Virus Trojan.Win32.Llac.dohi et UDS:DangerousObject.Multi.Generi Résolu/Fermé

Question

Bonjour,

Mon Pc est infecté par ces deux virus.

Je cherche depuis quelques jours à m'en débarrasser, mais je ne trouve pas de solution.

Si quelqu'un peut m'aider, je lui en serait très reconnaissant.

Merci

Malekal_morte- · Answer

Salut,

N'insère aucun media amovibles USB (clef USB, disque dur, appareil photo etc).

Télécharge et installe Malwarebyte : https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
Mets le à jour, fais un scan rapide, supprime tout et copie/colle le rapport ici dans une nouvelle réponse. 
!!! Malwarebyte doit être à jour avant de faire le scan !!! 
Coche tout ce qui est détecté - puis bouton supprimer sélection pour tout supprimer. 

si Malwarebytes demande de redémarrer le PC, redémarre le avant de passer à l'étape suivante.
 
 
puis:


Faire un scan OTL pour diagnostiquer les programmes qui tournent et déceler des infections - Le programme va générer deux rapports OTL.txt et Extras.txt 
Fournir les deux rapports :

Tu peux suivre les indications de cette page pour t'aider : https://www.malekal.com/tutorial-otl/    

* Télécharge http://www.geekstogo.com/forum/files/file/398-otl-oldtimers-list-it/ sur ton bureau.    
(Sous Vista/Win7, il faut cliquer droit sur OTL et choisir Exécuter en tant qu'administrateur)    

Dans le cas d'Avast!, ne pas lancer le programme dans la Sandbox (voir lien d'aide ci-dessus).

* Lance OTL    
* En haut à droite de Analyse rapide, coche "tous les utilisateurs"
* Sur OTL, sous Personnalisation, copie-colle le script ci-dessous :    



netsvcs   
msconfig   
safebootminimal   
safebootnetwork   
activex   
drivers32   
%ALLUSERSPROFILE%\Application Data\*.   
%ALLUSERSPROFILE%\Application Data\*.exe /s   
%APPDATA%\*.   
%APPDATA%\*.exe /s   
%temp%\*.exe /s   
%SYSTEMDRIVE%\*.exe   
%systemroot%\*. /mp /s
%systemroot%\system32\consrv.dll
%systemroot%\system32\*.dll /lockedfiles   
%windir%\Tasks\*.job /lockedfiles   
%systemroot%\system32\drivers\*.sys /lockedfiles   
%systemroot%\System32\config\*.sav   
/md5start   
explorer.exe   
winlogon.exe
services.exe
wininit.exe
/md5stop
HKEY_CLASSES_ROOT\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InprocServer32 /s
HKEY_LOCAL_MACHINE\SYSTEM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters /s
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems /s
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls /s
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList /s
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor /s
HKEY_CURRENT_USER\Software\Microsoft\Command Processor /s
CREATERESTOREPOINT   
nslookup https://www.google.fr/?gws_rd=ssl /c   
SAVEMBR:0   
hklm\software\clients\startmenuinternet|command /rs   
hklm\software\clients\startmenuinternet|command /64 /rs



* Clique sur le bouton Analyse.

* Quand le scan est fini, utilise le site http://pjjoint.malekal.com/ pour envoyer le rapport OTL.txt (et Extra.txt si présent).
Donne le ou les liens pjjoint qui pointent vers ces rapports ici dans une réponse.
Je répète : donne le lien du rapport pjjoint ici en réponse.

NE PAS COPIER/COLLER LE RAPPORT ICI - DONNER LE LIEN PJJOINT DANS UN NOUVEAU MESSAGE


Like the angel you are, you laugh creating a lightness in my chest,
Your eyes they penetrate me,
(Your answer's always 'maybe')
That's when I got up and left

Martin · Answer

Le rapport de malewarebyte :

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Version de la base de données: v2013.10.15.02

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16721
Martin :: MARTIN-PC [administrateur]

16/10/2013 18:03:31
mbam-log-2013-10-16 (18-03-31).txt

Type d'examen: Examen complet (C:\|D:\|E:\|)
Options d'examen activées: Mémoire | Démarrage | Registre | Système de fichiers | Heuristique/Extra | Heuristique/Shuriken | PUP | PUM
Options d'examen désactivées: P2P
Elément(s) analysé(s): 357055
Temps écoulé: 1 heure(s), 19 minute(s), 47 seconde(s)

Processus mémoire détecté(s): 0
(Aucun élément nuisible détecté)

Module(s) mémoire détecté(s): 0
(Aucun élément nuisible détecté)

Clé(s) du Registre détectée(s): 0
(Aucun élément nuisible détecté)

Valeur(s) du Registre détectée(s): 0
(Aucun élément nuisible détecté)

Elément(s) de données du Registre détecté(s): 0
(Aucun élément nuisible détecté)

Dossier(s) détecté(s): 0
(Aucun élément nuisible détecté)

Fichier(s) détecté(s): 1
C:\AdwCleaner\Quarantine\C\Users\Martin\AppData\Local\Conduit\CT2851639\uTorrentBar_FRAutoUpdateHelper.exe.vir (PUP.Optional.Conduit.A) -> Mis en quarantaine et supprimé avec succès.

(fin)

Martin · Answer

Le rapport OTL :

http://pjjoint.malekal.com/files.php?id=OTL_20131017_14q8i10p12m15

Malekal_morte- · Answer

Relance OTL. 
o sous Personnalisation (Custom Scan), copie_colle le contenu du cadre ci dessous (bien prendre :OTL en début).
Clic Correction (Fix), un rapport apparraitra, copie/colle le contenu ici:  

:OTL
O4 - HKU\S-1-5-21-1885158233-155693705-4185950152-1000..\Run: [5Ea6NbvA] wscript.exe //B C:\Users\Martin\AppData\Local\Temp\5Ea6NbvA.vbs File not found  
O4 - HKU\S-1-5-21-1885158233-155693705-4185950152-1000..\Run: [bEWm2wMR] wscript.exe //B C:\Users\Martin\AppData\Local\Temp\bEWm2wMR.vbs File not found  
O4 - HKU\S-1-5-21-1885158233-155693705-4185950152-1000..\Run: [Intel(R)Management] C:\Users\Public\Intel(R)Management.exe (Intel Corporation) 
O4 - HKU\S-1-5-21-1885158233-155693705-4185950152-1000..\Run: [Intel(R)TCP] C:\Users\Public\Intel(R)TCP.exe (Intel Corporation) 
O4 - HKU\S-1-5-21-1885158233-155693705-4185950152-1000..\Run: [Intel(TM)12 Corporation] C:\Users\Martin\AppData\Local\Temp\Intel(TM)12.exe (Java (TM)) 
O4 - HKU\S-1-5-21-1885158233-155693705-4185950152-1000..\Run: [iTunesHelper] wscript.exe //B C:\Users\Martin\AppData\Local\Temp\iTunesHelper.vbe File not found  
O4 - Startup: C:\Users\Martin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5z.lnk = C:\Users\Public\Intel(TM)Management.exe (Intel Corporation) 
O4 - Startup: C:\Users\Martin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5zz.lnk = C:\Users\Public\Intel(TM)SD.exe (Intel Corporation) 
O4 - Startup: C:\Users\Martin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\i79VclD.lnk = C:\Users\Public\Intel(TM)GMA9.exe (Java (TM)) 
O4 - Startup: C:\Users\Martin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Intel(R)TCP.exe (Intel Corporation) 
O4 - Startup: C:\Users\Martin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iTunesHelper.vbe ()  
[2013/10/16 23:18:34 | 000,000,000 | ---D | C] -- C:\Users\Martin\AppData\Roaming\dclogs
[2013/10/12 23:03:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DOSBox-0.73 
[2013/10/12 23:03:13 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DOSBox-0.73 
[2013/10/12 19:35:01 | 093,787,592 | ---- | C] (Intel Corporation) -- C:\Users\Martin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Intel(R)TCP.exe 
[2013/10/12 17:17:47 | 000,000,000 | ---D | C] -- C:\Users\Martin\AppData\Roaming\Public 
:Commands
[emptytemp] 
[emptyflash] 
[resethosts]
[reboot]

