PC trés infecté

ca serait bien que quelqu'un de serieux s'y mette car là c'est du n'importe quoi comme on vient de me le signaler en MP

ok rocky ^^ (Balboa99)

fais ce qui suit ca sent le brontok :

▶ Téléchargez UsbFix (créé par El Desaparecido) sur votre Bureau.

▶ Si votre antivirus affiche une alerte, ignorez-la et désactivez l'antivirus temporairement.
▶ Branchez toutes vos sources de données externes à votre PC (clé USB, disque dur externe, etc...) sans les ouvrir.
▶ Double cliquez sur UsbFix.exe. (pour les utilisateurs de windows Vista , windows 7 , windows 8 , clique droit => executer en tant qu'administrateur"

▶ Cliquez sur [Suppression].
▶ Laissez travailler l'outil.

▶ À la fin du scan, un rapport va s'afficher, postez-le dans votre prochaine réponse sur le forum.

▶ Le rapport est aussi sauvegardé à la racine du disque système ( C:\UsbFix.txt ).

re

et ben c'était pas ca :)

==

Télécharge ici :OTL

▶ enregistre le sur ton Bureau.

si tu as XP => double clique
si tu as Vista ou windows 7 / 8 => clic droit "executer en tant que...."

sur OTL.exe pour le lancer.

▶ => Clique ici pour voir la Configuration

▶ Copie et colle le contenu de ce qui suit en gras dans la partie inférieure d'OTL "Personnalisation"


HKCU\Software
HKLM\Software
HKCU\Software\Microsoft\Command Processor /s
%Homedrive%\*
%Homedrive%\*.
%Userprofile%\*
%Userprofile%\*.
%Allusersprofile%\*
%Allusersprofile%\*.
%LocalAppData%\*
%LocalAppData%\*.
%Userprofile%\Local Settings\Application Data\*
%Userprofile%\Local Settings\Application Data\*.
%programFiles%\*
%programFiles%\*.
%Systemroot%\Installer\*.
%Systemroot%\Temp\*.exe /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\system32\*.exe /lockedfiles
%systemroot%\system32\*.in*
%systemroot%\Tasks\*
%systemroot%\Tasks\*.
%systemroot%\system32\Tasks\*
%systemroot%\system32\Tasks\*.
%systemroot%\system32\drivers\*.sy* /lockedfiles
%systemroot%\system32\config\*.exe /s
%Systemroot%\ServiceProfiles\*.exe /s
%systemroot%\system32\*.sys
dir C:\ /S /A:L /C
msconfig
activex
/md5start
explorer.exe
winlogon.exe
wininit.exe
volsnap.sys
atapi.sys
ndisuio.sys
ndis.sys
cdrom.sys
i8042prt.sys
iastor.sys
tdx.sys
netbt.sys
afd.sys
/md5stop
netsvcs
safebootminimal
safebootnetwork
CREATERESTOREPOINT

▶ Clic sur Analyse.

A la fin du scan, le Bloc-Notes va s'ouvrir avec le rapport (OTL.txt).

Ce fichier est sur ton Bureau (en général C:\Documents and settings\le_nom_de_ta_session\<Bureau ou Desktop>\OTL.txt)

▶▶▶ NE LE POSTE PAS SUR LE FORUM (il est trop long)

heberge OTL.txt et extra.txt sur https://www.cjoint.com/ et donne les liens

ok tu me feras le plaisir de mettre ton lecteur "H:\" que tu n'avais pas mis et de refaire une suppression avec usbfix


tu as mis ce lecteur depuis, et tu as reinfecté la machine avec

==

ATTENTION !!! : Script personnalisé pour cette machine uniquement , ne pas reproduire !!

si tu as XP => double clique
si tu as Vista ou windows 7 => clic droit "executer en tant que...."

sur OTL.exe pour le lancer.


▶Copie la liste qui se trouve en gras ci-dessous,

▶ colle-la dans la zone sous "Personnalisation" :


:processes
explorer.exe
iexplore.exe
firefox.exe
msnmsgr.exe
Teatimer.exe
safari.exe
opera.exe
rundll32.exe

:OTL
IE - HKU\S-1-5-21-3194007295-2266635485-1072483425-1008\..\SearchScopes\{6B7E39E9-FEBB-40EB-904C-5CF4D6F32DC5}: "URL" = http://www.search.ask.com/?l=dis{searchTerms}&locale=&apn_ptnrs=U3&apn_dtid=OSJ000
FF - user.js - File not found
CHR - plugin: Java Deployment Toolkit 6.0.260.3 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java Platform SE 6 U26 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
O3 - HKLM\..\Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O33 - MountPoints2\{8f2588b3-fb66-11de-9506-001f3c2ee192}\Shell\AUtoPlaY\CommAnd - "" = H:\rndj.exe
O33 - MountPoints2\{8f2588b3-fb66-11de-9506-001f3c2ee192}\Shell\AutoRun\command - "" = H:\rndj.exe
O33 - MountPoints2\{8f2588b3-fb66-11de-9506-001f3c2ee192}\Shell\ExPlore\COMmAnd - "" = H:\rndj.exe
O33 - MountPoints2\{8f2588b3-fb66-11de-9506-001f3c2ee192}\Shell\opEn\CoMmAND - "" = H:\rndj.exe
[1 D:\Henry\Mes documents\*.tmp files -> D:\Henry\Mes documents\*.tmp -> ]

:Reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Alcmtr"=-
""=-
"IMJPMIG8.1"=-
"iTunesHelper"=-
"MSPY2002"=-
"PHIME2002A"=-
"PHIME2002ASync"=-
[-HKEY_LOCAL_MACHINE\Software\BrowserChoice]

:Files
C:\Documents and Settings\All Users\Application Data\vot03.pad
C:\Documents and Settings\All Users\Application Data\vot03.js
C:\Documents and Settings\All Users\Application Data\dco81do.dat
C:\*.sqm
C:\Program Files\Spybot - Search & Destroy

:commands
[emptytemp]


▶ Clique sur "Correction" pour lancer la suppression.


