PC trés infecté Résolu

Question

Bonjour

Ce PC plante régulièrement. J'ai lancé Housecall et TFC

Voici un rapport ZHPdiag

https://www.cjoint.com/?CFrvTo7KjIk

Merci pour votre aide

g3n-h@ckm@n · Accepted Answer

ca serait bien que quelqu'un de serieux s'y mette car là c'est du n'importe quoi comme on vient de me le signaler en MP

laysman123 · Answer

Bonjour,

1errement, je te conseil d'installer un antivirus de bossssss comme Kaspersky 3.0 ou une autre version ou si ton ordinateur est trop infecté, je crois que c'est la fin...

Balboa99 · Answer

Voici le rapport Malwarebytes

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Version de la base de données: v2013.06.17.05

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Henry :: ACER-564DF136B7 [administrateur]

17.06.2013 21:59:18
mbam-log-2013-06-17 (21-59-18).txt

Type d'examen: Examen rapide
Options d'examen activées: Mémoire | Démarrage | Registre | Système de fichiers | Heuristique/Extra | Heuristique/Shuriken | PUP | PUM
Options d'examen désactivées: P2P
Elément(s) analysé(s): 238657
Temps écoulé: 9 minute(s), 4 seconde(s)

Processus mémoire détecté(s): 0
(Aucun élément nuisible détecté)

Module(s) mémoire détecté(s): 0
(Aucun élément nuisible détecté)

Clé(s) du Registre détectée(s): 1
HKCU\SOFTWARE\g043oqxanu (Trojan.FakeAlert) -> Mis en quarantaine et supprimé avec succès.

Valeur(s) du Registre détectée(s): 0
(Aucun élément nuisible détecté)

Elément(s) de données du Registre détecté(s): 0
(Aucun élément nuisible détecté)

Dossier(s) détecté(s): 0
(Aucun élément nuisible détecté)

Fichier(s) détecté(s): 6
C:\Documents and Settings\All Users\Application Data\dsgsdgdsgdsgw.pad (Exploit.Drop.GSA) -> Mis en quarantaine et supprimé avec succès.
C:\Documents and Settings\All Users\Application Data\lsass.exe (Trojan.Delf) -> Mis en quarantaine et supprimé avec succès.
C:\Documents and Settings\Henry\Menu Démarrer\Programmes\Démarrage\ctfmon.lnk (Trojan.Ransom.Gen) -> Mis en quarantaine et supprimé avec succès.
C:\Documents and Settings\All Users\Application Data\2433f433 (Trojan.Agent.TPL) -> Mis en quarantaine et supprimé avec succès.
C:\Documents and Settings\Henry\Application Data\2433f433 (Trojan.Agent.TPL) -> Mis en quarantaine et supprimé avec succès.
C:\Documents and Settings\Henry\Local Settings\Application Data\2433f433 (Trojan.Agent.TPL) -> Mis en quarantaine et supprimé avec succès.

(fin)

g3n-h@ckm@n · Answer

ok rocky ^^ (Balboa99)

fais ce qui suit ca sent le brontok :

 &#9654 Téléchargez UsbFix (créé par El Desaparecido) sur votre Bureau.

&#9654 Si votre antivirus affiche une alerte, ignorez-la et désactivez l'antivirus temporairement.
&#9654 Branchez toutes vos sources de données externes à votre PC (clé USB, disque dur externe, etc...) sans les ouvrir.
&#9654 Double cliquez sur UsbFix.exe. (pour les utilisateurs de windows Vista , windows 7 , windows 8 , clique droit => executer en tant qu'administrateur" 

&#9654 Cliquez sur [Suppression].
&#9654 Laissez travailler l'outil. 

&#9654 À la fin du scan, un rapport va s'afficher, postez-le dans votre prochaine réponse sur le forum.

&#9654 Le rapport est aussi sauvegardé à la racine du disque système ( C:\UsbFix.txt ).

Balboa99 · Answer

Bonjour,

Voici le rapport

############################## | UsbFix V 7.127 | [Suppression]

Utilisateur: Henry (Administrateur) # ACER-564DF136B7
Mis à jour le 05/06/2013 par El Desaparecido
Lancé à 18:18:38 | 18/06/2013

Site Web: https://www.sosvirus.net/
Upload Malware: http://upload.sosvirus.org/
Contact: contact@sosvirus.org

PC: Acer            (Extensa 7620                   ) (X86-based PC)
CPU: Intel(R) Core(TM)2 Duo CPU     T5750  @ 2.00GHz (1994)
RAM -> [Total : 2046 | Free : 1243]
BIOS: Ver 1.00PARTTBL
BOOT: Normal boot

OS: Microsoft Windows XP Professionnel (5.1.2600 32-Bit) # Service Pack 3
WB: Windows Internet Explorer 8.0.6001.18702

SC: Security Center Service [Enabled]
WU: Windows Update Service [Enabled]
FW: Windows FireWall Service [Enabled]

C:\ (%systemdrive%) -> Disque fixe # 113 Go (86 Go libre(s) - 76%) [ACER] # NTFS
D:\ -> Disque fixe # 114 Go (113 Go libre(s) - 99%) [ACERDATA] # FAT32
E:\ -> CD-ROM