* poste le rapport ici 


~~~

Zip le dossier C:\_OTL 
Ouvre Mon Ordinateur / Poste de travail => Disque C 
Tu dois voir le dossier _OTL, ouvre le.
Là tu dois voir un dossier MovedFiles - NE PAS OUVRIR.
Dessus, fais : Clic droit / Envoyer vers dossier compressé.
Cela va créer un fichier MovedFiles.zip
Envoie ce fichier MovedFiles.zip sur http://upload.malekal.com

Ne pas envoyer OTL.exe qui se trouve sur le bureau, bien ouvrir Mon Ordinateur / Poste de travail puis le disque C.

Martin · Answer

Le rapport OTL :

All processes killed
========== OTL ==========
Registry value HKEY_USERS\S-1-5-21-1885158233-155693705-4185950152-1000\Software\Microsoft\Windows\CurrentVersion\Run\5Ea6NbvA deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1885158233-155693705-4185950152-1000\Software\Microsoft\Windows\CurrentVersion\Run\bEWm2wMR deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1885158233-155693705-4185950152-1000\Software\Microsoft\Windows\CurrentVersion\Run\Intel(R)Management deleted successfully.
C:\Users\Public\Intel(R)Management.exe moved successfully.
Registry value HKEY_USERS\S-1-5-21-1885158233-155693705-4185950152-1000\Software\Microsoft\Windows\CurrentVersion\Run\Intel(R)TCP deleted successfully.
C:\Users\Public\Intel(R)TCP.exe moved successfully.
Registry value HKEY_USERS\S-1-5-21-1885158233-155693705-4185950152-1000\Software\Microsoft\Windows\CurrentVersion\Run\Intel(TM)12 Corporation deleted successfully.
C:\Users\Martin\AppData\Local\Temp\Intel(TM)12.exe moved successfully.
Registry value HKEY_USERS\S-1-5-21-1885158233-155693705-4185950152-1000\Software\Microsoft\Windows\CurrentVersion\Run\iTunesHelper deleted successfully.
C:\Users\Martin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5z.lnk moved successfully.
C:\Users\Public\Intel(TM)Management.exe moved successfully.
C:\Users\Martin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5zz.lnk moved successfully.
C:\Users\Public\Intel(TM)SD.exe moved successfully.
C:\Users\Martin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\i79VclD.lnk moved successfully.
C:\Users\Public\Intel(TM)GMA9.exe moved successfully.
C:\Users\Martin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Intel(R)TCP.exe moved successfully.
C:\Users\Martin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iTunesHelper.vbe moved successfully.
C:\Users\Martin\AppData\Roaming\dclogs folder moved successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DOSBox-0.73\Video folder moved successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DOSBox-0.73\Configuration folder moved successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DOSBox-0.73 folder moved successfully.
C:\Program Files (x86)\DOSBox-0.73\zmbv folder moved successfully.
C:\Program Files (x86)\DOSBox-0.73 folder moved successfully.
File C:\Users\Martin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Intel(R)TCP.exe not found.
C:\Users\Martin\AppData\Roaming\Public folder moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 57472 bytes
 
User: Martin
->Temp folder emptied: 77527747 bytes
->Temporary Internet Files folder emptied: 21175 bytes
->Java cache emptied: 86516 bytes
->FireFox cache emptied: 77220476 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 57983 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 75922 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 36091224 bytes
RecycleBin emptied: 7078 bytes
 
Total Files Cleaned = 182,00 mb
 
 
[EMPTYFLASH]
 
User: Default
->Flash cache emptied: 0 bytes
 
User: Martin
->Flash cache emptied: 0 bytes
 
User: Public
 
Total Flash Files Cleaned = 0,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.69.0 log created on 10172013_123734

Files\Folders moved on Reboot...
C:\Users\Martin\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\Martin\AppData\Local\Temp\iTunesHelper.vbe moved successfully.
C:\Users\Martin\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat moved successfully.
File move failed. C:\Windows	emp\_avast_\Webshlock.txt scheduled to be moved on reboot.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

Martin · Answer

Par contre, je ne parviens pas à envoyer le fichier Zip à l'adresse que vous m'avez indiqué...

Il y a chaque fois un souci au moment de l'envoi... je réessaierai plus tard.

Martin · Answer

Le rapport du diagnostic USBFix

############################## | UsbFix V 7.145 | [Recherche]

Utilisateur: Martin (Administrateur) # MARTIN-PC
Mis à jour le 17/10/2013 par El Desaparecido - Team SosVirus
Lancé à 11:46:45 | 18/10/2013

Site Web: http://www.usbfix.net/
Forum : http://www.sosvirus.net/
Upload Malware: http://www.sosvirus.net/upload_malware.php
Contact: http://www.usbfix.net/contact/

PC: ASUSTeK Computer Inc.         (K52JB)
CPU: Intel(R) Pentium(R) CPU        P6000  @ 1.87GHz
RAM -> [Total : 3948 | Free : 1735]
Bios: American Megatrends Inc.
Boot: Normal boot

OS: Microsoft Windows 7 Édition Familiale Premium  (6.1.7601 64-Bit) # Service Pack 1
WB: Windows Internet Explorer 10.0.9200.16721

SC: Security Center Service [Enabled]
WU: Windows Update Service [Enabled]
AV: avast! Antivirus [Enabled | Updated]
FW: Windows FireWall Service [Enabled]

C:\ (%systemdrive%) -> Disque fixe # 75 Go (4 Go libre(s) - 5%) [OS] # NTFS
D:\ -> Disque fixe # 204 Go (99 Go libre(s) - 49%) [DATA] # NTFS
E:\ -> CD-ROM
F:\ -> Disque amovible # 8 Go (7 Go libre(s) - 99%) [] # FAT32

################## | Processus Actif |

C:\Windows\system32\csrss.exe (ID 432 |ParentID 424)
C:\Windows\system32\csrss.exe (ID 492 |ParentID 484)
C:\Windows\system32\wininit.exe (ID 500 |ParentID 424)
C:\Windows\system32\winlogon.exe (ID 548 |ParentID 484)
C:\Windows\system32\services.exe (ID 596 |ParentID 500)
C:\Windows\system32\lsass.exe (ID 604 |ParentID 500)
C:\Windows\system32\lsm.exe (ID 612 |ParentID 500)
C:\Windows\system32\svchost.exe (ID 708 |ParentID 596)
C:\Windows\system32\svchost.exe (ID 804 |ParentID 596)
C:\Windows\system32\atiesrxx.exe (ID 880 |ParentID 596)
C:\Windows\System32\svchost.exe (ID 928 |ParentID 596)
C:\Windows\System32\svchost.exe (ID 960 |ParentID 596)
C:\Windows\system32\svchost.exe (ID 984 |ParentID 596)
C:\Windows\system32\svchost.exe (ID 1012 |ParentID 596)
C:\Windows\system32\svchost.exe (ID 1056 |ParentID 596)
C:\Windows\system32\atieclxx.exe (ID 1156 |ParentID 880)
C:\Windows\system32\FBAgent.exe (ID 1168 |ParentID 596)
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe (ID 1212 |ParentID 596)
C:\Program Files (x86)\ASUS\SmartLogon\smartlogon.exe (ID 1284 |ParentID 892)
C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe (ID 1484 |ParentID 596)
C:\Windows\system32\Dwm.exe (ID 1520 |ParentID 960)
C:\Program Files\AVAST Software\Avast\AvastSvc.exe (ID 1548 |ParentID 596)
C:\Windows\Explorer.EXE (ID 1560 |ParentID 1504)
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe (ID 1632 |ParentID 1212)
C:\Windows\AsScrPro.exe (ID 1788 |ParentID 1168)
C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe (ID 1844 |ParentID 1168)
