Rapport usbfix

Bonjour,
voici le rapport usbfix

############################## | UsbFix V 7.155 | [Recherche]

Utilisateur: boukari (Administrateur) # MAISON
Mis à jour le 16/12/2013 par El Desaparecido - Team SosVirus
Lancé à 15:29:28 | 25/12/2013

Site Web : https://www.usbfix.net/
Forum : https://www.sosvirus.net/
Upload Malware : http://www.sosvirus.net/upload_malware.php
Contact : https://www.usb-antivirus.com/fr/contact/

PC: Acer (Aspire 7741 )
CPU: Intel(R) Core(TM) i3 CPU M 330 @ 2.13GHz
RAM -> [Total : 3957 | Free : 2135]
Bios: Phoenix Technologies LTD
Boot: Normal boot

OS: Microsoft Windows 7 Édition Familiale Premium (6.1.7601 64-Bit) Service Pack 1
WB: Windows Internet Explorer : 11.0.9600.16476
WB: Google Chrome : 31.0.1650.63
WB: Mozilla Firefox : 26.0

SC: Security Center Service [Enabled]
WU: Windows Update Service [Enabled]
AS: Windows Defender : 6.1.7600.16385 (win7_rtm.090713-1255)
FW: Windows FireWall Service [Enabled]

C:\ (%systemdrive%) -> Disque fixe # 145 Go (97 Go libre(s) - 67%) [ACER] # NTFS
D:\ -> CD-ROM
E:\ -> Disque fixe # 101 Go (12 Go libre(s) - 12%) [Données] # NTFS
F:\ -> Disque fixe # 40 Go (26 Go libre(s) - 66%) [Archives] # NTFS
H:\ -> Disque amovible # 15 Go (15 Go libre(s) - 99%) [SONY_16GR] # FAT32

################## | Processus Actif |

C:\Windows\system32\csrss.exe (ID: 628 |ParentID: 596)
C:\Windows\system32\wininit.exe (ID: 692 |ParentID: 596)
C:\Windows\system32\csrss.exe (ID: 716 |ParentID: 700)
C:\Windows\system32\services.exe (ID: 760 |ParentID: 692)
C:\Windows\system32\lsass.exe (ID: 780 |ParentID: 692)
C:\Windows\system32\lsm.exe (ID: 788 |ParentID: 692)
C:\Windows\system32\winlogon.exe (ID: 840 |ParentID: 700)
C:\Windows\system32\svchost.exe (ID: 928 |ParentID: 760)
C:\Windows\system32\svchost.exe (ID: 116 |ParentID: 760)
C:\Windows\System32\svchost.exe (ID: 524 |ParentID: 760)
C:\Windows\System32\svchost.exe (ID: 596 |ParentID: 760)
C:\Windows\system32\svchost.exe (ID: 868 |ParentID: 760)
C:\Windows\system32\svchost.exe (ID: 1040 |ParentID: 760)
C:\Windows\system32\svchost.exe (ID: 1124 |ParentID: 760)
C:\Windows\system32\svchost.exe (ID: 1228 |ParentID: 760)
C:\Program Files\AVAST Software\Avast\AvastSvc.exe (ID: 1324 |ParentID: 760)
C:\Windows\system32\svchost.exe (ID: 1660 |ParentID: 760)
C:\Windows\system32\mfevtps.exe (ID: 1452 |ParentID: 760)
C:\Windows\system32\Dwm.exe (ID: 2656 |ParentID: 596)
C:\Windows\system32\wbem\unsecapp.exe (ID: 3468 |ParentID: 928)
C:\Windows\system32\wbem\wmiprvse.exe (ID: 3544 |ParentID: 928)
C:\Program Files\AVAST Software\Avast\AvastUI.exe (ID: 3756 |ParentID: 3704)
C:\Windows\system32\svchost.exe (ID: 4244 |ParentID: 760)
C:\Windows\System32\svchost.exe (ID: 4696 |ParentID: 760)
C:\Windows\System32\rundll32.exe (ID: 5512 |ParentID: 928)
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (ID: 2996 |ParentID: 760)
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (ID: 5600 |ParentID: 760)
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (ID: 4044 |ParentID: 5600)
C:\Program Files\Windows Media Player\wmpnetwk.exe (ID: 7464 |ParentID: 760)
C:\Windows\system32\SearchIndexer.exe (ID: 2384 |ParentID: 760)
C:\Windows\System32\spoolsv.exe (ID: 2576 |ParentID: 760)
C:\Windows\Explorer.exe (ID: 1420 |ParentID: 2008)
C:\Windows\system32\DllHost.exe (ID: 5564 |ParentID: 928)
C:\Program Files (x86)\Mozilla Firefox\firefox.exe (ID: 6664 |ParentID: 1420)
C:\Program Files (x86)\RealNetworks\RealDownloader\recordingmanager.exe (ID: 1960 |ParentID: 6664)
C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE (ID: 7132 |ParentID: 1420)
C:\Windows\splwow64.exe (ID: 6328 |ParentID: 7132)
C:\Windows\System32\WUDFHost.exe (ID: 7080 |ParentID: 596)
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe (ID: 6736 |ParentID: 6664)
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe (ID: 7252 |ParentID: 6736)
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe (ID: 5168 |ParentID: 7252)
C:\UsbFix\Go.exe (ID: 7752 |ParentID: 5092)
C:\Windows\system32\wbem\wmiprvse.exe (ID: 6724 |ParentID: 928)

