Raccourcis clé uSB - Page 3
Résolu-
Disque G:
############################## | UsbFix V 7.169 | [Suppression]
Utilisateur: Administrateur (Administrateur) # UP1-LR3E2H7
Mis à jour le 31/03/2014 par El Desaparecido - Team SosVirus
Lancé à 23:33:33 | 15/04/2014
Site Web : https://www.usbfix.net/
Changelog : https://www.usb-antivirus.com/fr/maj/
Support : https://depannageinformatique.org/acheter/reservation/?f=6
Upload Malware : http://www.sosvirus.net/upload_malware.php
Contact : https://www.usb-antivirus.com/fr/contact/
PC: LENOVO (5017A78)
CPU: Intel(R) Core(TM) i5-2410M CPU @ 2.30GHz
RAM -> [Total : 3936 Mo| Free : 2819 Mo]
Bios: LENOVO
Boot: Normal boot
OS: Microsoft Windows 7 Professionnel (6.1.7601 64-Bit) Service Pack 1
WB: Windows Internet Explorer : 11.0.9600.17041
WB: Mozilla Firefox : 28.0
SC: Security Center [Enabled]
WU: Windows Update [Enabled]
AS: Windows Defender [Enabled | Updated]
FW: Windows FireWall [Enabled]
AS: Malwarebytes' Anti-Malware : 1.75.0001
C:\ (%systemdrive%) -> Disque fixe # 298 Go (68 Go libre(s) - 23%) [OSDisk] # NTFS
D:\ -> CD-ROM
F:\ -> CD-ROM
G:\ -> Disque fixe # 149 Go (28 Go libre(s) - 19%) [WD Passport] # FAT32
################## | Processus Actif |
C:\Windows\system32\csrss.exe (ID: 432 |ParentID: 424)
C:\Windows\system32\wininit.exe (ID: 496 |ParentID: 424)
C:\Windows\system32\csrss.exe (ID: 520 |ParentID: 504)
C:\Windows\system32\services.exe (ID: 560 |ParentID: 496)
C:\Windows\system32\lsass.exe (ID: 576 |ParentID: 496)
C:\Windows\system32\lsm.exe (ID: 584 |ParentID: 496)
C:\Windows\system32\svchost.exe (ID: 688 |ParentID: 560)
C:\Windows\system32\winlogon.exe (ID: 756 |ParentID: 504)
C:\Windows\system32\ibmpmsvc.exe (ID: 792 |ParentID: 560)
C:\Windows\system32\svchost.exe (ID: 848 |ParentID: 560)
C:\Windows\System32\svchost.exe (ID: 912 |ParentID: 560)
C:\Windows\System32\svchost.exe (ID: 952 |ParentID: 560)
C:\Windows\system32\svchost.exe (ID: 1012 |ParentID: 560)
C:\Windows\system32\svchost.exe (ID: 292 |ParentID: 560)
C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe (ID: 1040 |ParentID: 560)
C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (ID: 1068 |ParentID: 1040)
C:\Windows\system32\svchost.exe (ID: 1088 |ParentID: 560)
C:\Windows\System32\spoolsv.exe (ID: 1404 |ParentID: 560)
C:\Windows\system32\svchost.exe (ID: 1432 |ParentID: 560)
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (ID: 1528 |ParentID: 560)
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (ID: 1580 |ParentID: 560)
C:\Program Files\Bonjour\mDNSResponder.exe (ID: 1628 |ParentID: 560)
C:\Windows\system32\svchost.exe (ID: 1660 |ParentID: 560)
C:\Program Files (x86)\FusionInventory-Agent\perl\bin\perl.exe (ID: 1712 |ParentID: 560)
C:\Windows\system32\svchost.exe (ID: 1804 |ParentID: 560)
C:\Windows\system32\svchost.exe (ID: 1940 |ParentID: 560)
C:\Windows\system32\taskhost.exe (ID: 1760 |ParentID: 560)
C:\Windows\system32\svchost.exe (ID: 2132 |ParentID: 560)
C:\Windows\system32\taskeng.exe (ID: 2232 |ParentID: 292)
C:\Windows\system32\Dwm.exe (ID: 2280 |ParentID: 952)
C:\Windows\Explorer.EXE (ID: 2324 |ParentID: 2268)
C:\Windows\system32\runonce.exe (ID: 2572 |ParentID: 2324)
C:\Windows\SysWOW64\runonce.exe (ID: 2600 |ParentID: 2572)
C:\Windows\System32\rundll32.exe (ID: 2796 |ParentID: 688)
C:\Windows\system32\wbem\wmiprvse.exe (ID: 2928 |ParentID: 688)
################## | Recherche générique |
(!) Fichiers temporaires supprimés.