C:\Windows\System32\spoolsv.exe (ID 1868 |ParentID 596)
C:\Windows\system32\svchost.exe (ID 1964 |ParentID 596)
C:\Windows\system32	askhost.exe (ID 2008 |ParentID 596)
C:\Program Files (x86)\Canal+\CANAL+ CANALSAT A LA DEMANDE\VOD\CanalPlus.VOD.exe (ID 1348 |ParentID 596)
C:\Program Files\Elantech\ETDCtrl.exe (ID 1440 |ParentID 1560)
C:\Program Files\PeerBlock\peerblock.exe (ID 1604 |ParentID 1560)
C:\Windows\system32	askeng.exe (ID 1220 |ParentID 1012)
C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe (ID 1048 |ParentID 1560)
C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe (ID 2068 |ParentID 1220)
C:\Program Files (x86)\ASUS\ASUS CopyProtect\aspg.exe (ID 2076 |ParentID 1220)
C:\Program Files (x86)\ASUS\Splendid\ACMON.exe (ID 2100 |ParentID 1220)
C:\Windows\System32\wscript.exe (ID 2108 |ParentID 1560)
C:\Program Files (x86)\ASUS\ControlDeck\ControlDeck.exe (ID 2120 |ParentID 1220)
C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe (ID 2140 |ParentID 1220)
C:\Program Files\P4G\BatteryLife.exe (ID 2156 |ParentID 1220)
C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe (ID 2164 |ParentID 1220)
C:\Program Files\Elantech\ETDCtrlHelper.exe (ID 2228 |ParentID 1440)
C:\Program Files\SRS Labs\SRS Premium Sound Control Panel\SRSPremiumPanel_64.exe (ID 2400 |ParentID 1560)
C:\Windows\SysWOW64\explorer.exe (ID 2464 |ParentID 2440)
C:\Windows\system32\svchost.exe (ID 2572 |ParentID 596)
C:\Windows\SysWOW64\svchost.exe (ID 2604 |ParentID 596)
C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe (ID 2624 |ParentID 596)
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (ID 2684 |ParentID 596)
C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe (ID 2872 |ParentID 596)
C:\Program Files (x86)\Boingo\Boingo Wi-Fi\Boingo Wi-Fi.exe (ID 2892 |ParentID 2216)
C:\Windows\System32\svchost.exe (ID 2960 |ParentID 596)
C:\Users\Martin\AppData\Roaming\Public\Intel(R)TCP.exe (ID 3056 |ParentID 2440)
C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (ID 3064 |ParentID 2216)
C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ID 3084 |ParentID 2216)
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe (ID 3100 |ParentID 2216)
C:\Program Files\AVAST Software\Avast\AvastUI.exe (ID 3108 |ParentID 2216)
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (ID 3180 |ParentID 2932)
C:\Windows\System32\svchost.exe (ID 3228 |ParentID 596)
C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe (ID 3356 |ParentID 2216)
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (ID 3364 |ParentID 2216)
C:\Windows\system32\svchost.exe (ID 3376 |ParentID 596)
C:\Windows\system32\svchost.exe (ID 3752 |ParentID 596)
C:\Windows\system32\wbem\wmiprvse.exe (ID 1652 |ParentID 708)
C:\Program Files\Windows Media Player\wmpnetwk.exe (ID 4164 |ParentID 596)
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe (ID 4732 |ParentID 1632)
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe (ID 4764 |ParentID 1632)
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe (ID 4780 |ParentID 1632)
C:\Windows\system32\wbem\wmiprvse.exe (ID 4920 |ParentID 708)
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (ID 4984 |ParentID 3180)
C:\Windows\system32\SearchIndexer.exe (ID 4996 |ParentID 596)
C:\Windows\SysWOW64\ACEngSvr.exe (ID 4632 |ParentID 708)
C:\Windows\System32\svchost.exe (ID 4716 |ParentID 596)
C:\Windows\system32\SearchProtocolHost.exe (ID 3676 |ParentID 4996)
C:\Windows\servicing\TrustedInstaller.exe (ID 4796 |ParentID 596)
C:\Program Files (x86)\Mozilla Firefox\firefox.exe (ID 4476 |ParentID 1560)
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (ID 5440 |ParentID 596)
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe (ID 4108 |ParentID 596)
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe (ID 1932 |ParentID 4476)
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe (ID 5156 |ParentID 1932)
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe (ID 5180 |ParentID 5156)
C:\UsbFix\Go.exe (ID 5488 |ParentID 716)
C:\Windows\System32\WUDFHost.exe (ID 6076 |ParentID 960)
C:\Windows\system32\SearchFilterHost.exe (ID 4452 |ParentID 4996)
\?\C:\Windows\system32\wbem\WMIADAP.EXE (ID 1780 |ParentID 1012)

################## | Regedit Run |

HKLM\SOFTWARE | Run : [UpdateLBPShortCut] - "C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.5"
HKLM\SOFTWARE | Run : [UpdateP2GoShortCut] - "C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"
HKLM\SOFTWARE | Run : [Boingo Wi-Fi] - "C:\Program Files (x86)\Boingo\Boingo Wi-Fi\Boingo.lnk"
HKLM\SOFTWARE | Run : [StartCCC] - "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
HKLM\SOFTWARE | Run : [ATKOSD2] - C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
HKLM\SOFTWARE | Run : [ATKMEDIA] - C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
HKLM\SOFTWARE | Run : [HControlUser] - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
HKLM\SOFTWARE | Run : [avast] - "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
HKLM\SOFTWARE | Run : [Adobe Reader Speed Launcher] - "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
HKLM\SOFTWARE | Run : [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
HKLM\SOFTWARE | Run : [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
HKLM\SOFTWARE | Run : [] - 
HKLM\SOFTWARE | Run : [SunJavaUpdateSched] - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
HKLM\SOFTWARE | Run : [Intel(R)TCP] - C:\Users\Martin\AppData\Roaming\Public\Intel(R)TCP.exe
HKLM\SOFTWARE\wow6432Node | Run : [UpdateLBPShortCut] - "C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.5"
HKLM\SOFTWARE\wow6432Node | Run : [UpdateP2GoShortCut] - "C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"
HKLM\SOFTWARE\wow6432Node | Run : [Boingo Wi-Fi] - "C:\Program Files (x86)\Boingo\Boingo Wi-Fi\Boingo.lnk"
HKLM\SOFTWARE\wow6432Node | Run : [StartCCC] - "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
HKLM\SOFTWARE\wow6432Node | Run : [ATKOSD2] - C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
HKLM\SOFTWARE\wow6432Node | Run : [ATKMEDIA] - C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
HKLM\SOFTWARE\wow6432Node | Run : [HControlUser] - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
HKLM\SOFTWARE\wow6432Node | Run : [avast] - "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
HKLM\SOFTWARE\wow6432Node | Run : [Adobe Reader Speed Launcher] - "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
HKLM\SOFTWARE\wow6432Node | Run : [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
HKLM\SOFTWARE\wow6432Node | Run : [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
HKLM\SOFTWARE\wow6432Node | Run : [] - 
HKLM\SOFTWARE\wow6432Node | Run : [SunJavaUpdateSched] - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
HKLM\SOFTWARE\wow6432Node | Run : [Intel(R)TCP] - C:\Users\Martin\AppData\Roaming\Public\Intel(R)TCP.exe
HKLM\SOFTWARE | RunOnce : [] - 
HKLM\SOFTWARE\wow6432Node | RunOnce : [] - 
