Virus qui transforme les fichiers en raccourci Fermé

Question

Bonjour, 

Après avoir utilisé ma clé USB sur un ordinateur extérieur, mon PC et la clé ont été infecté par un virus qui transforme les fichiers en raccourci. 
Que dois-je faire?

Merci d'avance

2011N2 · Answer

Bonsoir,

Passe UsbFix en Recherche et poste le rapport : http://www.forum-entraide-informatique.com/support/usbfix-tutoriel-t34.html

Gabriel.

clo0104 · Answer

Merci pour cette réponse rapide ! 

Voilà le rapport: 

############################## | UsbFix V 7.152 | [Recherche]

Utilisateur: Utilisateur (Administrateur) # UTILISATEUR-PC
Mis à jour le 20/11/2013 par El Desaparecido - Team SosVirus
Lancé à 19:36:22 | 01/12/2013

Site Web : https://www.usbfix.net/
Forum : https://www.sosvirus.net/
Upload Malware : http://www.sosvirus.net/upload_malware.php
Contact : https://www.usb-antivirus.com/fr/contact/

PC: Packard Bell (EN Butterfly m)
CPU: Genuine Intel(R) CPU           U7300  @ 1.30GHz
RAM -> [Total : 3999 | Free : 1262]
Bios: Packard Bell
Boot: Normal boot

OS: Microsoft Windows 7 Édition Familiale Premium  (6.1.7600 64-Bit) 
WB: Windows Internet Explorer : 9.0.8112.16421
WB: Google Chrome : 31.0.1650.57

SC: Security Center Service [Enabled]
WU: Windows Update Service [Enabled]
AV: avast! Antivirus [Enabled | Updated]
AS: Windows Defender : 6.1.7600.16385 (win7_rtm.090713-1255)
FW: Windows FireWall Service [Enabled]

A:\ -> Disque amovible # 1 Mo (0 Mo libre(s) - 11%) [] # FAT
C:\ (%systemdrive%) -> Disque fixe # 286 Go (42 Go libre(s) - 15%) [Packard Bell] # NTFS
D:\ -> CD-ROM
F:\ -> Disque amovible # 2 Go (2 Go libre(s) - 82%) [] # FAT

