Rapport usbfix
husnu
Messages postés
391
Date d'inscription
Statut
Membre
Dernière intervention
-
meda -
meda -
Bonjour,
J'ai ma clé usb qui est infectée. Pourriez vous vérifier le rapport afin de la désinfectée svp?
Merci,
############################## | UsbFix V 7.164 | [Recherche]
Utilisateur: AUICE (Administrateur) # CHARLEROIMG
Mis à jour le05/02/2014 par El Desaparecido - Team SosVirus
Lancé à 22:42:55 | 11/02/2014
Site Web : https://www.usbfix.net/
Changelog : https://www.usb-antivirus.com/fr/maj/
Support : https://www.sosvirus.net/
Upload Malware : http://www.sosvirus.net/upload_malware.php
Contact : https://www.usb-antivirus.com/fr/contact/
PC: SAMSUNG ELECTRONICS CO., LTD. (R530/R730 )
CPU: Pentium(R) Dual-Core CPU T4500 @ 2.30GHz
RAM -> [Total : 3033 Mo| Free : 1597 Mo]
Bios: Phoenix Technologies Ltd.
Boot: Normal boot
OS: Microsoft Windows 7 Édition Familiale Premium (6.1.7601 32-Bit) Service Pack 1
WB: Windows Internet Explorer : 9.0.8112.16421
WB: Mozilla Firefox : 26.0
SC: Security Center [Enabled]
WU: Windows Update [Enabled]
AV: avast! Antivirus [(!) Disabled | Updated]
AS: avast! Antivirus [(!) Disabled | Updated]
AS: Windows Defender [(!) Disabled | Updated]
FW: Windows FireWall [Enabled]
C:\ (%systemdrive%) -> Disque fixe # 139 Go (52 Go libre(s) - 37%) [] # NTFS
D:\ -> Disque fixe # 139 Go (91 Go libre(s) - 65%) [] # NTFS
E:\ -> CD-ROM
G:\ -> Disque amovible # 15 Go (14 Go libre(s) - 95%) [SANDISK 16G] # FAT32
################## | Processus Actif |
C:\windows\system32\csrss.exe (ID: 496 |ParentID: 444)
C:\windows\system32\wininit.exe (ID: 548 |ParentID: 444)
C:\windows\system32\csrss.exe (ID: 556 |ParentID: 540)
C:\windows\system32\services.exe (ID: 604 |ParentID: 548)
C:\windows\system32\lsass.exe (ID: 620 |ParentID: 548)
C:\windows\system32\lsm.exe (ID: 628 |ParentID: 548)
C:\windows\system32\winlogon.exe (ID: 716 |ParentID: 540)
C:\windows\system32\svchost.exe (ID: 780 |ParentID: 604)
C:\windows\system32\svchost.exe (ID: 876 |ParentID: 604)
C:\windows\System32\svchost.exe (ID: 940 |ParentID: 604)
C:\windows\System32\svchost.exe (ID: 1012 |ParentID: 604)
C:\windows\system32\svchost.exe (ID: 1056 |ParentID: 604)
C:\windows\system32\svchost.exe (ID: 1176 |ParentID: 604)
C:\windows\system32\svchost.exe (ID: 1276 |ParentID: 604)
C:\windows\System32\spoolsv.exe (ID: 1572 |ParentID: 604)
C:\windows\system32\taskhost.exe (ID: 1636 |ParentID: 604)
C:\windows\system32\svchost.exe (ID: 1668 |ParentID: 604)
C:\windows\system32\Dwm.exe (ID: 1680 |ParentID: 1012)
C:\windows\Explorer.EXE (ID: 1728 |ParentID: 1648)
C:\windows\system32\svchost.exe (ID: 1752 |ParentID: 604)
C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (ID: 1928 |ParentID: 604)
C:\windows\system32\svchost.exe (ID: 1988 |ParentID: 604)
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe (ID: 2016 |ParentID: 604)
C:\windows\System32\svchost.exe (ID: 448 |ParentID: 604)
C:\windows\System32\svchost.exe (ID: 544 |ParentID: 604)
C:\Program Files\CyberLink\Shared files\RichVideo.exe (ID: 956 |ParentID: 604)
C:\windows\system32\svchost.exe (ID: 2060 |ParentID: 604)
C:\windows\System32\svchost.exe (ID: 2096 |ParentID: 604)
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (ID: 2160 |ParentID: 604)
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (ID: 2368 |ParentID: 2160)
C:\windows\system32\taskeng.exe (ID: 2612 |ParentID: 1056)
C:\windows\system32\svchost.exe (ID: 3120 |ParentID: 604)
C:\Windows\system32\WUDFHost.exe (ID: 3232 |ParentID: 1012)
C:\windows\system32\svchost.exe (ID: 3352 |ParentID: 604)
C:\windows\System32\rundll32.exe (ID: 3624 |ParentID: 780)
C:\Program Files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe (ID: 3668 |ParentID: 2612)
C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe (ID: 3712 |ParentID: 2612)
C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe (ID: 3732 |ParentID: 2612)
C:\Program Files\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe (ID: 3784 |ParentID: 2612)
C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe (ID: 3808 |ParentID: 2612)
C:\windows\system32\igfxext.exe (ID: 3872 |ParentID: 780)
C:\windows\system32\igfxsrvc.exe (ID: 3900 |ParentID: 780)
C:\windows\system32\SearchIndexer.exe (ID: 3424 |ParentID: 604)
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (ID: 3664 |ParentID: 1728)
C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe (ID: 1116 |ParentID: 1728)
C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe (ID: 4076 |ParentID: 1728)
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (ID: 412 |ParentID: 1728)
C:\Windows\System32\igfxtray.exe (ID: 4004 |ParentID: 1728)
C:\Windows\System32\hkcmd.exe (ID: 2604 |ParentID: 1728)
C:\Windows\System32\igfxpers.exe (ID: 2408 |ParentID: 1728)
C:\Program Files\Adobe\Acrobat 10.0\Acrobat\acrotray.exe (ID: 3592 |ParentID: 1728)
C:\Program Files\AVAST Software\Avast\AvastUI.exe (ID: 3032 |ParentID: 1728)
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (ID: 2596 |ParentID: 412)
C:\Program Files\Common Files\Java\Java Update\jusched.exe (ID: 3432 |ParentID: 1728)
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe (ID: 3312 |ParentID: 1728)
C:\Program Files\Windows Sidebar\sidebar.exe (ID: 1652 |ParentID: 1728)
C:\Users\AUICE\AppData\Roaming\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe (ID: 3556 |ParentID: 1728)
C:\Program Files\Salaat Time\SalaatTime.exe (ID: 4400 |ParentID: 1728)
C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE (ID: 4432 |ParentID: 1728)
C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe (ID: 4456 |ParentID: 1728)
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (ID: 4480 |ParentID: 1728)
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe (ID: 4584 |ParentID: 604)
C:\Program Files\AVAST Software\Avast\AvastSvc.exe (ID: 4620 |ParentID: 604)
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe (ID: 4676 |ParentID: 780)
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe (ID: 5784 |ParentID: 4480)
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe (ID: 5984 |ParentID: 780)
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe (ID: 6088 |ParentID: 780)
C:\Program Files\Adobe\Elements 10 Organizer\PhotoshopElementsFileAgent.exe (ID: 4048 |ParentID: 604)
C:\Program Files\Windows Media Player\wmpnetwk.exe (ID: 3224 |ParentID: 604)
C:\Program Files\Mozilla Firefox\firefox.exe (ID: 6124 |ParentID: 1728)
C:\Program Files\Common Files\Java\Java Update\jucheck.exe (ID: 4444 |ParentID: 3432)
C:\Program Files\Mozilla Firefox\plugin-container.exe (ID: 1376 |ParentID: 6124)
C:\windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_44.exe (ID: 6112 |ParentID: 1376)
C:\windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_44.exe (ID: 5684 |ParentID: 6112)
C:\windows\system32\msiexec.exe (ID: 2548 |ParentID: 604)
C:\Users\AUICE\AppData\Local\Temp\ARCompanionForSession1.exe (ID: 5440 |ParentID: 4416)
C:\windows\system32\wbem\wmiprvse.exe (ID: 5512 |ParentID: 780)
################## | Regedit Run |
04 - HKCU\..\Run : [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
04 - HKCU\..\Run : [Octoshape Streaming Services] "C:\Users\AUICE\AppData\Roaming\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe" -inv:bootrun
04 - HKCU\..\Run : [SalaatTime] C:\Program Files\Salaat Time\SalaatTime.exe
04 - HKCU\..\Run : [Google Update] "C:\Users\AUICE\AppData\Local\Google\Update\GoogleUpdate.exe" /c
04 - HKCU\..\Run : [] C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
04 - HKCU\..\Run : [OfficeSyncProcess] "C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE"
04 - HKCU\..\Run : [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"
04 - HKLM\..\Run : [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
04 - HKLM\..\Run : [UpdateLBPShortCut] "C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.5"
04 - HKLM\..\Run : [CLMLServer] "C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe"
04 - HKLM\..\Run : [UpdateP2GoShortCut] "C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"
04 - HKLM\..\Run : [UpdatePDRShortCut] "C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\PowerDirector" UpdateWithCreateOnce "Software\CyberLink\PowerDirector\7.0"
04 - HKLM\..\Run : [RemoteControl8] "C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe"
04 - HKLM\..\Run : [PDVD8LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe"
04 - HKLM\..\Run : [UpdatePPShortCut] "C:\Program Files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\PowerProducer" UpdateWithCreateOnce "Software\CyberLink\PowerProducer\5.0"
04 - HKLM\..\Run : [UpdatePSTShortCut] "C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\DVD Suite" UpdateWithCreateOnce "Software\CyberLink\PowerStarter"
04 - HKLM\..\Run : [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