HKLM\SOFTWARE | Policies\Explorerun : [Intel(R)LSM] - C:\Users\Martin\AppData\Roaming\Public\Intel(R)TCP.exe
HKU\S-1-5-19\SOFTWARE | Run : [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-20\SOFTWARE | Run : [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-21-1885158233-155693705-4185950152-1000\SOFTWARE | Run : [PeerBlock] - C:\Program Files\PeerBlock\peerblock.exe
HKU\S-1-5-21-1885158233-155693705-4185950152-1000\SOFTWARE | Run : [P7x1W1jG] - wscript.exe //B "C:\Users\Martin\AppData\Local\Temp\P7x1W1jG.vbs"
HKU\S-1-5-21-1885158233-155693705-4185950152-1000\SOFTWARE | Run : [rwGam3Dp] - wscript.exe //B "C:\Users\Martin\AppData\Local\TempwGam3Dp.vbs"
HKU\S-1-5-21-1885158233-155693705-4185950152-1000\SOFTWARE | Run : [KSS] - "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe" /autorun
HKU\S-1-5-21-1885158233-155693705-4185950152-1000\SOFTWARE | Run : [iTunesHelper] - wscript.exe //B "C:\Users\Martin\AppData\Local\Temp\iTunesHelper.vbe"
HKU\S-1-5-21-1885158233-155693705-4185950152-1000\SOFTWARE | Run : [Intel(R)TCP] - C:\Users\Martin\AppData\Roaming\Public\Intel(R)TCP.exe
HKU\S-1-5-19\SOFTWARE | RunOnce : [mctadmin] - C:\Windows\System32\mctadmin.exe
HKU\S-1-5-20\SOFTWARE | RunOnce : [mctadmin] - C:\Windows\System32\mctadmin.exe
HKU\S-1-5-21-1885158233-155693705-4185950152-1000\SOFTWARE | Policies\Explorerun : [Intel(R)LSM] - C:\Users\Martin\AppData\Roaming\Public\Intel(R)TCP.exe

################## | Éléments infectieux |

Présent! C:\Users\Martin\AppData\Local\Temp\iTunesHelper.vbe
Présent! C:\Users\Martin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Intel(R)TCP.exe
Présent! C:\Users\Martin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iTunesHelper.vbe
Présent! C:\Users\Martin\AppData\Roaming\5248E167\ak.tmp
Présent! C:\Users\Martin\AppData\Roaming\5248E167
Présent! C:\Users\Public\4z.VBE
Présent! C:\Users\Public\4zz.VBE
Présent! C:\Users\Public\7z.VBE
Présent! C:\Users\Public\7zz.VBE
Présent! C:\Users\Public\9eimmD.vbe
Présent! C:\Users\Public\9eizmmD.vbe
Présent! C:\Users\Public\9emmD.vbe
Présent! C:\Users\Public\9stemD.VBE
Présent! C:\Users\Public\9stiemD.VBE
Présent! C:\Users\Public\9stziemD.VBE
Présent! C:\Users\Public\sysfftem7.VBE
Présent! C:\Users\Public\systefm34.vbe
Présent! C:\Users\Public\D7_Loading.zip
Présent! C:\Users\Public\Intel(R)TCP.exe
Présent! C:\Users\Public\Intel(TM)SD.exe
Présent! C:\Users\Martin\AppData\Roaming\Martinv3.4.2.2.vbs
Présent! C:\Users\Martin\AppData\Roaming\Martin-wchelper.dll
Présent! C:\Users\Martin\AppData\Local\Temp\Martin7
Présent! C:\Users\Martin\AppData\Local\Temp\Martin8
Présent! C:\Users\Martin\AppData\Local\Temp\452CG4.hta
Présent! E:\autoplay.exe
Présent! E:\autorun.inf

################## | Registre |

Présent! HKU\S-1-5-21-1885158233-155693705-4185950152-1000\Software\Microsoft\Windows\CurrentVersion\Run|iTunesHelper
Présent! HKCU\Software\Microsoft\Windows\CurrentVersion\Run|iTunesHelper
Présent! HKU\S-1-5-21-1885158233-155693705-4185950152-1000\Software\Microsoft\Windows\CurrentVersion\Run|Intel(R)TCP
Présent! HKCU\Software\Microsoft\Windows\CurrentVersion\Run|Intel(R)TCP
Présent! HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run|Intel(R)TCP
Présent! HKLM\Software\Microsoft\Windows\CurrentVersion\Run|Intel(R)TCP
Présent! HKU\S-1-5-21-1885158233-155693705-4185950152-1000\Software\Microsoft\Windows\CurrentVersion\Run|iTunesHelper
Présent! HKCU\Software\Microsoft\Windows\CurrentVersion\Run|iTunesHelper
Présent! HKU\S-1-5-21-1885158233-155693705-4185950152-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run|Intel(R)LSM
Présent! HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run|Intel(R)LSM
Présent! HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run|Intel(R)LSM
Présent! HKU\S-1-5-21-1885158233-155693705-4185950152-1000\Software\Microsoft\Windows\CurrentVersion\Run|Intel(R)TCP
Présent! HKCU\Software\Microsoft\Windows\CurrentVersion\Run|Intel(R)TCP
Présent! HKLM\Software\Microsoft\Windows\CurrentVersion\Run|Intel(R)TCP
Présent! HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run|Intel(R)TCP
HKCU\.\.\.\.\Explorer\MountPoints2\{24591bb0-cefe-11e0-b1c6-806e6f6e6963}
Shell\AutoRun\Command = E:\autoplay.exe

HKCU\.\.\.\.\Explorer\MountPoints2\{c2c0c2bf-c484-11df-98aa-485b398b389e}
Shell\AutoRun\Command = F:\LaunchU3.exe -a



################## | Vaccin |

(!) Cet ordinateur n'est pas vacciné!

################## | E.O.F | http://www.usbfix.net - http://www.sosvirus.net |

Martin · Answer

Le rapport de nettoyage :

############################## | UsbFix V 7.145 | [Suppression]

Utilisateur: Martin (Administrateur) # MARTIN-PC
Mis à jour le 17/10/2013 par El Desaparecido - Team SosVirus
Lancé à 11:56:51 | 18/10/2013

Site Web: http://www.usbfix.net/
Forum : http://www.sosvirus.net/
Upload Malware: http://www.sosvirus.net/upload_malware.php
Contact: http://www.usbfix.net/contact/

PC: ASUSTeK Computer Inc.         (K52JB)
CPU: Intel(R) Pentium(R) CPU        P6000  @ 1.87GHz
RAM -> [Total : 3948 | Free : 1761]
Bios: American Megatrends Inc.
Boot: Normal boot

OS: Microsoft Windows 7 Édition Familiale Premium  (6.1.7601 64-Bit) # Service Pack 1
WB: Windows Internet Explorer 10.0.9200.16721

SC: Security Center Service [Enabled]
WU: Windows Update Service [Enabled]
AV: avast! Antivirus [Enabled | Updated]
FW: Windows FireWall Service [Enabled]

C:\ (%systemdrive%) -> Disque fixe # 75 Go (4 Go libre(s) - 5%) [OS] # NTFS
D:\ -> Disque fixe # 204 Go (99 Go libre(s) - 49%) [DATA] # NTFS
E:\ -> CD-ROM
F:\ -> Disque amovible # 8 Go (7 Go libre(s) - 99%) [] # FAT32

################## | Regedit Run |

HKLM\SOFTWARE | Run : [UpdateLBPShortCut] - "C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.5"
HKLM\SOFTWARE | Run : [UpdateP2GoShortCut] - "C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"
HKLM\SOFTWARE | Run : [Boingo Wi-Fi] - "C:\Program Files (x86)\Boingo\Boingo Wi-Fi\Boingo.lnk"
HKLM\SOFTWARE | Run : [StartCCC] - "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
HKLM\SOFTWARE | Run : [ATKOSD2] - C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
HKLM\SOFTWARE | Run : [ATKMEDIA] - C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
HKLM\SOFTWARE | Run : [HControlUser] - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
HKLM\SOFTWARE | Run : [avast] - "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
HKLM\SOFTWARE | Run : [Adobe Reader Speed Launcher] - "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
HKLM\SOFTWARE | Run : [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
HKLM\SOFTWARE | Run : [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
HKLM\SOFTWARE | Run : [] - 
HKLM\SOFTWARE | Run : [SunJavaUpdateSched] - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
HKLM\SOFTWARE | Run : [Intel(R)TCP] - C:\Users\Martin\AppData\Roaming\Public\Intel(R)TCP.exe
HKLM\SOFTWARE\wow6432Node | Run : [UpdateLBPShortCut] - "C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.5"