################## | Processus Actif |

C:\Windows\system32\csrss.exe (ID: 456 |ParentID: 448)
C:\Windows\system32\csrss.exe (ID: 540 |ParentID: 532)
C:\Windows\system32\wininit.exe (ID: 548 |ParentID: 448)
C:\Windows\system32\winlogon.exe (ID: 604 |ParentID: 532)
C:\Windows\system32\services.exe (ID: 644 |ParentID: 548)
C:\Windows\system32\lsass.exe (ID: 652 |ParentID: 548)
C:\Windows\system32\lsm.exe (ID: 664 |ParentID: 548)
C:\Windows\system32\svchost.exe (ID: 760 |ParentID: 644)
C:\Windows\system32\svchost.exe (ID: 840 |ParentID: 644)
C:\Windows\system32\atiesrxx.exe (ID: 924 |ParentID: 644)
C:\Windows\System32\svchost.exe (ID: 976 |ParentID: 644)
C:\Windows\System32\svchost.exe (ID: 1008 |ParentID: 644)
C:\Windows\system32\svchost.exe (ID: 232 |ParentID: 644)
C:\Windows\system32\svchost.exe (ID: 656 |ParentID: 644)
C:\Windows\system32\svchost.exe (ID: 1068 |ParentID: 644)
C:\Program Files\AVAST Software\Avast\AvastSvc.exe (ID: 1260 |ParentID: 644)
C:\Windows\system32\atieclxx.exe (ID: 1268 |ParentID: 924)
C:\Windows\system32\Dwm.exe (ID: 1528 |ParentID: 1008)
C:\Windows\Explorer.EXE (ID: 1540 |ParentID: 1520)
C:\Windows\System32\spoolsv.exe (ID: 1676 |ParentID: 644)
C:\Windows\system32\svchost.exe (ID: 1736 |ParentID: 644)
C:\Windows\system32\taskhost.exe (ID: 1808 |ParentID: 644)
c:\Program Files (x86)\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe (ID: 1908 |ParentID: 644)
C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe (ID: 1952 |ParentID: 1540)
C:\Windows\System32\igfxpers.exe (ID: 2036 |ParentID: 1540)
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (ID: 2044 |ParentID: 644)
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (ID: 1032 |ParentID: 1540)
C:\Windows\system32\igfxsrvc.exe (ID: 1200 |ParentID: 760)
C:\Program Files\Packard Bell\Optical Drive Power Management\ODDPWR.exe (ID: 1164 |ParentID: 1540)
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (ID: 1348 |ParentID: 1540)
C:\Program Files\Windows Sidebar\sidebar.exe (ID: 1776 |ParentID: 1540)
C:\Program Files\Bonjour\mDNSResponder.exe (ID: 2112 |ParentID: 644)
C:\Program Files (x86)\Launch Manager\dsiwmis.exe (ID: 2164 |ParentID: 644)
C:\Program Files\Packard Bell\Packard Bell PowerSave Solution\ePowerSvc.exe (ID: 2188 |ParentID: 644)
C:\Program Files (x86)\Packard Bell\Registration\GregHSRW.exe (ID: 2284 |ParentID: 644)
C:\Windows\System32\StikyNot.exe (ID: 2312 |ParentID: 1540)
C:\Program Files (x86)\Skype\Phone\Skype.exe (ID: 2344 |ParentID: 1540)
C:\Users\Utilisateur\AppData\Local\Box\Box Edit\Box Edit.exe (ID: 2420 |ParentID: 1540)
C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\IScheduleSvc.exe (ID: 2432 |ParentID: 644)
C:\Windows\System32\wscript.exe (ID: 2448 |ParentID: 1540)
C:\Users\Utilisateur\AppData\Roaming\Dropbox\bin\Dropbox.exe (ID: 2516 |ParentID: 1540)
C:\Program Files (x86)\Microsoft Works\WkCalRem.exe (ID: 2576 |ParentID: 1540)
C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe (ID: 2600 |ParentID: 2564)
C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin (ID: 2612 |ParentID: 2600)
C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\BackupManagerTray.exe (ID: 2720 |ParentID: 2472)
C:\Program Files (x86)\VideoWebCamera\VideoWebCamera.exe (ID: 2804 |ParentID: 2472)
C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe (ID: 2820 |ParentID: 2472)
C:\Program Files\AVAST Software\Avast\AvastUI.exe (ID: 2200 |ParentID: 1540)
C:\Program Files\Packard Bell\Optical Drive Power Management\ODDPWRSvc.exe (ID: 1456 |ParentID: 644)
C:\Program Files (x86)\PDF Architect\HelperService.exe (ID: 3036 |ParentID: 644)
C:\Program Files (x86)\PDF Architect\ConversionService.exe (ID: 2204 |ParentID: 644)
C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe (ID: 2992 |ParentID: 644)
C:\Program Files\Packard Bell\Packard Bell PowerSave Solution\ePowerTray.exe (ID: 3152 |ParentID: 1100)
C:\Windows\system32\svchost.exe (ID: 3164 |ParentID: 644)
C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe (ID: 3196 |ParentID: 644)
C:\Program Files (x86)\Wajam\Updater\WajamUpdater.exe (ID: 3248 |ParentID: 644)
C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe (ID: 3372 |ParentID: 644)
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (ID: 3512 |ParentID: 2712)
C:\Windows\system32\SearchIndexer.exe (ID: 3840 |ParentID: 644)
C:\Windows\system32\svchost.exe (ID: 3952 |ParentID: 644)
C:\Program Files (x86)\Searchqu Toolbar\Datamngr\datamngrUI.exe (ID: 1376 |ParentID: 2472)
C:\Program Files (x86)\Iminent\Iminent.exe (ID: 1400 |ParentID: 2472)
C:\Program Files (x86)\Iminent\Iminent.Messengers.exe (ID: 3584 |ParentID: 2472)
C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe (ID: 3768 |ParentID: 2472)
C:\Program Files (x86)\iTunes\iTunesHelper.exe (ID: 3828 |ParentID: 2472)
C:\Program Files (x86)\Boxore\BoxoreClient\boxore.exe (ID: 1344 |ParentID: 2472)
C:\Program Files (x86)\Boxore\BoxoreClient\boxore.exe (ID: 972 |ParentID: 1344)
C:\Program Files\iPod\bin\iPodService.exe (ID: 4348 |ParentID: 644)
C:\Windows\system32\wbem\unsecapp.exe (ID: 2416 |ParentID: 760)
C:\Windows\system32\wbem\wmiprvse.exe (ID: 1084 |ParentID: 760)
C:\Windows\system32\wbem\wmiprvse.exe (ID: 3208 |ParentID: 760)
C:\Windows\system32\igfxext.exe (ID: 1184 |ParentID: 760)
C:\Program Files\Packard Bell\Packard Bell PowerSave Solution\ePowerEvent.exe (ID: 3476 |ParentID: 2188)
C:\Windows\System32\svchost.exe (ID: 4436 |ParentID: 644)
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (ID: 3224 |ParentID: 3512)
C:\Program Files\Windows Media Player\wmpnetwk.exe (ID: 2492 |ParentID: 644)
C:\Windows\system32\wuauclt.exe (ID: 4844 |ParentID: 232)
C:\Windows\system32\igfxtray.exe (ID: 4928 |ParentID: 2036)
C:\Windows\system32\hkcmd.exe (ID: 3472 |ParentID: 2036)
C:\Windows\system32\taskeng.exe (ID: 2444 |ParentID: 232)
C:\Program Files (x86)\Software\Update\SoftwareUpdate.exe (ID: 3108 |ParentID: 2444)
C:\Program Files (x86)\Internet Explorer\IELowutil.exe (ID: 4976 |ParentID: 3444)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 4212 |ParentID: 1540)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 4060 |ParentID: 4212)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 4932 |ParentID: 4212)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 5516 |ParentID: 4212)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 5764 |ParentID: 4212)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 4404 |ParentID: 4212)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 5532 |ParentID: 4212)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 5808 |ParentID: 4212)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 4548 |ParentID: 4212)
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (ID: 5332 |ParentID: 1032)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 2840 |ParentID: 4212)
C:\Windows\system32\SearchProtocolHost.exe (ID: 5624 |ParentID: 3840)
C:\Windows\system32\SearchFilterHost.exe (ID: 5116 |ParentID: 3840)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 5668 |ParentID: 4212)
C:\Windows\System32\WUDFHost.exe (ID: 6096 |ParentID: 1008)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 4880 |ParentID: 4212)
\?\C:\Windows\system32\wbem\WMIADAP.EXE (ID: 4960 |ParentID: 232)
C:\UsbFix\Go.exe (ID: 2144 |ParentID: 1588)