################## | El Desaparecido Section |

HKLM\SOFTWARE | Run : [preload] - C:\Windows\RUNXMLPL.exe
HKLM\SOFTWARE | Run : [IAAnotif] - "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
HKLM\SOFTWARE | Run : [SynTPStart] - C:\Program Files\Synaptics\SynTP\SynTPStart.exe
HKLM\SOFTWARE | Run : [RTHDCPL] - RTHDCPL.EXE
HKLM\SOFTWARE | Run : [Alcmtr] - ALCMTR.EXE
HKLM\SOFTWARE | Run : [AzMixerSel] - C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
HKLM\SOFTWARE | Run : [IMJPMIG8.1] - "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
HKLM\SOFTWARE | Run : [MSPY2002] - C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
HKLM\SOFTWARE | Run : [PHIME2002ASync] - C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
HKLM\SOFTWARE | Run : [PHIME2002A] - C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
HKLM\SOFTWARE | Run : [StartCCC] - "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
HKLM\SOFTWARE | Run : [Acer ePresentation HPD] - C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
HKLM\SOFTWARE | Run : [ePower_DMC] - C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
HKLM\SOFTWARE | Run : [Boot] - C:\Acer\Empowering Technology\ePower\Boot.exe
HKLM\SOFTWARE | Run : [eRecoveryService] - C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
HKLM\SOFTWARE | Run : [LManager] - C:\PROGRA~1\LAUNCH~1\LManager.exe
HKLM\SOFTWARE | Run : [Kernel and Hardware Abstraction Layer] - KHALMNPR.EXE
HKLM\SOFTWARE | Run : [avast5] - C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
HKLM\SOFTWARE | Run : [HP Software Update] - C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
HKLM\SOFTWARE | Run : [] - 
HKLM\SOFTWARE | Run : [APSDaemon] - "C:\Program Files\Fichiers communs\Apple\Apple Application Support\APSDaemon.exe"
HKLM\SOFTWARE | Run : [iTunesHelper] - "C:\Program Files\iTunes\iTunesHelper.exe"
HKLM\SOFTWARE | Run : [Adobe ARM] - "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
HKLM\SOFTWARE | RunOnce : [] - 
HKU\S-1-5-19\SOFTWARE | Run : [CTFMON.EXE] - C:\WINDOWS\system32\CTFMON.EXE
HKU\S-1-5-20\SOFTWARE | Run : [CTFMON.EXE] - C:\WINDOWS\system32\CTFMON.EXE
HKU\S-1-5-21-3194007295-2266635485-1072483425-1008\SOFTWARE | Run : [ctfmon.exe] - C:\WINDOWS\system32\ctfmon.exe
HKU\S-1-5-21-3194007295-2266635485-1072483425-1008\SOFTWARE | Run : [MsnMsgr] - "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
HKU\S-1-5-21-3194007295-2266635485-1072483425-1008\SOFTWARE | Run : [swg] - "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
HKU\S-1-5-21-3194007295-2266635485-1072483425-1008\SOFTWARE | Run : [Skype] - "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
HKU\S-1-5-18\SOFTWARE | Run : [CTFMON.EXE] - C:\WINDOWS\system32\CTFMON.EXE

################## | Processus Stoppés |

Stoppé! C:\WINDOWS\system32\Ati2evxx.exe (1700)
Stoppé! C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe (1960)
Stoppé! C:\WINDOWS\system32\Ati2evxx.exe (296)
Stoppé! C:\Program Files\Alwil Software\Avast5\afwServ.exe (1020)
Stoppé! C:\WINDOWS\Explorer.EXE (1128)
Stoppé! C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (1212)
Stoppé! C:\WINDOWS\system32\spoolsv.exe (1360)
Stoppé! C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe (192)
Stoppé! C:\Program Files\Microsoft\BingBar\7.1.391.0\BBSvc.exe (264)
Stoppé! C:\Program Files\Bonjour\mDNSResponder.exe (612)
Stoppé! C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (848)
Stoppé! C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (888)
Stoppé! C:\WINDOWS\RTHDCPL.EXE (904)
Stoppé! C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (404)
Stoppé! C:\Acer\Empowering Technology\ePresentation\ePresentation.exe (304)
Stoppé! C:\Acer\Empowering Technology\ePower\ePower_DMC.exe (2064)
Stoppé! C:\Acer\Empowering Technology\eRecovery\eRAgent.exe (2140)
Stoppé! C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE (2180)
Stoppé! C:\PROGRA~1\LAUNCH~1\LManager.exe (2200)
Stoppé! C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe (2228)
Stoppé! C:\Program Files\HP\HP Software Update\HPWuSchd2.exe (2244)
Stoppé! C:\Program Files\iTunes\iTunesHelper.exe (2396)
Stoppé! C:\WINDOWS\system32\ctfmon.exe (2492)
Stoppé! C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe (2512)
Stoppé! C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (2528)
Stoppé! C:\Program Files\Skype\Phone\Skype.exe (2580)
Stoppé! C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe (2824)
Stoppé! C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe (2932)
Stoppé! C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (2964)
Stoppé! C:\Program Files\Logitech\SetPoint\SetPoint.exe (3004)
Stoppé! C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe (3012)
Stoppé! C:\Program Files\WinZip\WZQKPICK.EXE (3112)
Stoppé! C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (3128)
Stoppé! C:\Program Files\Fichiers communs\Motive\McciCMService.exe (3148)
Stoppé! C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (3836)
Stoppé! C:\Program Files\CyberLink\Shared Files\RichVideo.exe (3976)
Stoppé! C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe (4040)
Stoppé! C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe (2348)
Stoppé! C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLIDSVC.EXE (2880)
Stoppé! C:\Program Files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.EXE (980)
Stoppé! C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLIDSvcM.exe (1304)
Stoppé! C:\DOCUME~1\Henry\LOCALS~1\Temp\RtkBtMnt.exe (3376)
Stoppé! C:\Program Files\iPod\bin\iPodService.exe (3524)
Stoppé! C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe (5848)
Stoppé! C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe (5556)
Stoppé! C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe (5912)
Stoppé! C:\WINDOWS\system32\wbem\wmiapsrv.exe (6124)
Stoppé! C:\Program Files\Microsoft\BingBar\7.1.391.0\SeaPort.exe (3268)
Stoppé! C:\Program Files\Internet Explorer\iexplore.exe (1044)
Stoppé! C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_clipbook.exe (1512)

################## | Éléments infectieux |

Supprimé! C:\DOCUME~1\Henry\LOCALS~1\Temp\RtkBtMnt.exe

(!) Fichiers temporaires supprimés.