HKLM\SOFTWARE\wow6432Node | Run : [UpdateP2GoShortCut] - "C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"
HKLM\SOFTWARE\wow6432Node | Run : [Boingo Wi-Fi] - "C:\Program Files (x86)\Boingo\Boingo Wi-Fi\Boingo.lnk"
HKLM\SOFTWARE\wow6432Node | Run : [StartCCC] - "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
HKLM\SOFTWARE\wow6432Node | Run : [ATKOSD2] - C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
HKLM\SOFTWARE\wow6432Node | Run : [ATKMEDIA] - C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
HKLM\SOFTWARE\wow6432Node | Run : [HControlUser] - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
HKLM\SOFTWARE\wow6432Node | Run : [avast] - "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
HKLM\SOFTWARE\wow6432Node | Run : [Adobe Reader Speed Launcher] - "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
HKLM\SOFTWARE\wow6432Node | Run : [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
HKLM\SOFTWARE\wow6432Node | Run : [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
HKLM\SOFTWARE\wow6432Node | Run : [] - 
HKLM\SOFTWARE\wow6432Node | Run : [SunJavaUpdateSched] - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
HKLM\SOFTWARE\wow6432Node | Run : [Intel(R)TCP] - C:\Users\Martin\AppData\Roaming\Public\Intel(R)TCP.exe
HKLM\SOFTWARE | RunOnce : [] - 
HKLM\SOFTWARE\wow6432Node | RunOnce : [] - 
HKLM\SOFTWARE | Policies\Explorerun : [Intel(R)LSM] - C:\Users\Martin\AppData\Roaming\Public\Intel(R)TCP.exe
HKU\S-1-5-19\SOFTWARE | Run : [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-20\SOFTWARE | Run : [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-21-1885158233-155693705-4185950152-1000\SOFTWARE | Run : [PeerBlock] - C:\Program Files\PeerBlock\peerblock.exe
HKU\S-1-5-21-1885158233-155693705-4185950152-1000\SOFTWARE | Run : [P7x1W1jG] - wscript.exe //B "C:\Users\Martin\AppData\Local\Temp\P7x1W1jG.vbs"
HKU\S-1-5-21-1885158233-155693705-4185950152-1000\SOFTWARE | Run : [rwGam3Dp] - wscript.exe //B "C:\Users\Martin\AppData\Local\TempwGam3Dp.vbs"
HKU\S-1-5-21-1885158233-155693705-4185950152-1000\SOFTWARE | Run : [KSS] - "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe" /autorun
HKU\S-1-5-21-1885158233-155693705-4185950152-1000\SOFTWARE | Run : [iTunesHelper] - wscript.exe //B "C:\Users\Martin\AppData\Local\Temp\iTunesHelper.vbe"
HKU\S-1-5-21-1885158233-155693705-4185950152-1000\SOFTWARE | Run : [Intel(R)TCP] - C:\Users\Martin\AppData\Roaming\Public\Intel(R)TCP.exe
HKU\S-1-5-19\SOFTWARE | RunOnce : [mctadmin] - C:\Windows\System32\mctadmin.exe
HKU\S-1-5-20\SOFTWARE | RunOnce : [mctadmin] - C:\Windows\System32\mctadmin.exe
HKU\S-1-5-21-1885158233-155693705-4185950152-1000\SOFTWARE | Policies\Explorerun : [Intel(R)LSM] - C:\Users\Martin\AppData\Roaming\Public\Intel(R)TCP.exe

################## | Processus Stoppés |

Stoppé! C:\Windows\system32\atiesrxx.exe (ID 880 |ParentID 596)
Stoppé! C:\Windows\system32\atieclxx.exe (ID 1156 |ParentID 880)
Stoppé! C:\Windows\system32\FBAgent.exe (ID 1168 |ParentID 596)
Stoppé! C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe (ID 1212 |ParentID 596)
Stoppé! C:\Program Files (x86)\ASUS\SmartLogon\smartlogon.exe (ID 1284 |ParentID 892)
Stoppé! C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe (ID 1484 |ParentID 596)
Stoppé! C:\Program Files\AVAST Software\Avast\AvastSvc.exe (ID 1548 |ParentID 596)
Stoppé! C:\Windows\Explorer.EXE (ID 1560 |ParentID 1504)
Stoppé! C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe (ID 1632 |ParentID 1212)
Stoppé! C:\Windows\AsScrPro.exe (ID 1788 |ParentID 1168)
Stoppé! C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe (ID 1844 |ParentID 1168)
Stoppé! C:\Windows\System32\spoolsv.exe (ID 1868 |ParentID 596)
Stoppé! C:\Windows\system32	askhost.exe (ID 2008 |ParentID 596)
Stoppé! C:\Program Files (x86)\Canal+\CANAL+ CANALSAT A LA DEMANDE\VOD\CanalPlus.VOD.exe (ID 1348 |ParentID 596)
Stoppé! C:\Program Files\Elantech\ETDCtrl.exe (ID 1440 |ParentID 1560)
Stoppé! C:\Program Files\PeerBlock\peerblock.exe (ID 1604 |ParentID 1560)
Stoppé! C:\Windows\system32	askeng.exe (ID 1220 |ParentID 1012)
Stoppé! C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe (ID 1048 |ParentID 1560)
Stoppé! C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe (ID 2068 |ParentID 1220)
Stoppé! C:\Program Files (x86)\ASUS\ASUS CopyProtect\aspg.exe (ID 2076 |ParentID 1220)
Stoppé! C:\Program Files (x86)\ASUS\Splendid\ACMON.exe (ID 2100 |ParentID 1220)
Stoppé! C:\Windows\System32\wscript.exe (ID 2108 |ParentID 1560)
Stoppé! C:\Program Files (x86)\ASUS\ControlDeck\ControlDeck.exe (ID 2120 |ParentID 1220)
Stoppé! C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe (ID 2140 |ParentID 1220)
Stoppé! C:\Program Files\P4G\BatteryLife.exe (ID 2156 |ParentID 1220)
Stoppé! C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe (ID 2164 |ParentID 1220)
Stoppé! C:\Program Files\Elantech\ETDCtrlHelper.exe (ID 2228 |ParentID 1440)
Stoppé! C:\Program Files\SRS Labs\SRS Premium Sound Control Panel\SRSPremiumPanel_64.exe (ID 2400 |ParentID 1560)
Stoppé! C:\Windows\SysWOW64\explorer.exe (ID 2464 |ParentID 2440)
Stoppé! C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe (ID 2624 |ParentID 596)
Stoppé! C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (ID 2684 |ParentID 596)
Stoppé! C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe (ID 2872 |ParentID 596)
Stoppé! C:\Program Files (x86)\Boingo\Boingo Wi-Fi\Boingo Wi-Fi.exe (ID 2892 |ParentID 2216)
Stoppé! C:\Users\Martin\AppData\Roaming\Public\Intel(R)TCP.exe (ID 3056 |ParentID 2440)
Stoppé! C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (ID 3064 |ParentID 2216)
Stoppé! C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ID 3084 |ParentID 2216)
Stoppé! C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe (ID 3100 |ParentID 2216)
Stoppé! C:\Program Files\AVAST Software\Avast\AvastUI.exe (ID 3108 |ParentID 2216)
Stoppé! C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (ID 3180 |ParentID 2932)
Stoppé! C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe (ID 3356 |ParentID 2216)
Stoppé! C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (ID 3364 |ParentID 2216)
Stoppé! C:\Program Files\Windows Media Player\wmpnetwk.exe (ID 4164 |ParentID 596)
Stoppé! C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe (ID 4732 |ParentID 1632)
Stoppé! C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe (ID 4764 |ParentID 1632)
Stoppé! C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe (ID 4780 |ParentID 1632)
Stoppé! C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (ID 4984 |ParentID 3180)
Stoppé! C:\Windows\system32\SearchIndexer.exe (ID 4996 |ParentID 596)
Stoppé! C:\Windows\SysWOW64\ACEngSvr.exe (ID 4632 |ParentID 708)
Stoppé! C:\Program Files (x86)\Mozilla Firefox\firefox.exe (ID 4476 |ParentID 1560)
Stoppé! C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (ID 5440 |ParentID 596)
Stoppé! C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe (ID 4108 |ParentID 596)