▶ Poste le rapport qui logiquement s'ouvrira tout seul en fin de travail appres le redemarrage.

re

on les branche et ils sont automatiquement détectés

tu refais une suppression avec usbfix en branchant tous tes périphériques comme demandé ils sont infectés

il semblerait que tu ne te décides pas à brancher tes supports externes....

et tu n'as rien d'autre ? disque dur externe etc ????? à ce que j'ai cru comprendre si....

d'ac cite les soucis qu il te reste que je situe un peu

non c'est pas utile tu peux faire le menage

https://forums-fec.be/entraide/viewtopic.php?f=11&t=229

¤¤¤¤¤¤¤¤¤¤_Pre_Scan_Concept_¤¤¤¤¤¤¤¤¤¤
Windows 8 => meme flop que Vista X 10

le rapport de delfix ?

Voici le rapport Malwarebytes

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Version de la base de données: v2013.06.17.05

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Henry :: ACER-564DF136B7 [administrateur]

17.06.2013 21:59:18
mbam-log-2013-06-17 (21-59-18).txt

Type d'examen: Examen rapide
Options d'examen activées: Mémoire | Démarrage | Registre | Système de fichiers | Heuristique/Extra | Heuristique/Shuriken | PUP | PUM
Options d'examen désactivées: P2P
Elément(s) analysé(s): 238657
Temps écoulé: 9 minute(s), 4 seconde(s)

Processus mémoire détecté(s): 0
(Aucun élément nuisible détecté)

Module(s) mémoire détecté(s): 0
(Aucun élément nuisible détecté)

Clé(s) du Registre détectée(s): 1
HKCU\SOFTWARE\g043oqxanu (Trojan.FakeAlert) -> Mis en quarantaine et supprimé avec succès.

Valeur(s) du Registre détectée(s): 0
(Aucun élément nuisible détecté)

Elément(s) de données du Registre détecté(s): 0
(Aucun élément nuisible détecté)

Dossier(s) détecté(s): 0
(Aucun élément nuisible détecté)

Fichier(s) détecté(s): 6
C:\Documents and Settings\All Users\Application Data\dsgsdgdsgdsgw.pad (Exploit.Drop.GSA) -> Mis en quarantaine et supprimé avec succès.
C:\Documents and Settings\All Users\Application Data\lsass.exe (Trojan.Delf) -> Mis en quarantaine et supprimé avec succès.
C:\Documents and Settings\Henry\Menu Démarrer\Programmes\Démarrage\ctfmon.lnk (Trojan.Ransom.Gen) -> Mis en quarantaine et supprimé avec succès.
C:\Documents and Settings\All Users\Application Data\2433f433 (Trojan.Agent.TPL) -> Mis en quarantaine et supprimé avec succès.
C:\Documents and Settings\Henry\Application Data\2433f433 (Trojan.Agent.TPL) -> Mis en quarantaine et supprimé avec succès.
C:\Documents and Settings\Henry\Local Settings\Application Data\2433f433 (Trojan.Agent.TPL) -> Mis en quarantaine et supprimé avec succès.

(fin)

Bonjour,

Voici le rapport

############################## | UsbFix V 7.127 | [Suppression]

Utilisateur: Henry (Administrateur) # ACER-564DF136B7
Mis à jour le 05/06/2013 par El Desaparecido
Lancé à 18:18:38 | 18/06/2013

Site Web: https://www.sosvirus.net/
Upload Malware: http://upload.sosvirus.org/
Contact: contact@sosvirus.org

PC: Acer (Extensa 7620 ) (X86-based PC)
CPU: Intel(R) Core(TM)2 Duo CPU T5750 @ 2.00GHz (1994)
RAM -> [Total : 2046 | Free : 1243]
BIOS: Ver 1.00PARTTBL
BOOT: Normal boot

OS: Microsoft Windows XP Professionnel (5.1.2600 32-Bit) # Service Pack 3
WB: Windows Internet Explorer 8.0.6001.18702

SC: Security Center Service [Enabled]
WU: Windows Update Service [Enabled]
FW: Windows FireWall Service [Enabled]

C:\ (%systemdrive%) -> Disque fixe # 113 Go (86 Go libre(s) - 76%) [ACER] # NTFS
D:\ -> Disque fixe # 114 Go (113 Go libre(s) - 99%) [ACERDATA] # FAT32
E:\ -> CD-ROM