################## | Registre |
################## | Regedit Run |
F2 - HKLM\..\Winlogon : [Shell] explorer.exe
F2 - [x64] HKLM\..\Winlogon : [Shell] explorer.exe
F2 - HKLM\..\Winlogon : [Userinit] userinit.exe,
F2 - [x64] HKLM\..\Winlogon : [Userinit] C:\Windows\system32\userinit.exe,
04 - HKCU\..\Run : [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
04 - HKCU\..\Run : [Google Update] "C:\Users\Administrateur\AppData\Local\Google\Update\GoogleUpdate.exe" /c
04 - HKCU\..\Run : [AdobeBridge]
04 - HKCU\..\Run : [HP Photosmart Plus B210 series (NET)] "C:\Program Files\HP\HP Photosmart Plus B210 series\Bin\ScanToPCActivationApp.exe" -deviceID "CN16H3251605J9:NW" -scfn "HP Photosmart Plus B210 series (NET)" -AutoStart 1
04 - HKCU\..\Run : [YouSendIt.exe] C:\Program Files (x86)\YouSendIt\Express\YouSendIt.exe -ui none
04 - HKCU\..\Run : [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
04 - HKLM\..\Run : [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
04 - HKLM\..\Run : [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
04 - HKLM\..\Run : [Adobe Acrobat Speed Launcher] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe"
04 - HKLM\..\Run : [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe"
04 - HKLM\..\Run : [AdobeCS4ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
04 - HKLM\..\Run : [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
04 - HKLM\..\Run : [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
04 - HKLM\..\Run : [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
04 - HKLM\..\Run : []
04 - [x64] HKLM\..\Run : [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
04 - [x64] HKLM\..\Run : [IgfxTray] C:\Windows\system32\igfxtray.exe
04 - [x64] HKLM\..\Run : [HotKeysCmds] C:\Windows\system32\hkcmd.exe
04 - [x64] HKLM\..\Run : [Persistence] C:\Windows\system32\igfxpers.exe
04 - [x64] HKLM\..\Run : [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
04 - HKU\S-1-5-19\..\Run : [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
04 - HKU\S-1-5-20\..\Run : [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
04 - HKU\S-1-5-21-3331046427-1064584010-3109013383-500\..\Run : [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
04 - HKU\S-1-5-21-3331046427-1064584010-3109013383-500\..\Run : [Google Update] "C:\Users\Administrateur\AppData\Local\Google\Update\GoogleUpdate.exe" /c
04 - HKU\S-1-5-21-3331046427-1064584010-3109013383-500\..\Run : [AdobeBridge]
04 - HKU\S-1-5-21-3331046427-1064584010-3109013383-500\..\Run : [HP Photosmart Plus B210 series (NET)] "C:\Program Files\HP\HP Photosmart Plus B210 series\Bin\ScanToPCActivationApp.exe" -deviceID "CN16H3251605J9:NW" -scfn "HP Photosmart Plus B210 series (NET)" -AutoStart 1
04 - HKU\S-1-5-21-3331046427-1064584010-3109013383-500\..\Run : [YouSendIt.exe] C:\Program Files (x86)\YouSendIt\Express\YouSendIt.exe -ui none
04 - HKU\S-1-5-21-3331046427-1064584010-3109013383-500\..\Run : [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
04 - HKU\S-1-5-19\..\RunOnce : [mctadmin] C:\Windows\System32\mctadmin.exe
04 - HKU\S-1-5-20\..\RunOnce : [mctadmin] C:\Windows\System32\mctadmin.exe
################## | Listing |
[12/03/2013 - 11:39:34 | SHD] - C:\$Recycle.Bin
[17/02/2014 - 17:59:26 | N | 0 Ko] - C:\AVScanner.ini
[31/01/2012 - 15:56:33 | D] - C:\certs
[04/04/2014 - 17:11:55 | N | 1 Ko | CA974E73AB3623A7C74124B45307B2D3] - C:\DelFix.txt
[14/07/2009 - 07:08:56 | SHD] - C:\Documents and Settings
[03/10/2013 - 15:24:36 | D] - C:\Drivers