04 - HKLM\..\Run : [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" UpdateWithCreateOnce "Software\CyberLink\YouCam\2.0"
04 - HKLM\..\Run : [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
04 - HKLM\..\Run : [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
04 - HKLM\..\Run : [IgfxTray] C:\windows\system32\igfxtray.exe
04 - HKLM\..\Run : [HotKeysCmds] C:\windows\system32\hkcmd.exe
04 - HKLM\..\Run : [Persistence] C:\windows\system32\igfxpers.exe
04 - HKLM\..\Run : [Adobe Acrobat Speed Launcher] "C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe"
04 - HKLM\..\Run : [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe"
04 - HKLM\..\Run : [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
04 - HKLM\..\Run : [BCSSync] "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices
04 - HKLM\..\Run : [AdobeAAMUpdater-1.0] "C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
04 - HKLM\..\Run : []
04 - HKLM\..\Run : [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
04 - HKLM\..\Run : [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
04 - HKU\S-1-5-21-3360321568-3577047653-1866379785-1000\..\Run : [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
04 - HKU\S-1-5-21-3360321568-3577047653-1866379785-1000\..\Run : [Octoshape Streaming Services] "C:\Users\AUICE\AppData\Roaming\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe" -inv:bootrun
04 - HKU\S-1-5-21-3360321568-3577047653-1866379785-1000\..\Run : [SalaatTime] C:\Program Files\Salaat Time\SalaatTime.exe
04 - HKU\S-1-5-21-3360321568-3577047653-1866379785-1000\..\Run : [Google Update] "C:\Users\AUICE\AppData\Local\Google\Update\GoogleUpdate.exe" /c
04 - HKU\S-1-5-21-3360321568-3577047653-1866379785-1000\..\Run : [] C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
04 - HKU\S-1-5-21-3360321568-3577047653-1866379785-1000\..\Run : [OfficeSyncProcess] "C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE"
04 - HKU\S-1-5-21-3360321568-3577047653-1866379785-1000\..\Run : [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"
################## | Recherche générique |
Présent! G:\Recycler\S-5-3-42-2819952290-8240758988-879315005-3665
################## | Registre |
Présent! HKLM\Software\DoesNotExist
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitguard.exe
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bprotect.exe
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browsemngr.exe
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browserdefender.exe
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browsermngr.exe
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browserprotect.exe
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bundlesweetimsetup.exe
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cltmngsvc.exe
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\delta babylon.exe
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\delta tb.exe
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\delta2.exe
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\deltainstaller.exe
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\deltasetup.exe
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\deltatb.exe
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\deltatb_2501-c733154b.exe
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iminentsetup.exe
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rjatydimofu.exe
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sweetimsetup.exe
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbdelta.exetoolbar783881609.exe
################## | Vaccin |
C:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
D:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
G:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
################## | E.O.F | https://www.usbfix.net/ - https://www.sosvirus.net/ |
J'ai ma clé usb qui est infectée. Pourriez vous vérifier le rapport afin de la désinfectée svp?
Merci,
############################## | UsbFix V 7.164 | [Recherche]
Utilisateur: AUICE (Administrateur) # CHARLEROIMG
Mis à jour le05/02/2014 par El Desaparecido - Team SosVirus
Lancé à 22:42:55 | 11/02/2014
Site Web : https://www.usbfix.net/
Changelog : https://www.usb-antivirus.com/fr/maj/
Support : https://www.sosvirus.net/
Upload Malware : http://www.sosvirus.net/upload_malware.php
Contact : https://www.usb-antivirus.com/fr/contact/
PC: SAMSUNG ELECTRONICS CO., LTD. (R530/R730 )
CPU: Pentium(R) Dual-Core CPU T4500 @ 2.30GHz
RAM -> [Total : 3033 Mo| Free : 1597 Mo]
Bios: Phoenix Technologies Ltd.
Boot: Normal boot
OS: Microsoft Windows 7 Édition Familiale Premium (6.1.7601 32-Bit) Service Pack 1
WB: Windows Internet Explorer : 9.0.8112.16421
WB: Mozilla Firefox : 26.0
SC: Security Center [Enabled]
WU: Windows Update [Enabled]
AV: avast! Antivirus [(!) Disabled | Updated]
AS: avast! Antivirus [(!) Disabled | Updated]
AS: Windows Defender [(!) Disabled | Updated]
FW: Windows FireWall [Enabled]
C:\ (%systemdrive%) -> Disque fixe # 139 Go (52 Go libre(s) - 37%) [] # NTFS
D:\ -> Disque fixe # 139 Go (91 Go libre(s) - 65%) [] # NTFS
E:\ -> CD-ROM
G:\ -> Disque amovible # 15 Go (14 Go libre(s) - 95%) [SANDISK 16G] # FAT32
################## | Processus Actif |
C:\windows\system32\csrss.exe (ID: 496 |ParentID: 444)
C:\windows\system32\wininit.exe (ID: 548 |ParentID: 444)
C:\windows\system32\csrss.exe (ID: 556 |ParentID: 540)
C:\windows\system32\services.exe (ID: 604 |ParentID: 548)
C:\windows\system32\lsass.exe (ID: 620 |ParentID: 548)
C:\windows\system32\lsm.exe (ID: 628 |ParentID: 548)
C:\windows\system32\winlogon.exe (ID: 716 |ParentID: 540)
C:\windows\system32\svchost.exe (ID: 780 |ParentID: 604)
C:\windows\system32\svchost.exe (ID: 876 |ParentID: 604)
C:\windows\System32\svchost.exe (ID: 940 |ParentID: 604)
C:\windows\System32\svchost.exe (ID: 1012 |ParentID: 604)
C:\windows\system32\svchost.exe (ID: 1056 |ParentID: 604)
C:\windows\system32\svchost.exe (ID: 1176 |ParentID: 604)
C:\windows\system32\svchost.exe (ID: 1276 |ParentID: 604)
C:\windows\System32\spoolsv.exe (ID: 1572 |ParentID: 604)
C:\windows\system32\taskhost.exe (ID: 1636 |ParentID: 604)
C:\windows\system32\svchost.exe (ID: 1668 |ParentID: 604)
C:\windows\system32\Dwm.exe (ID: 1680 |ParentID: 1012)
C:\windows\Explorer.EXE (ID: 1728 |ParentID: 1648)
C:\windows\system32\svchost.exe (ID: 1752 |ParentID: 604)
C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (ID: 1928 |ParentID: 604)
C:\windows\system32\svchost.exe (ID: 1988 |ParentID: 604)
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe (ID: 2016 |ParentID: 604)
C:\windows\System32\svchost.exe (ID: 448 |ParentID: 604)
C:\windows\System32\svchost.exe (ID: 544 |ParentID: 604)
C:\Program Files\CyberLink\Shared files\RichVideo.exe (ID: 956 |ParentID: 604)
C:\windows\system32\svchost.exe (ID: 2060 |ParentID: 604)
C:\windows\System32\svchost.exe (ID: 2096 |ParentID: 604)
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (ID: 2160 |ParentID: 604)
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (ID: 2368 |ParentID: 2160)
C:\windows\system32\taskeng.exe (ID: 2612 |ParentID: 1056)
C:\windows\system32\svchost.exe (ID: 3120 |ParentID: 604)
C:\Windows\system32\WUDFHost.exe (ID: 3232 |ParentID: 1012)
C:\windows\system32\svchost.exe (ID: 3352 |ParentID: 604)
C:\windows\System32\rundll32.exe (ID: 3624 |ParentID: 780)
C:\Program Files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe (ID: 3668 |ParentID: 2612)
C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe (ID: 3712 |ParentID: 2612)
C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe (ID: 3732 |ParentID: 2612)
C:\Program Files\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe (ID: 3784 |ParentID: 2612)
C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe (ID: 3808 |ParentID: 2612)
C:\windows\system32\igfxext.exe (ID: 3872 |ParentID: 780)
C:\windows\system32\igfxsrvc.exe (ID: 3900 |ParentID: 780)
C:\windows\system32\SearchIndexer.exe (ID: 3424 |ParentID: 604)
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (ID: 3664 |ParentID: 1728)
C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe (ID: 1116 |ParentID: 1728)
C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe (ID: 4076 |ParentID: 1728)
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (ID: 412 |ParentID: 1728)
C:\Windows\System32\igfxtray.exe (ID: 4004 |ParentID: 1728)
C:\Windows\System32\hkcmd.exe (ID: 2604 |ParentID: 1728)
C:\Windows\System32\igfxpers.exe (ID: 2408 |ParentID: 1728)
C:\Program Files\Adobe\Acrobat 10.0\Acrobat\acrotray.exe (ID: 3592 |ParentID: 1728)
C:\Program Files\AVAST Software\Avast\AvastUI.exe (ID: 3032 |ParentID: 1728)
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (ID: 2596 |ParentID: 412)
C:\Program Files\Common Files\Java\Java Update\jusched.exe (ID: 3432 |ParentID: 1728)