################## | Registre |


################## | Mountpoints2 |

Supprimé! HKCU\.\.\.\.\Explorer\MountPoints2\{8f2588b2-fb66-11de-9506-001f3c2ee192}
Supprimé! HKCU\.\.\.\.\Explorer\MountPoints2\{fc76d260-6ccb-11de-943b-001f3c2ee192}

################## | Listing |

[23/09/2008 - 15:42:56 | D ] 	C:\Acer
[22/03/2008 - 21:42:46 | N | 715550] 	C:\bknowsetup.log
[24/09/2008 - 06:29:20 | D ] 	C:\BOOK
[23/09/2008 - 22:37:46 | N | 212] 	C:\boot.ini
[05/08/2004 - 06:00:00 | N | 4952] 	C:\Bootfont.bin
[06/09/2004 - 16:40:26 | N | 512] 	C:\BOOTSECT.DOS
[17/06/2013 - 08:29:03 | D ] 	C:\Config.Msi
[24/09/2008 - 06:22:55 | D ] 	C:\DOCS
[23/09/2008 - 22:39:21 | D ] 	C:\Documents and Settings
[24/09/2008 - 06:23:00 | D ] 	C:\DOTNETFX
[23/09/2008 - 16:56:20 | D ] 	C:\ELEMENTS
[15/06/2013 - 03:22:58 | N | 4968] 	C:\ffastun.ffa
[15/06/2013 - 03:22:58 | N | 884736] 	C:\ffastun.ffl
[15/06/2013 - 03:22:58 | N | 90112] 	C:\ffastun.ffo
[15/06/2013 - 03:22:58 | N | 2977792] 	C:\ffastun0.ffx
[18/06/2013 - 17:56:57 | ASH | 2145832960] 	C:\hiberfil.sys
[24/09/2008 - 06:23:31 | D ] 	C:\I386
[06/09/2004 - 17:00:24 | N | 0] 	C:\IO.SYS
[06/09/2004 - 17:00:24 | N | 0] 	C:\MSDOS.SYS
[16/04/2011 - 19:06:46 | RHD ] 	C:\MSOCache
[05/08/2004 - 06:00:00 | N | 47564] 	C:\NTDETECT.COM
[23/09/2008 - 16:37:26 | N | 252240] 	C:
tldr
[18/06/2013 - 17:56:55 | ASH | 2145386496] 	C:\pagefile.sys
[09/04/2008 - 22:09:28 | N | 6326] 	C:\Patch.rev
[26/04/2007 - 00:45:58 | N | 631] 	C:\PDVD.iss
[17/06/2013 - 21:35:22 | N | 512] 	C:\PhysicalDisk0_MBR.bin
[23/03/2008 - 09:05:28 | N | 73] 	C:\preload.aaa
[23/03/2008 - 09:05:28 | N | 73] 	C:\Preload.rev
[17/06/2013 - 22:20:27 | D ] 	C:\Program Files
[24/09/2008 - 08:24:38 | SHD ] 	C:\RECYCLER
[22/03/2008 - 21:42:04 | N | 595] 	C:\RHDSetup.log
[10/01/2011 - 09:59:59 | N | 368] 	C:kill.log
[22/03/2008 - 21:42:46 | N | 32] 	C:\setup.log
[16/08/2009 - 03:13:47 | N | 268] 	C:\sqmdata00.sqm
[16/08/2009 - 04:24:43 | N | 268] 	C:\sqmdata01.sqm
[16/08/2009 - 23:21:12 | N | 268] 	C:\sqmdata02.sqm
[17/08/2009 - 22:20:09 | N | 268] 	C:\sqmdata03.sqm
[18/08/2009 - 23:48:32 | N | 268] 	C:\sqmdata04.sqm
[20/08/2009 - 00:22:46 | N | 268] 	C:\sqmdata05.sqm
[20/08/2009 - 23:39:06 | N | 268] 	C:\sqmdata06.sqm
[22/08/2009 - 22:35:58 | N | 268] 	C:\sqmdata07.sqm
[23/08/2009 - 23:25:32 | N | 268] 	C:\sqmdata08.sqm
[24/08/2009 - 08:53:27 | N | 268] 	C:\sqmdata09.sqm
[08/09/2009 - 21:13:59 | N | 268] 	C:\sqmdata10.sqm
[24/09/2009 - 09:22:24 | N | 268] 	C:\sqmdata11.sqm
[06/08/2009 - 23:08:53 | N | 268] 	C:\sqmdata12.sqm
[07/08/2009 - 23:32:35 | N | 268] 	C:\sqmdata13.sqm
[09/08/2009 - 00:41:56 | N | 268] 	C:\sqmdata14.sqm
[09/08/2009 - 22:47:09 | N | 268] 	C:\sqmdata15.sqm
[11/08/2009 - 23:11:41 | N | 268] 	C:\sqmdata16.sqm
[13/08/2009 - 00:01:25 | N | 268] 	C:\sqmdata17.sqm
[13/08/2009 - 23:22:29 | N | 268] 	C:\sqmdata18.sqm
[14/08/2009 - 23:59:02 | N | 268] 	C:\sqmdata19.sqm
[16/08/2009 - 03:13:47 | N | 244] 	C:\sqmnoopt00.sqm
[16/08/2009 - 04:24:43 | N | 244] 	C:\sqmnoopt01.sqm
[16/08/2009 - 23:21:12 | N | 244] 	C:\sqmnoopt02.sqm
[17/08/2009 - 22:20:09 | N | 244] 	C:\sqmnoopt03.sqm
[18/08/2009 - 23:48:32 | N | 244] 	C:\sqmnoopt04.sqm
[20/08/2009 - 00:22:46 | N | 244] 	C:\sqmnoopt05.sqm
[20/08/2009 - 23:39:06 | N | 244] 	C:\sqmnoopt06.sqm
[22/08/2009 - 22:35:58 | N | 244] 	C:\sqmnoopt07.sqm
[23/08/2009 - 23:25:32 | N | 244] 	C:\sqmnoopt08.sqm
[24/08/2009 - 08:53:27 | N | 244] 	C:\sqmnoopt09.sqm
[08/09/2009 - 21:13:59 | N | 244] 	C:\sqmnoopt10.sqm
[24/09/2009 - 09:22:24 | N | 244] 	C:\sqmnoopt11.sqm
[06/08/2009 - 23:08:53 | N | 244] 	C:\sqmnoopt12.sqm
[07/08/2009 - 23:32:35 | N | 244] 	C:\sqmnoopt13.sqm
[09/08/2009 - 00:41:56 | N | 244] 	C:\sqmnoopt14.sqm
[09/08/2009 - 22:47:09 | N | 244] 	C:\sqmnoopt15.sqm
[11/08/2009 - 23:11:41 | N | 244] 	C:\sqmnoopt16.sqm
[13/08/2009 - 00:01:25 | N | 244] 	C:\sqmnoopt17.sqm
[13/08/2009 - 23:22:29 | N | 244] 	C:\sqmnoopt18.sqm
[14/08/2009 - 23:59:02 | N | 244] 	C:\sqmnoopt19.sqm
[24/09/2008 - 06:25:47 | D ] 	C:\SUPPORT
[24/09/2008 - 06:25:48 | D ] 	C:\sysinfo
[23/09/2008 - 22:37:49 | SHD ] 	C:\System Volume Information
[18/06/2013 - 18:29:44 | D ] 	C:\UsbFix
[18/06/2013 - 18:30:06 | A | 11597] 	C:\UsbFix [Clean 1] ACER-564DF136B7.txt
[24/09/2008 - 06:25:49 | D ] 	C:\VALUEADD
[18/06/2013 - 17:57:11 | D ] 	C:\WINDOWS
[23/09/2008 - 18:13:05 | D ] 	C:\winnt
[22/03/2008 - 21:17:44 | N | 4] 	C:\wps.dat
[17/06/2013 - 21:35:25 | D ] 	C:\ZHP
[15/06/2013 - 03:10:58 | N | 57344] 	D:\ffastun.ffl
[15/06/2013 - 03:10:58 | N | 139264] 	D:\ffastun0.ffx
[23/09/2008 - 22:40:00 | SHD ] 	D:\System Volume Information
[15/06/2013 - 03:10:58 | N | 61440] 	D:\ffastun.ffo
[15/06/2013 - 03:10:58 | N | 4379] 	D:\ffastun.ffa
[16/08/2009 - 03:04:00 | D ] 	D:\30b68b8111190fd97e
[24/09/2008 - 08:38:30 | D ] 	D:\Henry
[24/09/2008 - 09:34:50 | SHD ] 	D:\Recycled

