Rapport Usbfix
Bonjour,
Ma clé usb semble avoir été vérolée suite à l'utilisation des pc de la fac ... Je vous poste mon rapport d'Usbfix afin d'avoir votre avis ! Merci beaucoup !
############################## | UsbFix V 7.152 | [Recherche]
Utilisateur: Freja (Administrateur) # MARION
Mis à jour le 20/11/2013 par El Desaparecido - Team SosVirus
Lancé à 23:14:01 | 23/11/2013
Site Web : http://www.usbfix.net
Forum : http://www.sosvirus.net/
Upload Malware : http://www.sosvirus.net/upload_malware.php
Contact : http://www.usbfix.net/contact/
PC: ASUSTeK COMPUTER INC. (X202EP)
CPU: Intel(R) Pentium(R) CPU 987 @ 1.50GHz
RAM -> [Total : 3980 | Free : 980]
Bios: American Megatrends Inc.
Boot: Normal boot
OS: Microsoft Windows 8.1 (6.1.7600 64-Bit)
WB: Windows Internet Explorer : 11.0.9600.16438
WB: Google Chrome : 31.0.1650.57
SC: Security Center Service [Enabled]
WU: Windows Update Service [(!) Disabled]
AV: Windows Defender [(!) Disabled | Updated]
AS: Windows Defender : 4.3.9600.16384 (winblue_rtm.130821-1623)
FW: Windows FireWall Service [Enabled]
C:\ (%systemdrive%) -> Disque fixe # 186 Go (119 Go libre(s) - 64%) [OS] # NTFS
D:\ -> Disque fixe # 258 Go (224 Go libre(s) - 87%) [Data] # NTFS
E:\ -> Disque fixe # 931 Go (74 Go libre(s) - 8%) [FREECOM HDD] # FAT32
F:\ -> CD-ROM
G:\ -> Disque amovible # 7 Go (7 Go libre(s) - 100%) [] # FAT32
################## | Processus Actif |
C:\WINDOWS\system32\wininit.exe (ID: 496 |ParentID: 420)
C:\WINDOWS\system32\winlogon.exe (ID: 552 |ParentID: 488)
C:\WINDOWS\system32\lsass.exe (ID: 604 |ParentID: 496)
C:\WINDOWS\system32\svchost.exe (ID: 728 |ParentID: 596)
C:\WINDOWS\system32\svchost.exe (ID: 772 |ParentID: 596)
C:\WINDOWS\system32\dwm.exe (ID: 876 |ParentID: 552)
C:\WINDOWS\System32\svchost.exe (ID: 888 |ParentID: 596)
C:\WINDOWS\system32\svchost.exe (ID: 916 |ParentID: 596)
C:\WINDOWS\system32\svchost.exe (ID: 968 |ParentID: 596)
C:\WINDOWS\System32\svchost.exe (ID: 1016 |ParentID: 596)
C:\WINDOWS\system32\svchost.exe (ID: 672 |ParentID: 596)
C:\Windows\system32\FBAgent.exe (ID: 1036 |ParentID: 596)
C:\WINDOWS\System32\spoolsv.exe (ID: 1180 |ParentID: 596)
C:\WINDOWS\system32\svchost.exe (ID: 1248 |ParentID: 596)
C:\WINDOWS\system32\svchost.exe (ID: 1264 |ParentID: 596)
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (ID: 1372 |ParentID: 596)
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (ID: 1532 |ParentID: 596)
C:\WINDOWS\system32\dashost.exe (ID: 1604 |ParentID: 1016)
C:\Program Files (x86)\PANDORA.TV\PanService\PandoraService.exe (ID: 1640 |ParentID: 596)
C:\WINDOWS\system32\svchost.exe (ID: 1696 |ParentID: 596)
C:\Program Files (x86)\PANDORA.TV\PanService\PanProcess.exe (ID: 1192 |ParentID: 1640)
C:\Windows\System32\WUDFHost.exe (ID: 2692 |ParentID: 1016)
C:\WINDOWS\system32\wbem\wmiprvse.exe (ID: 2908 |ParentID: 728)
C:\WINDOWS\system32\taskhostex.exe (ID: 3016 |ParentID: 916)
C:\Windows\System32\InputMethod\JPN\JpnIME.exe (ID: 3172 |ParentID: 728)
C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20315_x64__8wekyb3d8bbwe\LiveComm.exe (ID: 3384 |ParentID: 728)
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe (ID: 3556 |ParentID: 1016)
C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe (ID: 3608 |ParentID: 3556)
C:\WINDOWS\system32\SearchIndexer.exe (ID: 3932 |ParentID: 596)
C:\Windows\System32\skydrive.exe (ID: 3132 |ParentID: 728)
C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe (ID: 3784 |ParentID: 596)
C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe (ID: 3828 |ParentID: 1416)
C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe (ID: 3816 |ParentID: 1416)
C:\Windows\System32\RuntimeBroker.exe (ID: 4032 |ParentID: 728)