[07/11/2007 - 08:00:40 | N | 17 Ko | 9147A93F43D8E58218EBCB15FDA888C9] - C:\eula.1028.txt
[07/11/2007 - 08:00:40 | N | 17 Ko | 9147A93F43D8E58218EBCB15FDA888C9] - C:\eula.1031.txt
[07/11/2007 - 08:00:40 | N | 10 Ko | 99C22D4A31F4EAD4351B71D6F4E5F6A1] - C:\eula.1033.txt
[07/11/2007 - 08:00:40 | N | 17 Ko | 9147A93F43D8E58218EBCB15FDA888C9] - C:\eula.1036.txt
[07/11/2007 - 08:00:40 | N | 17 Ko | 9147A93F43D8E58218EBCB15FDA888C9] - C:\eula.1040.txt
[07/11/2007 - 08:00:40 | N | 0 Ko | 9B15A3A055CC6E67EA191A1B7885649A] - C:\eula.1041.txt
[07/11/2007 - 08:00:40 | N | 17 Ko | 9147A93F43D8E58218EBCB15FDA888C9] - C:\eula.1042.txt
[07/11/2007 - 08:00:40 | N | 17 Ko | 9147A93F43D8E58218EBCB15FDA888C9] - C:\eula.2052.txt
[07/11/2007 - 08:00:40 | N | 17 Ko | 9147A93F43D8E58218EBCB15FDA888C9] - C:\eula.3082.txt
[18/10/2012 - 13:59:31 | D] - C:\GIRDAC
[07/11/2007 - 08:00:40 | N | 1 Ko] - C:\globdata.ini
[15/04/2014 - 23:32:33 | ASH | 3023220 Ko] - C:\hiberfil.sys
[07/11/2007 - 08:03:18 | N | 550 Ko | 520A6D1CBCC9CF642C625FE814C93C58] - C:\install.exe
[07/11/2007 - 08:00:40 | N | 1 Ko] - C:\install.ini
[31/01/2012 - 15:56:32 | N | 0 Ko] - C:\install.log
[07/11/2007 - 08:03:18 | N | 75 Ko | 4151A4D07640863783F837E588235837] - C:\install.res.1028.dll
[07/11/2007 - 08:03:18 | N | 94 Ko | 3B8A82E04238655EAEF97E074FB29911] - C:\install.res.1031.dll
[07/11/2007 - 08:03:18 | N | 89 Ko | 9EDEB8B1C5C0A4CD3A3016B85108127D] - C:\install.res.1033.dll
[07/11/2007 - 08:03:18 | N | 95 Ko | 5B6FF470CFA7087690E61F87E81EF78A] - C:\install.res.1036.dll
[07/11/2007 - 08:03:18 | N | 93 Ko | 6310AB8FC9E3DBEE80592FC453A34FEE] - C:\install.res.1040.dll
[07/11/2007 - 08:03:18 | N | 80 Ko | 13ED4517152203DE4BC52ACC0255D952] - C:\install.res.1041.dll
[07/11/2007 - 08:03:18 | N | 78 Ko | 0D4FB4095EA49C1EC89B9E8DB0B936A3] - C:\install.res.1042.dll
[07/11/2007 - 08:03:18 | N | 74 Ko | D7366B34E8AFB605C39EF56E2201FE85] - C:\install.res.2052.dll
[07/11/2007 - 08:03:18 | N | 94 Ko | 41BB37A347121F3E5E88D85100638B79] - C:\install.res.3082.dll
[31/01/2012 - 15:40:00 | D] - C:\Intel
[07/01/2014 - 20:35:06 | N | 0 Ko] - C:\lxct.log
[31/01/2012 - 15:45:17 | D] - C:\MININT
[02/10/2012 - 08:02:41 | RHD] - C:\MSOCache
[15/04/2014 - 23:32:38 | ASH | 6045696 Ko] - C:\pagefile.sys
[14/07/2009 - 05:20:08 | D] - C:\PerfLogs
[27/03/2014 - 18:28:07 | D] - C:\Program Files
[29/03/2014 - 18:39:51 | D] - C:\Program Files (x86)
[18/03/2014 - 11:34:26 | HD] - C:\ProgramData
[31/01/2012 - 15:44:07 | SHD] - C:\Recovery
[16/01/2014 - 02:42:40 | N | 594 Ko | ECFA4E7350DE3BB49AE671A9A3382A35] - C:\SecurityScanner.dll
[18/03/2014 - 14:41:20 | N | 219 Ko | 09F7E8F1D80416F7C17E8D76A65E93C9] - C:\Shortcut_Module_18_03_2014_13_41_20.txt
[15/04/2014 - 09:51:32 | SHD] - C:\System Volume Information
[15/04/2014 - 23:31:46 | D] - C:\UsbFix
[15/04/2014 - 10:55:33 | N | 12 Ko | 3CC3307DEDD69021ABF7C2C8E0DB5049] - C:\UsbFix [Clean 2] UP1-LR3E2H7.txt
[15/04/2014 - 23:27:25 | N | 12 Ko | F35B8564A0A4DEE34A7F206657FB057D] - C:\UsbFix [Clean 4] UP1-LR3E2H7.txt
[15/04/2014 - 23:33:57 | A | 10 Ko | 360A69543D0C3BEE1114C81463892855] - C:\UsbFix [Clean 6] UP1-LR3E2H7.txt
[10/10/2013 - 09:33:33 | D] - C:\Users
[07/11/2007 - 08:00:40 | N | 6 Ko] - C:\vcredist.bmp
[07/11/2007 - 08:09:22 | N | 1409 Ko] - C:\VC_RED.cab
[07/11/2007 - 08:12:28 | N | 228 Ko] - C:\VC_RED.MSI
[04/04/2014 - 17:10:57 | D] - C:\Windows
[31/03/2014 - 16:33:08 | D] - C:\xampp
[11/08/2009 - 13:28:24 | SHD] - G:\$RECYCLE.BIN