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe (ID: 3312 |ParentID: 1728)
C:\Program Files\Windows Sidebar\sidebar.exe (ID: 1652 |ParentID: 1728)
C:\Users\AUICE\AppData\Roaming\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe (ID: 3556 |ParentID: 1728)
C:\Program Files\Salaat Time\SalaatTime.exe (ID: 4400 |ParentID: 1728)
C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE (ID: 4432 |ParentID: 1728)
C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe (ID: 4456 |ParentID: 1728)
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (ID: 4480 |ParentID: 1728)
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe (ID: 4584 |ParentID: 604)
C:\Program Files\AVAST Software\Avast\AvastSvc.exe (ID: 4620 |ParentID: 604)
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe (ID: 4676 |ParentID: 780)
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe (ID: 5784 |ParentID: 4480)
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe (ID: 5984 |ParentID: 780)
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe (ID: 6088 |ParentID: 780)
C:\Program Files\Adobe\Elements 10 Organizer\PhotoshopElementsFileAgent.exe (ID: 4048 |ParentID: 604)
C:\Program Files\Windows Media Player\wmpnetwk.exe (ID: 3224 |ParentID: 604)
C:\Program Files\Mozilla Firefox\firefox.exe (ID: 6124 |ParentID: 1728)
C:\Program Files\Common Files\Java\Java Update\jucheck.exe (ID: 4444 |ParentID: 3432)
C:\Program Files\Mozilla Firefox\plugin-container.exe (ID: 1376 |ParentID: 6124)
C:\windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_44.exe (ID: 6112 |ParentID: 1376)
C:\windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_44.exe (ID: 5684 |ParentID: 6112)
C:\windows\system32\msiexec.exe (ID: 2548 |ParentID: 604)
C:\Users\AUICE\AppData\Local\Temp\ARCompanionForSession1.exe (ID: 5440 |ParentID: 4416)
C:\windows\system32\wbem\wmiprvse.exe (ID: 5512 |ParentID: 780)
################## | Regedit Run |
04 - HKCU\..\Run : [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
04 - HKCU\..\Run : [Octoshape Streaming Services] "C:\Users\AUICE\AppData\Roaming\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe" -inv:bootrun
04 - HKCU\..\Run : [SalaatTime] C:\Program Files\Salaat Time\SalaatTime.exe
04 - HKCU\..\Run : [Google Update] "C:\Users\AUICE\AppData\Local\Google\Update\GoogleUpdate.exe" /c
04 - HKCU\..\Run : [] C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
04 - HKCU\..\Run : [OfficeSyncProcess] "C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE"
04 - HKCU\..\Run : [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"
04 - HKLM\..\Run : [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
04 - HKLM\..\Run : [UpdateLBPShortCut] "C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.5"
04 - HKLM\..\Run : [CLMLServer] "C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe"
04 - HKLM\..\Run : [UpdateP2GoShortCut] "C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"
04 - HKLM\..\Run : [UpdatePDRShortCut] "C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\PowerDirector" UpdateWithCreateOnce "Software\CyberLink\PowerDirector\7.0"
04 - HKLM\..\Run : [RemoteControl8] "C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe"
04 - HKLM\..\Run : [PDVD8LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe"
04 - HKLM\..\Run : [UpdatePPShortCut] "C:\Program Files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\PowerProducer" UpdateWithCreateOnce "Software\CyberLink\PowerProducer\5.0"
04 - HKLM\..\Run : [UpdatePSTShortCut] "C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\DVD Suite" UpdateWithCreateOnce "Software\CyberLink\PowerStarter"
04 - HKLM\..\Run : [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
04 - HKLM\..\Run : [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" UpdateWithCreateOnce "Software\CyberLink\YouCam\2.0"
04 - HKLM\..\Run : [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
04 - HKLM\..\Run : [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
04 - HKLM\..\Run : [IgfxTray] C:\windows\system32\igfxtray.exe
04 - HKLM\..\Run : [HotKeysCmds] C:\windows\system32\hkcmd.exe
04 - HKLM\..\Run : [Persistence] C:\windows\system32\igfxpers.exe
04 - HKLM\..\Run : [Adobe Acrobat Speed Launcher] "C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe"
04 - HKLM\..\Run : [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe"
04 - HKLM\..\Run : [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
04 - HKLM\..\Run : [BCSSync] "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices
04 - HKLM\..\Run : [AdobeAAMUpdater-1.0] "C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
04 - HKLM\..\Run : []
04 - HKLM\..\Run : [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
04 - HKLM\..\Run : [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
04 - HKU\S-1-5-21-3360321568-3577047653-1866379785-1000\..\Run : [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
04 - HKU\S-1-5-21-3360321568-3577047653-1866379785-1000\..\Run : [Octoshape Streaming Services] "C:\Users\AUICE\AppData\Roaming\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe" -inv:bootrun
04 - HKU\S-1-5-21-3360321568-3577047653-1866379785-1000\..\Run : [SalaatTime] C:\Program Files\Salaat Time\SalaatTime.exe
04 - HKU\S-1-5-21-3360321568-3577047653-1866379785-1000\..\Run : [Google Update] "C:\Users\AUICE\AppData\Local\Google\Update\GoogleUpdate.exe" /c
04 - HKU\S-1-5-21-3360321568-3577047653-1866379785-1000\..\Run : [] C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
04 - HKU\S-1-5-21-3360321568-3577047653-1866379785-1000\..\Run : [OfficeSyncProcess] "C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE"
04 - HKU\S-1-5-21-3360321568-3577047653-1866379785-1000\..\Run : [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"
################## | Recherche générique |
Présent! G:\Recycler\S-5-3-42-2819952290-8240758988-879315005-3665
################## | Registre |
Présent! HKLM\Software\DoesNotExist
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitguard.exe
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bprotect.exe
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browsemngr.exe
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browserdefender.exe
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browsermngr.exe
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browserprotect.exe
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bundlesweetimsetup.exe
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cltmngsvc.exe
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\delta babylon.exe
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\delta tb.exe
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\delta2.exe
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\deltainstaller.exe
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\deltasetup.exe
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\deltatb.exe
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\deltatb_2501-c733154b.exe
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iminentsetup.exe
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rjatydimofu.exe
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sweetimsetup.exe
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbdelta.exetoolbar783881609.exe
################## | Vaccin |
C:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
D:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
G:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
################## | E.O.F | https://www.usbfix.net/ - https://www.sosvirus.net/ |
A voir également:
- Rapport usbfix
- Plan rapport de stage - Guide
- Rapport erreur windows - Guide
- Impossible d'afficher le rapport de tableau croisé dynamique sur un rapport existant - Forum Excel
- Thème rapport de stage comptabilité - Forum Word
- Rapport sur le dark web - Accueil - Protection
25 réponses
J'ai toujours ce foutu virus!
Marou81
Messages postés
4175
Date d'inscription
Statut
Membre
Dernière intervention
198
tu parle de quel virus ?
husnu
Messages postés
391
Date d'inscription
Statut
Membre
Dernière intervention
24
les dossiers .exe
Marou81
Messages postés
4175
Date d'inscription
Statut
Membre
Dernière intervention
198
G:\Data SYSTEM.exe ce n'est pas un virus xD
husnu
Messages postés
391
Date d'inscription
Statut
Membre
Dernière intervention
24
C'est peut être pas un virus mais c'est une infection car dans chaque dossier de ma clé usb il y a un dossier portant le même nom avec une extension .exe
Marou81
Messages postés
4175
Date d'inscription
Statut
Membre
Dernière intervention
198
cette extension est apparu il y a peu seulement ou longtemps ?
Bonjour,
Des améliorations pour la clé ?
Refais moi un ZHPDiag. As-tu installé des programmes depuis ?
A+
Des améliorations pour la clé ?
Refais moi un ZHPDiag. As-tu installé des programmes depuis ?