################## | Regedit Run |

04 - HKLM\SOFTWARE | Run : [avast] - "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
04 - HKLM\SOFTWARE | Run : [StartCCC] - "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
04 - HKLM\SOFTWARE | Run : [NortonOnlineBackupReminder] - "C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe" UNATTENDED
04 - HKLM\SOFTWARE | Run : [LManager] - C:\Program Files (x86)\Launch Manager\LManager.exe
04 - HKLM\SOFTWARE | Run : [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
04 - HKLM\SOFTWARE | Run : [EgisUpdate] - C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe
04 - HKLM\SOFTWARE | Run : [EgisTecPMMUpdate] - "C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe" 196609
04 - HKLM\SOFTWARE | Run : [BackupManagerTray] - "C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" -h -k
04 - HKLM\SOFTWARE | Run : [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
04 - HKLM\SOFTWARE | Run : [TkBellExe] - "C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe" -osboot
04 - HKLM\SOFTWARE | Run : [Flashget] - C:\Program Files (x86)\FlashGet\flashget.exe /min
04 - HKLM\SOFTWARE\wow6432Node | Run : [avast] - "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
04 - HKLM\SOFTWARE\wow6432Node | Run : [StartCCC] - "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
04 - HKLM\SOFTWARE\wow6432Node | Run : [NortonOnlineBackupReminder] - "C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe" UNATTENDED
04 - HKLM\SOFTWARE\wow6432Node | Run : [LManager] - C:\Program Files (x86)\Launch Manager\LManager.exe
04 - HKLM\SOFTWARE\wow6432Node | Run : [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
04 - HKLM\SOFTWARE\wow6432Node | Run : [EgisUpdate] - C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe
04 - HKLM\SOFTWARE\wow6432Node | Run : [EgisTecPMMUpdate] - "C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe" 196609
04 - HKLM\SOFTWARE\wow6432Node | Run : [BackupManagerTray] - "C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" -h -k
04 - HKLM\SOFTWARE\wow6432Node | Run : [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
04 - HKLM\SOFTWARE\wow6432Node | Run : [TkBellExe] - "C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe" -osboot
04 - HKLM\SOFTWARE\wow6432Node | Run : [Flashget] - C:\Program Files (x86)\FlashGet\flashget.exe /min
04 - HKLM\SOFTWARE | RunOnce : [] -
04 - HKLM\SOFTWARE\wow6432Node | RunOnce : [] -
04 - HKU\S-1-5-19\SOFTWARE | Run : [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
04 - HKU\S-1-5-20\SOFTWARE | Run : [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
04 - HKU\S-1-5-21-4009335847-3301133346-3894172742-1000\SOFTWARE | Run : [E09FXLRD_144254] - "C:\Program Files (x86)\Microsoft Encarta\Microsoft Encarta 2009 - Collection DVD\EDICT.EXE" -m
04 - HKU\S-1-5-21-4009335847-3301133346-3894172742-1000\SOFTWARE | Run : [SuperCopier2.exe] - C:\Program Files (x86)\SuperCopier2\SuperCopier2.exe
04 - HKU\S-1-5-21-4009335847-3301133346-3894172742-1000\SOFTWARE | Run : [E09FXLRD_258446] - "C:\Program Files (x86)\Microsoft Encarta\Microsoft Encarta 2009 - Collection DVD\EDICT.EXE" -m
04 - HKU\S-1-5-21-4009335847-3301133346-3894172742-1000\SOFTWARE | Run : [E09FXLRD_241754] - "C:\Program Files (x86)\Microsoft Encarta\Microsoft Encarta 2009 - Collection DVD\EDICT.EXE" -m
04 - HKU\S-1-5-21-4009335847-3301133346-3894172742-1000\SOFTWARE | Run : [E09FXLRD_1558371] - "C:\Program Files (x86)\Microsoft Encarta\Microsoft Encarta 2009 - Collection DVD\EDICT.EXE" -m
04 - HKU\S-1-5-21-4009335847-3301133346-3894172742-1000\SOFTWARE | Run : [iTunesHelper] - wscript.exe //B "C:\Users\boukari\AppData\Local\Temp\iTunesHelper.vbe"
04 - HKU\S-1-5-19\SOFTWARE | RunOnce : [mctadmin] - C:\Windows\System32\mctadmin.exe
04 - HKU\S-1-5-20\SOFTWARE | RunOnce : [mctadmin] - C:\Windows\System32\mctadmin.exe