Stoppé! C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe (ID 1932 |ParentID 4476)
Stoppé! C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe (ID 5156 |ParentID 1932)
Stoppé! C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe (ID 5180 |ParentID 5156)
Stoppé! C:\Windows\System32\WUDFHost.exe (ID 6076 |ParentID 960)
Stoppé! C:\Windows\system32\SearchProtocolHost.exe (ID 2616 |ParentID 4996)
Stoppé! C:\Windows\SysWOW64\NOTEPAD.EXE (ID 2740 |ParentID 5488)
Stoppé! C:\Windows\system32\SearchFilterHost.exe (ID 1900 |ParentID 4996)
Stoppé! C:\Windows\system32	askeng.exe (ID 5476 |ParentID 1012)

################## | Éléments infectieux |

Supprimé! F:\iTunesHelper.vbe
Supprimé! C:\Users\Martin\AppData\Local\Temp\iTunesHelper.vbe
Supprimé! C:\Users\Martin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Intel(R)TCP.exe
Supprimé! C:\Users\Martin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iTunesHelper.vbe
Supprimé! C:\Users\Martin\AppData\Roaming\5248E167\ak.tmp
Supprimé! C:\Users\Martin\AppData\Roaming\5248E167
Supprimé! C:\Users\Public\4z.VBE
Supprimé! C:\Users\Public\4zz.VBE
Supprimé! C:\Users\Public\7z.VBE
Supprimé! C:\Users\Public\7zz.VBE
Supprimé! C:\Users\Public\9eimmD.vbe
Supprimé! C:\Users\Public\9eizmmD.vbe
Supprimé! C:\Users\Public\9emmD.vbe
Supprimé! C:\Users\Public\9stemD.VBE
Supprimé! C:\Users\Public\9stiemD.VBE
Supprimé! C:\Users\Public\9stziemD.VBE
Supprimé! C:\Users\Public\sysfftem7.VBE
Supprimé! C:\Users\Public\systefm34.vbe
Supprimé! C:\Users\Public\D7_Loading.zip
Supprimé! C:\Users\Public\Intel(TM)SD.exe
Supprimé! C:\Users\Martin\AppData\Roaming\Martinv3.4.2.2.vbs
Supprimé! C:\Users\Martin\AppData\Roaming\Martin-wchelper.dll
Supprimé! C:\Users\Martin\AppData\Local\Temp\Martin7
Supprimé! C:\Users\Martin\AppData\Local\Temp\Martin8
Supprimé! C:\Users\Martin\AppData\Local\Temp\452CG4.hta
Non supprimé ! E:\autoplay.exe
Non supprimé ! E:\autorun.inf

(!) Fichiers temporaires supprimés.

################## | Registre |

Supprimé! HKU\S-1-5-21-1885158233-155693705-4185950152-1000\Software\Microsoft\Windows\CurrentVersion\Run|iTunesHelper
Supprimé! HKU\S-1-5-21-1885158233-155693705-4185950152-1000\Software\Microsoft\Windows\CurrentVersion\Run|Intel(R)TCP
Supprimé! HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run|Intel(R)TCP
Supprimé! HKU\S-1-5-21-1885158233-155693705-4185950152-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run|Intel(R)LSM
Supprimé! HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run|Intel(R)LSM
Supprimé! HKCU\.\.\.\.\Explorer\MountPoints2\{24591bb0-cefe-11e0-b1c6-806e6f6e6963}
Supprimé! HKCU\.\.\.\.\Explorer\MountPoints2\{c2c0c2bf-c484-11df-98aa-485b398b389e}

################## | Listing |

[22/07/2012 - 14:14:59 | SHD ] 	C:\$Recycle.Bin
[15/06/2009 - 13:11:59 | N | 54] 	C:\AdobeReader.log
[19/09/2013 - 09:35:37 | D ] 	C:\AdwCleaner
[07/09/2010 - 19:04:35 | D ] 	C:\ASUS.DAT
[31/05/2012 - 19:40:50 | SHD ] 	C:\Boot
[20/11/2010 - 14:40:07 | RASH | 383786] 	C:\bootmgr
[29/07/2009 - 08:03:37 | RASH | 8192] 	C:\BOOTSECT.BAK
[02/06/2011 - 22:39:08 | N | 3639808] 	C:\CANAL+ CANALSAT A LA DEMANDE.msi
[17/10/2013 - 07:50:53 | HD ] 	C:\Config.Msi
[05/06/2010 - 04:08:42 | N | 14228] 	C:\devlist.txt
[14/07/2009 - 07:08:56 | SHD ] 	C:\Documents and Settings
[05/06/2010 - 04:01:57 | D ] 	C:\eSupport
[05/06/2010 - 04:08:42 | N | 9] 	C:\Finish.log
[18/10/2013 - 11:34:20 | ASH | 3105116160] 	C:\hiberfil.sys
[05/06/2010 - 03:44:31 | D ] 	C:\Intel
[14/04/2010 - 08:02:19 | N | 2097152] 	C:\K52JB.BIN
[13/04/2010 - 03:47:07 | N | 2097152] 	C:\K52JK.BIN
[15/04/2010 - 15:10:50 | N | 19] 	C:\K52JK_K52JB_WIN7.20
[31/05/2012 - 20:26:13 | RHD ] 	C:\MSOCache
[18/10/2013 - 11:34:22 | ASH | 4140158976] 	C:\pagefile.sys
[04/06/2010 - 15:32:52 | N | 233] 	C:\Pass.txt
[14/07/2009 - 05:20:08 | D ] 	C:\PerfLogs
[16/10/2013 - 23:27:24 | N | 512] 	C:\PhysicalMBR.bin
[09/08/2013 - 00:22:58 | D ] 	C:\Program Files
[17/10/2013 - 12:37:48 | D ] 	C:\Program Files (x86)
[18/10/2013 - 11:24:20 | HD ] 	C:\ProgramData
[07/09/2010 - 18:52:21 | SHD ] 	C:\Recovery
[15/04/2010 - 15:10:50 | N | 14] 	C:\RECOVERY.DAT
[05/06/2010 - 04:01:54 | N | 90] 	C:\setup.log
[13/05/2006 - 18:22:24 | N | 5] 	C:\store.log
[05/06/2010 - 03:11:26 | N | 166] 	C:\SumHidd.txt
[05/06/2010 - 03:10:04 | N | 98] 	C:\SumOS.txt
[17/10/2013 - 20:09:47 | SHD ] 	C:\System Volume Information
[18/10/2013 - 11:59:04 | D ] 	C:\UsbFix
[18/10/2013 - 12:00:48 | A | 15127] 	C:\UsbFix [Clean 1] MARTIN-PC.txt
[18/10/2013 - 11:53:24 | N | 15374] 	C:\UsbFix [Scan 1] MARTIN-PC.txt
[12/07/2011 - 17:37:14 | RD ] 	C:\Users
[18/10/2013 - 11:34:35 | D ] 	C:\Windows
[17/10/2013 - 12:48:01 | D ] 	C:\_OTL
[02/01/2012 - 18:58:50 | SHDC ] 	D:\$RECYCLE.BIN
[28/09/2013 - 00:05:49 | DC ] 	D:\Actualisations PE
[02/05/2013 - 20:14:27 | DC ] 	D:\Disque Dur WE Digital
[02/05/2013 - 19:57:11 | C | 810] 	D:\Disque Dur WE Digital - Raccourci.lnk
[13/07/2012 - 12:51:17 | DC ] 	D:\Ecole d'éduc'
[16/04/2011 - 17:14:38 | DC ] 	D:\fe78c24f0dc0a284c75f918a951ddc
[13/09/2013 - 08:53:46 | DC ] 	D:\Music
[25/01/2013 - 00:21:15 | DC ] 	D:\Recherche d'emploi
[31/05/2012 - 19:01:56 | DC ] 	D:\Sauvegarde registre
[05/06/2010 - 03:11:25 | SHDC ] 	D:\System Volume Information
[17/10/2013 - 21:47:11 | DC ] 	D:\Téléchargements Torrents
[13/09/2013 - 08:53:46 | DC ] 	D:\Videos
[02/07/2005 - 12:56:47 | D ] 	E:\Acrobat Reader
[02/07/2005 - 12:56:47 | D ] 	E:\Manuel
[02/07/2005 - 12:57:07 | D ] 	E:\Patch
[23/05/2003 - 18:13:08 | R | 486868556] 	E:\Setup.mpq
[23/05/2003 - 17:31:58 | D ] 	E:\Support
[18/05/2003 - 18:16:11 | D ] 	E:\Trailers
[12/02/2003 - 10:01:48 | R | 21630] 	E:\appicon.ico
[20/05/2003 - 04:22:06 | R | 61440] 	E:\autoplay.exe
[12/02/2003 - 10:01:48 | R | 50] 	E:\autorun.inf
[01/07/2005 - 10:47:22 | D ] 	E:\directx
[20/05/2003 - 04:22:26 | R | 307200] 	E:\install.exe

################## | Vaccin |

C:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
D:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
F:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)

################## | E.O.F | http://www.usbfix.net - http://www.sosvirus.net |

Malekal_morte- · Answer

mouaip apparemment il est revenu et ta clef USB est infectée.
Fais suppression sur USBFix.

Avant de redémarrer, vas dans C:\Users\Martin\AppData\Roaming\Public\ et supprime le fichier Intel(R)TCP.exe
 
Like the angel you are, you laugh creating a lightness in my chest,
Your eyes they penetrate me,
(Your answer's always 'maybe')
That's when I got up and left

Martin · Answer

Le rapport après avoir fait la seconde suppression avec USBfix

############################## | UsbFix V 7.145 | [Suppression]

Utilisateur: Martin (Administrateur) # MARTIN-PC
Mis à jour le 17/10/2013 par El Desaparecido - Team SosVirus
Lancé à 15:32:57 | 18/10/2013

Site Web: http://www.usbfix.net/
Forum : http://www.sosvirus.net/
Upload Malware: http://www.sosvirus.net/upload_malware.php
Contact: http://www.usbfix.net/contact/

PC: ASUSTeK Computer Inc.         (K52JB)