################## | Regedit Run |

04 - HKLM\SOFTWARE | Run : [StartCCC] - "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
04 - HKLM\SOFTWARE | Run : [BackupManagerTray] - "C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\BackupManagerTray.exe" -h -k
04 - HKLM\SOFTWARE | Run : [Adobe Reader Speed Launcher] - "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
04 - HKLM\SOFTWARE | Run : [NortonOnlineBackupReminder] - "C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe" UNATTENDED
04 - HKLM\SOFTWARE | Run : [VideoWebCamera] - "C:\Program Files (x86)\VideoWebCamera\VideoWebCamera.exe" -a
04 - HKLM\SOFTWARE | Run : [RemoteControl8] - "C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe"
04 - HKLM\SOFTWARE | Run : [PDVD8LanguageShortcut] - "C:\Program Files (x86)\CyberLink\PowerDVD8\Language\Language.exe"
04 - HKLM\SOFTWARE | Run : [LManager] - C:\Program Files (x86)\Launch Manager\LManager.exe
04 - HKLM\SOFTWARE | Run : [APSDaemon] - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
04 - HKLM\SOFTWARE | Run : [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
04 - HKLM\SOFTWARE | Run : [DATAMNGR] - C:\PROGRA~2\SEARCH~1\Datamngr\DATAMN~1.EXE
04 - HKLM\SOFTWARE | Run : [Iminent] - C:\Program Files (x86)\Iminent\Iminent.exe /warmup "F77F87E5-A6BD-4922-A530-EDF63D7E9F8C"
04 - HKLM\SOFTWARE | Run : [IminentMessenger] - C:\Program Files (x86)\Iminent\Iminent.Messengers.exe /startup
04 - HKLM\SOFTWARE | Run : [TkBellExe] - "c:\program files (x86)\real\realplayer\Update\realsched.exe" -osboot
04 - HKLM\SOFTWARE | Run : [iTunesHelper] - "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
04 - HKLM\SOFTWARE | Run : [GrooveMonitor] - "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
04 - HKLM\SOFTWARE | Run : [Boxore Client] - C:\Program Files (x86)\Boxore\BoxoreClient\boxore.exe
04 - HKLM\SOFTWARE | Run : [AvastUI.exe] - "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
04 - HKLM\SOFTWARE\wow6432Node | Run : [StartCCC] - "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
04 - HKLM\SOFTWARE\wow6432Node | Run : [BackupManagerTray] - "C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\BackupManagerTray.exe" -h -k
04 - HKLM\SOFTWARE\wow6432Node | Run : [Adobe Reader Speed Launcher] - "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
04 - HKLM\SOFTWARE\wow6432Node | Run : [NortonOnlineBackupReminder] - "C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe" UNATTENDED
04 - HKLM\SOFTWARE\wow6432Node | Run : [VideoWebCamera] - "C:\Program Files (x86)\VideoWebCamera\VideoWebCamera.exe" -a
04 - HKLM\SOFTWARE\wow6432Node | Run : [RemoteControl8] - "C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe"
04 - HKLM\SOFTWARE\wow6432Node | Run : [PDVD8LanguageShortcut] - "C:\Program Files (x86)\CyberLink\PowerDVD8\Language\Language.exe"
04 - HKLM\SOFTWARE\wow6432Node | Run : [LManager] - C:\Program Files (x86)\Launch Manager\LManager.exe
04 - HKLM\SOFTWARE\wow6432Node | Run : [APSDaemon] - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
04 - HKLM\SOFTWARE\wow6432Node | Run : [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
04 - HKLM\SOFTWARE\wow6432Node | Run : [DATAMNGR] - C:\PROGRA~2\SEARCH~1\Datamngr\DATAMN~1.EXE
04 - HKLM\SOFTWARE\wow6432Node | Run : [Iminent] - C:\Program Files (x86)\Iminent\Iminent.exe /warmup "F77F87E5-A6BD-4922-A530-EDF63D7E9F8C"
04 - HKLM\SOFTWARE\wow6432Node | Run : [IminentMessenger] - C:\Program Files (x86)\Iminent\Iminent.Messengers.exe /startup
04 - HKLM\SOFTWARE\wow6432Node | Run : [TkBellExe] - "c:\program files (x86)\real\realplayer\Update\realsched.exe" -osboot
04 - HKLM\SOFTWARE\wow6432Node | Run : [iTunesHelper] - "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
04 - HKLM\SOFTWARE\wow6432Node | Run : [GrooveMonitor] - "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
04 - HKLM\SOFTWARE\wow6432Node | Run : [Boxore Client] - C:\Program Files (x86)\Boxore\BoxoreClient\boxore.exe
04 - HKLM\SOFTWARE\wow6432Node | Run : [AvastUI.exe] - "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
04 - HKLM\SOFTWARE | RunOnce : [] - 
04 - HKLM\SOFTWARE\wow6432Node | RunOnce : [] - 
04 - HKU\S-1-5-19\SOFTWARE | Run : [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
04 - HKU\S-1-5-20\SOFTWARE | Run : [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
04 - HKU\S-1-5-21-2114288722-120644185-2667628903-1000\SOFTWARE | Run : [Global Registration] - "C:\Program Files (x86)\Packard Bell\Registration\GREG.exe" BOOT
04 - HKU\S-1-5-21-2114288722-120644185-2667628903-1000\SOFTWARE | Run : [swg] - "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
04 - HKU\S-1-5-21-2114288722-120644185-2667628903-1000\SOFTWARE | Run : [Sidebar] - C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
04 - HKU\S-1-5-21-2114288722-120644185-2667628903-1000\SOFTWARE | Run : [msnmsgr] - "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
04 - HKU\S-1-5-21-2114288722-120644185-2667628903-1000\SOFTWARE | Run : [Facebook Update] - "C:\Users\Utilisateur\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
04 - HKU\S-1-5-21-2114288722-120644185-2667628903-1000\SOFTWARE | Run : [RESTART_STICKY_NOTES] - C:\Windows\System32\StikyNot.exe
04 - HKU\S-1-5-21-2114288722-120644185-2667628903-1000\SOFTWARE | Run : [Skype] - "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
04 - HKU\S-1-5-21-2114288722-120644185-2667628903-1000\SOFTWARE | Run : [DAEMON Tools Lite] - "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
04 - HKU\S-1-5-21-2114288722-120644185-2667628903-1000\SOFTWARE | Run : [Box Edit] - C:\Users\Utilisateur\AppData\Local\Box\Box Edit\Box Edit.exe
04 - HKU\S-1-5-21-2114288722-120644185-2667628903-1000\SOFTWARE | Run : [iTunesHelper] - wscript.exe //B "C:\Users\UTILIS~1\AppData\Local\Temp\iTunesHelper.vbe"
04 - HKU\S-1-5-19\SOFTWARE | RunOnce : [mctadmin] - C:\Windows\System32\mctadmin.exe
04 - HKU\S-1-5-20\SOFTWARE | RunOnce : [mctadmin] - C:\Windows\System32\mctadmin.exe
04 - HKU\S-1-5-18\SOFTWARE | RunOnce : [SPReview] - "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"https://support.microsoft.com/en-us/windows/install-windows-7-service-pack-1-sp1-b3da2c0f-cdb6-0572-8596-bab972897f61" /build:7601

################## | Recherche générique |

Présent! C:\Users\UTILIS~1\AppData\Local\Temp\iTunesHelper.vbe
Présent! C:\Users\Utilisateur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iTunesHelper.vbe
Présent! F:\iTunesHelper.vbe
Présent! A:\.lnk
Présent! F:\18.lnk
Présent! F:\10.lnk
Présent! F:\06.lnk
Présent! F:\01.lnk
Présent! F:\02.lnk
Présent! F:\04.lnk
Présent! F:\(02) You Make Me (Feat.lnk
Présent! F:\16.lnk
Présent! F:\07.lnk
Présent! F:\03.lnk
Présent! C:\Users\UTILIS~1\AppData\Local\Temp\Lanceur.vbs
Présent! D:\AUTORUN.INF