################## | Recherche générique |

Présent! C:\Users\boukari\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iTunesHelper.vbe
Présent! C:\Users\boukari\AppData\Local\Temp\iTunesHelper.vbe
Présent! C:\Users\boukari\AppData\Local\Temp\Drives.vbs
Présent! H:\iTunesHelper.vbe
Présent! H:\std_form_claim_fr.lnk
Présent! H:\scansim_Brazza.lnk
Présent! C:\Windows\SysWOW64\secushr.dat

################## | Référence de comparaison MD5 |

Md5 : 3356FE364AC7ECD552F92BE8111D18B9 -> C:\Users\boukari\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iTunesHelper.vbe
Md5 : 3356FE364AC7ECD552F92BE8111D18B9 -> C:\Users\boukari\AppData\Local\Temp\iTunesHelper.vbe
Md5 : AC8F18C5C595A5685FCEA46E61B6B5AF -> C:\Users\boukari\AppData\Local\Temp\Drives.vbs
Md5 : 3356FE364AC7ECD552F92BE8111D18B9 -> H:\iTunesHelper.vbe

################## | Comparaison MD5 |

Présent! Md5 : AC8F18C5C595A5685FCEA46E61B6B5AF -> C:\Users\boukari\AppData\Local\Temp\Drives.vbs
Présent! Md5 : 3356FE364AC7ECD552F92BE8111D18B9 -> C:\Users\boukari\AppData\Local\Temp\iTunesHelper.vbe
Présent! Md5 : 3356FE364AC7ECD552F92BE8111D18B9 -> C:\Users\boukari\AppData\Roaming\Microsoft\Windows\Start Menu\Programmes\Startup\iTunesHelper.vbe
Présent! Md5 : 3356FE364AC7ECD552F92BE8111D18B9 -> C:\Users\boukari\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iTunesHelper.vbe
Présent! Md5 : 3356FE364AC7ECD552F92BE8111D18B9 -> C:\Users\boukari\Application Data\Microsoft\Windows\Start Menu\Programmes\Startup\iTunesHelper.vbe
Présent! Md5 : 3356FE364AC7ECD552F92BE8111D18B9 -> C:\Users\boukari\Application Data\Microsoft\Windows\Start Menu\Programs\Startup\iTunesHelper.vbe
Présent! Md5 : 3356FE364AC7ECD552F92BE8111D18B9 -> H:\iTunesHelper.vbe

################## | Registre |

Présent! HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System|EnableLUA -> 0
Présent! HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System|ConsentPromptBehaviorAdmin -> 0
Présent! HKU\S-1-5-21-4009335847-3301133346-3894172742-1000\Software\Microsoft\Windows\CurrentVersion\Run|iTunesHelper
Présent! HKCU\Software\Microsoft\Windows\CurrentVersion\Run|iTunesHelper

################## | Vaccin |

E:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
F:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
H:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)

################## | E.O.F | https://www.usbfix.net/ - https://www.sosvirus.net/ |