################## | Vaccin |

C:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
D:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)

################## | E.O.F | https://www.sosvirus.net/ |

g3n-h@ckm@n · Answer

re

et ben c'était pas ca :)

==

 Télécharge ici :OTL

&#9654 enregistre le sur ton Bureau.

si tu as XP => double clique
si tu as Vista ou windows 7 / 8 => clic droit "executer en tant que...." 

sur OTL.exe pour le lancer.

&#9654 => Clique ici pour voir la Configuration

&#9654 Copie et colle le contenu de ce qui suit en gras dans la partie inférieure d'OTL "Personnalisation"


HKCU\Software
HKLM\Software
HKCU\Software\Microsoft\Command Processor /s
%Homedrive%\*
%Homedrive%\*.
%Userprofile%\*
%Userprofile%\*. 
%Allusersprofile%\*
%Allusersprofile%\*.
%LocalAppData%\*
%LocalAppData%\*.
%Userprofile%\Local Settings\Application Data\*
%Userprofile%\Local Settings\Application Data\*.
%programFiles%\*
%programFiles%\*.
%Systemroot%\Installer\*.
%Systemroot%\Temp\*.exe /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\system32\*.exe /lockedfiles
%systemroot%\system32\*.in*
%systemroot%\Tasks\*
%systemroot%\Tasks\*.
%systemroot%\system32\Tasks\*
%systemroot%\system32\Tasks\*.
%systemroot%\system32\drivers\*.sy* /lockedfiles
%systemroot%\system32\config\*.exe /s
%Systemroot%\ServiceProfiles\*.exe /s
%systemroot%\system32\*.sys 
dir C:\ /S /A:L /C 
msconfig 
activex 
/md5start
explorer.exe
winlogon.exe
wininit.exe
volsnap.sys
atapi.sys
ndisuio.sys
ndis.sys
cdrom.sys
i8042prt.sys
iastor.sys
tdx.sys
netbt.sys
afd.sys
/md5stop 
netsvcs
safebootminimal
safebootnetwork 
CREATERESTOREPOINT 

&#9654 Clic sur Analyse.

A la fin du scan, le Bloc-Notes va s'ouvrir avec le rapport (OTL.txt).

Ce fichier est sur ton Bureau (en général C:\Documents and settings\le_nom_de_ta_session\<Bureau ou Desktop>\OTL.txt)

&#9654&#9654&#9654 NE LE POSTE PAS SUR LE FORUM (il est trop long)

heberge OTL.txt et extra.txt sur https://www.cjoint.com/ et donne les liens

Balboa99 · Answer

Voici les liens

https://www.cjoint.com/?CFswh7rURWY

https://www.cjoint.com/?CFswiIECFSD

Balboa99 · Answer

Ok bonne soirée et à demain

g3n-h@ckm@n · Answer

ok tu me feras le plaisir de mettre ton lecteur "H:\" que tu n'avais pas mis et de refaire une suppression avec usbfix


tu as mis ce lecteur depuis, et tu as reinfecté la machine avec

==

 ATTENTION !!! : Script personnalisé pour cette machine uniquement , ne pas reproduire !! 

si tu as XP => double clique
si tu as Vista ou windows 7 => clic droit "executer en tant que...." 

sur OTL.exe pour le lancer.