CPU: Intel(R) Pentium(R) CPU        P6000  @ 1.87GHz
RAM -> [Total : 3948 | Free : 1927]
Bios: American Megatrends Inc.
Boot: Normal boot

OS: Microsoft Windows 7 Édition Familiale Premium  (6.1.7601 64-Bit) # Service Pack 1
WB: Windows Internet Explorer 10.0.9200.16721

SC: Security Center Service [Enabled]
WU: Windows Update Service [Enabled]
AV: avast! Antivirus [Enabled | Updated]
FW: Windows FireWall Service [Enabled]

C:\ (%systemdrive%) -> Disque fixe # 75 Go (3 Go libre(s) - 5%) [OS] # NTFS
D:\ -> Disque fixe # 204 Go (99 Go libre(s) - 49%) [DATA] # NTFS
E:\ -> CD-ROM
F:\ -> Disque amovible # 8 Go (8 Go libre(s) - 100%) [] # FAT32

################## | Regedit Run |

HKLM\SOFTWARE | Run : [UpdateLBPShortCut] - "C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.5"
HKLM\SOFTWARE | Run : [UpdateP2GoShortCut] - "C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"
HKLM\SOFTWARE | Run : [Boingo Wi-Fi] - "C:\Program Files (x86)\Boingo\Boingo Wi-Fi\Boingo.lnk"
HKLM\SOFTWARE | Run : [StartCCC] - "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
HKLM\SOFTWARE | Run : [ATKOSD2] - C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
HKLM\SOFTWARE | Run : [ATKMEDIA] - C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
HKLM\SOFTWARE | Run : [HControlUser] - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
HKLM\SOFTWARE | Run : [avast] - "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
HKLM\SOFTWARE | Run : [Adobe Reader Speed Launcher] - "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
HKLM\SOFTWARE | Run : [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
HKLM\SOFTWARE | Run : [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
HKLM\SOFTWARE | Run : [] - 
HKLM\SOFTWARE | Run : [SunJavaUpdateSched] - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
HKLM\SOFTWARE | Run : [Intel(R)TCP] - C:\Users\Martin\AppData\Roaming\Public\Intel(R)TCP.exe
HKLM\SOFTWARE\wow6432Node | Run : [UpdateLBPShortCut] - "C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.5"
HKLM\SOFTWARE\wow6432Node | Run : [UpdateP2GoShortCut] - "C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"
HKLM\SOFTWARE\wow6432Node | Run : [Boingo Wi-Fi] - "C:\Program Files (x86)\Boingo\Boingo Wi-Fi\Boingo.lnk"
HKLM\SOFTWARE\wow6432Node | Run : [StartCCC] - "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
HKLM\SOFTWARE\wow6432Node | Run : [ATKOSD2] - C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
HKLM\SOFTWARE\wow6432Node | Run : [ATKMEDIA] - C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
HKLM\SOFTWARE\wow6432Node | Run : [HControlUser] - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
HKLM\SOFTWARE\wow6432Node | Run : [avast] - "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
HKLM\SOFTWARE\wow6432Node | Run : [Adobe Reader Speed Launcher] - "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
HKLM\SOFTWARE\wow6432Node | Run : [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
HKLM\SOFTWARE\wow6432Node | Run : [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
HKLM\SOFTWARE\wow6432Node | Run : [] - 
HKLM\SOFTWARE\wow6432Node | Run : [SunJavaUpdateSched] - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
HKLM\SOFTWARE\wow6432Node | Run : [Intel(R)TCP] - C:\Users\Martin\AppData\Roaming\Public\Intel(R)TCP.exe
HKLM\SOFTWARE | RunOnce : [] - 
HKLM\SOFTWARE\wow6432Node | RunOnce : [] - 
HKLM\SOFTWARE | Policies\Explorer\run : [Intel(R)LSM] - C:\Users\Martin\AppData\Roaming\Public\Intel(R)TCP.exe
HKU\S-1-5-19\SOFTWARE | Run : [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-20\SOFTWARE | Run : [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-21-1885158233-155693705-4185950152-1000\SOFTWARE | Run : [PeerBlock] - C:\Program Files\PeerBlock\peerblock.exe
HKU\S-1-5-21-1885158233-155693705-4185950152-1000\SOFTWARE | Run : [P7x1W1jG] - wscript.exe //B "C:\Users\Martin\AppData\Local\Temp\P7x1W1jG.vbs"
HKU\S-1-5-21-1885158233-155693705-4185950152-1000\SOFTWARE | Run : [rwGam3Dp] - wscript.exe //B "C:\Users\Martin\AppData\Local\Temp\rwGam3Dp.vbs"
HKU\S-1-5-21-1885158233-155693705-4185950152-1000\SOFTWARE | Run : [KSS] - "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe" /autorun
HKU\S-1-5-21-1885158233-155693705-4185950152-1000\SOFTWARE | Run : [Intel(R)TCP] - C:\Users\Martin\AppData\Roaming\Public\Intel(R)TCP.exe
HKU\S-1-5-19\SOFTWARE | RunOnce : [mctadmin] - C:\Windows\System32\mctadmin.exe
HKU\S-1-5-20\SOFTWARE | RunOnce : [mctadmin] - C:\Windows\System32\mctadmin.exe
HKU\S-1-5-21-1885158233-155693705-4185950152-1000\SOFTWARE | Policies\Explorer\run : [Intel(R)LSM] - C:\Users\Martin\AppData\Roaming\Public\Intel(R)TCP.exe

################## | Processus Stoppés |

Stoppé! C:\Program Files\AVAST Software\Avast\AvastSvc.exe (ID 1548 |ParentID 596)
Stoppé! C:\Program Files\AVAST Software\Avast\AvastUI.exe (ID 3108 |ParentID 2216)
Stoppé! C:\Windows\explorer.exe (ID 3464 |ParentID 548)
Stoppé! C:\Windows\System32\rundll32.exe (ID 4344 |ParentID 708)
Stoppé! C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe (ID 5788 |ParentID 596)
Stoppé! C:\Windows\SysWOW64\explorer.exe (ID 1412 |ParentID 3992)
Stoppé! C:\Windows\system32\DllHost.exe (ID 1648 |ParentID 708)
Stoppé! C:\Users\Martin\AppData\Roaming\Public\Intel(R)TCP.exe (ID 2812 |ParentID 3992)
Stoppé! C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (ID 1868 |ParentID 596)
Stoppé! C:\Windows\system32\SearchIndexer.exe (ID 5408 |ParentID 596)
Stoppé! C:\Program Files\Windows Media Player\wmpnetwk.exe (ID 3096 |ParentID 596)
Stoppé! C:\Windows\System32\spoolsv.exe (ID 2984 |ParentID 596)
Stoppé! C:\Program Files (x86)\Mozilla Firefox\firefox.exe (ID 3592 |ParentID 3464)
Stoppé! C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe (ID 5808 |ParentID 596)
Stoppé! C:\Windows\System32\WUDFHost.exe (ID 5088 |ParentID 960)
Stoppé! C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe (ID 2848 |ParentID 3592)
Stoppé! C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe (ID 4132 |ParentID 2848)
Stoppé! C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe (ID 3116 |ParentID 4132)
Stoppé! C:\Program Files (x86)\HP\Digital Imaging\smart web printing\hpswp_clipbook.exe (ID 1716 |ParentID 708)
Stoppé! C:\Windows\system32\SearchProtocolHost.exe (ID 1776 |ParentID 5408)
Stoppé! C:\Windows\system32\SearchFilterHost.exe (ID 4604 |ParentID 5408)
Stoppé! C:\Windows\system32\SearchProtocolHost.exe (ID 5484 |ParentID 5408)

################## | Éléments infectieux |

Supprimé! C:\Users\Martin\AppData\Local\Temp\Martin7
Non supprimé ! E:\autoplay.exe
Non supprimé ! E:\autorun.inf

(!) Fichiers temporaires supprimés.

################## | Registre |

Supprimé! HKU\S-1-5-21-1885158233-155693705-4185950152-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run|Intel(R)LSM
Supprimé! HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run|Intel(R)LSM
Supprimé! HKU\S-1-5-21-1885158233-155693705-4185950152-1000\Software\Microsoft\Windows\CurrentVersion\Run|Intel(R)TCP