[05/03/2009 - 16:10:50 | AH | 15 Ko] - G:\.DS_Store
[24/03/2014 - 16:53:20 | D] - G:\2014-03 Mes images MEILO
[05/07/2008 - 16:13:10 | D] - G:\wd
[23/07/2009 - 15:21:48 | D] - G:\PM_récits
[11/09/2008 - 21:59:38 | D] - G:\Favoris
[07/10/2011 - 07:33:30 | D] - G:\2011-2012
[20/03/2008 - 14:07:26 | HD] - G:\.Trashes
[15/09/2011 - 15:31:24 | RSHD] - G:\RECYCLER
[02/08/2009 - 16:33:10 | N | 0 Ko] - G:\~$ript 30.doc
[19/03/2008 - 21:19:58 | SHD] - G:\System Volume Information
[19/03/2008 - 22:23:20 | D] - G:\Recycled
[11/07/2009 - 15:59:30 | ASH | 2801 Ko] - G:\Thumbs.db
[13/10/2011 - 21:54:42 | D] - G:\stage ORL
[20/04/2009 - 14:21:52 | D] - G:\films serkan bea
[10/05/2012 - 00:06:20 | D] - G:\2011-2012B
[03/09/2012 - 08:07:54 | D] - G:\meiloperso
[22/03/2009 - 20:17:58 | HD] - G:\.fseventsd
[05/01/2009 - 21:44:46 | N | 4 Ko] - G:\._Araba yolda 6.mov
[20/03/2008 - 14:07:26 | HD] - G:\.Spotlight-V100
[03/01/2009 - 01:39:26 | D] - G:\SAUVEGARDES LO 2007
[17/09/2012 - 11:27:20 | D] - G:\2012 SEYYAR
[30/01/2009 - 17:16:14 | HD] - G:\.TemporaryItems
[29/03/2012 - 13:40:32 | D] - G:\administratif
[22/04/2012 - 22:08:18 | D] - G:\sauvpartielleecole
[11/07/2009 - 15:55:18 | D] - G:\POSET MOSET
################## | Vaccin |
G:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
################## | E.O.F | https://www.usbfix.net/ - https://www.sosvirus.net/ | -
Et le troisieme disque dur externe qui se nomme aussi E:
---
############################## | UsbFix V 7.169 | [Suppression]
Utilisateur: Administrateur (Administrateur) # UP1-LR3E2H7
Mis à jour le 31/03/2014 par El Desaparecido - Team SosVirus
Lancé à 23:40:03 | 15/04/2014
Site Web : https://www.usbfix.net/
Changelog : https://www.usb-antivirus.com/fr/maj/
Support : https://depannageinformatique.org/acheter/reservation/?f=6
Upload Malware : http://www.sosvirus.net/upload_malware.php
Contact : https://www.usb-antivirus.com/fr/contact/
PC: LENOVO (5017A78)
CPU: Intel(R) Core(TM) i5-2410M CPU @ 2.30GHz
RAM -> [Total : 3936 Mo| Free : 2872 Mo]
Bios: LENOVO
Boot: Normal boot
OS: Microsoft Windows 7 Professionnel (6.1.7601 64-Bit) Service Pack 1
WB: Windows Internet Explorer : 11.0.9600.17041
WB: Mozilla Firefox : 28.0
SC: Security Center [Enabled]
WU: Windows Update [Enabled]
AS: Windows Defender [Enabled | Updated]
FW: Windows FireWall [Enabled]
AS: Malwarebytes' Anti-Malware : 1.75.0001
C:\ (%systemdrive%) -> Disque fixe # 298 Go (68 Go libre(s) - 23%) [OSDisk] # NTFS
D:\ -> CD-ROM
E:\ -> Disque fixe # 466 Go (107 Go libre(s) - 23%) [Iomega HDD] # NTFS
F:\ -> CD-ROM
################## | Processus Actif |
C:\Windows\system32\csrss.exe (ID: 428 |ParentID: 412)
C:\Windows\system32\wininit.exe (ID: 492 |ParentID: 412)
C:\Windows\system32\csrss.exe (ID: 516 |ParentID: 500)
C:\Windows\system32\services.exe (ID: 560 |ParentID: 492)
C:\Windows\system32\lsass.exe (ID: 568 |ParentID: 492)
C:\Windows\system32\lsm.exe (ID: 580 |ParentID: 492)
C:\Windows\system32\svchost.exe (ID: 684 |ParentID: 560)
C:\Windows\system32\ibmpmsvc.exe (ID: 744 |ParentID: 560)
C:\Windows\system32\svchost.exe (ID: 800 |ParentID: 560)
C:\Windows\system32\winlogon.exe (ID: 836 |ParentID: 500)
C:\Windows\System32\svchost.exe (ID: 900 |ParentID: 560)
C:\Windows\System32\svchost.exe (ID: 948 |ParentID: 560)
C:\Windows\system32\svchost.exe (ID: 988 |ParentID: 560)
C:\Windows\system32\svchost.exe (ID: 1020 |ParentID: 560)
C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe (ID: 1052 |ParentID: 560)