&#9654Copie la liste qui se trouve en gras ci-dessous,

&#9654 colle-la dans la zone sous "Personnalisation" :


:processes
explorer.exe
iexplore.exe
firefox.exe
msnmsgr.exe
Teatimer.exe
safari.exe
opera.exe
rundll32.exe

:OTL
IE - HKU\S-1-5-21-3194007295-2266635485-1072483425-1008\..\SearchScopes\{6B7E39E9-FEBB-40EB-904C-5CF4D6F32DC5}: "URL" = http://www.search.ask.com/?l=dis{searchTerms}&locale=&apn_ptnrs=U3&apn_dtid=OSJ000 
FF - user.js - File not found
CHR - plugin: Java Deployment Toolkit 6.0.260.3 (Enabled) = C:\Program Files\Java\jre6\bin
ew_plugin
pdeployJava1.dll     
CHR - plugin: Java Platform SE 6 U26 (Enabled) = C:\Program Files\Java\jre6\bin
ew_plugin
pjp2.dll     
O3 - HKLM\..\Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O33 - MountPoints2\{8f2588b3-fb66-11de-9506-001f3c2ee192}\Shell\AUtoPlaY\CommAnd - "" = H:ndj.exe 
O33 - MountPoints2\{8f2588b3-fb66-11de-9506-001f3c2ee192}\Shell\AutoRun\command - "" = H:ndj.exe 
O33 - MountPoints2\{8f2588b3-fb66-11de-9506-001f3c2ee192}\Shell\ExPlore\COMmAnd - "" = H:ndj.exe 
O33 - MountPoints2\{8f2588b3-fb66-11de-9506-001f3c2ee192}\Shell\opEn\CoMmAND - "" = H:ndj.exe 
[1 D:\Henry\Mes documents\*.tmp files -> D:\Henry\Mes documents\*.tmp -> ] 

:Reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]  
"Alcmtr"=-    
""=-
"IMJPMIG8.1"=-
"iTunesHelper"=-
"MSPY2002"=-
"PHIME2002A"=-
"PHIME2002ASync"=-
[-HKEY_LOCAL_MACHINE\Software\BrowserChoice]     

:Files
C:\Documents and Settings\All Users\Application Data\vot03.pad 
C:\Documents and Settings\All Users\Application Data\vot03.js 
C:\Documents and Settings\All Users\Application Data\dco81do.dat 
C:\*.sqm 
C:\Program Files\Spybot - Search & Destroy 

:commands
[emptytemp]


&#9654 Clique sur "Correction" pour lancer la suppression.


&#9654 Poste le rapport qui logiquement s'ouvrira tout seul en fin de travail appres le redemarrage.

Balboa99 · Answer

Salut

Je n'ai pas ajouté de lecteur H ni branché de clés USB ou disque dur
Comment fait-on avec usbfix pour sélectionner des lecteurs ?

Voici le rapport

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
Process iexplore.exe killed successfully!
No active process named firefox.exe was found!
Process msnmsgr.exe killed successfully!
No active process named Teatimer.exe was found!
No active process named safari.exe was found!
No active process named opera.exe was found!
No active process named rundll32.exe was found!
========== OTL ==========
Registry key HKEY_USERS\S-1-5-21-3194007295-2266635485-1072483425-1008\Software\Microsoft\Internet Explorer\SearchScopes\{6B7E39E9-FEBB-40EB-904C-5CF4D6F32DC5}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6B7E39E9-FEBB-40EB-904C-5CF4D6F32DC5}\ not found.
File C:\Program Files\Java\jre6\bin
ew_plugin
pdeployJava1.dll not found.
File C:\Program Files\Java\jre6\bin
ew_plugin
pjp2.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\{0BF43445-2F28-4351-9252-17FE6E806AA0} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0BF43445-2F28-4351-9252-17FE6E806AA0}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\Locked deleted successfully.
Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
C:\WINDOWS\Downloaded Program Files\erma.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8f2588b3-fb66-11de-9506-001f3c2ee192}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8f2588b3-fb66-11de-9506-001f3c2ee192}\ not found.
File H:ndj.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8f2588b3-fb66-11de-9506-001f3c2ee192}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8f2588b3-fb66-11de-9506-001f3c2ee192}\ not found.
File H:ndj.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8f2588b3-fb66-11de-9506-001f3c2ee192}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8f2588b3-fb66-11de-9506-001f3c2ee192}\ not found.
File H:ndj.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8f2588b3-fb66-11de-9506-001f3c2ee192}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8f2588b3-fb66-11de-9506-001f3c2ee192}\ not found.
File H:ndj.exe not found.
D:\Henry\Mes documents\~WRL3817.tmp deleted successfully.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Alcmtr deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\IMJPMIG8.1 deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\iTunesHelper deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\MSPY2002 deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\PHIME2002A deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\PHIME2002ASync deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\BrowserChoice\ deleted successfully.
========== FILES ==========
C:\Documents and Settings\All Users\Application Data\vot03.pad moved successfully.
File\Folder C:\Documents and Settings\All Users\Application Data\vot03.js not found.
C:\Documents and Settings\All Users\Application Data\dco81do.dat moved successfully.
C:\sqmdata00.sqm moved successfully.
C:\sqmdata01.sqm moved successfully.
C:\sqmdata02.sqm moved successfully.
C:\sqmdata03.sqm moved successfully.
C:\sqmdata04.sqm moved successfully.
C:\sqmdata05.sqm moved successfully.
C:\sqmdata06.sqm moved successfully.
C:\sqmdata07.sqm moved successfully.
C:\sqmdata08.sqm moved successfully.
C:\sqmdata09.sqm moved successfully.
C:\sqmdata10.sqm moved successfully.
C:\sqmdata11.sqm moved successfully.
C:\sqmdata12.sqm moved successfully.
C:\sqmdata13.sqm moved successfully.
C:\sqmdata14.sqm moved successfully.
C:\sqmdata15.sqm moved successfully.
C:\sqmdata16.sqm moved successfully.
C:\sqmdata17.sqm moved successfully.
C:\sqmdata18.sqm moved successfully.
C:\sqmdata19.sqm moved successfully.
C:\sqmnoopt00.sqm moved successfully.
C:\sqmnoopt01.sqm moved successfully.
C:\sqmnoopt02.sqm moved successfully.
C:\sqmnoopt03.sqm moved successfully.
C:\sqmnoopt04.sqm moved successfully.
C:\sqmnoopt05.sqm moved successfully.
C:\sqmnoopt06.sqm moved successfully.
C:\sqmnoopt07.sqm moved successfully.
C:\sqmnoopt08.sqm moved successfully.
C:\sqmnoopt09.sqm moved successfully.
C:\sqmnoopt10.sqm moved successfully.
C:\sqmnoopt11.sqm moved successfully.
C:\sqmnoopt12.sqm moved successfully.
C:\sqmnoopt13.sqm moved successfully.
C:\sqmnoopt14.sqm moved successfully.
C:\sqmnoopt15.sqm moved successfully.
C:\sqmnoopt16.sqm moved successfully.
C:\sqmnoopt17.sqm moved successfully.
C:\sqmnoopt18.sqm moved successfully.
C:\sqmnoopt19.sqm moved successfully.
C:\Program Files\Spybot - Search & Destroy\Help folder moved successfully.
C:\Program Files\Spybot - Search & Destroy folder moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Administrateur
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: All Users
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Henry
->Temp folder emptied: 180174304 bytes
->Temporary Internet Files folder emptied: 19051877 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Google Chrome cache emptied: 18175150 bytes
->Flash cache emptied: 2290 bytes
 