C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe (ID: 4164 |ParentID: 728)
C:\Program Files (x86)\iTunes\iTunesHelper.exe (ID: 4276 |ParentID: 2892)
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (ID: 4300 |ParentID: 2892)
C:\Program Files\iPod\bin\iPodService.exe (ID: 4384 |ParentID: 596)
C:\Windows\System32\SettingSyncHost.exe (ID: 4620 |ParentID: 728)
C:\Program Files (x86)\ASUS\Splendid\ACMON.exe (ID: 5116 |ParentID: 1036)
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe (ID: 2888 |ParentID: 596)
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe (ID: 3488 |ParentID: 2888)
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe (ID: 2816 |ParentID: 3488)
C:\Windows\SysWOW64\ACEngSvr.exe (ID: 1352 |ParentID: 728)
C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnSrv.exe (ID: 3360 |ParentID: 596)
C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (ID: 236 |ParentID: 3272)
C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ID: 4660 |ParentID: 3280)
C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnWMI.exe (ID: 1124 |ParentID: 3360)
C:\Program Files (x86)\Bluetooth Suite\adminservice.exe (ID: 4860 |ParentID: 596)
C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe (ID: 4972 |ParentID: 596)
C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x64\QuickGesture64.exe (ID: 1708 |ParentID: 1036)
C:\Program Files\Intel\iCLS Client\HeciServer.exe (ID: 5052 |ParentID: 596)
C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x86\QuickGesture.exe (ID: 2220 |ParentID: 1036)
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe (ID: 2156 |ParentID: 596)
C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLoader.exe (ID: 2236 |ParentID: 1036)
C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPCenter.exe (ID: 2300 |ParentID: 2236)
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe (ID: 2380 |ParentID: 596)
C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPHelper.exe (ID: 820 |ParentID: 2300)
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (ID: 840 |ParentID: 596)
C:\Program Files (x86)\Bluetooth Suite\BtTray.exe (ID: 1968 |ParentID: 1036)
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (ID: 4392 |ParentID: 596)
C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe (ID: 4716 |ParentID: 1036)
C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe (ID: 4332 |ParentID: 1036)
C:\WINDOWS\system32\viakaraokesrv.exe (ID: 3684 |ParentID: 596)
C:\WINDOWS\system32\hkcmd.exe (ID: 3108 |ParentID: 1036)
C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe (ID: 316 |ParentID: 596)
C:\Program Files (x86)\VIA\VIAudioi\VDeck\viaaud.exe (ID: 3064 |ParentID: 1036)
C:\Program Files (x86)\Winamp\winampa.exe (ID: 4936 |ParentID: 1036)
C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe (ID: 2516 |ParentID: 3776)
C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin (ID: 4256 |ParentID: 2516)
C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe (ID: 4876 |ParentID: 916)
C:\Program Files\ASUS\P4G\BatteryLife.exe (ID: 1804 |ParentID: 916)
C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe (ID: 4596 |ParentID: 916)
C:\Program Files\WindowsApps\Microsoft.Reader_6.3.9600.16422_x64__8wekyb3d8bbwe\glcnd.exe (ID: 6068 |ParentID: 728)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 5748 |ParentID: 5316)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 2412 |ParentID: 5748)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 5004 |ParentID: 5748)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 5988 |ParentID: 5748)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 5396 |ParentID: 5748)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 2036 |ParentID: 5748)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 1500 |ParentID: 5748)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 996 |ParentID: 5748)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 3332 |ParentID: 5748)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 6588 |ParentID: 5748)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 6336 |ParentID: 5748)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 1108 |ParentID: 5748)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 3416 |ParentID: 5748)