################## | El Desaparecido Section |

HKLM\SOFTWARE | Run : [preload] - C:\Windows\RUNXMLPL.exe
HKLM\SOFTWARE | Run : [IAAnotif] - "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
HKLM\SOFTWARE | Run : [SynTPStart] - C:\Program Files\Synaptics\SynTP\SynTPStart.exe
HKLM\SOFTWARE | Run : [RTHDCPL] - RTHDCPL.EXE
HKLM\SOFTWARE | Run : [Alcmtr] - ALCMTR.EXE
HKLM\SOFTWARE | Run : [AzMixerSel] - C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
HKLM\SOFTWARE | Run : [IMJPMIG8.1] - "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
HKLM\SOFTWARE | Run : [MSPY2002] - C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
HKLM\SOFTWARE | Run : [PHIME2002ASync] - C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
HKLM\SOFTWARE | Run : [PHIME2002A] - C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
HKLM\SOFTWARE | Run : [StartCCC] - "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
HKLM\SOFTWARE | Run : [Acer ePresentation HPD] - C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
HKLM\SOFTWARE | Run : [ePower_DMC] - C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
HKLM\SOFTWARE | Run : [Boot] - C:\Acer\Empowering Technology\ePower\Boot.exe
HKLM\SOFTWARE | Run : [eRecoveryService] - C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
HKLM\SOFTWARE | Run : [LManager] - C:\PROGRA~1\LAUNCH~1\LManager.exe
HKLM\SOFTWARE | Run : [Kernel and Hardware Abstraction Layer] - KHALMNPR.EXE
HKLM\SOFTWARE | Run : [avast5] - C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
HKLM\SOFTWARE | Run : [HP Software Update] - C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
HKLM\SOFTWARE | Run : [] -
HKLM\SOFTWARE | Run : [APSDaemon] - "C:\Program Files\Fichiers communs\Apple\Apple Application Support\APSDaemon.exe"
HKLM\SOFTWARE | Run : [iTunesHelper] - "C:\Program Files\iTunes\iTunesHelper.exe"
HKLM\SOFTWARE | Run : [Adobe ARM] - "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
HKLM\SOFTWARE | RunOnce : [] -
HKU\S-1-5-19\SOFTWARE | Run : [CTFMON.EXE] - C:\WINDOWS\system32\CTFMON.EXE
HKU\S-1-5-20\SOFTWARE | Run : [CTFMON.EXE] - C:\WINDOWS\system32\CTFMON.EXE
HKU\S-1-5-21-3194007295-2266635485-1072483425-1008\SOFTWARE | Run : [ctfmon.exe] - C:\WINDOWS\system32\ctfmon.exe
HKU\S-1-5-21-3194007295-2266635485-1072483425-1008\SOFTWARE | Run : [MsnMsgr] - "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
HKU\S-1-5-21-3194007295-2266635485-1072483425-1008\SOFTWARE | Run : [swg] - "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
HKU\S-1-5-21-3194007295-2266635485-1072483425-1008\SOFTWARE | Run : [Skype] - "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
HKU\S-1-5-18\SOFTWARE | Run : [CTFMON.EXE] - C:\WINDOWS\system32\CTFMON.EXE

################## | Processus Stoppés |

Stoppé! C:\WINDOWS\system32\Ati2evxx.exe (1700)
Stoppé! C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe (1960)
Stoppé! C:\WINDOWS\system32\Ati2evxx.exe (296)
Stoppé! C:\Program Files\Alwil Software\Avast5\afwServ.exe (1020)
Stoppé! C:\WINDOWS\Explorer.EXE (1128)
Stoppé! C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (1212)
Stoppé! C:\WINDOWS\system32\spoolsv.exe (1360)
Stoppé! C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe (192)
Stoppé! C:\Program Files\Microsoft\BingBar\7.1.391.0\BBSvc.exe (264)
Stoppé! C:\Program Files\Bonjour\mDNSResponder.exe (612)
Stoppé! C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (848)
Stoppé! C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (888)
Stoppé! C:\WINDOWS\RTHDCPL.EXE (904)
Stoppé! C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (404)
Stoppé! C:\Acer\Empowering Technology\ePresentation\ePresentation.exe (304)
Stoppé! C:\Acer\Empowering Technology\ePower\ePower_DMC.exe (2064)
Stoppé! C:\Acer\Empowering Technology\eRecovery\eRAgent.exe (2140)
Stoppé! C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE (2180)
Stoppé! C:\PROGRA~1\LAUNCH~1\LManager.exe (2200)
Stoppé! C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe (2228)
Stoppé! C:\Program Files\HP\HP Software Update\HPWuSchd2.exe (2244)
Stoppé! C:\Program Files\iTunes\iTunesHelper.exe (2396)
Stoppé! C:\WINDOWS\system32\ctfmon.exe (2492)
Stoppé! C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe (2512)
Stoppé! C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (2528)
Stoppé! C:\Program Files\Skype\Phone\Skype.exe (2580)
Stoppé! C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe (2824)
Stoppé! C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe (2932)
Stoppé! C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (2964)
Stoppé! C:\Program Files\Logitech\SetPoint\SetPoint.exe (3004)
Stoppé! C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe (3012)
Stoppé! C:\Program Files\WinZip\WZQKPICK.EXE (3112)
Stoppé! C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (3128)
Stoppé! C:\Program Files\Fichiers communs\Motive\McciCMService.exe (3148)
Stoppé! C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (3836)
Stoppé! C:\Program Files\CyberLink\Shared Files\RichVideo.exe (3976)
Stoppé! C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe (4040)
Stoppé! C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe (2348)
Stoppé! C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLIDSVC.EXE (2880)
Stoppé! C:\Program Files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.EXE (980)
Stoppé! C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLIDSvcM.exe (1304)
Stoppé! C:\DOCUME~1\Henry\LOCALS~1\Temp\RtkBtMnt.exe (3376)
Stoppé! C:\Program Files\iPod\bin\iPodService.exe (3524)
Stoppé! C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe (5848)
Stoppé! C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe (5556)
Stoppé! C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe (5912)
Stoppé! C:\WINDOWS\system32\wbem\wmiapsrv.exe (6124)
Stoppé! C:\Program Files\Microsoft\BingBar\7.1.391.0\SeaPort.exe (3268)
Stoppé! C:\Program Files\Internet Explorer\iexplore.exe (1044)
Stoppé! C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_clipbook.exe (1512)

