1008\SOFTWARE | Run : [MsnMsgr] - "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
                        HKU\S-1-5-21-3194007295-2266635485-1072483425-1008\SOFTWARE | Run : [swg] - "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
                        HKU\S-1-5-21-3194007295-2266635485-1072483425-1008\SOFTWARE | Run : [Skype] - "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
                        HKU\S-1-5-18\SOFTWARE | Run : [CTFMON.EXE] - C:\WINDOWS\system32\CTFMON.EXE

                        ################## | Processus Stoppés |

                        Stoppé! C:\WINDOWS\system32\Ati2evxx.exe (1700)
                        Stoppé! C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe (1960)
                        Stoppé! C:\WINDOWS\system32\Ati2evxx.exe (296)
                        Stoppé! C:\Program Files\Alwil Software\Avast5\afwServ.exe (1020)
                        Stoppé! C:\WINDOWS\Explorer.EXE (1128)
                        Stoppé! C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (1212)
                        Stoppé! C:\WINDOWS\system32\spoolsv.exe (1360)
                        Stoppé! C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe (192)
                        Stoppé! C:\Program Files\Microsoft\BingBar\7.1.391.0\BBSvc.exe (264)
                        Stoppé! C:\Program Files\Bonjour\mDNSResponder.exe (612)
                        Stoppé! C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (848)
                        Stoppé! C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (888)
                        Stoppé! C:\WINDOWS\RTHDCPL.EXE (904)
                        Stoppé! C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (404)
                        Stoppé! C:\Acer\Empowering Technology\ePresentation\ePresentation.exe (304)
                        Stoppé! C:\Acer\Empowering Technology\ePower\ePower_DMC.exe (2064)
                        Stoppé! C:\Acer\Empowering Technology\eRecovery\eRAgent.exe (2140)
                        Stoppé! C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE (2180)
                        Stoppé! C:\PROGRA~1\LAUNCH~1\LManager.exe (2200)
                        Stoppé! C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe (2228)
                        Stoppé! C:\Program Files\HP\HP Software Update\HPWuSchd2.exe (2244)
                        Stoppé! C:\Program Files\iTunes\iTunesHelper.exe (2396)
                        Stoppé! C:\WINDOWS\system32\ctfmon.exe (2492)
                        Stoppé! C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe (2512)
                        Stoppé! C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (2528)
                        Stoppé! C:\Program Files\Skype\Phone\Skype.exe (2580)
                        Stoppé! C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe (2824)
                        Stoppé! C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe (2932)
                        Stoppé! C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (2964)
                        Stoppé! C:\Program Files\Logitech\SetPoint\SetPoint.exe (3004)
                        Stoppé! C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe (3012)
                        Stoppé! C:\Program Files\WinZip\WZQKPICK.EXE (3112)
                        Stoppé! C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (3128)
                        Stoppé! C:\Program Files\Fichiers communs\Motive\McciCMService.exe (3148)
                        Stoppé! C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (3836)
                        Stoppé! C:\Program Files\CyberLink\Shared Files\RichVideo.exe (3976)
                        Stoppé! C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe (4040)
                        Stoppé! C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe (2348)
                        Stoppé! C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLIDSVC.EXE (2880)
                        Stoppé! C:\Program Files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.EXE (980)
                        Stoppé! C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLIDSvcM.exe (1304)
                        Stoppé! C:\DOCUME~1\Henry\LOCALS~1\Temp\RtkBtMnt.exe (3376)
                        Stoppé! C:\Program Files\iPod\bin\iPodService.exe (3524)
                        Stoppé! C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe (5848)
                        Stoppé! C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe (5556)
                        Stoppé! C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe (5912)
                        Stoppé! C:\WINDOWS\system32\wbem\wmiapsrv.exe (6124)
                        Stoppé! C:\Program Files\Microsoft\BingBar\7.1.391.0\SeaPort.exe (3268)
                        Stoppé! C:\Program Files\Internet Explorer\iexplore.exe (1044)
                        Stoppé! C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_clipbook.exe (1512)

                        ################## | Éléments infectieux |

                        Supprimé! C:\DOCUME~1\Henry\LOCALS~1\Temp\RtkBtMnt.exe

                        (!) Fichiers temporaires supprimés.