User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 0 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 736421 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 107231845 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 270 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 147538081 bytes
 
Total Files Cleaned = 451.00 mb
 
 
OTL by OldTimer - Version 3.2.69.0 log created on 06192013_192209

Files\Folders moved on Reboot...
File move failed. C:\WINDOWS	emp\_avast_\Webshlock.txt scheduled to be moved on reboot.
C:\WINDOWS	emp\Perflib_Perfdata_f0c.dat moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

g3n-h@ckm@n · Answer

re

on les branche et ils sont automatiquement détectés

Balboa99 · Answer

Ok mais je n'ai rien branché

Est-ce qu'il y a encore quelque chose à nettoyer ?

g3n-h@ckm@n · Answer

tu refais une suppression avec usbfix en branchant tous tes périphériques comme demandé ils sont infectés

Balboa99 · Answer

Voici le rapport

############################## | UsbFix V 7.127 | [Suppression]

Utilisateur: Henry (Administrateur) # ACER-564DF136B7
Mis à jour le 05/06/2013 par El Desaparecido
Lancé à 21:30:54 | 19/06/2013

Site Web: https://www.sosvirus.net/
Upload Malware: http://upload.sosvirus.org/
Contact: contact@sosvirus.org

PC: Acer            (Extensa 7620                   ) (X86-based PC)
CPU: Intel(R) Core(TM)2 Duo CPU     T5750  @ 2.00GHz (1995)
RAM -> [Total : 2046 | Free : 1284]
BIOS: Ver 1.00PARTTBL
BOOT: Normal boot

OS: Microsoft Windows XP Professionnel (5.1.2600 32-Bit) # Service Pack 3
WB: Windows Internet Explorer 8.0.6001.18702

SC: Security Center Service [Enabled]
WU: Windows Update Service [Enabled]
FW: Windows FireWall Service [Enabled]

C:\ (%systemdrive%) -> Disque fixe # 113 Go (85 Go libre(s) - 75%) [ACER] # NTFS
D:\ -> Disque fixe # 114 Go (113 Go libre(s) - 99%) [ACERDATA] # FAT32
E:\ -> CD-ROM

################## | El Desaparecido Section |

HKLM\SOFTWARE | Run : [preload] - C:\Windows\RUNXMLPL.exe
HKLM\SOFTWARE | Run : [IAAnotif] - "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
HKLM\SOFTWARE | Run : [SynTPStart] - C:\Program Files\Synaptics\SynTP\SynTPStart.exe
HKLM\SOFTWARE | Run : [RTHDCPL] - RTHDCPL.EXE
HKLM\SOFTWARE | Run : [AzMixerSel] - C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
HKLM\SOFTWARE | Run : [StartCCC] - "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
HKLM\SOFTWARE | Run : [Acer ePresentation HPD] - C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
HKLM\SOFTWARE | Run : [ePower_DMC] - C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
HKLM\SOFTWARE | Run : [Boot] - C:\Acer\Empowering Technology\ePower\Boot.exe
HKLM\SOFTWARE | Run : [eRecoveryService] - C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
HKLM\SOFTWARE | Run : [LManager] - C:\PROGRA~1\LAUNCH~1\LManager.exe
HKLM\SOFTWARE | Run : [Kernel and Hardware Abstraction Layer] - KHALMNPR.EXE
HKLM\SOFTWARE | Run : [HP Software Update] - C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
HKLM\SOFTWARE | Run : [APSDaemon] - "C:\Program Files\Fichiers communs\Apple\Apple Application Support\APSDaemon.exe"
HKLM\SOFTWARE | Run : [Adobe ARM] - "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
HKLM\SOFTWARE | Run : [avast] - "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
HKLM\SOFTWARE | RunOnce : [] - 
HKU\S-1-5-19\SOFTWARE | Run : [CTFMON.EXE] - C:\WINDOWS\system32\CTFMON.EXE
HKU\S-1-5-20\SOFTWARE | Run : [CTFMON.EXE] - C:\WINDOWS\system32\CTFMON.EXE
HKU\S-1-5-21-3194007295-2266635485-1072483425-1008\SOFTWARE | Run : [ctfmon.exe] - C:\WINDOWS\system32\ctfmon.exe
HKU\S-1-5-21-3194007295-2266635485-1072483425-1008\SOFTWARE | Run : [MsnMsgr] - "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
HKU\S-1-5-21-3194007295-2266635485-1072483425-1008\SOFTWARE | Run : [swg] - "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
HKU\S-1-5-21-3194007295-2266635485-1072483425-1008\SOFTWARE | Run : [Skype] - "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
HKU\S-1-5-18\SOFTWARE | Run : [CTFMON.EXE] - C:\WINDOWS\system32\CTFMON.EXE