################## | Éléments infectieux |

Supprimé! C:\DOCUME~1\Henry\LOCALS~1\Temp\RtkBtMnt.exe

(!) Fichiers temporaires supprimés.

################## | Registre |


################## | Mountpoints2 |

Supprimé! HKCU\.\.\.\.\Explorer\MountPoints2\{8f2588b2-fb66-11de-9506-001f3c2ee192}
Supprimé! HKCU\.\.\.\.\Explorer\MountPoints2\{fc76d260-6ccb-11de-943b-001f3c2ee192}

################## | Listing |

[23/09/2008 - 15:42:56 | D ] C:\Acer
[22/03/2008 - 21:42:46 | N | 715550] C:\bknowsetup.log
[24/09/2008 - 06:29:20 | D ] C:\BOOK
[23/09/2008 - 22:37:46 | N | 212] C:\boot.ini
[05/08/2004 - 06:00:00 | N | 4952] C:\Bootfont.bin
[06/09/2004 - 16:40:26 | N | 512] C:\BOOTSECT.DOS
[17/06/2013 - 08:29:03 | D ] C:\Config.Msi
[24/09/2008 - 06:22:55 | D ] C:\DOCS
[23/09/2008 - 22:39:21 | D ] C:\Documents and Settings
[24/09/2008 - 06:23:00 | D ] C:\DOTNETFX
[23/09/2008 - 16:56:20 | D ] C:\ELEMENTS
[15/06/2013 - 03:22:58 | N | 4968] C:\ffastun.ffa
[15/06/2013 - 03:22:58 | N | 884736] C:\ffastun.ffl
[15/06/2013 - 03:22:58 | N | 90112] C:\ffastun.ffo
[15/06/2013 - 03:22:58 | N | 2977792] C:\ffastun0.ffx
[18/06/2013 - 17:56:57 | ASH | 2145832960] C:\hiberfil.sys
[24/09/2008 - 06:23:31 | D ] C:\I386
[06/09/2004 - 17:00:24 | N | 0] C:\IO.SYS
[06/09/2004 - 17:00:24 | N | 0] C:\MSDOS.SYS
[16/04/2011 - 19:06:46 | RHD ] C:\MSOCache
[05/08/2004 - 06:00:00 | N | 47564] C:\NTDETECT.COM
[23/09/2008 - 16:37:26 | N | 252240] C:\ntldr
[18/06/2013 - 17:56:55 | ASH | 2145386496] C:\pagefile.sys
[09/04/2008 - 22:09:28 | N | 6326] C:\Patch.rev
[26/04/2007 - 00:45:58 | N | 631] C:\PDVD.iss
[17/06/2013 - 21:35:22 | N | 512] C:\PhysicalDisk0_MBR.bin
[23/03/2008 - 09:05:28 | N | 73] C:\preload.aaa
[23/03/2008 - 09:05:28 | N | 73] C:\Preload.rev
[17/06/2013 - 22:20:27 | D ] C:\Program Files
[24/09/2008 - 08:24:38 | SHD ] C:\RECYCLER
[22/03/2008 - 21:42:04 | N | 595] C:\RHDSetup.log
[10/01/2011 - 09:59:59 | N | 368] C:\rkill.log
[22/03/2008 - 21:42:46 | N | 32] C:\setup.log
[16/08/2009 - 03:13:47 | N | 268] C:\sqmdata00.sqm
[16/08/2009 - 04:24:43 | N | 268] C:\sqmdata01.sqm
[16/08/2009 - 23:21:12 | N | 268] C:\sqmdata02.sqm
[17/08/2009 - 22:20:09 | N | 268] C:\sqmdata03.sqm
[18/08/2009 - 23:48:32 | N | 268] C:\sqmdata04.sqm
[20/08/2009 - 00:22:46 | N | 268] C:\sqmdata05.sqm
[20/08/2009 - 23:39:06 | N | 268] C:\sqmdata06.sqm
[22/08/2009 - 22:35:58 | N | 268] C:\sqmdata07.sqm
[23/08/2009 - 23:25:32 | N | 268] C:\sqmdata08.sqm