                        ################## | Registre |

                        ################## | Mountpoints2 |

                        Supprimé! HKCU\.\.\.\.\Explorer\MountPoints2\{8f2588b2-fb66-11de-9506-001f3c2ee192}
                        Supprimé! HKCU\.\.\.\.\Explorer\MountPoints2\{fc76d260-6ccb-11de-943b-001f3c2ee192}

                        ################## | Listing |

                        [23/09/2008 - 15:42:56 | D ] C:\Acer
                        [22/03/2008 - 21:42:46 | N | 715550] C:\bknowsetup.log
                        [24/09/2008 - 06:29:20 | D ] C:\BOOK
                        [23/09/2008 - 22:37:46 | N | 212] C:\boot.ini
                        [05/08/2004 - 06:00:00 | N | 4952] C:\Bootfont.bin
                        [06/09/2004 - 16:40:26 | N | 512] C:\BOOTSECT.DOS
                        [17/06/2013 - 08:29:03 | D ] C:\Config.Msi
                        [24/09/2008 - 06:22:55 | D ] C:\DOCS
                        [23/09/2008 - 22:39:21 | D ] C:\Documents and Settings
                        [24/09/2008 - 06:23:00 | D ] C:\DOTNETFX
                        [23/09/2008 - 16:56:20 | D ] C:\ELEMENTS
                        [15/06/2013 - 03:22:58 | N | 4968] C:\ffastun.ffa
                        [15/06/2013 - 03:22:58 | N | 884736] C:\ffastun.ffl
                        [15/06/2013 - 03:22:58 | N | 90112] C:\ffastun.ffo
                        [15/06/2013 - 03:22:58 | N | 2977792] C:\ffastun0.ffx
                        [18/06/2013 - 17:56:57 | ASH | 2145832960] C:\hiberfil.sys
                        [24/09/2008 - 06:23:31 | D ] C:\I386
                        [06/09/2004 - 17:00:24 | N | 0] C:\IO.SYS
                        [06/09/2004 - 17:00:24 | N | 0] C:\MSDOS.SYS
                        [16/04/2011 - 19:06:46 | RHD ] C:\MSOCache
                        [05/08/2004 - 06:00:00 | N | 47564] C:\NTDETECT.COM
                        [23/09/2008 - 16:37:26 | N | 252240] C:\ntldr
                        [18/06/2013 - 17:56:55 | ASH | 2145386496] C:\pagefile.sys
                        [09/04/2008 - 22:09:28 | N | 6326] C:\Patch.rev
                        [26/04/2007 - 00:45:58 | N | 631] C:\PDVD.iss
                        [17/06/2013 - 21:35:22 | N | 512] C:\PhysicalDisk0_MBR.bin
                        [23/03/2008 - 09:05:28 | N | 73] C:\preload.aaa
                        [23/03/2008 - 09:05:28 | N | 73] C:\Preload.rev
                        [17/06/2013 - 22:20:27 | D ] C:\Program Files
                        [24/09/2008 - 08:24:38 | SHD ] C:\RECYCLER
                        [22/03/2008 - 21:42:04 | N | 595] C:\RHDSetup.log
                        [10/01/2011 - 09:59:59 | N | 368] C:\rkill.log
                        [22/03/2008 - 21:42:46 | N | 32] C:\setup.log
                        [16/08/2009 - 03:13:47 | N | 268] C:\sqmdata00.sqm
                        [16/08/2009 - 04:24:43 | N | 268] C:\sqmdata01.sqm
                        [16/08/2009 - 23:21:12 | N | 268] C:\sqmdata02.sqm
                        [17/08/2009 - 22:20:09 | N | 268] C:\sqmdata03.sqm
                        [18/08/2009 - 23:48:32 | N | 268] C:\sqmdata04.sqm
                        [20/08/2009 - 00:22:46 | N | 268] C:\sqmdata05.sqm
                        [20/08/2009 - 23:39:06 | N | 268] C:\sqmdata06.sqm
                        [22/08/2009 - 22:35:58 | N | 268] C:\sqmdata07.sqm
                        [23/08/2009 - 23:25:32 | N | 268] C:\sqmdata08.sqm
                        [24/08/2009 - 08:53:27 | N | 268] C:\sqmdata09.sqm