C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (ID: 1076 |ParentID: 1052)
C:\Windows\system32\svchost.exe (ID: 1100 |ParentID: 560)
C:\Windows\System32\spoolsv.exe (ID: 1376 |ParentID: 560)
C:\Windows\system32\svchost.exe (ID: 1404 |ParentID: 560)
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (ID: 1508 |ParentID: 560)
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (ID: 1592 |ParentID: 560)
C:\Program Files\Bonjour\mDNSResponder.exe (ID: 1632 |ParentID: 560)
C:\Windows\system32\svchost.exe (ID: 1680 |ParentID: 560)
C:\Program Files (x86)\FusionInventory-Agent\perl\bin\perl.exe (ID: 1716 |ParentID: 560)
C:\Windows\system32\svchost.exe (ID: 1824 |ParentID: 560)
C:\Windows\system32\taskhost.exe (ID: 2088 |ParentID: 560)
C:\Windows\system32\svchost.exe (ID: 2136 |ParentID: 560)
C:\Windows\system32\svchost.exe (ID: 2256 |ParentID: 560)
C:\Windows\system32\taskeng.exe (ID: 2380 |ParentID: 1020)
C:\Windows\system32\Dwm.exe (ID: 2408 |ParentID: 948)
C:\Windows\Explorer.EXE (ID: 2436 |ParentID: 2392)
C:\Windows\system32\runonce.exe (ID: 2680 |ParentID: 2436)
C:\Windows\SysWOW64\runonce.exe (ID: 2692 |ParentID: 2680)
C:\Windows\System32\rundll32.exe (ID: 2744 |ParentID: 684)
C:\Windows\system32\wbem\wmiprvse.exe (ID: 3040 |ParentID: 684)
################## | Recherche générique |
(!) Fichiers temporaires supprimés.
################## | Registre |
################## | Regedit Run |
F2 - HKLM\..\Winlogon : [Shell] explorer.exe
F2 - [x64] HKLM\..\Winlogon : [Shell] explorer.exe
F2 - HKLM\..\Winlogon : [Userinit] userinit.exe,
F2 - [x64] HKLM\..\Winlogon : [Userinit] C:\Windows\system32\userinit.exe,
04 - HKCU\..\Run : [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
04 - HKCU\..\Run : [Google Update] "C:\Users\Administrateur\AppData\Local\Google\Update\GoogleUpdate.exe" /c
04 - HKCU\..\Run : [AdobeBridge]
04 - HKCU\..\Run : [HP Photosmart Plus B210 series (NET)] "C:\Program Files\HP\HP Photosmart Plus B210 series\Bin\ScanToPCActivationApp.exe" -deviceID "CN16H3251605J9:NW" -scfn "HP Photosmart Plus B210 series (NET)" -AutoStart 1
04 - HKCU\..\Run : [YouSendIt.exe] C:\Program Files (x86)\YouSendIt\Express\YouSendIt.exe -ui none
04 - HKCU\..\Run : [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
04 - HKLM\..\Run : [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
04 - HKLM\..\Run : [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
04 - HKLM\..\Run : [Adobe Acrobat Speed Launcher] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe"
04 - HKLM\..\Run : [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe"
04 - HKLM\..\Run : [AdobeCS4ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
04 - HKLM\..\Run : [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
04 - HKLM\..\Run : [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
04 - HKLM\..\Run : [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
04 - HKLM\..\Run : []
04 - [x64] HKLM\..\Run : [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
04 - [x64] HKLM\..\Run : [IgfxTray] C:\Windows\system32\igfxtray.exe
04 - [x64] HKLM\..\Run : [HotKeysCmds] C:\Windows\system32\hkcmd.exe
04 - [x64] HKLM\..\Run : [Persistence] C:\Windows\system32\igfxpers.exe
04 - [x64] HKLM\..\Run : [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
04 - HKU\S-1-5-19\..\Run : [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
04 - HKU\S-1-5-20\..\Run : [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