[24/08/2009 - 08:53:27 | N | 268] C:\sqmdata09.sqm
[08/09/2009 - 21:13:59 | N | 268] C:\sqmdata10.sqm
[24/09/2009 - 09:22:24 | N | 268] C:\sqmdata11.sqm
[06/08/2009 - 23:08:53 | N | 268] C:\sqmdata12.sqm
[07/08/2009 - 23:32:35 | N | 268] C:\sqmdata13.sqm
[09/08/2009 - 00:41:56 | N | 268] C:\sqmdata14.sqm
[09/08/2009 - 22:47:09 | N | 268] C:\sqmdata15.sqm
[11/08/2009 - 23:11:41 | N | 268] C:\sqmdata16.sqm
[13/08/2009 - 00:01:25 | N | 268] C:\sqmdata17.sqm
[13/08/2009 - 23:22:29 | N | 268] C:\sqmdata18.sqm
[14/08/2009 - 23:59:02 | N | 268] C:\sqmdata19.sqm
[16/08/2009 - 03:13:47 | N | 244] C:\sqmnoopt00.sqm
[16/08/2009 - 04:24:43 | N | 244] C:\sqmnoopt01.sqm
[16/08/2009 - 23:21:12 | N | 244] C:\sqmnoopt02.sqm
[17/08/2009 - 22:20:09 | N | 244] C:\sqmnoopt03.sqm
[18/08/2009 - 23:48:32 | N | 244] C:\sqmnoopt04.sqm
[20/08/2009 - 00:22:46 | N | 244] C:\sqmnoopt05.sqm
[20/08/2009 - 23:39:06 | N | 244] C:\sqmnoopt06.sqm
[22/08/2009 - 22:35:58 | N | 244] C:\sqmnoopt07.sqm
[23/08/2009 - 23:25:32 | N | 244] C:\sqmnoopt08.sqm
[24/08/2009 - 08:53:27 | N | 244] C:\sqmnoopt09.sqm
[08/09/2009 - 21:13:59 | N | 244] C:\sqmnoopt10.sqm
[24/09/2009 - 09:22:24 | N | 244] C:\sqmnoopt11.sqm
[06/08/2009 - 23:08:53 | N | 244] C:\sqmnoopt12.sqm
[07/08/2009 - 23:32:35 | N | 244] C:\sqmnoopt13.sqm
[09/08/2009 - 00:41:56 | N | 244] C:\sqmnoopt14.sqm
[09/08/2009 - 22:47:09 | N | 244] C:\sqmnoopt15.sqm
[11/08/2009 - 23:11:41 | N | 244] C:\sqmnoopt16.sqm
[13/08/2009 - 00:01:25 | N | 244] C:\sqmnoopt17.sqm
[13/08/2009 - 23:22:29 | N | 244] C:\sqmnoopt18.sqm
[14/08/2009 - 23:59:02 | N | 244] C:\sqmnoopt19.sqm
[24/09/2008 - 06:25:47 | D ] C:\SUPPORT
[24/09/2008 - 06:25:48 | D ] C:\sysinfo
[23/09/2008 - 22:37:49 | SHD ] C:\System Volume Information
[18/06/2013 - 18:29:44 | D ] C:\UsbFix
[18/06/2013 - 18:30:06 | A | 11597] C:\UsbFix [Clean 1] ACER-564DF136B7.txt
[24/09/2008 - 06:25:49 | D ] C:\VALUEADD
[18/06/2013 - 17:57:11 | D ] C:\WINDOWS
[23/09/2008 - 18:13:05 | D ] C:\winnt
[22/03/2008 - 21:17:44 | N | 4] C:\wps.dat
[17/06/2013 - 21:35:25 | D ] C:\ZHP
[15/06/2013 - 03:10:58 | N | 57344] D:\ffastun.ffl
[15/06/2013 - 03:10:58 | N | 139264] D:\ffastun0.ffx
[23/09/2008 - 22:40:00 | SHD ] D:\System Volume Information
[15/06/2013 - 03:10:58 | N | 61440] D:\ffastun.ffo
[15/06/2013 - 03:10:58 | N | 4379] D:\ffastun.ffa
[16/08/2009 - 03:04:00 | D ] D:\30b68b8111190fd97e
[24/09/2008 - 08:38:30 | D ] D:\Henry
[24/09/2008 - 09:34:50 | SHD ] D:\Recycled