                        [08/09/2009 - 21:13:59 | N | 268] C:\sqmdata10.sqm
                        [24/09/2009 - 09:22:24 | N | 268] C:\sqmdata11.sqm
                        [06/08/2009 - 23:08:53 | N | 268] C:\sqmdata12.sqm
                        [07/08/2009 - 23:32:35 | N | 268] C:\sqmdata13.sqm
                        [09/08/2009 - 00:41:56 | N | 268] C:\sqmdata14.sqm
                        [09/08/2009 - 22:47:09 | N | 268] C:\sqmdata15.sqm
                        [11/08/2009 - 23:11:41 | N | 268] C:\sqmdata16.sqm
                        [13/08/2009 - 00:01:25 | N | 268] C:\sqmdata17.sqm
                        [13/08/2009 - 23:22:29 | N | 268] C:\sqmdata18.sqm
                        [14/08/2009 - 23:59:02 | N | 268] C:\sqmdata19.sqm
                        [16/08/2009 - 03:13:47 | N | 244] C:\sqmnoopt00.sqm
                        [16/08/2009 - 04:24:43 | N | 244] C:\sqmnoopt01.sqm
                        [16/08/2009 - 23:21:12 | N | 244] C:\sqmnoopt02.sqm
                        [17/08/2009 - 22:20:09 | N | 244] C:\sqmnoopt03.sqm
                        [18/08/2009 - 23:48:32 | N | 244] C:\sqmnoopt04.sqm
                        [20/08/2009 - 00:22:46 | N | 244] C:\sqmnoopt05.sqm
                        [20/08/2009 - 23:39:06 | N | 244] C:\sqmnoopt06.sqm
                        [22/08/2009 - 22:35:58 | N | 244] C:\sqmnoopt07.sqm
                        [23/08/2009 - 23:25:32 | N | 244] C:\sqmnoopt08.sqm
                        [24/08/2009 - 08:53:27 | N | 244] C:\sqmnoopt09.sqm
                        [08/09/2009 - 21:13:59 | N | 244] C:\sqmnoopt10.sqm
                        [24/09/2009 - 09:22:24 | N | 244] C:\sqmnoopt11.sqm
                        [06/08/2009 - 23:08:53 | N | 244] C:\sqmnoopt12.sqm
                        [07/08/2009 - 23:32:35 | N | 244] C:\sqmnoopt13.sqm
                        [09/08/2009 - 00:41:56 | N | 244] C:\sqmnoopt14.sqm
                        [09/08/2009 - 22:47:09 | N | 244] C:\sqmnoopt15.sqm
                        [11/08/2009 - 23:11:41 | N | 244] C:\sqmnoopt16.sqm
                        [13/08/2009 - 00:01:25 | N | 244] C:\sqmnoopt17.sqm
                        [13/08/2009 - 23:22:29 | N | 244] C:\sqmnoopt18.sqm
                        [14/08/2009 - 23:59:02 | N | 244] C:\sqmnoopt19.sqm
                        [24/09/2008 - 06:25:47 | D ] C:\SUPPORT
                        [24/09/2008 - 06:25:48 | D ] C:\sysinfo
                        [23/09/2008 - 22:37:49 | SHD ] C:\System Volume Information
                        [18/06/2013 - 18:29:44 | D ] C:\UsbFix
                        [18/06/2013 - 18:30:06 | A | 11597] C:\UsbFix [Clean 1] ACER-564DF136B7.txt
                        [24/09/2008 - 06:25:49 | D ] C:\VALUEADD
                        [18/06/2013 - 17:57:11 | D ] C:\WINDOWS
                        [23/09/2008 - 18:13:05 | D ] C:\winnt
                        [22/03/2008 - 21:17:44 | N | 4] C:\wps.dat
                        [17/06/2013 - 21:35:25 | D ] C:\ZHP
                        [15/06/2013 - 03:10:58 | N | 57344] D:\ffastun.ffl
                        [15/06/2013 - 03:10:58 | N | 139264] D:\ffastun0.ffx
                        [23/09/2008 - 22:40:00 | SHD ] D:\System Volume Information
                        [15/06/2013 - 03:10:58 | N | 61440] D:\ffastun.ffo
                        [15/06/2013 - 03:10:58 | N | 4379] D:\ffastun.ffa
                        [16/08/2009 - 03:04:00 | D ] D:\30b68b8111190fd97e
                        [24/09/2008 - 08:38:30 | D ] D:\Henry
                        [24/09/2008 - 09:34:50 | SHD ] D:\Recycled