04 - HKU\S-1-5-21-3331046427-1064584010-3109013383-500\..\Run : [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
04 - HKU\S-1-5-21-3331046427-1064584010-3109013383-500\..\Run : [Google Update] "C:\Users\Administrateur\AppData\Local\Google\Update\GoogleUpdate.exe" /c
04 - HKU\S-1-5-21-3331046427-1064584010-3109013383-500\..\Run : [AdobeBridge]
04 - HKU\S-1-5-21-3331046427-1064584010-3109013383-500\..\Run : [HP Photosmart Plus B210 series (NET)] "C:\Program Files\HP\HP Photosmart Plus B210 series\Bin\ScanToPCActivationApp.exe" -deviceID "CN16H3251605J9:NW" -scfn "HP Photosmart Plus B210 series (NET)" -AutoStart 1
04 - HKU\S-1-5-21-3331046427-1064584010-3109013383-500\..\Run : [YouSendIt.exe] C:\Program Files (x86)\YouSendIt\Express\YouSendIt.exe -ui none
04 - HKU\S-1-5-21-3331046427-1064584010-3109013383-500\..\Run : [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
04 - HKU\S-1-5-19\..\RunOnce : [mctadmin] C:\Windows\System32\mctadmin.exe
04 - HKU\S-1-5-20\..\RunOnce : [mctadmin] C:\Windows\System32\mctadmin.exe
################## | Listing |
[12/03/2013 - 11:39:34 | SHD] - C:\$Recycle.Bin
[17/02/2014 - 17:59:26 | N | 0 Ko] - C:\AVScanner.ini
[31/01/2012 - 15:56:33 | D] - C:\certs
[04/04/2014 - 17:11:55 | N | 1 Ko | CA974E73AB3623A7C74124B45307B2D3] - C:\DelFix.txt
[14/07/2009 - 07:08:56 | SHD] - C:\Documents and Settings
[03/10/2013 - 15:24:36 | D] - C:\Drivers
[07/11/2007 - 08:00:40 | N | 17 Ko | 9147A93F43D8E58218EBCB15FDA888C9] - C:\eula.1028.txt
[07/11/2007 - 08:00:40 | N | 17 Ko | 9147A93F43D8E58218EBCB15FDA888C9] - C:\eula.1031.txt
[07/11/2007 - 08:00:40 | N | 10 Ko | 99C22D4A31F4EAD4351B71D6F4E5F6A1] - C:\eula.1033.txt
[07/11/2007 - 08:00:40 | N | 17 Ko | 9147A93F43D8E58218EBCB15FDA888C9] - C:\eula.1036.txt
[07/11/2007 - 08:00:40 | N | 17 Ko | 9147A93F43D8E58218EBCB15FDA888C9] - C:\eula.1040.txt
[07/11/2007 - 08:00:40 | N | 0 Ko | 9B15A3A055CC6E67EA191A1B7885649A] - C:\eula.1041.txt
[07/11/2007 - 08:00:40 | N | 17 Ko | 9147A93F43D8E58218EBCB15FDA888C9] - C:\eula.1042.txt
[07/11/2007 - 08:00:40 | N | 17 Ko | 9147A93F43D8E58218EBCB15FDA888C9] - C:\eula.2052.txt
[07/11/2007 - 08:00:40 | N | 17 Ko | 9147A93F43D8E58218EBCB15FDA888C9] - C:\eula.3082.txt
[18/10/2012 - 13:59:31 | D] - C:\GIRDAC
[07/11/2007 - 08:00:40 | N | 1 Ko] - C:\globdata.ini
[15/04/2014 - 23:39:09 | ASH | 3023220 Ko] - C:\hiberfil.sys
[07/11/2007 - 08:03:18 | N | 550 Ko | 520A6D1CBCC9CF642C625FE814C93C58] - C:\install.exe
[07/11/2007 - 08:00:40 | N | 1 Ko] - C:\install.ini
[31/01/2012 - 15:56:32 | N | 0 Ko] - C:\install.log
[07/11/2007 - 08:03:18 | N | 75 Ko | 4151A4D07640863783F837E588235837] - C:\install.res.1028.dll
[07/11/2007 - 08:03:18 | N | 94 Ko | 3B8A82E04238655EAEF97E074FB29911] - C:\install.res.1031.dll
[07/11/2007 - 08:03:18 | N | 89 Ko | 9EDEB8B1C5C0A4CD3A3016B85108127D] - C:\install.res.1033.dll
[07/11/2007 - 08:03:18 | N | 95 Ko | 5B6FF470CFA7087690E61F87E81EF78A] - C:\install.res.1036.dll
[07/11/2007 - 08:03:18 | N | 93 Ko | 6310AB8FC9E3DBEE80592FC453A34FEE] - C:\install.res.1040.dll
[07/11/2007 - 08:03:18 | N | 80 Ko | 13ED4517152203DE4BC52ACC0255D952] - C:\install.res.1041.dll
[07/11/2007 - 08:03:18 | N | 78 Ko | 0D4FB4095EA49C1EC89B9E8DB0B936A3] - C:\install.res.1042.dll
[07/11/2007 - 08:03:18 | N | 74 Ko | D7366B34E8AFB605C39EF56E2201FE85] - C:\install.res.2052.dll
[07/11/2007 - 08:03:18 | N | 94 Ko | 41BB37A347121F3E5E88D85100638B79] - C:\install.res.3082.dll
[31/01/2012 - 15:40:00 | D] - C:\Intel
[07/01/2014 - 20:35:06 | N | 0 Ko] - C:\lxct.log