C:\WINDOWS\system32\wwahost.exe (ID: 748 |ParentID: 728)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 812 |ParentID: 5748)
C:\WINDOWS\explorer.exe (ID: 5744 |ParentID: 552)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 3188 |ParentID: 5748)
C:\WINDOWS\system32\SearchProtocolHost.exe (ID: 1412 |ParentID: 3932)
C:\WINDOWS\system32\SearchFilterHost.exe (ID: 5096 |ParentID: 3932)
C:\UsbFix\Go.exe (ID: 5320 |ParentID: 7032)
\\?\C:\WINDOWS\system32\wbem\WMIADAP.EXE (ID: 6568 |ParentID: 916)
C:\Program Files\Windows Defender\MpCmdRun.exe (ID: 3000 |ParentID: 5824)
C:\WINDOWS\system32\wbem\wmiprvse.exe (ID: 3284 |ParentID: 728)
################## | Regedit Run |
04 - HKLM\SOFTWARE | Run : [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
04 - HKLM\SOFTWARE | Run : [APSDaemon] - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
04 - HKLM\SOFTWARE | Run : [iTunesHelper] - "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
04 - HKLM\SOFTWARE | Run : [SunJavaUpdateSched] - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
04 - HKLM\SOFTWARE | Run : [SwitchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
04 - HKLM\SOFTWARE | Run : [AdobeCS5ServiceManager] - "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
04 - HKLM\SOFTWARE\wow6432Node | Run : [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
04 - HKLM\SOFTWARE\wow6432Node | Run : [APSDaemon] - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
04 - HKLM\SOFTWARE\wow6432Node | Run : [iTunesHelper] - "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
04 - HKLM\SOFTWARE\wow6432Node | Run : [SunJavaUpdateSched] - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
04 - HKLM\SOFTWARE\wow6432Node | Run : [SwitchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
04 - HKLM\SOFTWARE\wow6432Node | Run : [AdobeCS5ServiceManager] - "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
04 - HKLM\SOFTWARE | RunOnce : [] -
04 - HKLM\SOFTWARE\wow6432Node | RunOnce : [] -
04 - HKU\S-1-5-21-335425271-1867195113-2800408935-1001\SOFTWARE | Run : [GM4IE] - C:\Facemoi\facemoi.exe
04 - HKU\S-1-5-21-335425271-1867195113-2800408935-1001\SOFTWARE | Run : [iCloudServices] - C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
04 - HKU\S-1-5-21-335425271-1867195113-2800408935-1001\SOFTWARE | Run : [ApplePhotoStreams] - C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
04 - HKU\S-1-5-21-335425271-1867195113-2800408935-1001\SOFTWARE | Run : [DAEMON Tools Lite] - "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
################## | Recherche générique |
Présent! C:\Users\Freja\AppData\Local\Temp\utt8A79.tmp.exe
Présent! E:\._autorun.inf
Présent! E:\autorun.inf
################## | Registre |
Présent! HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer|NoActiveDesktop -> 1
Présent! HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer|NoActiveDesktopChanges -> 1
################## | Vaccin |
(!) Cet ordinateur n'est pas vacciné!
################## | E.O.F | http://www.usbfix.net - http://www.sosvirus.net |
Ma clé usb semble avoir été vérolée suite à l'utilisation des pc de la fac ... Je vous poste mon rapport d'Usbfix afin d'avoir votre avis ! Merci beaucoup !