                        ################## | Vaccin |

                        C:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
                        D:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)

                        ################## | E.O.F | https://www.sosvirus.net/ |
                        0
                        2. Balboa99 Auteur
                          Ok bonne soirée et à demain
                          0
                          1. Balboa99 Auteur
                            Salut

                            Je n'ai pas ajouté de lecteur H ni branché de clés USB ou disque dur
                            Comment fait-on avec usbfix pour sélectionner des lecteurs ?

                            Voici le rapport

                            All processes killed
                            ========== PROCESSES ==========
                            No active process named explorer.exe was found!
                            Process iexplore.exe killed successfully!
                            No active process named firefox.exe was found!
                            Process msnmsgr.exe killed successfully!
                            No active process named Teatimer.exe was found!
                            No active process named safari.exe was found!
                            No active process named opera.exe was found!
                            No active process named rundll32.exe was found!
                            ========== OTL ==========
                            Registry key HKEY_USERS\S-1-5-21-3194007295-2266635485-1072483425-1008\Software\Microsoft\Internet Explorer\SearchScopes\{6B7E39E9-FEBB-40EB-904C-5CF4D6F32DC5}\ deleted successfully.
                            Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6B7E39E9-FEBB-40EB-904C-5CF4D6F32DC5}\ not found.
                            File C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll not found.
                            File C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll not found.
                            Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{0BF43445-2F28-4351-9252-17FE6E806AA0} deleted successfully.
                            Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0BF43445-2F28-4351-9252-17FE6E806AA0}\ not found.
                            Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
                            Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
                            C:\WINDOWS\Downloaded Program Files\erma.inf moved successfully.
                            Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully.
                            Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
                            Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
                            Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
                            Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8f2588b3-fb66-11de-9506-001f3c2ee192}\ deleted successfully.
                            Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8f2588b3-fb66-11de-9506-001f3c2ee192}\ not found.
                            File H:\rndj.exe not found.
                            Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8f2588b3-fb66-11de-9506-001f3c2ee192}\ not found.
                            Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8f2588b3-fb66-11de-9506-001f3c2ee192}\ not found.
                            File H:\rndj.exe not found.
                            Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8f2588b3-fb66-11de-9506-001f3c2ee192}\ not found.
                            Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8f2588b3-fb66-11de-9506-001f3c2ee192}\ not found.
                            File H:\rndj.exe not found.
                            Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8f2588b3-fb66-11de-9506-001f3c2ee192}\ not found.
                            Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8f2588b3-fb66-11de-9506-001f3c2ee192}\ not found.
                            File H:\rndj.exe not found.
                            D:\Henry\Mes documents\~WRL3817.tmp deleted successfully.
                            ========== REGISTRY ==========
                            Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Alcmtr deleted successfully.
                            Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
                            Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\IMJPMIG8.1 deleted successfully.
                            Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\iTunesHelper deleted successfully.
                            Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\MSPY2002 deleted successfully.
                            Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\PHIME2002A deleted successfully.
                            Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\PHIME2002ASync deleted successfully.
                            Registry key HKEY_LOCAL_MACHINE\Software\BrowserChoice\ deleted successfully.
                            ========== FILES ==========
                            C:\Documents and Settings\All Users\Application Data\vot03.pad moved successfully.
                            File\Folder C:\Documents and Settings\All Users\Application Data\vot03.js not found.
                            C:\Documents and Settings\All Users\Application Data\dco81do.dat moved successfully.
                            C:\sqmdata00.sqm moved successfully.
                            C:\sqmdata01.sqm moved successfully.
                            C:\sqmdata02.sqm moved successfully.
                            C:\sqmdata03.sqm moved successfully.
                            C:\sqmdata04.sqm moved successfully.
                            C:\sqmdata05.sqm moved successfully.
                            C:\sqmdata06.sqm moved successfully.
                            C:\sqmdata07.sqm moved successfully.
                            C:\sqmdata08.sqm moved successfully.
                            C:\sqmdata09.sqm moved successfully.
                            C:\sqmdata10.sqm moved successfully.
                            C:\sqmdata11.sqm moved successfully.
                            C:\sqmdata12.sqm moved successfully.
                            C:\sqmdata13.sqm moved successfully.
                            C:\sqmdata14.sqm moved successfully.
                            C:\sqmdata15.sqm moved successfully.
                            C:\sqmdata16.sqm moved successfully.
                            C:\sqmdata17.sqm moved successfully.
                            C:\sqmdata18.sqm moved successfully.
                            C:\sqmdata19.sqm moved successfully.
                            C:\sqmnoopt00.sqm moved successfully.
                            C:\sqmnoopt01.sqm moved successfully.
                            C:\sqmnoopt02.sqm moved successfully.
                            C:\sqmnoopt03.sqm moved successfully.
                            C:\sqmnoopt04.sqm moved successfully.
                            C:\sqmnoopt05.sqm moved successfully.
                            C:\sqmnoopt06.sqm moved successfully.
                            C:\sqmnoopt07.sqm moved successfully.
                            C:\sqmnoopt08.sqm moved successfully.
                            C:\sqmnoopt09.sqm moved successfully.
                            C:\sqmnoopt10.sqm moved successfully.
                            C:\sqmnoopt11.sqm moved successfully.
                            C:\sqmnoopt12.sqm moved successfully.
                            C:\sqmnoopt13.sqm moved successfully.
                            C:\sqmnoopt14.sqm moved successfully.
                            C:\sqmnoopt15.sqm moved successfully.
                            C:\sqmnoopt16.sqm moved successfully.
                            C:\sqmnoopt17.sqm moved successfully.
                            C:\sqmnoopt18.sqm moved successfully.
                            C:\sqmnoopt19.sqm moved successfully.
                            C:\Program Files\Spybot - Search & Destroy\Help folder moved successfully.
                            C:\Program Files\Spybot - Search & Destroy folder moved successfully.
                            ========== COMMANDS ==========