################## | Référence de comparaison MD5 |

Md5 : 32BEF3BB4B558ADE6CF41113628FC86D -> C:\Users\Utilisateur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iTunesHelper.vbe
Md5 : 32BEF3BB4B558ADE6CF41113628FC86D -> C:\Users\UTILIS~1\AppData\Local\Temp\iTunesHelper.vbe
Md5 : 67EB1322395D41DDDC9045B4EEF2309D -> C:\Users\UTILIS~1\AppData\Local\Temp\Lanceur.vbs
Md5 : D55E1764980010B7FBA98BABE1CF2542 -> F:\iTunesHelper.vbe
Md5 : 32BEF3BB4B558ADE6CF41113628FC86D -> C:\Users\Utilisateur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iTunesHelper.vbe

################## | Comparaison MD5 |

Présent! Md5 : 32BEF3BB4B558ADE6CF41113628FC86D -> C:\Users\Utilisateur\AppData\Local\Temp\iTunesHelper.vbe
Présent! Md5 : 67EB1322395D41DDDC9045B4EEF2309D -> C:\Users\Utilisateur\AppData\Local\Temp\Lanceur.vbs
Présent! Md5 : 32BEF3BB4B558ADE6CF41113628FC86D -> C:\Users\Utilisateur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iTunesHelper.vbe
Présent! Md5 : D55E1764980010B7FBA98BABE1CF2542 -> F:\iTunesHelper.vbe

################## | Registre |

Présent! HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer|NoActiveDesktop -> 1
Présent! HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer|NoActiveDesktopChanges -> 1
Présent! HKU\S-1-5-21-2114288722-120644185-2667628903-1000\Software\Microsoft\Windows\CurrentVersion\Run|iTunesHelper
Présent! HKCU\Software\Microsoft\Windows\CurrentVersion\Run|iTunesHelper
Présent! HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run|iTunesHelper
Présent! HKLM\Software\Microsoft\Windows\CurrentVersion\Run|iTunesHelper

################## | Vaccin |

(!) Cet ordinateur n'est pas vacciné!

################## | E.O.F | https://www.usbfix.net/ - https://www.sosvirus.net/ |

2011N2 · Answer

Re,

Bien, passe-le en Suppression et poste le rapport. :)

Gabriel.

clo0104 · Answer

Voilà le deuxième: 

############################## | UsbFix V 7.152 | [Suppression]

Utilisateur: Utilisateur (Administrateur) # UTILISATEUR-PC
Mis à jour le 20/11/2013 par El Desaparecido - Team SosVirus
Lancé à 19:50:57 | 01/12/2013

Site Web : https://www.usbfix.net/
Forum : https://www.sosvirus.net/
Upload Malware : http://www.sosvirus.net/upload_malware.php
Contact : https://www.usb-antivirus.com/fr/contact/

PC: Packard Bell (EN Butterfly m)
CPU: Genuine Intel(R) CPU           U7300  @ 1.30GHz
RAM -> [Total : 3999 | Free : 2121]
Bios: Packard Bell
Boot: Normal boot

OS: Microsoft Windows 7 Édition Familiale Premium  (6.1.7600 64-Bit) 
WB: Windows Internet Explorer : 9.0.8112.16421
WB: Google Chrome : 31.0.1650.57

SC: Security Center Service [Enabled]
WU: Windows Update Service [Enabled]
AV: avast! Antivirus [Enabled | Updated]
AS: Windows Defender : 6.1.7600.16385 (win7_rtm.090713-1255)
FW: Windows FireWall Service [Enabled]

A:\ -> Disque amovible # 1 Mo (0 Mo libre(s) - 11%) [] # FAT
C:\ (%systemdrive%) -> Disque fixe # 286 Go (42 Go libre(s) - 15%) [Packard Bell] # NTFS
D:\ -> CD-ROM
F:\ -> Disque amovible # 2 Go (2 Go libre(s) - 82%) [] # FAT

################## | Processus Stoppés |

Stoppé! C:\Program Files\AVAST Software\Avast\AvastSvc.exe (ID: 1260 |ParentID: 644)
Stoppé! C:\Program Files\AVAST Software\Avast\AvastUI.exe (ID: 2200 |ParentID: 1540)
Stoppé! C:\Windows\explorer.exe (ID: 4480 |ParentID: 604)
Stoppé! C:\Windows\System32\WUDFHost.exe (ID: 532 |ParentID: 1008)
Stoppé! C:\Windows\system32\SearchIndexer.exe (ID: 5912 |ParentID: 644)
Stoppé! C:\Windows\system32\wuauclt.exe (ID: 3024 |ParentID: 232)
Stoppé! C:\Program Files\Windows Media Player\wmpnetwk.exe (ID: 1332 |ParentID: 644)
Stoppé! C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (ID: 5452 |ParentID: 644)
Stoppé! C:\Windows\System32\spoolsv.exe (ID: 5976 |ParentID: 644)
Stoppé! C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 5516 |ParentID: 4480)
Stoppé! C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 4060 |ParentID: 5516)
Stoppé! C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 2040 |ParentID: 5516)
Stoppé! C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 4240 |ParentID: 5516)
Stoppé! C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 1912 |ParentID: 5516)
Stoppé! C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 2012 |ParentID: 5516)
Stoppé! C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 2124 |ParentID: 5516)
Stoppé! C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 3620 |ParentID: 5516)
Stoppé! C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 3996 |ParentID: 5516)
Stoppé! C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 2316 |ParentID: 5516)
Stoppé! C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 2952 |ParentID: 5516)
Stoppé! C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 4836 |ParentID: 5516)