A+
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
############################## | UsbFix V 7.169 | [Suppression]
Utilisateur: ndeye bane (Administrateur) # NDEYEBANE-PC
Mis à jour le 31/03/2014 par El Desaparecido - Team SosVirus
Lancé à 22:27:10 | 11/04/2014
Site Web : http://www.usbfix.net/
Changelog : http://www.usbfix.net/maj/
Support : http://www.sosvirus.net/forum-virus-securite.html
Upload Malware : http://www.sosvirus.net/upload_malware.php
Contact : http://www.usbfix.net/contact/
PC: Hewlett-Packard (1425)
CPU: Intel(R) Core(TM) i3 CPU M 350 @ 2.27GHz
RAM -> [Total : 2998 Mo| Free : 1266 Mo]
Bios: Hewlett-Packard
Boot: Normal boot
OS: Microsoft Windows 7 Édition Intégrale (6.1.7601 32-Bit) Service Pack 1
WB: Windows Internet Explorer : 11.0.9600.16659
WB: Google Chrome : 34.0.1847.116
SC: Security Center [Enabled]
WU: Windows Update [Enabled]
AV: avast! Antivirus [(!) Disabled | Updated]
AS: avast! Antivirus [(!) Disabled | Updated]
AS: Windows Defender [Enabled | Updated]
FW: Windows FireWall [(!) Disabled]
C:\ (%systemdrive%) -> Disque fixe # 578 Go (254 Go libre(s) - 44%) [] # NTFS
D:\ -> Disque fixe # 18 Go (3 Go libre(s) - 14%) [RECOVERY] # NTFS
E:\ -> Disque fixe # 99 Mo (89 Mo libre(s) - 90%) [HP_TOOLS] # FAT32
F:\ -> CD-ROM
I:\ -> Disque amovible # 7 Go (7 Go libre(s) - 100%) [] # FAT32
################## | Processus Actif |
C:\Windows\system32\csrss.exe (ID: 484 |ParentID: 440)
C:\Windows\system32\wininit.exe (ID: 524 |ParentID: 440)
C:\Windows\system32\csrss.exe (ID: 532 |ParentID: 516)
C:\Windows\system32\services.exe (ID: 580 |ParentID: 524)
C:\Windows\system32\lsass.exe (ID: 596 |ParentID: 524)
C:\Windows\system32\lsm.exe (ID: 604 |ParentID: 524)
C:\Windows\system32\winlogon.exe (ID: 684 |ParentID: 516)
C:\Windows\system32\svchost.exe (ID: 748 |ParentID: 580)
C:\Windows\system32\svchost.exe (ID: 844 |ParentID: 580)
C:\Windows\System32\svchost.exe (ID: 928 |ParentID: 580)
C:\Windows\System32\svchost.exe (ID: 968 |ParentID: 580)
C:\Windows\system32\svchost.exe (ID: 1008 |ParentID: 580)
C:\Windows\system32\svchost.exe (ID: 1048 |ParentID: 580)
C:\Windows\system32\svchost.exe (ID: 1288 |ParentID: 580)
C:\Program Files\AVAST Software\Avast\AvastSvc.exe (ID: 1376 |ParentID: 580)
C:\Windows\System32\spoolsv.exe (ID: 1480 |ParentID: 580)
C:\Windows\system32\svchost.exe (ID: 1540 |ParentID: 580)
C:\Windows\system32\taskhost.exe (ID: 1564 |ParentID: 580)
C:\Windows\system32\Dwm.exe (ID: 1664 |ParentID: 968)
C:\Windows\Explorer.EXE (ID: 1696 |ParentID: 1656)
C:\Windows\system32\taskeng.exe (ID: 1908 |ParentID: 1048)
C:\Program Files\ReviverSoft\Registry Reviver\RegistryReviver.exe (ID: 1024 |ParentID: 1908)
C:\Program Files\Realtek\Audio\HDA\AERTSrv.exe (ID: 2124 |ParentID: 580)
C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (ID: 2184 |ParentID: 580)
C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (ID: 2388 |ParentID: 1696)
C:\Program Files\Realtek\Audio\HDA\RtkNGUI.exe (ID: 2416 |ParentID: 1696)
C:\Windows\System32\igfxtray.exe (ID: 2452 |ParentID: 1696)
C:\Windows\system32\svchost.exe (ID: 2508 |ParentID: 580)
C:\Windows\System32\hkcmd.exe (ID: 2584 |ParentID: 1696)
C:\Windows\System32\igfxpers.exe (ID: 2792 |ParentID: 1696)
C:\Windows\system32\wbem\wmiprvse.exe (ID: 2852 |ParentID: 748)
C:\Program Files\AVAST Software\Avast\AvastUI.exe (ID: 2892 |ParentID: 1696)
C:\Program Files\Supercopier\supercopier.exe (ID: 2976 |ParentID: 1696)
C:\Program Files\Internet Download Manager\IDMan.exe (ID: 3168 |ParentID: 1696)
C:\Users\ndeye bane\AppData\Roaming\uTorrent\uTorrent.exe (ID: 3176 |ParentID: 1696)
C:\Program Files\Skype\Phone\Skype.exe (ID: 3324 |ParentID: 1696)
C:\Windows\System32\wscript.exe (ID: 3336 |ParentID: 1696)
C:\Windows\system32\SearchIndexer.exe (ID: 3784 |ParentID: 580)
C:\Program Files\Internet Download Manager\IEMonitor.exe (ID: 3984 |ParentID: 3168)
C:\Windows\System32\WUDFHost.exe (ID: 2104 |ParentID: 968)
C:\Windows\system32\svchost.exe (ID: 960 |ParentID: 580)
C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (ID: 1084 |ParentID: 580)
C:\Program Files\Realtek\RtVOsd\RtVOsdService.exe (ID: 4440 |ParentID: 580)
C:\Program Files\Realtek\RtVOsd\RtVOsd.exe (ID: 4516 |ParentID: 4440)
C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (ID: 4356 |ParentID: 580)
C:\Windows\System32\svchost.exe (ID: 4184 |ParentID: 580)
C:\Windows\system32\wuauclt.exe (ID: 5656 |ParentID: 1048)
C:\Program Files\Google\Chrome\Application\chrome.exe (ID: 4788 |ParentID: 1696)
C:\Program Files\Google\Chrome\Application\chrome.exe (ID: 1492 |ParentID: 4788)
C:\Program Files\Google\Chrome\Application\chrome.exe (ID: 2300 |ParentID: 4788)
C:\Program Files\Google\Chrome\Application\chrome.exe (ID: 5184 |ParentID: 4788)
C:\Program Files\Google\Chrome\Application\chrome.exe (ID: 4720 |ParentID: 4788)
C:\Program Files\Google\Chrome\Application\chrome.exe (ID: 5100 |ParentID: 4788)
C:\Windows\explorer.exe (ID: 5352 |ParentID: 748)
C:\Program Files\Google\Chrome\Application\chrome.exe (ID: 4584 |ParentID: 4788)
C:\Windows\system32\igfxsrvc.exe (ID: 4160 |ParentID: 748)
C:\Windows\system32\SearchProtocolHost.exe (ID: 1124 |ParentID: 3784)
C:\Windows\system32\SearchFilterHost.exe (ID: 4308 |ParentID: 3784)
################## | Recherche générique |
Supprimé! C:\Users\ndeye bane\AppData\Roaming\168816984_MicrosoftUpdate.vbe
Supprimé! I:\168816984_MicrosoftUpdate.vbe
Supprimé! I:\Recorded.lnk
Supprimé! I:\reggae.lnk
Supprimé! I:\salif keita.lnk
Supprimé! I:\sound.lnk
Supprimé! I:\tof dykha.lnk
Supprimé! I:\vocal.lnk
Supprimé! I:\blue.lnk
Supprimé! I:\boul khol.lnk
Supprimé! I:\CLIPS.lnk
Supprimé! I:\dcim.lnk
Supprimé! I:\dykha.lnk
Supprimé! I:\hits.lnk
Supprimé! I:\images.lnk
Supprimé! I:\medajox.lnk
Supprimé! I:\pac.lnk
Supprimé! I:\photos.lnk
Supprimé! C:\Windows.old\Users\El hadji DIOUKHANE\AppData\Roaming\168816984_MicrosoftUpdate.vbe
Supprimé! C:\Windows.old.001\Documents and Settings\ndeye bane\AppData\Roaming\168816984_MicrosoftUpdate.vbe
(!) Fichiers temporaires supprimés.