################## | Processus Stoppés |

Stoppé! C:\WINDOWS\system32\Ati2evxx.exe (1720)
Stoppé! C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe (1976)
Stoppé! C:\WINDOWS\system32\Ati2evxx.exe (376)
Stoppé! C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (1040)
Stoppé! C:\WINDOWS\Explorer.EXE (1084)
Stoppé! C:\Program Files\Alwil Software\Avast5\afwServ.exe (1260)
Stoppé! C:\WINDOWS\system32\spoolsv.exe (1992)
Stoppé! C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe (1116)
Stoppé! C:\Program Files\Microsoft\BingBar\7.1.391.0\BBSvc.exe (400)
Stoppé! C:\Program Files\Bonjour\mDNSResponder.exe (704)
Stoppé! C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (788)
Stoppé! C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe (2244)
Stoppé! C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe (2280)
Stoppé! C:\Program Files\Fichiers communs\Motive\McciCMService.exe (2392)
Stoppé! C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (2452)
Stoppé! C:\Program Files\CyberLink\Shared Files\RichVideo.exe (2564)
Stoppé! C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe (2612)
Stoppé! C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLIDSVC.EXE (2784)
Stoppé! C:\WINDOWS\system32\wuauclt.exe (760)
Stoppé! C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLIDSvcM.exe (740)
Stoppé! C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (1000)
Stoppé! C:\WINDOWS\RTHDCPL.EXE (1020)
Stoppé! C:\Acer\Empowering Technology\ePresentation\ePresentation.exe (1548)
Stoppé! C:\Acer\Empowering Technology\ePower\ePower_DMC.exe (1760)
Stoppé! C:\Acer\Empowering Technology\eRecovery\eRAgent.exe (2100)
Stoppé! C:\PROGRA~1\LAUNCH~1\LManager.exe (2316)
Stoppé! C:\Program Files\HP\HP Software Update\HPWuSchd2.exe (2468)
Stoppé! C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (2536)
Stoppé! C:\Program Files\Alwil Software\Avast5\avastUI.exe (2880)
Stoppé! C:\WINDOWS\system32\ctfmon.exe (3200)
Stoppé! C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe (3172)
Stoppé! C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (3308)
Stoppé! C:\Program Files\Skype\Phone\Skype.exe (3544)
Stoppé! C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe (2108)
Stoppé! C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (2224)
Stoppé! C:\Program Files\Logitech\SetPoint\SetPoint.exe (1016)
Stoppé! C:\Program Files\WinZip\WZQKPICK.EXE (3000)
Stoppé! C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (3096)
Stoppé! C:\Program Files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.EXE (988)
Stoppé! C:\DOCUME~1\Henry\LOCALS~1\Temp\RtkBtMnt.exe (4056)
Stoppé! C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe (2716)
Stoppé! C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe (5116)
Stoppé! C:\WINDOWS\system32\wbem\wmiapsrv.exe (5200)
Stoppé! C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe (5444)

################## | Éléments infectieux |

Supprimé! C:\DOCUME~1\Henry\LOCALS~1\Temp\RtkBtMnt.exe

(!) Fichiers temporaires supprimés.

################## | Registre |


################## | Mountpoints2 |


################## | Listing |

[23/09/2008 - 15:42:56 | D ] 	C:\Acer
[18/06/2013 - 22:46:08 | N | 1152] 	C:\AdwCleaner[R1].txt
[18/06/2013 - 18:30:07 | RASHD ] 	C:\Autorun.inf
[22/03/2008 - 21:42:46 | N | 715550] 	C:\bknowsetup.log
[24/09/2008 - 06:29:20 | D ] 	C:\BOOK
[23/09/2008 - 22:37:46 | N | 212] 	C:\boot.ini
[05/08/2004 - 06:00:00 | N | 4952] 	C:\Bootfont.bin
[06/09/2004 - 16:40:26 | N | 512] 	C:\BOOTSECT.DOS
[19/06/2013 - 19:41:25 | D ] 	C:\Config.Msi
[24/09/2008 - 06:22:55 | D ] 	C:\DOCS
[23/09/2008 - 22:39:21 | D ] 	C:\Documents and Settings
[24/09/2008 - 06:23:00 | D ] 	C:\DOTNETFX
[23/09/2008 - 16:56:20 | D ] 	C:\ELEMENTS
[15/06/2013 - 03:22:58 | N | 4968] 	C:\ffastun.ffa
[15/06/2013 - 03:22:58 | N | 884736] 	C:\ffastun.ffl
[15/06/2013 - 03:22:58 | N | 90112] 	C:\ffastun.ffo
[15/06/2013 - 03:22:58 | N | 2977792] 	C:\ffastun0.ffx
[19/06/2013 - 21:25:34 | ASH | 2145832960] 	C:\hiberfil.sys
[24/09/2008 - 06:23:31 | D ] 	C:\I386
[06/09/2004 - 17:00:24 | N | 0] 	C:\IO.SYS
[06/09/2004 - 17:00:24 | N | 0] 	C:\MSDOS.SYS
[16/04/2011 - 19:06:46 | RHD ] 	C:\MSOCache
[05/08/2004 - 06:00:00 | N | 47564] 	C:\NTDETECT.COM
[23/09/2008 - 16:37:26 | N | 252240] 	C:
tldr
[19/06/2013 - 21:25:32 | ASH | 2145386496] 	C:\pagefile.sys
[09/04/2008 - 22:09:28 | N | 6326] 	C:\Patch.rev
[26/04/2007 - 00:45:58 | N | 631] 	C:\PDVD.iss
[17/06/2013 - 21:35:22 | N | 512] 	C:\PhysicalDisk0_MBR.bin
[23/03/2008 - 09:05:28 | N | 73] 	C:\preload.aaa
[23/03/2008 - 09:05:28 | N | 73] 	C:\Preload.rev
[19/06/2013 - 19:22:22 | D ] 	C:\Program Files
[24/09/2008 - 08:24:38 | SHD ] 	C:\RECYCLER
[22/03/2008 - 21:42:04 | N | 595] 	C:\RHDSetup.log
[10/01/2011 - 09:59:59 | N | 368] 	C:kill.log
[22/03/2008 - 21:42:46 | N | 32] 	C:\setup.log
[24/09/2008 - 06:25:47 | D ] 	C:\SUPPORT
[24/09/2008 - 06:25:48 | D ] 	C:\sysinfo
[23/09/2008 - 22:37:49 | SHD ] 	C:\System Volume Information
[19/06/2013 - 21:36:42 | D ] 	C:\UsbFix
[18/06/2013 - 18:30:08 | N | 12505] 	C:\UsbFix [Clean 1] ACER-564DF136B7.txt
[19/06/2013 - 21:37:03 | A | 8512] 	C:\UsbFix [Clean 3] ACER-564DF136B7.txt
[19/06/2013 - 19:16:43 | N | 5893] 	C:\UsbFix [Listing 1 ] ACER-564DF136B7.txt
[24/09/2008 - 06:25:49 | D ] 	C:\VALUEADD
[19/06/2013 - 21:26:10 | D ] 	C:\WINDOWS
[23/09/2008 - 18:13:05 | D ] 	C:\winnt
[22/03/2008 - 21:17:44 | N | 4] 	C:\wps.dat
[17/06/2013 - 21:35:25 | D ] 	C:\ZHP
[19/06/2013 - 19:22:09 | D ] 	C:\_OTL
[15/06/2013 - 03:10:58 | N | 57344] 	D:\ffastun.ffl
[15/06/2013 - 03:10:58 | N | 139264] 	D:\ffastun0.ffx
[23/09/2008 - 22:40:00 | SHD ] 	D:\System Volume Information
[15/06/2013 - 03:10:58 | N | 61440] 	D:\ffastun.ffo
[15/06/2013 - 03:10:58 | N | 4379] 	D:\ffastun.ffa
[18/06/2013 - 18:30:08 | RASHD ] 	D:\Autorun.inf
[16/08/2009 - 03:04:00 | D ] 	D:\30b68b8111190fd97e
[24/09/2008 - 08:38:30 | D ] 	D:\Henry
[24/09/2008 - 09:34:50 | SHD ] 	D:\Recycled