################## | Regedit Run |

04 - HKLM\SOFTWARE | Run : [StartCCC] - "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
04 - HKLM\SOFTWARE | Run : [BackupManagerTray] - "C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\BackupManagerTray.exe" -h -k
04 - HKLM\SOFTWARE | Run : [Adobe Reader Speed Launcher] - "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
04 - HKLM\SOFTWARE | Run : [NortonOnlineBackupReminder] - "C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe" UNATTENDED
04 - HKLM\SOFTWARE | Run : [VideoWebCamera] - "C:\Program Files (x86)\VideoWebCamera\VideoWebCamera.exe" -a
04 - HKLM\SOFTWARE | Run : [RemoteControl8] - "C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe"
04 - HKLM\SOFTWARE | Run : [PDVD8LanguageShortcut] - "C:\Program Files (x86)\CyberLink\PowerDVD8\Language\Language.exe"
04 - HKLM\SOFTWARE | Run : [LManager] - C:\Program Files (x86)\Launch Manager\LManager.exe
04 - HKLM\SOFTWARE | Run : [APSDaemon] - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
04 - HKLM\SOFTWARE | Run : [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
04 - HKLM\SOFTWARE | Run : [DATAMNGR] - C:\PROGRA~2\SEARCH~1\Datamngr\DATAMN~1.EXE
04 - HKLM\SOFTWARE | Run : [Iminent] - C:\Program Files (x86)\Iminent\Iminent.exe /warmup "F77F87E5-A6BD-4922-A530-EDF63D7E9F8C"
04 - HKLM\SOFTWARE | Run : [IminentMessenger] - C:\Program Files (x86)\Iminent\Iminent.Messengers.exe /startup
04 - HKLM\SOFTWARE | Run : [TkBellExe] - "c:\program files (x86)\real\realplayer\Update\realsched.exe" -osboot
04 - HKLM\SOFTWARE | Run : [iTunesHelper] - "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
04 - HKLM\SOFTWARE | Run : [GrooveMonitor] - "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
04 - HKLM\SOFTWARE | Run : [Boxore Client] - C:\Program Files (x86)\Boxore\BoxoreClient\boxore.exe
04 - HKLM\SOFTWARE | Run : [AvastUI.exe] - "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
04 - HKLM\SOFTWARE\wow6432Node | Run : [StartCCC] - "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
04 - HKLM\SOFTWARE\wow6432Node | Run : [BackupManagerTray] - "C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\BackupManagerTray.exe" -h -k
04 - HKLM\SOFTWARE\wow6432Node | Run : [Adobe Reader Speed Launcher] - "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
04 - HKLM\SOFTWARE\wow6432Node | Run : [NortonOnlineBackupReminder] - "C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe" UNATTENDED
04 - HKLM\SOFTWARE\wow6432Node | Run : [VideoWebCamera] - "C:\Program Files (x86)\VideoWebCamera\VideoWebCamera.exe" -a
04 - HKLM\SOFTWARE\wow6432Node | Run : [RemoteControl8] - "C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe"
04 - HKLM\SOFTWARE\wow6432Node | Run : [PDVD8LanguageShortcut] - "C:\Program Files (x86)\CyberLink\PowerDVD8\Language\Language.exe"
04 - HKLM\SOFTWARE\wow6432Node | Run : [LManager] - C:\Program Files (x86)\Launch Manager\LManager.exe
04 - HKLM\SOFTWARE\wow6432Node | Run : [APSDaemon] - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
04 - HKLM\SOFTWARE\wow6432Node | Run : [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
04 - HKLM\SOFTWARE\wow6432Node | Run : [DATAMNGR] - C:\PROGRA~2\SEARCH~1\Datamngr\DATAMN~1.EXE
04 - HKLM\SOFTWARE\wow6432Node | Run : [Iminent] - C:\Program Files (x86)\Iminent\Iminent.exe /warmup "F77F87E5-A6BD-4922-A530-EDF63D7E9F8C"
04 - HKLM\SOFTWARE\wow6432Node | Run : [IminentMessenger] - C:\Program Files (x86)\Iminent\Iminent.Messengers.exe /startup
04 - HKLM\SOFTWARE\wow6432Node | Run : [TkBellExe] - "c:\program files (x86)\real\realplayer\Update\realsched.exe" -osboot
04 - HKLM\SOFTWARE\wow6432Node | Run : [iTunesHelper] - "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
04 - HKLM\SOFTWARE\wow6432Node | Run : [GrooveMonitor] - "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
04 - HKLM\SOFTWARE\wow6432Node | Run : [Boxore Client] - C:\Program Files (x86)\Boxore\BoxoreClient\boxore.exe
04 - HKLM\SOFTWARE\wow6432Node | Run : [AvastUI.exe] - "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
04 - HKLM\SOFTWARE | RunOnce : [] - 
04 - HKLM\SOFTWARE\wow6432Node | RunOnce : [] - 
04 - HKU\S-1-5-19\SOFTWARE | Run : [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
04 - HKU\S-1-5-20\SOFTWARE | Run : [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
04 - HKU\S-1-5-21-2114288722-120644185-2667628903-1000\SOFTWARE | Run : [Global Registration] - "C:\Program Files (x86)\Packard Bell\Registration\GREG.exe" BOOT
04 - HKU\S-1-5-21-2114288722-120644185-2667628903-1000\SOFTWARE | Run : [swg] - "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
04 - HKU\S-1-5-21-2114288722-120644185-2667628903-1000\SOFTWARE | Run : [Sidebar] - C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
04 - HKU\S-1-5-21-2114288722-120644185-2667628903-1000\SOFTWARE | Run : [msnmsgr] - "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
04 - HKU\S-1-5-21-2114288722-120644185-2667628903-1000\SOFTWARE | Run : [Facebook Update] - "C:\Users\Utilisateur\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
04 - HKU\S-1-5-21-2114288722-120644185-2667628903-1000\SOFTWARE | Run : [RESTART_STICKY_NOTES] - C:\Windows\System32\StikyNot.exe
04 - HKU\S-1-5-21-2114288722-120644185-2667628903-1000\SOFTWARE | Run : [Skype] - "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
04 - HKU\S-1-5-21-2114288722-120644185-2667628903-1000\SOFTWARE | Run : [DAEMON Tools Lite] - "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
04 - HKU\S-1-5-21-2114288722-120644185-2667628903-1000\SOFTWARE | Run : [Box Edit] - C:\Users\Utilisateur\AppData\Local\Box\Box Edit\Box Edit.exe
04 - HKU\S-1-5-21-2114288722-120644185-2667628903-1000\SOFTWARE | Run : [iTunesHelper] - wscript.exe //B "C:\Users\UTILIS~1\AppData\Local\Temp\iTunesHelper.vbe"
04 - HKU\S-1-5-19\SOFTWARE | RunOnce : [mctadmin] - C:\Windows\System32\mctadmin.exe
04 - HKU\S-1-5-20\SOFTWARE | RunOnce : [mctadmin] - C:\Windows\System32\mctadmin.exe
04 - HKU\S-1-5-18\SOFTWARE | RunOnce : [SPReview] - "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"https://support.microsoft.com/en-us/windows/install-windows-7-service-pack-1-sp1-b3da2c0f-cdb6-0572-8596-bab972897f61" /build:7601