################## | Registre |
Supprimé! HKU\S-1-5-21-1481839596-1714043040-341275525-1000\Software\Microsoft\Windows\CurrentVersion\Run|168816984_MicrosoftUpdate
################## | Regedit Run |
F2 - HKLM\..\Winlogon : [Shell] explorer.exe
F2 - [x64] HKLM\..\Winlogon : [Shell] explorer.exe
F2 - HKLM\..\Winlogon : [Userinit] C:\Windows\system32\userinit.exe,
F2 - [x64] HKLM\..\Winlogon : [Userinit] C:\Windows\system32\userinit.exe,
04 - HKCU\..\Run : [ultracopier] "C:\Program Files\Supercopier\supercopier.exe"
04 - HKCU\..\Run : [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
04 - HKCU\..\Run : [uTorrent] "C:\Users\ndeye bane\AppData\Roaming\uTorrent\uTorrent.exe" /MINIMIZED
04 - HKCU\..\Run : [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
04 - HKLM\..\Run : [IAStorIcon] C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
04 - HKLM\..\Run : [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI.exe -s
04 - HKLM\..\Run : [IgfxTray] C:\Windows\system32\igfxtray.exe
04 - HKLM\..\Run : [HotKeysCmds] C:\Windows\system32\hkcmd.exe
04 - HKLM\..\Run : [Persistence] C:\Windows\system32\igfxpers.exe
04 - HKLM\..\Run : [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
04 - HKLM\..\RunOnce : []
04 - HKU\S-1-5-19\..\Run : [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
04 - HKU\S-1-5-20\..\Run : [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
04 - HKU\S-1-5-21-1481839596-1714043040-341275525-1000\..\Run : [ultracopier] "C:\Program Files\Supercopier\supercopier.exe"
04 - HKU\S-1-5-21-1481839596-1714043040-341275525-1000\..\Run : [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
04 - HKU\S-1-5-21-1481839596-1714043040-341275525-1000\..\Run : [uTorrent] "C:\Users\ndeye bane\AppData\Roaming\uTorrent\uTorrent.exe" /MINIMIZED
04 - HKU\S-1-5-21-1481839596-1714043040-341275525-1000\..\Run : [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
04 - HKU\S-1-5-19\..\RunOnce : [mctadmin] C:\Windows\System32\mctadmin.exe
04 - HKU\S-1-5-20\..\RunOnce : [mctadmin] C:\Windows\System32\mctadmin.exe
04 - HKU\S-1-5-18\..\RunOnce : [SPReview] "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"http://go.microsoft.com/fwlink/?LinkID=122915" /build:7601
################## | Listing |
[12/11/2011 - 17:32:54 | D] - C:\## aswSnx private storage
[01/04/2014 - 01:09:57 | SHD] - C:\$Recycle.Bin
[17/11/2013 - 22:01:58 | D] - C:\07445a3d2c9a5aa18d0de307414bc0e2
[17/01/2013 - 16:31:52 | D] - C:\0b31559e33e3c388b0c63f69
[17/01/2013 - 15:02:51 | D] - C:\0b7b773f3101a1b45bfccc51
[17/02/2012 - 15:01:51 | D] - C:\18653e907949ff7bdb
[12/05/2012 - 02:09:54 | D] - C:\1d1f493c8cc1b9e2501889c3357e
[19/01/2013 - 00:14:02 | D] - C:\218dbec242d4ac24ce0a
[24/10/2012 - 20:34:02 | D] - C:\2ce1929494a74a2b10e311ac87
[17/02/2012 - 15:10:03 | D] - C:\345a19b28c71242ab8c851d2b5
[22/07/2013 - 19:04:43 | D] - C:\3829e3759777b059f8
[18/11/2013 - 15:22:54 | D] - C:\7546dc9756c6a8ac4229817578c4
[14/06/2012 - 23:56:59 | D] - C:\780b12edb59bee3ada
[31/01/2014 - 02:54:48 | D] - C:\85a9360bcf585ac0067846d390cf
[11/05/2012 - 14:35:33 | D] - C:\928351d483a76017845306
[11/05/2012 - 16:09:57 | D] - C:\96aea0170b4909fd0383451f4d7e26
[17/01/2013 - 17:09:32 | D] - C:\a11b92056af07f095531
[11/05/2012 - 14:45:58 | D] - C:\acde135f6f0c2a0967f6320867
[10/06/2009 - 23:42:20 | A | 0 Ko] - C:\autoexec.bat
[23/10/2010 - 03:56:09 | SHD] - C:\boot
[14/07/2009 - 03:38:58 | RASH | 375 Ko] - C:\bootmgr
[12/04/2012 - 23:50:39 | D] - C:\c88b890e79bee0ed9d
[28/02/2014 - 01:45:28 | N | 0 Ko | A877BA11F92A20DE14F249C27639593F] - C:\CKINFO.TXT
[05/04/2014 - 18:05:07 | D] - C:\Config.Msi
[10/06/2009 - 23:42:20 | N | 0 Ko] - C:\config.sys
[14/07/2009 - 06:53:55 | SHD] - C:\Documents and Settings
[28/02/2014 - 00:24:20 | N | 0 Ko] - C:\END
[28/03/2014 - 07:58:12 | D] - C:\Epi_Info
[07/11/2007 - 15:00:40 | N | 17 Ko | 9147A93F43D8E58218EBCB15FDA888C9] - C:\eula.1028.txt
[07/11/2007 - 15:00:40 | N | 17 Ko | 9147A93F43D8E58218EBCB15FDA888C9] - C:\eula.1031.txt
[07/11/2007 - 15:00:40 | N | 10 Ko | 99C22D4A31F4EAD4351B71D6F4E5F6A1] - C:\eula.1033.txt
[07/11/2007 - 15:00:40 | N | 17 Ko | 9147A93F43D8E58218EBCB15FDA888C9] - C:\eula.1036.txt
[07/11/2007 - 15:00:40 | N | 17 Ko | 9147A93F43D8E58218EBCB15FDA888C9] - C:\eula.1040.txt
[07/11/2007 - 15:00:40 | N | 0 Ko | 9B15A3A055CC6E67EA191A1B7885649A] - C:\eula.1041.txt
[07/11/2007 - 15:00:40 | N | 17 Ko | 9147A93F43D8E58218EBCB15FDA888C9] - C:\eula.1042.txt
[07/11/2007 - 15:00:40 | N | 17 Ko | 9147A93F43D8E58218EBCB15FDA888C9] - C:\eula.2052.txt
[07/11/2007 - 15:00:40 | N | 17 Ko | 9147A93F43D8E58218EBCB15FDA888C9] - C:\eula.3082.txt
[18/01/2013 - 18:15:13 | D] - C:\f1f8ea6ecbb2af3807b8
[14/06/2012 - 22:04:46 | D] - C:\fb8628cd1102d15bd5651534
[07/11/2007 - 15:00:40 | N | 1 Ko] - C:\globdata.ini
[11/04/2014 - 20:14:32 | ASH | 2302356 Ko] - C:\hiberfil.sys
[20/12/2010 - 01:54:11 | D] - C:\HP
[01/04/2014 - 21:05:37 | N | 0 Ko] - C:\IDMSetup2.log
[07/11/2007 - 15:44:20 | N | 835 Ko | E015A2D8890E2A96A93CA818F834C45B] - C:\install.exe
[07/11/2007 - 15:00:40 | N | 1 Ko] - C:\install.ini
[07/11/2007 - 15:44:20 | N | 74 Ko | 8F05FE39BDD336C8FA2A18EC3DFE418C] - C:\install.res.1028.dll
[07/11/2007 - 15:44:20 | N | 93 Ko | 7D9EBB7DCA62BA75361346CAF4EC196B] - C:\install.res.1031.dll
[07/11/2007 - 15:44:20 | N | 88 Ko | 43FB29E3A676D26FCBF0352207991523] - C:\install.res.1033.dll
[07/11/2007 - 15:44:20 | N | 94 Ko | 37C8A4717B40540816A3B92C470FD58F] - C:\install.res.1036.dll
[07/11/2007 - 15:44:20 | N | 92 Ko | 03576876C7E9A5B44EB7916492B5B0F6] - C:\install.res.1040.dll
[07/11/2007 - 15:44:20 | N | 79 Ko | A3946D3C9ED130AF89D1C1A9E63DEAA6] - C:\install.res.1041.dll
[07/11/2007 - 15:44:20 | N | 77 Ko | A5CFFE01D83AFECCD9590B4D696AA44E] - C:\install.res.1042.dll
[07/11/2007 - 15:44:20 | N | 73 Ko | 213BF3AD8A5F31C021BBE011D6460752] - C:\install.res.2052.dll
[07/11/2007 - 15:44:20 | N | 93 Ko | FACD045628070999B43EB7C13AB2E0FE] - C:\install.res.3082.dll
[20/12/2010 - 01:32:03 | D] - C:\Intel
[27/10/2011 - 22:29:22 | N | 0 Ko] - C:\law.sp
[27/02/2014 - 23:12:42 | D] - C:\Log
[05/06/2011 - 15:23:53 | RHD] - C:\MSOCache
[28/03/2014 - 07:58:12 | D] - C:\Natom
[11/04/2014 - 20:14:37 | ASH | 3069808 Ko] - C:\pagefile.sys