                            [EMPTYTEMP]

                            User: Administrateur
                            ->Temp folder emptied: 0 bytes
                            ->Temporary Internet Files folder emptied: 0 bytes

                            User: All Users

                            User: Default User
                            ->Temp folder emptied: 0 bytes
                            ->Temporary Internet Files folder emptied: 0 bytes

                            User: Henry
                            ->Temp folder emptied: 180174304 bytes
                            ->Temporary Internet Files folder emptied: 19051877 bytes
                            ->Java cache emptied: 0 bytes
                            ->FireFox cache emptied: 0 bytes
                            ->Google Chrome cache emptied: 18175150 bytes
                            ->Flash cache emptied: 2290 bytes

                            User: LocalService
                            ->Temp folder emptied: 66016 bytes
                            ->Temporary Internet Files folder emptied: 33170 bytes
                            ->Flash cache emptied: 0 bytes

                            User: NetworkService
                            ->Temp folder emptied: 0 bytes
                            ->Temporary Internet Files folder emptied: 736421 bytes

                            %systemdrive% .tmp files removed: 0 bytes
                            %systemroot% .tmp files removed: 0 bytes
                            %systemroot%\System32 .tmp files removed: 0 bytes
                            %systemroot%\System32\dllcache .tmp files removed: 0 bytes
                            %systemroot%\System32\drivers .tmp files removed: 0 bytes
                            Windows Temp folder emptied: 107231845 bytes
                            %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 270 bytes
                            %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
                            RecycleBin emptied: 147538081 bytes

                            Total Files Cleaned = 451.00 mb

                            OTL by OldTimer - Version 3.2.69.0 log created on 06192013_192209

                            Files\Folders moved on Reboot...
                            File move failed. C:\WINDOWS\temp\_avast_\Webshlock.txt scheduled to be moved on reboot.
                            C:\WINDOWS\temp\Perflib_Perfdata_f0c.dat moved successfully.

                            PendingFileRenameOperations files...