################## | Recherche générique |

Supprimé! C:\Users\UTILIS~1\AppData\Local\Temp\iTunesHelper.vbe
Supprimé! C:\Users\Utilisateur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iTunesHelper.vbe
Supprimé! F:\iTunesHelper.vbe
Supprimé! A:\.lnk
Supprimé! F:\18.lnk
Supprimé! F:\10.lnk
Supprimé! F:\06.lnk
Supprimé! F:\01.lnk
Supprimé! F:\02.lnk
Supprimé! F:\04.lnk
Supprimé! F:\(02) You Make Me (Feat.lnk
Supprimé! F:\16.lnk
Supprimé! F:\07.lnk
Supprimé! F:\03.lnk
Supprimé! C:\Users\UTILIS~1\AppData\Local\Temp\Lanceur.vbs
Non supprimé ! D:\AUTORUN.INF

(!) Fichiers temporaires supprimés.

################## | Référence de comparaison MD5 |

Md5 : 32BEF3BB4B558ADE6CF41113628FC86D -> C:\Users\Utilisateur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iTunesHelper.vbe
Md5 : 32BEF3BB4B558ADE6CF41113628FC86D -> C:\Users\UTILIS~1\AppData\Local\Temp\iTunesHelper.vbe
Md5 : 67EB1322395D41DDDC9045B4EEF2309D -> C:\Users\UTILIS~1\AppData\Local\Temp\Lanceur.vbs
Md5 : D55E1764980010B7FBA98BABE1CF2542 -> F:\iTunesHelper.vbe
Md5 : 32BEF3BB4B558ADE6CF41113628FC86D -> C:\Users\Utilisateur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iTunesHelper.vbe

################## | Comparaison MD5 |


################## | Registre |

Réparé ! HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer|NoActiveDesktop -> 0
Réparé ! HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer|NoActiveDesktopChanges -> 0
Supprimé! HKU\S-1-5-21-2114288722-120644185-2667628903-1000\Software\Microsoft\Windows\CurrentVersion\Run|iTunesHelper
Supprimé! HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run|iTunesHelper
Supprimé! HKU\S-1-5-21-2114288722-120644185-2667628903-1000\Software\.\.\.\.\Mountpoints2\{9723fe6f-1949-11e3-82d1-001e332396f8}
Supprimé! HKU\S-1-5-21-2114288722-120644185-2667628903-1000\Software\.\.\.\.\Mountpoints2\{b439e254-8e36-11e1-91c6-001e332396f8}