[14/07/2009 - 04:37:05 | D] - C:\PerfLogs
[05/04/2014 - 02:29:54 | D] - C:\Program Files
[01/04/2014 - 00:27:19 | D] - C:\Program Files (x86)
[04/04/2014 - 22:03:02 | HD] - C:\ProgramData
[01/04/2014 - 01:09:21 | SHD] - C:\Recovery
[09/06/2012 - 04:08:42 | D] - C:\recuperation dame
[19/01/2012 - 22:18:53 | D] - C:\sunuradio
[13/12/2012 - 21:11:44 | D] - C:\SwSetup
[09/04/2014 - 01:57:45 | SHD] - C:\System Volume Information
[31/05/2011 - 00:13:03 | D] - C:\SYSTEM.SAV
[11/04/2014 - 22:25:55 | D] - C:\UsbFix
[31/03/2014 - 18:09:06 | N | 8 Ko | 16EFF81932B190DDBC4DB2B0BFF2588F] - C:\UsbFix [Clean 2] ELHADJIDIOUKHAN.txt
[11/04/2014 - 22:44:22 | A | 13 Ko | E769D2180A12B1B67608393E0FC220BE] - C:\UsbFix [Clean 2] NDEYEBANE-PC.txt
[31/03/2014 - 17:37:16 | N | 11 Ko | 1E0DFCD97C61EBC07E306BD45E2AA644] - C:\UsbFix [Scan 1] ELHADJIDIOUKHAN.txt
[31/03/2014 - 17:45:13 | N | 11 Ko | 91C87CAE75BAC5105B8FD7F3DBC95669] - C:\UsbFix [Scan 2] ELHADJIDIOUKHAN.txt
[01/04/2014 - 01:09:39 | D] - C:\Users
[07/11/2007 - 15:00:40 | N | 6 Ko] - C:\vcredist.bmp
[07/11/2007 - 15:50:40 | N | 1883 Ko] - C:\VC_RED.cab
[07/11/2007 - 15:53:12 | N | 237 Ko] - C:\VC_RED.MSI
[05/04/2014 - 18:04:03 | D] - C:\Windows
[31/03/2014 - 18:02:44 | D] - C:\Windows.old
[31/03/2014 - 18:47:26 | D] - C:\Windows.old.000
[01/04/2014 - 01:51:01 | D] - C:\Windows.old.001
[01/04/2014 - 01:09:57 | SHD] - D:\$RECYCLE.BIN
[31/05/2011 - 00:17:53 | SHD] - D:\boot
[14/07/2009 - 20:39:00 | ASH | 375 Ko] - D:\bootmgr
[31/05/2011 - 00:17:52 | N | 0 Ko] - D:\BT_HP.FLG
[20/12/2010 - 11:30:01 | N | 0 Ko] - D:\CSP.DAT
[31/05/2011 - 00:17:53 | D] - D:\hp
[26/01/2012 - 20:12:43 | N | 0 Ko | 600C611B6C950F8B50EBF8C8C6AA73B1] - D:\HPSF_Rep.txt
[31/05/2011 - 00:17:44 | N | 0 Ko] - D:\HP_WSD.dat
[31/05/2011 - 00:17:52 | N | 0 Ko] - D:\language.ini
[31/05/2011 - 00:17:53 | SHD] - D:\preload
[27/10/2011 - 23:01:38 | SD] - D:\Recovery
[20/12/2010 - 11:40:08 | N | 0 Ko] - D:\RPCONFIG.LOG
[05/06/2011 - 16:02:56 | SHD] - D:\System Volume Information
[31/05/2011 - 00:17:53 | D] - D:\system.sav
[20/12/2010 - 01:01:56 | SHD] - E:\$RECYCLE.BIN
[31/03/2014 - 16:51:36 | D] - E:\Hewlett-Packard
[15/09/2011 - 18:29:50 | N | 0 Ko] - E:\HP_WSD.dat
[26/01/2012 - 13:12:44 | N | 0 Ko | 600C611B6C950F8B50EBF8C8C6AA73B1] - E:\HPSF_Rep.txt
[29/01/2012 - 19:37:12 | N | 4467 Ko] - E:\Gaston_ wa hood.mp3
[11/04/2014 - 22:06:14 | D] - I:\Recorded
[11/04/2014 - 22:06:14 | D] - I:\reggae
[11/04/2014 - 22:06:14 | D] - I:\salif keita
[11/04/2014 - 22:06:14 | D] - I:\sound
[11/04/2014 - 22:06:16 | D] - I:\tof dykha
[11/04/2014 - 22:06:16 | D] - I:\vocal
[11/04/2014 - 22:06:16 | D] - I:\blue
[11/04/2014 - 22:06:16 | D] - I:\boul khol
[11/04/2014 - 22:06:16 | D] - I:\CLIPS
[11/04/2014 - 22:06:16 | D] - I:\dcim
[11/04/2014 - 22:06:18 | D] - I:\dykha
[11/04/2014 - 22:06:18 | D] - I:\hits
[11/04/2014 - 22:06:24 | D] - I:\images
[11/04/2014 - 22:06:24 | D] - I:\medajox
[11/04/2014 - 22:06:34 | D] - I:\pac
[11/04/2014 - 22:06:36 | D] - I:\photos
################## | Vaccin |
D:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
E:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
I:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
################## | E.O.F | http://www.usbfix.net/ - http://www.sosvirus.net |
Utilisateur: ndeye bane (Administrateur) # NDEYEBANE-PC
Mis à jour le 31/03/2014 par El Desaparecido - Team SosVirus
Lancé à 22:27:10 | 11/04/2014
Site Web : http://www.usbfix.net/
Changelog : http://www.usbfix.net/maj/
Support : http://www.sosvirus.net/forum-virus-securite.html
Upload Malware : http://www.sosvirus.net/upload_malware.php
Contact : http://www.usbfix.net/contact/
PC: Hewlett-Packard (1425)
CPU: Intel(R) Core(TM) i3 CPU M 350 @ 2.27GHz
RAM -> [Total : 2998 Mo| Free : 1266 Mo]
Bios: Hewlett-Packard
Boot: Normal boot
OS: Microsoft Windows 7 Édition Intégrale (6.1.7601 32-Bit) Service Pack 1
WB: Windows Internet Explorer : 11.0.9600.16659
WB: Google Chrome : 34.0.1847.116
SC: Security Center [Enabled]
WU: Windows Update [Enabled]
AV: avast! Antivirus [(!) Disabled | Updated]
AS: avast! Antivirus [(!) Disabled | Updated]
AS: Windows Defender [Enabled | Updated]
FW: Windows FireWall [(!) Disabled]
C:\ (%systemdrive%) -> Disque fixe # 578 Go (254 Go libre(s) - 44%) [] # NTFS
D:\ -> Disque fixe # 18 Go (3 Go libre(s) - 14%) [RECOVERY] # NTFS
E:\ -> Disque fixe # 99 Mo (89 Mo libre(s) - 90%) [HP_TOOLS] # FAT32
F:\ -> CD-ROM
I:\ -> Disque amovible # 7 Go (7 Go libre(s) - 100%) [] # FAT32
################## | Processus Actif |
C:\Windows\system32\csrss.exe (ID: 484 |ParentID: 440)
C:\Windows\system32\wininit.exe (ID: 524 |ParentID: 440)
C:\Windows\system32\csrss.exe (ID: 532 |ParentID: 516)
C:\Windows\system32\services.exe (ID: 580 |ParentID: 524)
C:\Windows\system32\lsass.exe (ID: 596 |ParentID: 524)
C:\Windows\system32\lsm.exe (ID: 604 |ParentID: 524)
C:\Windows\system32\winlogon.exe (ID: 684 |ParentID: 516)
C:\Windows\system32\svchost.exe (ID: 748 |ParentID: 580)
C:\Windows\system32\svchost.exe (ID: 844 |ParentID: 580)
C:\Windows\System32\svchost.exe (ID: 928 |ParentID: 580)
C:\Windows\System32\svchost.exe (ID: 968 |ParentID: 580)
C:\Windows\system32\svchost.exe (ID: 1008 |ParentID: 580)
C:\Windows\system32\svchost.exe (ID: 1048 |ParentID: 580)
C:\Windows\system32\svchost.exe (ID: 1288 |ParentID: 580)
C:\Program Files\AVAST Software\Avast\AvastSvc.exe (ID: 1376 |ParentID: 580)
C:\Windows\System32\spoolsv.exe (ID: 1480 |ParentID: 580)
C:\Windows\system32\svchost.exe (ID: 1540 |ParentID: 580)
C:\Windows\system32\taskhost.exe (ID: 1564 |ParentID: 580)
C:\Windows\system32\Dwm.exe (ID: 1664 |ParentID: 968)
C:\Windows\Explorer.EXE (ID: 1696 |ParentID: 1656)
C:\Windows\system32\taskeng.exe (ID: 1908 |ParentID: 1048)
C:\Program Files\ReviverSoft\Registry Reviver\RegistryReviver.exe (ID: 1024 |ParentID: 1908)
C:\Program Files\Realtek\Audio\HDA\AERTSrv.exe (ID: 2124 |ParentID: 580)
C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (ID: 2184 |ParentID: 580)
C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (ID: 2388 |ParentID: 1696)
C:\Program Files\Realtek\Audio\HDA\RtkNGUI.exe (ID: 2416 |ParentID: 1696)
C:\Windows\System32\igfxtray.exe (ID: 2452 |ParentID: 1696)