                            Registry entries deleted on Reboot...
                            0
                            1. Balboa99 Auteur
                              Ok mais je n'ai rien branché

                              Est-ce qu'il y a encore quelque chose à nettoyer ?
                              0
                              1. Balboa99 Auteur
                                Voici le rapport

                                ############################## | UsbFix V 7.127 | [Suppression]

                                Utilisateur: Henry (Administrateur) # ACER-564DF136B7
                                Mis à jour le 05/06/2013 par El Desaparecido
                                Lancé à 21:30:54 | 19/06/2013

                                Site Web: https://www.sosvirus.net/
                                Upload Malware: http://upload.sosvirus.org/
                                Contact: contact@sosvirus.org

                                PC: Acer (Extensa 7620 ) (X86-based PC)
                                CPU: Intel(R) Core(TM)2 Duo CPU T5750 @ 2.00GHz (1995)
                                RAM -> [Total : 2046 | Free : 1284]
                                BIOS: Ver 1.00PARTTBL
                                BOOT: Normal boot

                                OS: Microsoft Windows XP Professionnel (5.1.2600 32-Bit) # Service Pack 3
                                WB: Windows Internet Explorer 8.0.6001.18702

                                SC: Security Center Service [Enabled]
                                WU: Windows Update Service [Enabled]
                                FW: Windows FireWall Service [Enabled]

                                C:\ (%systemdrive%) -> Disque fixe # 113 Go (85 Go libre(s) - 75%) [ACER] # NTFS
                                D:\ -> Disque fixe # 114 Go (113 Go libre(s) - 99%) [ACERDATA] # FAT32
                                E:\ -> CD-ROM

                                ################## | El Desaparecido Section |

                                HKLM\SOFTWARE | Run : [preload] - C:\Windows\RUNXMLPL.exe
                                HKLM\SOFTWARE | Run : [IAAnotif] - "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
                                HKLM\SOFTWARE | Run : [SynTPStart] - C:\Program Files\Synaptics\SynTP\SynTPStart.exe
                                HKLM\SOFTWARE | Run : [RTHDCPL] - RTHDCPL.EXE
                                HKLM\SOFTWARE | Run : [AzMixerSel] - C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
                                HKLM\SOFTWARE | Run : [StartCCC] - "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
                                HKLM\SOFTWARE | Run : [Acer ePresentation HPD] - C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
                                HKLM\SOFTWARE | Run : [ePower_DMC] - C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
                                HKLM\SOFTWARE | Run : [Boot] - C:\Acer\Empowering Technology\ePower\Boot.exe
                                HKLM\SOFTWARE | Run : [eRecoveryService] - C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
                                HKLM\SOFTWARE | Run : [LManager] - C:\PROGRA~1\LAUNCH~1\LManager.exe
                                HKLM\SOFTWARE | Run : [Kernel and Hardware Abstraction Layer] - KHALMNPR.EXE
                                HKLM\SOFTWARE | Run : [HP Software Update] - C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
                                HKLM\SOFTWARE | Run : [APSDaemon] - "C:\Program Files\Fichiers communs\Apple\Apple Application Support\APSDaemon.exe"
                                HKLM\SOFTWARE | Run : [Adobe ARM] - "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
                                HKLM\SOFTWARE | Run : [avast] - "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
                                HKLM\SOFTWARE | RunOnce : [] -
                                HKU\S-1-5-19\SOFTWARE | Run : [CTFMON.EXE] - C:\WINDOWS\system32\CTFMON.EXE
                                HKU\S-1-5-20\SOFTWARE | Run : [CTFMON.EXE] - C:\WINDOWS\system32\CTFMON.EXE
                                HKU\S-1-5-21-3194007295-2266635485-1072483425-1008\SOFTWARE | Run : [ctfmon.exe] - C:\WINDOWS\system32\ctfmon.exe
                                HKU\S-1-5-21-3194007295-2266635485-1072483425-1008\SOFTWARE | Run : [MsnMsgr] - "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
                                HKU\S-1-5-21-3194007295-2266635485-1072483425-1008\SOFTWARE | Run : [swg] - "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
                                HKU\S-1-5-21-3194007295-2266635485-1072483425-1008\SOFTWARE | Run : [Skype] - "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
                                HKU\S-1-5-18\SOFTWARE | Run : [CTFMON.EXE] - C:\WINDOWS\system32\CTFMON.EXE