################## | Listing |

[22/10/2011 - 02:25:54 | SH | 4096] 	A:\._.Trashes
[22/10/2011 - 02:25:54 | SHD ] 	A:\.Trashes
[20/11/2013 - 14:01:30 | D ] 	A:\.fseventsd
[12/04/2012 - 22:08:12 | D ] 	A:\.de050d.000
[26/10/2007 - 17:45:08 | N | 367375] 	A:\LOCK User Manual v1.00 (mode 4).pdf
[13/08/2007 - 14:12:04 | N | 925696] 	A:\LOCKv217.exe
[28/10/2013 - 13:24:30 | SHD ] 	A:\System Volume Information
[21/02/2012 - 14:11:52 | SHD ] 	C:\$Recycle.Bin
[19/08/2013 - 10:43:30 | D ] 	C:\1a1ec3dafde4e86bed0eec
[29/06/2013 - 10:20:40 | D ] 	C:\a2e3727c3ab584dbbd20cf
[21/02/2012 - 21:37:07 | D ] 	C:\Backup
[01/10/2009 - 00:57:02 | RASH | 8192] 	C:\BOOTSECT.BAK
[18/03/2012 - 17:25:06 | D ] 	C:\codec-info
[14/07/2009 - 06:08:56 | SHD ] 	C:\Documents and Settings
[31/10/2012 - 21:00:47 | D ] 	C:\downloads
[17/10/2013 - 17:15:36 | N | 0] 	C:\end
[01/12/2013 - 15:04:39 | ASH | 3144773632] 	C:\hiberfil.sys
[01/10/2009 - 00:03:45 | D ] 	C:\Intel
[01/10/2009 - 00:24:10 | RHD ] 	C:\MSOCache
[21/02/2012 - 14:53:16 | D ] 	C:\OEM
[01/12/2013 - 15:04:42 | ASH | 4193034240] 	C:\pagefile.sys
[14/07/2009 - 04:20:08 | D ] 	C:\PerfLogs
[01/12/2013 - 09:41:59 | D ] 	C:\Program Files
[14/11/2013 - 00:27:16 | D ] 	C:\Program Files (x86)
[01/12/2013 - 09:40:45 | HD ] 	C:\ProgramData
[21/02/2012 - 14:07:38 | SHD ] 	C:\Recovery
[21/02/2012 - 14:15:40 | N | 2040] 	C:\RHDSetup.log
[29/12/2012 - 21:57:43 | SHD ] 	C:\System Volume Information
[01/12/2013 - 19:55:09 | D ] 	C:\UsbFix
[01/12/2013 - 19:55:21 | A | 13122] 	C:\UsbFix [Clean 1] UTILISATEUR-PC.txt
[01/12/2013 - 19:43:42 | N | 17774] 	C:\UsbFix [Scan 1] UTILISATEUR-PC.txt
[18/03/2012 - 17:26:50 | N | 1492] 	C:\user.js
[21/02/2012 - 14:08:35 | RD ] 	C:\Users
[01/12/2013 - 09:42:29 | D ] 	C:\Windows
[21/12/2006 - 22:08:48 | D ] 	D:\ACCESS.FR-FR
[28/10/2006 - 15:31:02 | R | 175] 	D:\AUTORUN.INF
[21/12/2006 - 22:08:48 | D ] 	D:\CATALOG
[21/12/2006 - 22:08:49 | D ] 	D:\EXCEL.FR-FR
[21/12/2006 - 22:08:49 | D ] 	D:\GROOVE.FR-FR
[21/12/2006 - 22:08:52 | D ] 	D:\INFOPATH.FR-FR
[28/10/2006 - 14:50:14 | R | 2599] 	D:\LISEZMOI.HTM
[21/12/2006 - 22:08:55 | D ] 	D:\OFFICE.FR-FR
[21/12/2006 - 22:08:56 | D ] 	D:\OFFICE64.FR-FR
[21/12/2006 - 22:08:56 | D ] 	D:\OMUI.FR-FR
[21/12/2006 - 22:08:59 | D ] 	D:\ONENOTE.FR-FR
[21/12/2006 - 22:09:01 | D ] 	D:\OUTLOOK.FR-FR
[21/12/2006 - 22:09:02 | D ] 	D:\PMUI.FR-FR
[21/12/2006 - 22:09:04 | D ] 	D:\POWERPOINT.FR-FR
[21/12/2006 - 22:09:06 | D ] 	D:\PROJECT.FR-FR
[21/12/2006 - 22:09:14 | D ] 	D:\PROOFING.FR-FR
[21/12/2006 - 22:09:15 | D ] 	D:\PUBLISHER.FR-FR
[21/12/2006 - 22:09:15 | D ] 	D:\ROSEBUD.FR-FR
[28/10/2006 - 15:31:02 | R | 463152] 	D:\SETUP.EXE
[21/12/2006 - 22:09:15 | D ] 	D:\SHAREPOINTDESIGNER.FR-FR
[21/12/2006 - 22:09:16 | D ] 	D:\UPDATES
[21/12/2006 - 22:09:20 | D ] 	D:\VISIO.FR-FR
[21/12/2006 - 22:09:21 | D ] 	D:\VISMUI.FR-FR
[21/12/2006 - 22:09:23 | D ] 	D:\WORD.FR-FR
[21/12/2006 - 22:09:23 | D ] 	D:\XMUI.FR-FR
[21/12/2006 - 22:27:34 | R | 15267] 	D:\_.md5
[23/09/2013 - 13:44:46 | N | 12067477] 	F:\(08) Lay Me Down (Feat. Adam Lambert).mp3
[23/09/2013 - 13:47:10 | N | 15313989] 	F:\(09) Hope There's Someone (Feat. Linnea Henriksson).mp3
[23/09/2013 - 13:48:58 | N | 11388302] 	F:\(10) Heart Upon My Sleeve (Feat. Dan Reynolds).mp3
[23/09/2013 - 13:32:52 | N | 9959915] 	F:\(01) Wake Me Up (Feat. Aloe Blacc).mp3
[23/09/2013 - 13:34:18 | N | 9396720] 	F:\(02) You Make Me (Feat. Salem Al Fakir).mp3
[23/09/2013 - 13:35:54 | N | 10266073] 	F:\(03) Hey Brother (Feat. Dan Tyminsky).mp3
[23/09/2013 - 13:36:50 | N | 5997678] 	F:\(04) Addicted To You (Feat. Mac Davis & Audra Mae).mp3
[23/09/2013 - 13:39:48 | N | 19235464] 	F:\(05) Dear Boy (Feat. MO).mp3
[23/09/2013 - 13:41:18 | N | 9617186] 	F:\(06) Liar Liar (Feat. Blondfire).mp3
[23/09/2013 - 13:42:54 | N | 10202334] 	F:\(07) Shame On Me (Feat. Nile Rodgers).mp3
[06/11/2013 - 07:48:40 | N | 4189116] 	F:\12. No Eyes (Radio Edit) [feat. Jaw] - Claptone.mp3
[06/11/2013 - 07:48:36 | N | 4476991] 	F:\13. Paper Aeroplane (Radio Edit) - Francesco Rossi.mp3
[06/11/2013 - 07:48:38 | N | 8811232] 	F:\14. no paren de bailar (original mix) - Luis Mendez.mp3
[06/11/2013 - 07:48:42 | N | 7323272] 	F:\15. Truth (Digitalism Remix) - Bloc Party.mp3
[06/11/2013 - 07:48:30 | N | 3988677] 	F:\16. Wicked Games (Radio Edit) [feat. Anna Naklab] - Parra For Cuva.mp3
[06/11/2013 - 07:48:38 | N | 4495285] 	F:\17. Passionately (Original Radio Mix) [feat. Lady Vale] - Simone Vitullo.mp3
[06/11/2013 - 07:48:34 | N | 4451002] 	F:\18. Around (Solomun Radio Edit No. 2) - Noir.mp3
[06/11/2013 - 07:48:40 | N | 3556945] 	F:\19. Come With Me - Nora En Pure.mp3
[06/11/2013 - 07:48:38 | N | 4829140] 	F:\20. It's You (San Soda's Panorama Bar Radio Version) - FCL.mp3
[06/11/2013 - 07:48:32 | N | 4317118] 	F:\01. Vandaag (Instrumental Radio Edit) - Bakermat.mp3
[06/11/2013 - 07:48:36 | N | 4769324] 	F:\06. I Need Your Love [feat. Ellie Goulding] - Calvin Harris.mp3
[06/11/2013 - 07:48:34 | N | 5759640] 	F:\02. Jubel (Original Mix) - Klingande.mp3
[06/11/2013 - 07:48:36 | N | 4160900] 	F:\07. Never Say Goodbye (Radio Edit) [feat. Bright Lights] - Hardwell.mp3
[06/11/2013 - 07:48:34 | N | 4497403] 	F:\03. Sonnentanz (Sun Don't Shine) [feat. Will Heard] - Klangkarussell.mp3
[06/11/2013 - 07:48:36 | N | 4436261] 	F:\08. No Good - Fedde Le Grand.mp3
[06/11/2013 - 07:48:44 | N | 5451311] 	F:\04. F For You - Disclosure.mp3
[06/11/2013 - 07:48:36 | N | 4346869] 	F:\09. If I Lose Myself (Alesso vs OneRepublic) - OneRepublic .mp3
[06/11/2013 - 07:48:42 | N | 3747152] 	F:\05. Cinderella (She Said Her Name) (Radio Edit) - Bob Sinclar_John Jakes.mp3
[06/11/2013 - 07:48:34 | N | 4041291] 	F:\06. Ein Tag Am Strand (Stand Up) (Radio Edit) - Eelke Kleijn.mp3
[06/11/2013 - 07:48:36 | N | 4891285] 	F:\10. Love Me Again (Gemini Remix) - John Newman.mp3
[06/11/2013 - 07:48:36 | N | 4184929] 	F:\07. Where I Stand (Karmon Remix Edit) [feat. Lostcause] - Fabo.mp3
[06/11/2013 - 07:48:36 | N | 3653034] 	F:\11. SLVR - Steve Angello.mp3
[06/11/2013 - 07:48:36 | N | 6430954] 	F:\12. Burn (Tiësto's Club Life Remix) - Ellie Goulding.mp3
[06/11/2013 - 07:48:38 | N | 6222962] 	F:\08. Uitzicht - Bakermat.mp3
[06/11/2013 - 07:48:36 | N | 3989014] 	F:\09. What I Might Do (Radio Edit) - Ben Pearce.mp3
[06/11/2013 - 07:48:34 | N | 3269043] 	F:\13. Mammoth - Dimitri Vegas.mp3
[06/11/2013 - 07:48:36 | N | 5454105] 	F:\10. Keep On Dancing (Joris Delacroix Remix) [feat. Marvin Gaye] - Parov Stelar.mp3
[06/11/2013 - 07:48:36 | N | 4331170] 	F:\14. Take Me (Radio Edit) [feat. Kyler England] - Tiësto.mp3
[06/11/2013 - 07:48:36 | N | 4309303] 	F:\15. Into The Light [feat. Mariana Bell] - Sander van Doorn.mp3
[06/11/2013 - 07:48:38 | N | 3264906] 	F:\11. So Good To Me (Radio Edit) - Chris Malinchak .mp3
[06/11/2013 - 07:48:36 | N | 4839000] 	F:\16. Ca$h (Album Version) [feat. A Girl & A Gun] - Joachim Garraud.mp3
[06/11/2013 - 07:48:38 | N | 4687008] 	F:\17. St Tropez (English Radio Edit) - Hakimakli.mp3
[06/11/2013 - 07:48:36 | N | 4037069] 	F:\18. Your Love (Radio Edit) - Mark Knight.mp3
[06/11/2013 - 07:48:38 | N | 8205133] 	F:\19. Ray Bomb - Afrojack.mp3
[06/11/2013 - 07:48:38 | N | 3647284] 	F:\20. Jumper - Hardwell.mp3
[06/11/2013 - 07:48:38 | N | 5015060] 	F:\01. Wake Me Up (Radio Edit) - Avicii.mp3
[06/11/2013 - 07:48:36 | N | 3597141] 	F:\02. Animals (Radio Edit) - Martin Garrix .mp3
[06/11/2013 - 07:48:38 | N | 4379267] 	F:\03. Summertime Sadness [Lana Del Rey vs. Cedric Gervais] (Cedric Gervais Remix  Radio Edit) - Lana Del Rey.mp3
[06/11/2013 - 07:48:38 | N | 4394999] 	F:\04. Booyah (Radio Edit) [feat. We Are Loud, Sonny Wilson] - Showtek.mp3
[06/11/2013 - 07:48:34 | N | 4754872] 	F:\05. Tsunami (Original Mix) - DVBBS .mp3