############################## | UsbFix V 7.152 | [Recherche]
Utilisateur: Freja (Administrateur) # MARION
Mis à jour le 20/11/2013 par El Desaparecido - Team SosVirus
Lancé à 23:14:01 | 23/11/2013
Site Web : http://www.usbfix.net
Forum : http://www.sosvirus.net/
Upload Malware : http://www.sosvirus.net/upload_malware.php
Contact : http://www.usbfix.net/contact/
PC: ASUSTeK COMPUTER INC. (X202EP)
CPU: Intel(R) Pentium(R) CPU 987 @ 1.50GHz
RAM -> [Total : 3980 | Free : 980]
Bios: American Megatrends Inc.
Boot: Normal boot
OS: Microsoft Windows 8.1 (6.1.7600 64-Bit)
WB: Windows Internet Explorer : 11.0.9600.16438
WB: Google Chrome : 31.0.1650.57
SC: Security Center Service [Enabled]
WU: Windows Update Service [(!) Disabled]
AV: Windows Defender [(!) Disabled | Updated]
AS: Windows Defender : 4.3.9600.16384 (winblue_rtm.130821-1623)
FW: Windows FireWall Service [Enabled]
C:\ (%systemdrive%) -> Disque fixe # 186 Go (119 Go libre(s) - 64%) [OS] # NTFS
D:\ -> Disque fixe # 258 Go (224 Go libre(s) - 87%) [Data] # NTFS
E:\ -> Disque fixe # 931 Go (74 Go libre(s) - 8%) [FREECOM HDD] # FAT32
F:\ -> CD-ROM
G:\ -> Disque amovible # 7 Go (7 Go libre(s) - 100%) [] # FAT32
################## | Processus Actif |
C:\WINDOWS\system32\wininit.exe (ID: 496 |ParentID: 420)
C:\WINDOWS\system32\winlogon.exe (ID: 552 |ParentID: 488)
C:\WINDOWS\system32\lsass.exe (ID: 604 |ParentID: 496)
C:\WINDOWS\system32\svchost.exe (ID: 728 |ParentID: 596)
C:\WINDOWS\system32\svchost.exe (ID: 772 |ParentID: 596)
C:\WINDOWS\system32\dwm.exe (ID: 876 |ParentID: 552)
C:\WINDOWS\System32\svchost.exe (ID: 888 |ParentID: 596)
C:\WINDOWS\system32\svchost.exe (ID: 916 |ParentID: 596)
C:\WINDOWS\system32\svchost.exe (ID: 968 |ParentID: 596)
C:\WINDOWS\System32\svchost.exe (ID: 1016 |ParentID: 596)
C:\WINDOWS\system32\svchost.exe (ID: 672 |ParentID: 596)
C:\Windows\system32\FBAgent.exe (ID: 1036 |ParentID: 596)
C:\WINDOWS\System32\spoolsv.exe (ID: 1180 |ParentID: 596)
C:\WINDOWS\system32\svchost.exe (ID: 1248 |ParentID: 596)
C:\WINDOWS\system32\svchost.exe (ID: 1264 |ParentID: 596)
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (ID: 1372 |ParentID: 596)
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (ID: 1532 |ParentID: 596)
C:\WINDOWS\system32\dashost.exe (ID: 1604 |ParentID: 1016)
C:\Program Files (x86)\PANDORA.TV\PanService\PandoraService.exe (ID: 1640 |ParentID: 596)
C:\WINDOWS\system32\svchost.exe (ID: 1696 |ParentID: 596)
C:\Program Files (x86)\PANDORA.TV\PanService\PanProcess.exe (ID: 1192 |ParentID: 1640)
C:\Windows\System32\WUDFHost.exe (ID: 2692 |ParentID: 1016)
C:\WINDOWS\system32\wbem\wmiprvse.exe (ID: 2908 |ParentID: 728)
C:\WINDOWS\system32\taskhostex.exe (ID: 3016 |ParentID: 916)
C:\Windows\System32\InputMethod\JPN\JpnIME.exe (ID: 3172 |ParentID: 728)
C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20315_x64__8wekyb3d8bbwe\LiveComm.exe (ID: 3384 |ParentID: 728)
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe (ID: 3556 |ParentID: 1016)
C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe (ID: 3608 |ParentID: 3556)
C:\WINDOWS\system32\SearchIndexer.exe (ID: 3932 |ParentID: 596)
C:\Windows\System32\skydrive.exe (ID: 3132 |ParentID: 728)
C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe (ID: 3784 |ParentID: 596)
C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe (ID: 3828 |ParentID: 1416)
C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe (ID: 3816 |ParentID: 1416)
C:\Windows\System32\RuntimeBroker.exe (ID: 4032 |ParentID: 728)
C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe (ID: 4164 |ParentID: 728)
C:\Program Files (x86)\iTunes\iTunesHelper.exe (ID: 4276 |ParentID: 2892)
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (ID: 4300 |ParentID: 2892)
C:\Program Files\iPod\bin\iPodService.exe (ID: 4384 |ParentID: 596)
C:\Windows\System32\SettingSyncHost.exe (ID: 4620 |ParentID: 728)