                                ################## | Processus Stoppés |

                                Stoppé! C:\WINDOWS\system32\Ati2evxx.exe (1720)
                                Stoppé! C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe (1976)
                                Stoppé! C:\WINDOWS\system32\Ati2evxx.exe (376)
                                Stoppé! C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (1040)
                                Stoppé! C:\WINDOWS\Explorer.EXE (1084)
                                Stoppé! C:\Program Files\Alwil Software\Avast5\afwServ.exe (1260)
                                Stoppé! C:\WINDOWS\system32\spoolsv.exe (1992)
                                Stoppé! C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe (1116)
                                Stoppé! C:\Program Files\Microsoft\BingBar\7.1.391.0\BBSvc.exe (400)
                                Stoppé! C:\Program Files\Bonjour\mDNSResponder.exe (704)
                                Stoppé! C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (788)
                                Stoppé! C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe (2244)
                                Stoppé! C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe (2280)
                                Stoppé! C:\Program Files\Fichiers communs\Motive\McciCMService.exe (2392)
                                Stoppé! C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (2452)
                                Stoppé! C:\Program Files\CyberLink\Shared Files\RichVideo.exe (2564)
                                Stoppé! C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe (2612)
                                Stoppé! C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLIDSVC.EXE (2784)
                                Stoppé! C:\WINDOWS\system32\wuauclt.exe (760)
                                Stoppé! C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLIDSvcM.exe (740)
                                Stoppé! C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (1000)
                                Stoppé! C:\WINDOWS\RTHDCPL.EXE (1020)
                                Stoppé! C:\Acer\Empowering Technology\ePresentation\ePresentation.exe (1548)
                                Stoppé! C:\Acer\Empowering Technology\ePower\ePower_DMC.exe (1760)
                                Stoppé! C:\Acer\Empowering Technology\eRecovery\eRAgent.exe (2100)
                                Stoppé! C:\PROGRA~1\LAUNCH~1\LManager.exe (2316)
                                Stoppé! C:\Program Files\HP\HP Software Update\HPWuSchd2.exe (2468)
                                Stoppé! C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (2536)
                                Stoppé! C:\Program Files\Alwil Software\Avast5\avastUI.exe (2880)
                                Stoppé! C:\WINDOWS\system32\ctfmon.exe (3200)
                                Stoppé! C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe (3172)
                                Stoppé! C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (3308)
                                Stoppé! C:\Program Files\Skype\Phone\Skype.exe (3544)
                                Stoppé! C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe (2108)
                                Stoppé! C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (2224)
                                Stoppé! C:\Program Files\Logitech\SetPoint\SetPoint.exe (1016)
                                Stoppé! C:\Program Files\WinZip\WZQKPICK.EXE (3000)
                                Stoppé! C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (3096)
                                Stoppé! C:\Program Files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.EXE (988)
                                Stoppé! C:\DOCUME~1\Henry\LOCALS~1\Temp\RtkBtMnt.exe (4056)
                                Stoppé! C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe (2716)
                                Stoppé! C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe (5116)
                                Stoppé! C:\WINDOWS\system32\wbem\wmiapsrv.exe (5200)
                                Stoppé! C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe (5444)

                                ################## | Éléments infectieux |

                                Supprimé! C:\DOCUME~1\Henry\LOCALS~1\Temp\RtkBtMnt.exe

                                (!) Fichiers temporaires supprimés.