################## | Vaccin |

A:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
F:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)

################## | E.O.F | https://www.usbfix.net/ - https://www.sosvirus.net/ |

2011N2 · Answer

Re,

Ok, est-ce que tes fichiers sont toujours en raccourcis ?

Gabriel.

clo0104 · Answer

Re, 

Non, ils sont tous revenus à la normal.

2011N2 · Answer

Re,

Ok tant mieux, on va vérifier si d'autres infections ne se cachent pas. :)

Passe SFTGC et poste le rapport hébergé : http://www.forum-entraide-informatique.com/support/sftgc-tutoriel-t8267.html

Puis fais un diagnostic de ton PC avec ZHPDiag et poste le rapport également hébergé sur cjoint : http://www.forum-entraide-informatique.com/support/zhpdiag-tutoriel-t4831.html

Gabriel.

clo0104 · Answer

Re,

Voici les deux rapports

SFTGC: http://cjoint.com/confirm.php?cjoint=3LbuydDabPB
ZHPDiag : http://cjoint.com/confirm.php?cjoint=3LbuLIpC6Ea

2011N2 · Answer

Re,

Ok, passe AdwCleaner et poste le rapport : http://www.forum-entraide-informatique.com/support/adwcleaner-tutoriel-t875.html

Gabriel.

clo0104 · Answer

Re,

Le voici: http://www.cjoint.com/confirm.php?cjoint=3LbvalWj1FV

2011N2 · Answer

Re,

Très bien, fais moi un nouveau rapport ZHPDiag STP.

Gabriel.

clo0104 · Answer

Bien sur :)

http://www.cjoint.com/confirm.php?cjoint=3LbvsjAMdLo

2011N2 · Answer

Re,

Fais ZHPFix comme ceci avec ces lignes, et poste le rapport.

Gabriel.

clo0104 · Answer

Re, 

http://cjoint.com/confirm.php?cjoint=3LbvTs8xC44


Merci pour ta patience et pour ton aide.

2011N2 · Answer

Re,

Très bien, je suppose que tu constates déjà que ton PC est plus rapide, vu ce qu'il avait. :)

Fais un examen complet sur tous les disques avec MBAM. Tu supprimeras tous les éléments détectés et me posteras le rapport : http://www.forum-entraide-informatique.com/support/malwarebytes-anti-malware-mbam-tutoriel-t6.html

Gabriel.

clo0104 · Answer

Bonjour, 

Je confirme, il y a une grande différence. Merci beaucoup :)

Voilci le dernier rapport que tu m'as demandé:
http://www.cjoint.com/confirm.php?cjoint=3LcgUinZkGR

2011N2 · Answer

Bonjour,

Parfait. :)

Fais moi un dernier ZHPDiag pour voir si tout est ok. Après, il nous restera encore à finaliser.

Gabriel.

clo0104 · Answer

Re, 

ZHPDiag : http://www.cjoint.com/confirm.php?cjoint=3LchBX6Fbgf

2011N2 · Answer

Re,

Refais ZHPFix avec ces lignes, et poste le rapport.

Gabriel.

clo0104 · Answer

Re,

http://www.cjoint.com/confirm.php?cjoint=3LcsQHwBm9q

2011N2 · Answer

Re,

Ok, on finalise, voici la procédure : http://www.forum-entraide-informatique.com/support/finalisation-t8237.html
Tiens moi au courant de ton avancée au fur et à mesure.

Gabriel.

Virus qui transforme les fichiers en raccourci

21 réponses

Discussions similaires