C:\Windows\system32\svchost.exe (ID: 2508 |ParentID: 580)
C:\Windows\System32\hkcmd.exe (ID: 2584 |ParentID: 1696)
C:\Windows\System32\igfxpers.exe (ID: 2792 |ParentID: 1696)
C:\Windows\system32\wbem\wmiprvse.exe (ID: 2852 |ParentID: 748)
C:\Program Files\AVAST Software\Avast\AvastUI.exe (ID: 2892 |ParentID: 1696)
C:\Program Files\Supercopier\supercopier.exe (ID: 2976 |ParentID: 1696)
C:\Program Files\Internet Download Manager\IDMan.exe (ID: 3168 |ParentID: 1696)
C:\Users\ndeye bane\AppData\Roaming\uTorrent\uTorrent.exe (ID: 3176 |ParentID: 1696)
C:\Program Files\Skype\Phone\Skype.exe (ID: 3324 |ParentID: 1696)
C:\Windows\System32\wscript.exe (ID: 3336 |ParentID: 1696)
C:\Windows\system32\SearchIndexer.exe (ID: 3784 |ParentID: 580)
C:\Program Files\Internet Download Manager\IEMonitor.exe (ID: 3984 |ParentID: 3168)
C:\Windows\System32\WUDFHost.exe (ID: 2104 |ParentID: 968)
C:\Windows\system32\svchost.exe (ID: 960 |ParentID: 580)
C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (ID: 1084 |ParentID: 580)
C:\Program Files\Realtek\RtVOsd\RtVOsdService.exe (ID: 4440 |ParentID: 580)
C:\Program Files\Realtek\RtVOsd\RtVOsd.exe (ID: 4516 |ParentID: 4440)
C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (ID: 4356 |ParentID: 580)
C:\Windows\System32\svchost.exe (ID: 4184 |ParentID: 580)
C:\Windows\system32\wuauclt.exe (ID: 5656 |ParentID: 1048)
C:\Program Files\Google\Chrome\Application\chrome.exe (ID: 4788 |ParentID: 1696)
C:\Program Files\Google\Chrome\Application\chrome.exe (ID: 1492 |ParentID: 4788)
C:\Program Files\Google\Chrome\Application\chrome.exe (ID: 2300 |ParentID: 4788)
C:\Program Files\Google\Chrome\Application\chrome.exe (ID: 5184 |ParentID: 4788)
C:\Program Files\Google\Chrome\Application\chrome.exe (ID: 4720 |ParentID: 4788)
C:\Program Files\Google\Chrome\Application\chrome.exe (ID: 5100 |ParentID: 4788)
C:\Windows\explorer.exe (ID: 5352 |ParentID: 748)
C:\Program Files\Google\Chrome\Application\chrome.exe (ID: 4584 |ParentID: 4788)
C:\Windows\system32\igfxsrvc.exe (ID: 4160 |ParentID: 748)
C:\Windows\system32\SearchProtocolHost.exe (ID: 1124 |ParentID: 3784)
C:\Windows\system32\SearchFilterHost.exe (ID: 4308 |ParentID: 3784)
################## | Recherche générique |
Supprimé! C:\Users\ndeye bane\AppData\Roaming\168816984_MicrosoftUpdate.vbe
Supprimé! I:\168816984_MicrosoftUpdate.vbe
Supprimé! I:\Recorded.lnk
Supprimé! I:\reggae.lnk
Supprimé! I:\salif keita.lnk
Supprimé! I:\sound.lnk
Supprimé! I:\tof dykha.lnk
Supprimé! I:\vocal.lnk
Supprimé! I:\blue.lnk
Supprimé! I:\boul khol.lnk
Supprimé! I:\CLIPS.lnk
Supprimé! I:\dcim.lnk
Supprimé! I:\dykha.lnk
Supprimé! I:\hits.lnk
Supprimé! I:\images.lnk
Supprimé! I:\medajox.lnk
Supprimé! I:\pac.lnk
Supprimé! I:\photos.lnk
Supprimé! C:\Windows.old\Users\El hadji DIOUKHANE\AppData\Roaming\168816984_MicrosoftUpdate.vbe
Supprimé! C:\Windows.old.001\Documents and Settings\ndeye bane\AppData\Roaming\168816984_MicrosoftUpdate.vbe
(!) Fichiers temporaires supprimés.
################## | Registre |
Supprimé! HKU\S-1-5-21-1481839596-1714043040-341275525-1000\Software\Microsoft\Windows\CurrentVersion\Run|168816984_MicrosoftUpdate
################## | Regedit Run |
F2 - HKLM\..\Winlogon : [Shell] explorer.exe
F2 - [x64] HKLM\..\Winlogon : [Shell] explorer.exe
F2 - HKLM\..\Winlogon : [Userinit] C:\Windows\system32\userinit.exe,
F2 - [x64] HKLM\..\Winlogon : [Userinit] C:\Windows\system32\userinit.exe,
04 - HKCU\..\Run : [ultracopier] "C:\Program Files\Supercopier\supercopier.exe"
04 - HKCU\..\Run : [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
04 - HKCU\..\Run : [uTorrent] "C:\Users\ndeye bane\AppData\Roaming\uTorrent\uTorrent.exe" /MINIMIZED
04 - HKCU\..\Run : [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
04 - HKLM\..\Run : [IAStorIcon] C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
04 - HKLM\..\Run : [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI.exe -s
04 - HKLM\..\Run : [IgfxTray] C:\Windows\system32\igfxtray.exe
04 - HKLM\..\Run : [HotKeysCmds] C:\Windows\system32\hkcmd.exe
04 - HKLM\..\Run : [Persistence] C:\Windows\system32\igfxpers.exe
04 - HKLM\..\Run : [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
04 - HKLM\..\RunOnce : []
04 - HKU\S-1-5-19\..\Run : [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
04 - HKU\S-1-5-20\..\Run : [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
04 - HKU\S-1-5-21-1481839596-1714043040-341275525-1000\..\Run : [ultracopier] "C:\Program Files\Supercopier\supercopier.exe"
04 - HKU\S-1-5-21-1481839596-1714043040-341275525-1000\..\Run : [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
04 - HKU\S-1-5-21-1481839596-1714043040-341275525-1000\..\Run : [uTorrent] "C:\Users\ndeye bane\AppData\Roaming\uTorrent\uTorrent.exe" /MINIMIZED
04 - HKU\S-1-5-21-1481839596-1714043040-341275525-1000\..\Run : [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
04 - HKU\S-1-5-19\..\RunOnce : [mctadmin] C:\Windows\System32\mctadmin.exe
04 - HKU\S-1-5-20\..\RunOnce : [mctadmin] C:\Windows\System32\mctadmin.exe
04 - HKU\S-1-5-18\..\RunOnce : [SPReview] "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"http://go.microsoft.com/fwlink/?LinkID=122915" /build:7601
################## | Listing |
[12/11/2011 - 17:32:54 | D] - C:\## aswSnx private storage
[01/04/2014 - 01:09:57 | SHD] - C:\$Recycle.Bin
[17/11/2013 - 22:01:58 | D] - C:\07445a3d2c9a5aa18d0de307414bc0e2
[17/01/2013 - 16:31:52 | D] - C:\0b31559e33e3c388b0c63f69
[17/01/2013 - 15:02:51 | D] - C:\0b7b773f3101a1b45bfccc51
[17/02/2012 - 15:01:51 | D] - C:\18653e907949ff7bdb
[12/05/2012 - 02:09:54 | D] - C:\1d1f493c8cc1b9e2501889c3357e
[19/01/2013 - 00:14:02 | D] - C:\218dbec242d4ac24ce0a
[24/10/2012 - 20:34:02 | D] - C:\2ce1929494a74a2b10e311ac87
[17/02/2012 - 15:10:03 | D] - C:\345a19b28c71242ab8c851d2b5
[22/07/2013 - 19:04:43 | D] - C:\3829e3759777b059f8
[18/11/2013 - 15:22:54 | D] - C:\7546dc9756c6a8ac4229817578c4
[14/06/2012 - 23:56:59 | D] - C:\780b12edb59bee3ada
[31/01/2014 - 02:54:48 | D] - C:\85a9360bcf585ac0067846d390cf
[11/05/2012 - 14:35:33 | D] - C:\928351d483a76017845306
[11/05/2012 - 16:09:57 | D] - C:\96aea0170b4909fd0383451f4d7e26
[17/01/2013 - 17:09:32 | D] - C:\a11b92056af07f095531
[11/05/2012 - 14:45:58 | D] - C:\acde135f6f0c2a0967f6320867