C:\Program Files (x86)\ASUS\Splendid\ACMON.exe (ID: 5116 |ParentID: 1036)
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe (ID: 2888 |ParentID: 596)
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe (ID: 3488 |ParentID: 2888)
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe (ID: 2816 |ParentID: 3488)
C:\Windows\SysWOW64\ACEngSvr.exe (ID: 1352 |ParentID: 728)
C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnSrv.exe (ID: 3360 |ParentID: 596)
C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (ID: 236 |ParentID: 3272)
C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ID: 4660 |ParentID: 3280)
C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnWMI.exe (ID: 1124 |ParentID: 3360)
C:\Program Files (x86)\Bluetooth Suite\adminservice.exe (ID: 4860 |ParentID: 596)
C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe (ID: 4972 |ParentID: 596)
C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x64\QuickGesture64.exe (ID: 1708 |ParentID: 1036)
C:\Program Files\Intel\iCLS Client\HeciServer.exe (ID: 5052 |ParentID: 596)
C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x86\QuickGesture.exe (ID: 2220 |ParentID: 1036)
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe (ID: 2156 |ParentID: 596)
C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLoader.exe (ID: 2236 |ParentID: 1036)
C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPCenter.exe (ID: 2300 |ParentID: 2236)
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe (ID: 2380 |ParentID: 596)
C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPHelper.exe (ID: 820 |ParentID: 2300)
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (ID: 840 |ParentID: 596)
C:\Program Files (x86)\Bluetooth Suite\BtTray.exe (ID: 1968 |ParentID: 1036)
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (ID: 4392 |ParentID: 596)
C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe (ID: 4716 |ParentID: 1036)
C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe (ID: 4332 |ParentID: 1036)
C:\WINDOWS\system32\viakaraokesrv.exe (ID: 3684 |ParentID: 596)
C:\WINDOWS\system32\hkcmd.exe (ID: 3108 |ParentID: 1036)
C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe (ID: 316 |ParentID: 596)
C:\Program Files (x86)\VIA\VIAudioi\VDeck\viaaud.exe (ID: 3064 |ParentID: 1036)
C:\Program Files (x86)\Winamp\winampa.exe (ID: 4936 |ParentID: 1036)
C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe (ID: 2516 |ParentID: 3776)
C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin (ID: 4256 |ParentID: 2516)
C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe (ID: 4876 |ParentID: 916)
C:\Program Files\ASUS\P4G\BatteryLife.exe (ID: 1804 |ParentID: 916)
C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe (ID: 4596 |ParentID: 916)
C:\Program Files\WindowsApps\Microsoft.Reader_6.3.9600.16422_x64__8wekyb3d8bbwe\glcnd.exe (ID: 6068 |ParentID: 728)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 5748 |ParentID: 5316)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 2412 |ParentID: 5748)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 5004 |ParentID: 5748)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 5988 |ParentID: 5748)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 5396 |ParentID: 5748)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 2036 |ParentID: 5748)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 1500 |ParentID: 5748)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 996 |ParentID: 5748)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 3332 |ParentID: 5748)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 6588 |ParentID: 5748)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 6336 |ParentID: 5748)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 1108 |ParentID: 5748)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 3416 |ParentID: 5748)
C:\WINDOWS\system32\wwahost.exe (ID: 748 |ParentID: 728)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 812 |ParentID: 5748)