                                ################## | Registre |

                                ################## | Mountpoints2 |

                                ################## | Listing |

                                [23/09/2008 - 15:42:56 | D ] C:\Acer
                                [18/06/2013 - 22:46:08 | N | 1152] C:\AdwCleaner[R1].txt
                                [18/06/2013 - 18:30:07 | RASHD ] C:\Autorun.inf
                                [22/03/2008 - 21:42:46 | N | 715550] C:\bknowsetup.log
                                [24/09/2008 - 06:29:20 | D ] C:\BOOK
                                [23/09/2008 - 22:37:46 | N | 212] C:\boot.ini
                                [05/08/2004 - 06:00:00 | N | 4952] C:\Bootfont.bin
                                [06/09/2004 - 16:40:26 | N | 512] C:\BOOTSECT.DOS
                                [19/06/2013 - 19:41:25 | D ] C:\Config.Msi
                                [24/09/2008 - 06:22:55 | D ] C:\DOCS
                                [23/09/2008 - 22:39:21 | D ] C:\Documents and Settings
                                [24/09/2008 - 06:23:00 | D ] C:\DOTNETFX
                                [23/09/2008 - 16:56:20 | D ] C:\ELEMENTS
                                [15/06/2013 - 03:22:58 | N | 4968] C:\ffastun.ffa
                                [15/06/2013 - 03:22:58 | N | 884736] C:\ffastun.ffl
                                [15/06/2013 - 03:22:58 | N | 90112] C:\ffastun.ffo
                                [15/06/2013 - 03:22:58 | N | 2977792] C:\ffastun0.ffx
                                [19/06/2013 - 21:25:34 | ASH | 2145832960] C:\hiberfil.sys
                                [24/09/2008 - 06:23:31 | D ] C:\I386
                                [06/09/2004 - 17:00:24 | N | 0] C:\IO.SYS
                                [06/09/2004 - 17:00:24 | N | 0] C:\MSDOS.SYS
                                [16/04/2011 - 19:06:46 | RHD ] C:\MSOCache
                                [05/08/2004 - 06:00:00 | N | 47564] C:\NTDETECT.COM
                                [23/09/2008 - 16:37:26 | N | 252240] C:\ntldr
                                [19/06/2013 - 21:25:32 | ASH | 2145386496] C:\pagefile.sys
                                [09/04/2008 - 22:09:28 | N | 6326] C:\Patch.rev
                                [26/04/2007 - 00:45:58 | N | 631] C:\PDVD.iss
                                [17/06/2013 - 21:35:22 | N | 512] C:\PhysicalDisk0_MBR.bin
                                [23/03/2008 - 09:05:28 | N | 73] C:\preload.aaa
                                [23/03/2008 - 09:05:28 | N | 73] C:\Preload.rev
                                [19/06/2013 - 19:22:22 | D ] C:\Program Files
                                [24/09/2008 - 08:24:38 | SHD ] C:\RECYCLER
                                [22/03/2008 - 21:42:04 | N | 595] C:\RHDSetup.log
                                [10/01/2011 - 09:59:59 | N | 368] C:\rkill.log
                                [22/03/2008 - 21:42:46 | N | 32] C:\setup.log
                                [24/09/2008 - 06:25:47 | D ] C:\SUPPORT
                                [24/09/2008 - 06:25:48 | D ] C:\sysinfo
                                [23/09/2008 - 22:37:49 | SHD ] C:\System Volume Information
                                [19/06/2013 - 21:36:42 | D ] C:\UsbFix
                                [18/06/2013 - 18:30:08 | N | 12505] C:\UsbFix [Clean 1] ACER-564DF136B7.txt
                                [19/06/2013 - 21:37:03 | A | 8512] C:\UsbFix [Clean 3] ACER-564DF136B7.txt
                                [19/06/2013 - 19:16:43 | N | 5893] C:\UsbFix [Listing 1 ] ACER-564DF136B7.txt
                                [24/09/2008 - 06:25:49 | D ] C:\VALUEADD
                                [19/06/2013 - 21:26:10 | D ] C:\WINDOWS
                                [23/09/2008 - 18:13:05 | D ] C:\winnt
                                [22/03/2008 - 21:17:44 | N | 4] C:\wps.dat
                                [17/06/2013 - 21:35:25 | D ] C:\ZHP
                                [19/06/2013 - 19:22:09 | D ] C:\_OTL
                                [15/06/2013 - 03:10:58 | N | 57344] D:\ffastun.ffl
                                [15/06/2013 - 03:10:58 | N | 139264] D:\ffastun0.ffx
                                [23/09/2008 - 22:40:00 | SHD ] D:\System Volume Information
                                [15/06/2013 - 03:10:58 | N | 61440] D:\ffastun.ffo
                                [15/06/2013 - 03:10:58 | N | 4379] D:\ffastun.ffa
                                [18/06/2013 - 18:30:08 | RASHD ] D:\Autorun.inf
                                [16/08/2009 - 03:04:00 | D ] D:\30b68b8111190fd97e
                                [24/09/2008 - 08:38:30 | D ] D:\Henry
                                [24/09/2008 - 09:34:50 | SHD ] D:\Recycled

                                ################## | Vaccin |

                                C:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
                                D:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)

                                ################## | E.O.F | https://www.sosvirus.net/ |
                                0
                                1. Balboa99 Auteur
                                  Le clé USB qui se trouvait peut-être en H ne sera plus utilisée sur ce PC, donc pas de problème
                                  0
                                  • 1
                                  • 2