################## | Vaccin |

C:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
D:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)

################## | E.O.F | https://www.sosvirus.net/ |

g3n-h@ckm@n · Answer

il semblerait que tu ne te décides pas à brancher tes supports externes....

Balboa99 · Answer

Le clé USB qui se trouvait peut-être en H ne sera plus utilisée sur ce PC, donc pas de problème

g3n-h@ckm@n · Answer

et tu n'as rien d'autre ? disque dur externe etc ????? à ce que j'ai cru comprendre si....

Balboa99 · Answer

Non rien d'autre

g3n-h@ckm@n · Answer

d'ac cite les soucis qu il te reste que je situe un peu

Balboa99 · Answer

Le PC fonctionne bien, plus de problème

L'anti-virus se charge

Je pensais lancer un scan complet de Malwarebytes

Qu'en penses-tu ? Faut-il un nouveau rapport de ZHPdiag ?

g3n-h@ckm@n · Answer

non c'est pas utile tu peux faire le menage

https://forums-fec.be/entraide/viewtopic.php?f=11&t=229 
 
¤¤¤¤¤¤¤¤¤¤_Pre_Scan_Concept_¤¤¤¤¤¤¤¤¤¤
Windows 8 => meme flop que Vista X 10

Balboa99 · Answer

Salut g3n-h@ckm@n

Un grand merci pour ton aide


Bonne soirée

g3n-h@ckm@n · Answer

le rapport de delfix ?

Balboa99 · Answer

Le voici

# DelFix v10.3 - Rapport créé le 20/06/2013 à 21:08:06
# Mis à jour le 08/06/2013 par Xplode
# Nom d'utilisateur : Henry - ACER-564DF136B7
# Système d'exploitation : Microsoft Windows XP Service Pack 3 (32 bits)

~ Suppression des outils de désinfection ...

Supprimé : C:\USBFix
Supprimé : C:\_OTL
Supprimé : C:\ZHP
Supprimé : C:\Program Files\ZHPDiag
Supprimé : C:\AdwCleaner[R1].txt
Supprimé : C:\PhysicalDisk0_MBR.bin
Supprimé : C:\rkill.log
Supprimé : C:\UsbFix [Clean 1] ACER-564DF136B7.txt
Supprimé : C:\UsbFix [Clean 3] ACER-564DF136B7.txt
Supprimé : C:\UsbFix [Listing 1 ] ACER-564DF136B7.txt
Supprimé : C:\Documents and Settings\Henry\Bureau\adwcleaner.exe
Supprimé : C:\Documents and Settings\Henry\Bureau\Extras.Txt
Supprimé : C:\Documents and Settings\Henry\Bureau\OTL.Txt
Supprimé : C:\Documents and Settings\Henry\Bureau\OTL.exe
Supprimé : C:\Documents and Settings\Henry\Bureau\TFC.exe
Supprimé : C:\Documents and Settings\Henry\Bureau\UsbFix [Clean 1] ACER-564DF136B7.txt
Supprimé : C:\Documents and Settings\Henry\Bureau\UsbFix [Clean 3] ACER-564DF136B7.txt
Supprimé : C:\Documents and Settings\Henry\Bureau\UsbFix.exe
Supprimé : C:\Documents and Settings\Henry\Bureau\ZHPDiag.txt
Supprimé : C:\Documents and Settings\Henry\Bureau\ZHPDiag2.exe
Supprimé : C:\Documents and Settings\All Users\Bureau\MBRCheck.lnk
Supprimé : C:\Documents and Settings\All Users\Bureau\ZHPDiag.lnk
Supprimé : C:\Documents and Settings\All Users\Bureau\ZHPFix.lnk
Supprimée : HKCU\Software\USBFix
Supprimée : HKLM\SOFTWARE\OldTimer Tools
Supprimée : HKLM\SOFTWARE\AdwCleaner
Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\USBFix
Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZHPDiag_is1

########## - EOF - ##########

D@Rocha · Answer

Bonjour,
J'ai le même problème que Balboa 99 semble-t-il, mon PC est super lent au démarrage en exécution (environ 20min pour pouvoir commencer quelque chose)... donc dès que le scan complet avec Malwarebytes sera terminé (s'il y arrive un jour car il semble qu'il faille au moins 7-8h) et que j'aurais fais le scan avec Usbfix, pourrais-je poster tout ça ici et demander votre aide ? :D

PC trés infecté

25 réponses

Newsletters