[31/01/2012 - 15:45:17 | D] - C:\MININT
[02/10/2012 - 08:02:41 | RHD] - C:\MSOCache
[15/04/2014 - 23:39:13 | ASH | 6045696 Ko] - C:\pagefile.sys
[14/07/2009 - 05:20:08 | D] - C:\PerfLogs
[27/03/2014 - 18:28:07 | D] - C:\Program Files
[29/03/2014 - 18:39:51 | D] - C:\Program Files (x86)
[18/03/2014 - 11:34:26 | HD] - C:\ProgramData
[31/01/2012 - 15:44:07 | SHD] - C:\Recovery
[16/01/2014 - 02:42:40 | N | 594 Ko | ECFA4E7350DE3BB49AE671A9A3382A35] - C:\SecurityScanner.dll
[18/03/2014 - 14:41:20 | N | 219 Ko | 09F7E8F1D80416F7C17E8D76A65E93C9] - C:\Shortcut_Module_18_03_2014_13_41_20.txt
[15/04/2014 - 09:51:32 | SHD] - C:\System Volume Information
[15/04/2014 - 23:38:22 | D] - C:\UsbFix
[15/04/2014 - 10:55:33 | N | 12 Ko | 3CC3307DEDD69021ABF7C2C8E0DB5049] - C:\UsbFix [Clean 2] UP1-LR3E2H7.txt
[15/04/2014 - 23:27:25 | N | 12 Ko | F35B8564A0A4DEE34A7F206657FB057D] - C:\UsbFix [Clean 4] UP1-LR3E2H7.txt
[15/04/2014 - 23:33:57 | N | 12 Ko | F916701323B46DAB5EF4DAD25262687D] - C:\UsbFix [Clean 6] UP1-LR3E2H7.txt
[15/04/2014 - 23:40:33 | A | 10 Ko | 65F9DEB2AFF35BA0628FBF62742EBB55] - C:\UsbFix [Clean 8] UP1-LR3E2H7.txt
[10/10/2013 - 09:33:33 | D] - C:\Users
[07/11/2007 - 08:00:40 | N | 6 Ko] - C:\vcredist.bmp
[07/11/2007 - 08:09:22 | N | 1409 Ko] - C:\VC_RED.cab
[07/11/2007 - 08:12:28 | N | 228 Ko] - C:\VC_RED.MSI
[04/04/2014 - 17:10:57 | D] - C:\Windows
[31/03/2014 - 16:33:08 | D] - C:\xampp
[09/10/2013 - 13:36:26 | SHD] - E:\$RECYCLE.BIN
[18/04/2011 - 22:36:15 | D] - E:\092511zik
[03/05/2013 - 13:07:00 | D] - E:\2013-05 Mes images MEILO
[13/03/2013 - 23:13:55 | N | 7441 Ko] - E:\CASNAV.pub
[07/07/2012 - 00:51:29 | D] - E:\Copie Lezarde
[14/06/2013 - 12:29:52 | D] - E:\Documentaires
[01/06/2005 - 14:36:46 | N | 419 Ko] - E:\DSCN3968.JPG
[02/06/2005 - 14:37:38 | N | 427 Ko] - E:\DSCN3971.JPG
[22/04/2012 - 22:37:45 | D] - E:\films serkan bea
[22/04/2012 - 22:23:39 | D] - E:\Final cut express
[04/05/2010 - 08:26:16 | N | 1312 Ko] - E:\girafe (3).JPG
[29/03/2013 - 12:07:57 | D] - E:\laurence2
[17/12/2012 - 23:54:48 | D] - E:\laurencelenovosauv2012_12_17
[07/11/2012 - 15:38:02 | D] - E:\MAG ALTER JEUNS
[07/11/2012 - 15:38:45 | D] - E:\meiloperso
[01/03/2011 - 19:47:59 | D] - E:\Mes vidéos
[07/10/2013 - 08:32:52 | D] - E:\Mise en page 2013-09-23
[09/10/2013 - 17:42:27 | D] - E:\Mise en page2013-10-08
[17/04/2011 - 22:46:47 | D] - E:\Nico
[25/09/2012 - 15:09:19 | D] - E:\plans maison
[05/02/2013 - 10:22:50 | D] - E:\PLUME
[15/04/2010 - 13:19:36 | N | 7989 Ko] - E:\pour zo.jpg
[11/11/2010 - 21:49:17 | D] - E:\RASED 2010
[15/02/2010 - 08:24:20 | SHD] - E:\RECYCLER
[31/08/2011 - 10:51:10 | D] - E:\sauvJO
[31/08/2011 - 10:50:03 | D] - E:\sauvLILLE
[24/01/2012 - 01:32:16 | D] - E:\sauvLO
[31/08/2011 - 10:53:31 | D] - E:\sauvMA MUSIQUE
[31/08/2011 - 10:55:03 | D] - E:\sauvMa musique meilo
[07/10/2013 - 14:06:15 | D] - E:\SEYYAR 2013-09-23
[06/02/2014 - 10:53:23 | D] - E:\SEYYAR IMPRIMEUR
[02/05/2013 - 14:23:30 | D] - E:\SEYYAR sauv 2009
[02/05/2013 - 14:31:42 | D] - E:\SEYYAR sauv 2012
[18/11/2012 - 11:52:44 | D] - E:\stage musique rome
[02/09/2011 - 09:28:16 | SHD] - E:\System Volume Information
[26/07/2010 - 00:26:22 | D] - E:\video posetmoset
################## | Vaccin |
E:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
################## | E.O.F | https://www.usbfix.net/ - https://www.sosvirus.net/ | -
Et il ne me restera qu'une seule clé usb à vacciner... mais je ne la retrouverai que jeudi soir !