################## | Vaccin |

C:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
D:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)

################## | E.O.F | https://www.sosvirus.net/ |

Voici les liens

https://www.cjoint.com/?CFswh7rURWY

https://www.cjoint.com/?CFswiIECFSD

Ok bonne soirée et à demain

Salut

Je n'ai pas ajouté de lecteur H ni branché de clés USB ou disque dur
Comment fait-on avec usbfix pour sélectionner des lecteurs ?

Voici le rapport

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
Process iexplore.exe killed successfully!
No active process named firefox.exe was found!
Process msnmsgr.exe killed successfully!
No active process named Teatimer.exe was found!
No active process named safari.exe was found!
No active process named opera.exe was found!
No active process named rundll32.exe was found!
========== OTL ==========
Registry key HKEY_USERS\S-1-5-21-3194007295-2266635485-1072483425-1008\Software\Microsoft\Internet Explorer\SearchScopes\{6B7E39E9-FEBB-40EB-904C-5CF4D6F32DC5}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6B7E39E9-FEBB-40EB-904C-5CF4D6F32DC5}\ not found.
File C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll not found.
File C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{0BF43445-2F28-4351-9252-17FE6E806AA0} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0BF43445-2F28-4351-9252-17FE6E806AA0}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
C:\WINDOWS\Downloaded Program Files\erma.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8f2588b3-fb66-11de-9506-001f3c2ee192}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8f2588b3-fb66-11de-9506-001f3c2ee192}\ not found.
File H:\rndj.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8f2588b3-fb66-11de-9506-001f3c2ee192}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8f2588b3-fb66-11de-9506-001f3c2ee192}\ not found.
File H:\rndj.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8f2588b3-fb66-11de-9506-001f3c2ee192}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8f2588b3-fb66-11de-9506-001f3c2ee192}\ not found.
File H:\rndj.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8f2588b3-fb66-11de-9506-001f3c2ee192}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8f2588b3-fb66-11de-9506-001f3c2ee192}\ not found.
File H:\rndj.exe not found.
D:\Henry\Mes documents\~WRL3817.tmp deleted successfully.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Alcmtr deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\IMJPMIG8.1 deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\iTunesHelper deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\MSPY2002 deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\PHIME2002A deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\PHIME2002ASync deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\BrowserChoice\ deleted successfully.
========== FILES ==========
C:\Documents and Settings\All Users\Application Data\vot03.pad moved successfully.
File\Folder C:\Documents and Settings\All Users\Application Data\vot03.js not found.
C:\Documents and Settings\All Users\Application Data\dco81do.dat moved successfully.
C:\sqmdata00.sqm moved successfully.
C:\sqmdata01.sqm moved successfully.
C:\sqmdata02.sqm moved successfully.
C:\sqmdata03.sqm moved successfully.
C:\sqmdata04.sqm moved successfully.
C:\sqmdata05.sqm moved successfully.
C:\sqmdata06.sqm moved successfully.
C:\sqmdata07.sqm moved successfully.
C:\sqmdata08.sqm moved successfully.
C:\sqmdata09.sqm moved successfully.
C:\sqmdata10.sqm moved successfully.
C:\sqmdata11.sqm moved successfully.
C:\sqmdata12.sqm moved successfully.
C:\sqmdata13.sqm moved successfully.
C:\sqmdata14.sqm moved successfully.
C:\sqmdata15.sqm moved successfully.
C:\sqmdata16.sqm moved successfully.
C:\sqmdata17.sqm moved successfully.
C:\sqmdata18.sqm moved successfully.
C:\sqmdata19.sqm moved successfully.
C:\sqmnoopt00.sqm moved successfully.
C:\sqmnoopt01.sqm moved successfully.
C:\sqmnoopt02.sqm moved successfully.
C:\sqmnoopt03.sqm moved successfully.
C:\sqmnoopt04.sqm moved successfully.
C:\sqmnoopt05.sqm moved successfully.
C:\sqmnoopt06.sqm moved successfully.
C:\sqmnoopt07.sqm moved successfully.
C:\sqmnoopt08.sqm moved successfully.
C:\sqmnoopt09.sqm moved successfully.
C:\sqmnoopt10.sqm moved successfully.
C:\sqmnoopt11.sqm moved successfully.
C:\sqmnoopt12.sqm moved successfully.
C:\sqmnoopt13.sqm moved successfully.
C:\sqmnoopt14.sqm moved successfully.
C:\sqmnoopt15.sqm moved successfully.
C:\sqmnoopt16.sqm moved successfully.
C:\sqmnoopt17.sqm moved successfully.
C:\sqmnoopt18.sqm moved successfully.
C:\sqmnoopt19.sqm moved successfully.
C:\Program Files\Spybot - Search & Destroy\Help folder moved successfully.
C:\Program Files\Spybot - Search & Destroy folder moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrateur
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Henry
->Temp folder emptied: 180174304 bytes
->Temporary Internet Files folder emptied: 19051877 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Google Chrome cache emptied: 18175150 bytes
->Flash cache emptied: 2290 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 0 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 736421 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 107231845 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 270 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 147538081 bytes

Total Files Cleaned = 451.00 mb


OTL by OldTimer - Version 3.2.69.0 log created on 06192013_192209

Files\Folders moved on Reboot...
File move failed. C:\WINDOWS\temp\_avast_\Webshlock.txt scheduled to be moved on reboot.
C:\WINDOWS\temp\Perflib_Perfdata_f0c.dat moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

Ok mais je n'ai rien branché

Est-ce qu'il y a encore quelque chose à nettoyer ?

Voici le rapport

############################## | UsbFix V 7.127 | [Suppression]

Utilisateur: Henry (Administrateur) # ACER-564DF136B7
Mis à jour le 05/06/2013 par El Desaparecido
Lancé à 21:30:54 | 19/06/2013

Site Web: https://www.sosvirus.net/
Upload Malware: http://upload.sosvirus.org/
Contact: contact@sosvirus.org

PC: Acer (Extensa 7620 ) (X86-based PC)
CPU: Intel(R) Core(TM)2 Duo CPU T5750 @ 2.00GHz (1995)
RAM -> [Total : 2046 | Free : 1284]
BIOS: Ver 1.00PARTTBL
BOOT: Normal boot

OS: Microsoft Windows XP Professionnel (5.1.2600 32-Bit) # Service Pack 3
WB: Windows Internet Explorer 8.0.6001.18702

SC: Security Center Service [Enabled]
WU: Windows Update Service [Enabled]
FW: Windows FireWall Service [Enabled]

C:\ (%systemdrive%) -> Disque fixe # 113 Go (85 Go libre(s) - 75%) [ACER] # NTFS
D:\ -> Disque fixe # 114 Go (113 Go libre(s) - 99%) [ACERDATA] # FAT32
E:\ -> CD-ROM