C:\WINDOWS\explorer.exe (ID: 5744 |ParentID: 552)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 3188 |ParentID: 5748)
C:\WINDOWS\system32\SearchProtocolHost.exe (ID: 1412 |ParentID: 3932)
C:\WINDOWS\system32\SearchFilterHost.exe (ID: 5096 |ParentID: 3932)
C:\UsbFix\Go.exe (ID: 5320 |ParentID: 7032)
\\?\C:\WINDOWS\system32\wbem\WMIADAP.EXE (ID: 6568 |ParentID: 916)
C:\Program Files\Windows Defender\MpCmdRun.exe (ID: 3000 |ParentID: 5824)
C:\WINDOWS\system32\wbem\wmiprvse.exe (ID: 3284 |ParentID: 728)
################## | Regedit Run |
04 - HKLM\SOFTWARE | Run : [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
04 - HKLM\SOFTWARE | Run : [APSDaemon] - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
04 - HKLM\SOFTWARE | Run : [iTunesHelper] - "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
04 - HKLM\SOFTWARE | Run : [SunJavaUpdateSched] - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
04 - HKLM\SOFTWARE | Run : [SwitchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
04 - HKLM\SOFTWARE | Run : [AdobeCS5ServiceManager] - "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
04 - HKLM\SOFTWARE\wow6432Node | Run : [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
04 - HKLM\SOFTWARE\wow6432Node | Run : [APSDaemon] - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
04 - HKLM\SOFTWARE\wow6432Node | Run : [iTunesHelper] - "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
04 - HKLM\SOFTWARE\wow6432Node | Run : [SunJavaUpdateSched] - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
04 - HKLM\SOFTWARE\wow6432Node | Run : [SwitchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
04 - HKLM\SOFTWARE\wow6432Node | Run : [AdobeCS5ServiceManager] - "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
04 - HKLM\SOFTWARE | RunOnce : [] -
04 - HKLM\SOFTWARE\wow6432Node | RunOnce : [] -
04 - HKU\S-1-5-21-335425271-1867195113-2800408935-1001\SOFTWARE | Run : [GM4IE] - C:\Facemoi\facemoi.exe
04 - HKU\S-1-5-21-335425271-1867195113-2800408935-1001\SOFTWARE | Run : [iCloudServices] - C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
04 - HKU\S-1-5-21-335425271-1867195113-2800408935-1001\SOFTWARE | Run : [ApplePhotoStreams] - C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
04 - HKU\S-1-5-21-335425271-1867195113-2800408935-1001\SOFTWARE | Run : [DAEMON Tools Lite] - "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
################## | Recherche générique |
Présent! C:\Users\Freja\AppData\Local\Temp\utt8A79.tmp.exe
Présent! E:\._autorun.inf
Présent! E:\autorun.inf
################## | Registre |
Présent! HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer|NoActiveDesktop -> 1
Présent! HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer|NoActiveDesktopChanges -> 1
################## | Vaccin |
(!) Cet ordinateur n'est pas vacciné!
################## | E.O.F | http://www.usbfix.net - http://www.sosvirus.net |
3 réponses
-
Bonsoir
Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) susceptible d avoir été infectés sans les ouvrir
# Double clic sur UsbFix (pour les utilisateurs de windows Vista , windows 7 , windows 8) , clique droit => exécuter en tant qu'administrateur"
# Choisis Suppression
# Ton bureau disparaîtra et le pc redémarrera.
# Au redémarrage, UsbFix scannera ton pc, laisse travailler l outil.
# Ensuite post le rapport UsbFix.txt qui apparaîtra avec le bureau.
# Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque.( C:\UsbFix.txt )
( CTRL+A Pour tout sélectionner , CTRL+C pour copier et CTRL+V pour coller )
-
Voici mon rapport après suppression. Mais j'ai toujours des fichiers en raccourcit (qui se sont créé quand j'ai branché la clé, bien que j'ai désactivé le lancement automatique)
-
Bonjour
Je ne vois aucun rapport de suppression.
Et d'ailleurs dans ton rapport de recherche je ne vois aucun "raccourcis"
@+