Supprimé! HKLM\Software\Microsoft\Windows\CurrentVersion\Run|Intel(R)TCP

################## | Listing |

[22/07/2012 - 14:14:59 | SHD ] 	C:\$Recycle.Bin
[15/06/2009 - 13:11:59 | N | 54] 	C:\AdobeReader.log
[19/09/2013 - 09:35:37 | D ] 	C:\AdwCleaner
[07/09/2010 - 19:04:35 | D ] 	C:\ASUS.DAT
[18/10/2013 - 12:00:48 | RASHD ] 	C:\Autorun.inf
[31/05/2012 - 19:40:50 | SHD ] 	C:\Boot
[20/11/2010 - 14:40:07 | RASH | 383786] 	C:\bootmgr
[29/07/2009 - 08:03:37 | RASH | 8192] 	C:\BOOTSECT.BAK
[02/06/2011 - 22:39:08 | N | 3639808] 	C:\CANAL+ CANALSAT A LA DEMANDE.msi
[17/10/2013 - 07:50:53 | HD ] 	C:\Config.Msi
[05/06/2010 - 04:08:42 | N | 14228] 	C:\devlist.txt
[14/07/2009 - 07:08:56 | SHD ] 	C:\Documents and Settings
[05/06/2010 - 04:01:57 | D ] 	C:\eSupport
[05/06/2010 - 04:08:42 | N | 9] 	C:\Finish.log
[18/10/2013 - 11:34:20 | ASH | 3105116160] 	C:\hiberfil.sys
[05/06/2010 - 03:44:31 | D ] 	C:\Intel
[14/04/2010 - 08:02:19 | N | 2097152] 	C:\K52JB.BIN
[13/04/2010 - 03:47:07 | N | 2097152] 	C:\K52JK.BIN
[15/04/2010 - 15:10:50 | N | 19] 	C:\K52JK_K52JB_WIN7.20
[31/05/2012 - 20:26:13 | RHD ] 	C:\MSOCache
[18/10/2013 - 11:34:22 | ASH | 4140158976] 	C:\pagefile.sys
[04/06/2010 - 15:32:52 | N | 233] 	C:\Pass.txt
[14/07/2009 - 05:20:08 | D ] 	C:\PerfLogs
[16/10/2013 - 23:27:24 | N | 512] 	C:\PhysicalMBR.bin
[09/08/2013 - 00:22:58 | D ] 	C:\Program Files
[17/10/2013 - 12:37:48 | D ] 	C:\Program Files (x86)
[18/10/2013 - 11:24:20 | HD ] 	C:\ProgramData
[07/09/2010 - 18:52:21 | SHD ] 	C:\Recovery
[15/04/2010 - 15:10:50 | N | 14] 	C:\RECOVERY.DAT
[05/06/2010 - 04:01:54 | N | 90] 	C:\setup.log
[13/05/2006 - 18:22:24 | N | 5] 	C:\store.log
[05/06/2010 - 03:11:26 | N | 166] 	C:\SumHidd.txt
[05/06/2010 - 03:10:04 | N | 98] 	C:\SumOS.txt
[17/10/2013 - 20:09:47 | SHD ] 	C:\System Volume Information
[18/10/2013 - 15:34:27 | D ] 	C:\UsbFix
[18/10/2013 - 12:01:01 | N | 16879] 	C:\UsbFix [Clean 1] MARTIN-PC.txt
[18/10/2013 - 15:36:36 | A | 10369] 	C:\UsbFix [Clean 2] MARTIN-PC.txt
[18/10/2013 - 11:53:24 | N | 15374] 	C:\UsbFix [Scan 1] MARTIN-PC.txt
[12/07/2011 - 17:37:14 | RD ] 	C:\Users
[18/10/2013 - 11:34:35 | D ] 	C:\Windows
[18/10/2013 - 15:15:01 | D ] 	C:\_OTL
[02/01/2012 - 18:58:50 | SHDC ] 	D:\$RECYCLE.BIN
[28/09/2013 - 00:05:49 | DC ] 	D:\Actualisations PE
[18/10/2013 - 12:00:48 | RASHDC ] 	D:\Autorun.inf
[02/05/2013 - 20:14:27 | DC ] 	D:\Disque Dur WE Digital
[02/05/2013 - 19:57:11 | C | 810] 	D:\Disque Dur WE Digital - Raccourci.lnk
[13/07/2012 - 12:51:17 | DC ] 	D:\Ecole d'éduc'
[16/04/2011 - 17:14:38 | DC ] 	D:\fe78c24f0dc0a284c75f918a951ddc
[13/09/2013 - 08:53:46 | DC ] 	D:\Music
[25/01/2013 - 00:21:15 | DC ] 	D:\Recherche d'emploi
[31/05/2012 - 19:01:56 | DC ] 	D:\Sauvegarde registre
[05/06/2010 - 03:11:25 | SHDC ] 	D:\System Volume Information
[17/10/2013 - 21:47:11 | DC ] 	D:\Téléchargements Torrents
[13/09/2013 - 08:53:46 | DC ] 	D:\Videos
[02/07/2005 - 12:56:47 | D ] 	E:\Acrobat Reader
[02/07/2005 - 12:56:47 | D ] 	E:\Manuel
[02/07/2005 - 12:57:07 | D ] 	E:\Patch
[23/05/2003 - 18:13:08 | R | 486868556] 	E:\Setup.mpq
[23/05/2003 - 17:31:58 | D ] 	E:\Support
[18/05/2003 - 18:16:11 | D ] 	E:\Trailers
[12/02/2003 - 10:01:48 | R | 21630] 	E:\appicon.ico
[20/05/2003 - 04:22:06 | R | 61440] 	E:\autoplay.exe
[12/02/2003 - 10:01:48 | R | 50] 	E:\autorun.inf
[01/07/2005 - 10:47:22 | D ] 	E:\directx
[20/05/2003 - 04:22:26 | R | 307200] 	E:\install.exe
[18/10/2013 - 12:00:50 | RASHD ] 	F:\Autorun.inf

################## | Vaccin |

C:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
D:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
F:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)

################## | E.O.F | http://www.usbfix.net - http://www.sosvirus.net |

Malekal_morte- · Answer

refais un scan OTL et donne le rapport pour voir.

Martin · Answer

C'est fait, voici le rapport :


http://pjjoint.malekal.com/files.php?id=20131018_k8h13h8b9t15

Malekal_morte- · Answer

ca a l'air qu'usbfix a fait le job.

Relance OTL. 
o sous Personnalisation (Custom Scan), copie_colle le contenu du cadre ci dessous (bien prendre :OTL en début).
Clic Correction (Fix), un rapport apparraitra, copie/colle le contenu ici:  

:OTL
O4:[b]64bit:[/b] - HKLM..\Run: [iTunesHelper] wscript.exe //B C:\Users\Martin\AppData\Local\Temp\iTunesHelper.vbe File not found  
O4 - HKU\S-1-5-21-1885158233-155693705-4185950152-1000..\Run: [P7x1W1jG] wscript.exe //B C:\Users\Martin\AppData\Local\Temp\P7x1W1jG.vbs File not found  
O4 - HKU\S-1-5-21-1885158233-155693705-4185950152-1000..\Run: [rwGam3Dp] wscript.exe //B C:\Users\Martin\AppData\Local\Temp\rwGam3Dp.vbs File not found  
:Commands
[emptytemp] 
[emptyflash] 
[resethosts]
[reboot]

* poste le rapport ici

Martin · Answer

Le rapport : 

All processes killed
========== OTL ==========
Registry value HKEY_USERS\S-1-5-21-1885158233-155693705-4185950152-1000\Software\Microsoft\Windows\CurrentVersion\Run\P7x1W1jG deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1885158233-155693705-4185950152-1000\Software\Microsoft\Windows\CurrentVersion\Run\rwGam3Dp deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Martin
->Temp folder emptied: 5539039 bytes
->Temporary Internet Files folder emptied: 2725109 bytes
->Java cache emptied: 1067 bytes
->FireFox cache emptied: 18735957 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 492 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 55952 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 128 bytes
RecycleBin emptied: 161223328 bytes
 
Total Files Cleaned = 180,00 mb
 
 
[EMPTYFLASH]
 
User: Default
->Flash cache emptied: 0 bytes
 
User: Martin
->Flash cache emptied: 0 bytes
 
User: Public
 
Total Flash Files Cleaned = 0,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

Martin · Answer

J'ai refait un scan Avast. Il m'indique que j'ai un "win32:inject-AZC [trj]"

Malekal_morte- · Answer

dans quel fichier ?

Martin · Answer

Dans beaucoup de fichiers... :

Des fichiers présentant ces 2 différentes formes :

C:\Users\Public	rz(quatre chiffres ou lettres en majuscule).tmp


C:\_OTL\MovedFiles\10172013_123734\C_Users\Martin\RppData\Roaming\Public	rz(quatre chiffres ou lettres en majuscule).tmp


De plus plusieurs fichiers sont indiqués :

Erreur : L'archive est protégé par mot de passe. (42056)

Il s'agit de fichiers commençant ainsi :

C:\Users\Martin\Downloads\install_flashplayer\11x32au_mssd_aaa_aih.exe|>(suivit de quelques autres éléments)

Malekal_morte- · Answer

mouais  pour les fichiers tmp :)

le second est dans la quarantaine OTL.

USBfix détecte plus rien ?

Martin · Answer

Le rapport UsBfix

http://pjjoint.malekal.com/files.php?id=20131020_h9h8h10i13x9

Malekal_morte- · Answer

Pour moi, c'est bon :)

Martin · Answer

Oui, en tout cas, mon PC a complètement arrêté de couiner. Merci beaucoup en tout cas pour l'aide.

Martin

Virus Trojan.Win32.Llac.dohi et UDS:DangerousObject.Multi.Generi

21 réponses

Discussions similaires