################## | El Desaparecido Section |

HKLM\SOFTWARE | Run : [preload] - C:\Windows\RUNXMLPL.exe
HKLM\SOFTWARE | Run : [IAAnotif] - "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
HKLM\SOFTWARE | Run : [SynTPStart] - C:\Program Files\Synaptics\SynTP\SynTPStart.exe
HKLM\SOFTWARE | Run : [RTHDCPL] - RTHDCPL.EXE
HKLM\SOFTWARE | Run : [AzMixerSel] - C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
HKLM\SOFTWARE | Run : [StartCCC] - "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
HKLM\SOFTWARE | Run : [Acer ePresentation HPD] - C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
HKLM\SOFTWARE | Run : [ePower_DMC] - C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
HKLM\SOFTWARE | Run : [Boot] - C:\Acer\Empowering Technology\ePower\Boot.exe
HKLM\SOFTWARE | Run : [eRecoveryService] - C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
HKLM\SOFTWARE | Run : [LManager] - C:\PROGRA~1\LAUNCH~1\LManager.exe
HKLM\SOFTWARE | Run : [Kernel and Hardware Abstraction Layer] - KHALMNPR.EXE
HKLM\SOFTWARE | Run : [HP Software Update] - C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
HKLM\SOFTWARE | Run : [APSDaemon] - "C:\Program Files\Fichiers communs\Apple\Apple Application Support\APSDaemon.exe"
HKLM\SOFTWARE | Run : [Adobe ARM] - "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
HKLM\SOFTWARE | Run : [avast] - "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
HKLM\SOFTWARE | RunOnce : [] -
HKU\S-1-5-19\SOFTWARE | Run : [CTFMON.EXE] - C:\WINDOWS\system32\CTFMON.EXE
HKU\S-1-5-20\SOFTWARE | Run : [CTFMON.EXE] - C:\WINDOWS\system32\CTFMON.EXE
HKU\S-1-5-21-3194007295-2266635485-1072483425-1008\SOFTWARE | Run : [ctfmon.exe] - C:\WINDOWS\system32\ctfmon.exe
HKU\S-1-5-21-3194007295-2266635485-1072483425-1008\SOFTWARE | Run : [MsnMsgr] - "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
HKU\S-1-5-21-3194007295-2266635485-1072483425-1008\SOFTWARE | Run : [swg] - "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
HKU\S-1-5-21-3194007295-2266635485-1072483425-1008\SOFTWARE | Run : [Skype] - "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
HKU\S-1-5-18\SOFTWARE | Run : [CTFMON.EXE] - C:\WINDOWS\system32\CTFMON.EXE

################## | Processus Stoppés |

Stoppé! C:\WINDOWS\system32\Ati2evxx.exe (1720)
Stoppé! C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe (1976)
Stoppé! C:\WINDOWS\system32\Ati2evxx.exe (376)
Stoppé! C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (1040)
Stoppé! C:\WINDOWS\Explorer.EXE (1084)
Stoppé! C:\Program Files\Alwil Software\Avast5\afwServ.exe (1260)
Stoppé! C:\WINDOWS\system32\spoolsv.exe (1992)
Stoppé! C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe (1116)
Stoppé! C:\Program Files\Microsoft\BingBar\7.1.391.0\BBSvc.exe (400)
Stoppé! C:\Program Files\Bonjour\mDNSResponder.exe (704)
Stoppé! C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (788)
Stoppé! C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe (2244)
Stoppé! C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe (2280)
Stoppé! C:\Program Files\Fichiers communs\Motive\McciCMService.exe (2392)
Stoppé! C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (2452)
Stoppé! C:\Program Files\CyberLink\Shared Files\RichVideo.exe (2564)
Stoppé! C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe (2612)
Stoppé! C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLIDSVC.EXE (2784)
Stoppé! C:\WINDOWS\system32\wuauclt.exe (760)
Stoppé! C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLIDSvcM.exe (740)
Stoppé! C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (1000)
Stoppé! C:\WINDOWS\RTHDCPL.EXE (1020)
Stoppé! C:\Acer\Empowering Technology\ePresentation\ePresentation.exe (1548)
Stoppé! C:\Acer\Empowering Technology\ePower\ePower_DMC.exe (1760)
Stoppé! C:\Acer\Empowering Technology\eRecovery\eRAgent.exe (2100)
Stoppé! C:\PROGRA~1\LAUNCH~1\LManager.exe (2316)
Stoppé! C:\Program Files\HP\HP Software Update\HPWuSchd2.exe (2468)
Stoppé! C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (2536)
Stoppé! C:\Program Files\Alwil Software\Avast5\avastUI.exe (2880)
Stoppé! C:\WINDOWS\system32\ctfmon.exe (3200)
Stoppé! C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe (3172)
Stoppé! C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (3308)
Stoppé! C:\Program Files\Skype\Phone\Skype.exe (3544)
Stoppé! C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe (2108)
Stoppé! C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (2224)
Stoppé! C:\Program Files\Logitech\SetPoint\SetPoint.exe (1016)
Stoppé! C:\Program Files\WinZip\WZQKPICK.EXE (3000)
Stoppé! C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (3096)
Stoppé! C:\Program Files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.EXE (988)
Stoppé! C:\DOCUME~1\Henry\LOCALS~1\Temp\RtkBtMnt.exe (4056)
Stoppé! C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe (2716)
Stoppé! C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe (5116)
Stoppé! C:\WINDOWS\system32\wbem\wmiapsrv.exe (5200)
Stoppé! C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe (5444)

################## | Éléments infectieux |

Supprimé! C:\DOCUME~1\Henry\LOCALS~1\Temp\RtkBtMnt.exe

(!) Fichiers temporaires supprimés.