[10/06/2009 - 23:42:20 | A | 0 Ko] - C:\autoexec.bat
[23/10/2010 - 03:56:09 | SHD] - C:\boot
[14/07/2009 - 03:38:58 | RASH | 375 Ko] - C:\bootmgr
[12/04/2012 - 23:50:39 | D] - C:\c88b890e79bee0ed9d
[28/02/2014 - 01:45:28 | N | 0 Ko | A877BA11F92A20DE14F249C27639593F] - C:\CKINFO.TXT
[05/04/2014 - 18:05:07 | D] - C:\Config.Msi
[10/06/2009 - 23:42:20 | N | 0 Ko] - C:\config.sys
[14/07/2009 - 06:53:55 | SHD] - C:\Documents and Settings
[28/02/2014 - 00:24:20 | N | 0 Ko] - C:\END
[28/03/2014 - 07:58:12 | D] - C:\Epi_Info
[07/11/2007 - 15:00:40 | N | 17 Ko | 9147A93F43D8E58218EBCB15FDA888C9] - C:\eula.1028.txt
[07/11/2007 - 15:00:40 | N | 17 Ko | 9147A93F43D8E58218EBCB15FDA888C9] - C:\eula.1031.txt
[07/11/2007 - 15:00:40 | N | 10 Ko | 99C22D4A31F4EAD4351B71D6F4E5F6A1] - C:\eula.1033.txt
[07/11/2007 - 15:00:40 | N | 17 Ko | 9147A93F43D8E58218EBCB15FDA888C9] - C:\eula.1036.txt
[07/11/2007 - 15:00:40 | N | 17 Ko | 9147A93F43D8E58218EBCB15FDA888C9] - C:\eula.1040.txt
[07/11/2007 - 15:00:40 | N | 0 Ko | 9B15A3A055CC6E67EA191A1B7885649A] - C:\eula.1041.txt
[07/11/2007 - 15:00:40 | N | 17 Ko | 9147A93F43D8E58218EBCB15FDA888C9] - C:\eula.1042.txt
[07/11/2007 - 15:00:40 | N | 17 Ko | 9147A93F43D8E58218EBCB15FDA888C9] - C:\eula.2052.txt
[07/11/2007 - 15:00:40 | N | 17 Ko | 9147A93F43D8E58218EBCB15FDA888C9] - C:\eula.3082.txt
[18/01/2013 - 18:15:13 | D] - C:\f1f8ea6ecbb2af3807b8
[14/06/2012 - 22:04:46 | D] - C:\fb8628cd1102d15bd5651534
[07/11/2007 - 15:00:40 | N | 1 Ko] - C:\globdata.ini
[11/04/2014 - 20:14:32 | ASH | 2302356 Ko] - C:\hiberfil.sys
[20/12/2010 - 01:54:11 | D] - C:\HP
[01/04/2014 - 21:05:37 | N | 0 Ko] - C:\IDMSetup2.log
[07/11/2007 - 15:44:20 | N | 835 Ko | E015A2D8890E2A96A93CA818F834C45B] - C:\install.exe
[07/11/2007 - 15:00:40 | N | 1 Ko] - C:\install.ini
[07/11/2007 - 15:44:20 | N | 74 Ko | 8F05FE39BDD336C8FA2A18EC3DFE418C] - C:\install.res.1028.dll
[07/11/2007 - 15:44:20 | N | 93 Ko | 7D9EBB7DCA62BA75361346CAF4EC196B] - C:\install.res.1031.dll
[07/11/2007 - 15:44:20 | N | 88 Ko | 43FB29E3A676D26FCBF0352207991523] - C:\install.res.1033.dll
[07/11/2007 - 15:44:20 | N | 94 Ko | 37C8A4717B40540816A3B92C470FD58F] - C:\install.res.1036.dll
[07/11/2007 - 15:44:20 | N | 92 Ko | 03576876C7E9A5B44EB7916492B5B0F6] - C:\install.res.1040.dll
[07/11/2007 - 15:44:20 | N | 79 Ko | A3946D3C9ED130AF89D1C1A9E63DEAA6] - C:\install.res.1041.dll
[07/11/2007 - 15:44:20 | N | 77 Ko | A5CFFE01D83AFECCD9590B4D696AA44E] - C:\install.res.1042.dll
[07/11/2007 - 15:44:20 | N | 73 Ko | 213BF3AD8A5F31C021BBE011D6460752] - C:\install.res.2052.dll
[07/11/2007 - 15:44:20 | N | 93 Ko | FACD045628070999B43EB7C13AB2E0FE] - C:\install.res.3082.dll
[20/12/2010 - 01:32:03 | D] - C:\Intel
[27/10/2011 - 22:29:22 | N | 0 Ko] - C:\law.sp
[27/02/2014 - 23:12:42 | D] - C:\Log
[05/06/2011 - 15:23:53 | RHD] - C:\MSOCache
[28/03/2014 - 07:58:12 | D] - C:\Natom
[11/04/2014 - 20:14:37 | ASH | 3069808 Ko] - C:\pagefile.sys
[14/07/2009 - 04:37:05 | D] - C:\PerfLogs
[05/04/2014 - 02:29:54 | D] - C:\Program Files
[01/04/2014 - 00:27:19 | D] - C:\Program Files (x86)
[04/04/2014 - 22:03:02 | HD] - C:\ProgramData
[01/04/2014 - 01:09:21 | SHD] - C:\Recovery
[09/06/2012 - 04:08:42 | D] - C:\recuperation dame
[19/01/2012 - 22:18:53 | D] - C:\sunuradio
[13/12/2012 - 21:11:44 | D] - C:\SwSetup
[09/04/2014 - 01:57:45 | SHD] - C:\System Volume Information
[31/05/2011 - 00:13:03 | D] - C:\SYSTEM.SAV
[11/04/2014 - 22:25:55 | D] - C:\UsbFix
[31/03/2014 - 18:09:06 | N | 8 Ko | 16EFF81932B190DDBC4DB2B0BFF2588F] - C:\UsbFix [Clean 2] ELHADJIDIOUKHAN.txt
[11/04/2014 - 22:44:22 | A | 13 Ko | E769D2180A12B1B67608393E0FC220BE] - C:\UsbFix [Clean 2] NDEYEBANE-PC.txt
[31/03/2014 - 17:37:16 | N | 11 Ko | 1E0DFCD97C61EBC07E306BD45E2AA644] - C:\UsbFix [Scan 1] ELHADJIDIOUKHAN.txt
[31/03/2014 - 17:45:13 | N | 11 Ko | 91C87CAE75BAC5105B8FD7F3DBC95669] - C:\UsbFix [Scan 2] ELHADJIDIOUKHAN.txt
[01/04/2014 - 01:09:39 | D] - C:\Users
[07/11/2007 - 15:00:40 | N | 6 Ko] - C:\vcredist.bmp
[07/11/2007 - 15:50:40 | N | 1883 Ko] - C:\VC_RED.cab
[07/11/2007 - 15:53:12 | N | 237 Ko] - C:\VC_RED.MSI
[05/04/2014 - 18:04:03 | D] - C:\Windows
[31/03/2014 - 18:02:44 | D] - C:\Windows.old
[31/03/2014 - 18:47:26 | D] - C:\Windows.old.000
[01/04/2014 - 01:51:01 | D] - C:\Windows.old.001
[01/04/2014 - 01:09:57 | SHD] - D:\$RECYCLE.BIN
[31/05/2011 - 00:17:53 | SHD] - D:\boot
[14/07/2009 - 20:39:00 | ASH | 375 Ko] - D:\bootmgr
[31/05/2011 - 00:17:52 | N | 0 Ko] - D:\BT_HP.FLG
[20/12/2010 - 11:30:01 | N | 0 Ko] - D:\CSP.DAT
[31/05/2011 - 00:17:53 | D] - D:\hp
[26/01/2012 - 20:12:43 | N | 0 Ko | 600C611B6C950F8B50EBF8C8C6AA73B1] - D:\HPSF_Rep.txt
[31/05/2011 - 00:17:44 | N | 0 Ko] - D:\HP_WSD.dat
[31/05/2011 - 00:17:52 | N | 0 Ko] - D:\language.ini
[31/05/2011 - 00:17:53 | SHD] - D:\preload
[27/10/2011 - 23:01:38 | SD] - D:\Recovery
[20/12/2010 - 11:40:08 | N | 0 Ko] - D:\RPCONFIG.LOG
[05/06/2011 - 16:02:56 | SHD] - D:\System Volume Information
[31/05/2011 - 00:17:53 | D] - D:\system.sav
[20/12/2010 - 01:01:56 | SHD] - E:\$RECYCLE.BIN
[31/03/2014 - 16:51:36 | D] - E:\Hewlett-Packard
[15/09/2011 - 18:29:50 | N | 0 Ko] - E:\HP_WSD.dat
[26/01/2012 - 13:12:44 | N | 0 Ko | 600C611B6C950F8B50EBF8C8C6AA73B1] - E:\HPSF_Rep.txt
[29/01/2012 - 19:37:12 | N | 4467 Ko] - E:\Gaston_ wa hood.mp3
[11/04/2014 - 22:06:14 | D] - I:\Recorded
[11/04/2014 - 22:06:14 | D] - I:\reggae
[11/04/2014 - 22:06:14 | D] - I:\salif keita
[11/04/2014 - 22:06:14 | D] - I:\sound
[11/04/2014 - 22:06:16 | D] - I:\tof dykha
[11/04/2014 - 22:06:16 | D] - I:\vocal
[11/04/2014 - 22:06:16 | D] - I:\blue
[11/04/2014 - 22:06:16 | D] - I:\boul khol
[11/04/2014 - 22:06:16 | D] - I:\CLIPS
[11/04/2014 - 22:06:16 | D] - I:\dcim
[11/04/2014 - 22:06:18 | D] - I:\dykha
[11/04/2014 - 22:06:18 | D] - I:\hits
[11/04/2014 - 22:06:24 | D] - I:\images
[11/04/2014 - 22:06:24 | D] - I:\medajox
[11/04/2014 - 22:06:34 | D] - I:\pac
[11/04/2014 - 22:06:36 | D] - I:\photos
################## | Vaccin |
D:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
E:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
I:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
################## | E.O.F | http://www.usbfix.net/ - http://www.sosvirus.net |