################## | Registre |


################## | Mountpoints2 |


################## | Listing |

[23/09/2008 - 15:42:56 | D ] C:\Acer
[18/06/2013 - 22:46:08 | N | 1152] C:\AdwCleaner[R1].txt
[18/06/2013 - 18:30:07 | RASHD ] C:\Autorun.inf
[22/03/2008 - 21:42:46 | N | 715550] C:\bknowsetup.log
[24/09/2008 - 06:29:20 | D ] C:\BOOK
[23/09/2008 - 22:37:46 | N | 212] C:\boot.ini
[05/08/2004 - 06:00:00 | N | 4952] C:\Bootfont.bin
[06/09/2004 - 16:40:26 | N | 512] C:\BOOTSECT.DOS
[19/06/2013 - 19:41:25 | D ] C:\Config.Msi
[24/09/2008 - 06:22:55 | D ] C:\DOCS
[23/09/2008 - 22:39:21 | D ] C:\Documents and Settings
[24/09/2008 - 06:23:00 | D ] C:\DOTNETFX
[23/09/2008 - 16:56:20 | D ] C:\ELEMENTS
[15/06/2013 - 03:22:58 | N | 4968] C:\ffastun.ffa
[15/06/2013 - 03:22:58 | N | 884736] C:\ffastun.ffl
[15/06/2013 - 03:22:58 | N | 90112] C:\ffastun.ffo
[15/06/2013 - 03:22:58 | N | 2977792] C:\ffastun0.ffx
[19/06/2013 - 21:25:34 | ASH | 2145832960] C:\hiberfil.sys
[24/09/2008 - 06:23:31 | D ] C:\I386
[06/09/2004 - 17:00:24 | N | 0] C:\IO.SYS
[06/09/2004 - 17:00:24 | N | 0] C:\MSDOS.SYS
[16/04/2011 - 19:06:46 | RHD ] C:\MSOCache
[05/08/2004 - 06:00:00 | N | 47564] C:\NTDETECT.COM
[23/09/2008 - 16:37:26 | N | 252240] C:\ntldr
[19/06/2013 - 21:25:32 | ASH | 2145386496] C:\pagefile.sys
[09/04/2008 - 22:09:28 | N | 6326] C:\Patch.rev
[26/04/2007 - 00:45:58 | N | 631] C:\PDVD.iss
[17/06/2013 - 21:35:22 | N | 512] C:\PhysicalDisk0_MBR.bin
[23/03/2008 - 09:05:28 | N | 73] C:\preload.aaa
[23/03/2008 - 09:05:28 | N | 73] C:\Preload.rev
[19/06/2013 - 19:22:22 | D ] C:\Program Files
[24/09/2008 - 08:24:38 | SHD ] C:\RECYCLER
[22/03/2008 - 21:42:04 | N | 595] C:\RHDSetup.log
[10/01/2011 - 09:59:59 | N | 368] C:\rkill.log
[22/03/2008 - 21:42:46 | N | 32] C:\setup.log
[24/09/2008 - 06:25:47 | D ] C:\SUPPORT
[24/09/2008 - 06:25:48 | D ] C:\sysinfo
[23/09/2008 - 22:37:49 | SHD ] C:\System Volume Information
[19/06/2013 - 21:36:42 | D ] C:\UsbFix
[18/06/2013 - 18:30:08 | N | 12505] C:\UsbFix [Clean 1] ACER-564DF136B7.txt
[19/06/2013 - 21:37:03 | A | 8512] C:\UsbFix [Clean 3] ACER-564DF136B7.txt
[19/06/2013 - 19:16:43 | N | 5893] C:\UsbFix [Listing 1 ] ACER-564DF136B7.txt
[24/09/2008 - 06:25:49 | D ] C:\VALUEADD
[19/06/2013 - 21:26:10 | D ] C:\WINDOWS
[23/09/2008 - 18:13:05 | D ] C:\winnt
[22/03/2008 - 21:17:44 | N | 4] C:\wps.dat
[17/06/2013 - 21:35:25 | D ] C:\ZHP
[19/06/2013 - 19:22:09 | D ] C:\_OTL
[15/06/2013 - 03:10:58 | N | 57344] D:\ffastun.ffl
[15/06/2013 - 03:10:58 | N | 139264] D:\ffastun0.ffx
[23/09/2008 - 22:40:00 | SHD ] D:\System Volume Information
[15/06/2013 - 03:10:58 | N | 61440] D:\ffastun.ffo
[15/06/2013 - 03:10:58 | N | 4379] D:\ffastun.ffa
[18/06/2013 - 18:30:08 | RASHD ] D:\Autorun.inf
[16/08/2009 - 03:04:00 | D ] D:\30b68b8111190fd97e
[24/09/2008 - 08:38:30 | D ] D:\Henry
[24/09/2008 - 09:34:50 | SHD ] D:\Recycled

################## | Vaccin |

C:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
D:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)

################## | E.O.F | https://www.sosvirus.net/ |

Le clé USB qui se trouvait peut-être en H ne sera plus utilisée sur ce PC, donc pas de problème

Non rien d'autre