Voilà...c'est tout pour aujourd'hui !
Merci ! -
Hello ,
Ok a demain :)
-
-
Bonjour !
Voici le rapport pour les deux dernieres clés USB.
Manifestement elles étaient infestées car un collegue s'en est servi sur son ordi et son antivirus les a vidées de leur contenu !
############################## | UsbFix V 7.169 | [Suppression]
Utilisateur: Administrateur (Administrateur) # UP1-LR3E2H7
Mis à jour le 31/03/2014 par El Desaparecido - Team SosVirus
Lancé à 09:51:08 | 19/04/2014
Site Web : https://www.usbfix.net/
Changelog : https://www.usb-antivirus.com/fr/maj/
Support : https://depannageinformatique.org/acheter/reservation/?f=6
Upload Malware : http://www.sosvirus.net/upload_malware.php
Contact : https://www.usb-antivirus.com/fr/contact/
PC: LENOVO (5017A78)
CPU: Intel(R) Core(TM) i5-2410M CPU @ 2.30GHz
RAM -> [Total : 3936 Mo| Free : 2840 Mo]
Bios: LENOVO
Boot: Normal boot
OS: Microsoft Windows 7 Professionnel (6.1.7601 64-Bit) Service Pack 1
WB: Windows Internet Explorer : 11.0.9600.17041
WB: Mozilla Firefox : 28.0
SC: Security Center [Enabled]
WU: Windows Update [Enabled]
AS: Windows Defender [Enabled | Updated]
FW: Windows FireWall [Enabled]
AS: Malwarebytes' Anti-Malware : 1.75.0001
C:\ (%systemdrive%) -> Disque fixe # 298 Go (68 Go libre(s) - 23%) [OSDisk] # NTFS
D:\ -> CD-ROM
E:\ -> Disque amovible # 7 Go (7 Go libre(s) - 94%) [KINGSTON] # FAT32
F:\ -> CD-ROM
G:\ -> Disque amovible # 7 Go (7 Go libre(s) - 100%) [] # FAT32
################## | Processus Actif |
C:\Windows\system32\csrss.exe (ID: 428 |ParentID: 420)
C:\Windows\system32\wininit.exe (ID: 492 |ParentID: 420)
C:\Windows\system32\csrss.exe (ID: 516 |ParentID: 500)
C:\Windows\system32\services.exe (ID: 556 |ParentID: 492)
C:\Windows\system32\lsass.exe (ID: 568 |ParentID: 492)
C:\Windows\system32\lsm.exe (ID: 580 |ParentID: 492)
C:\Windows\system32\svchost.exe (ID: 684 |ParentID: 556)
C:\Windows\system32\ibmpmsvc.exe (ID: 744 |ParentID: 556)
C:\Windows\system32\svchost.exe (ID: 800 |ParentID: 556)
C:\Windows\System32\svchost.exe (ID: 860 |ParentID: 556)
C:\Windows\System32\svchost.exe (ID: 892 |ParentID: 556)
C:\Windows\system32\svchost.exe (ID: 936 |ParentID: 556)
C:\Windows\system32\svchost.exe (ID: 968 |ParentID: 556)
C:\Windows\system32\winlogon.exe (ID: 1004 |ParentID: 500)
C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe (ID: 1076 |ParentID: 556)
C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (ID: 1100 |ParentID: 1076)
C:\Windows\system32\svchost.exe (ID: 1124 |ParentID: 556)
C:\Windows\System32\spoolsv.exe (ID: 1360 |ParentID: 556)
C:\Windows\system32\svchost.exe (ID: 1400 |ParentID: 556)
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (ID: 1492 |ParentID: 556)
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (ID: 1512 |ParentID: 556)
C:\Program Files\Bonjour\mDNSResponder.exe (ID: 1556 |ParentID: 556)
C:\Windows\system32\svchost.exe (ID: 1620 |ParentID: 556)
C:\Program Files (x86)\FusionInventory-Agent\perl\bin\perl.exe (ID: 1656 |ParentID: 556)
C:\Windows\system32\svchost.exe (ID: 1772 |ParentID: 556)
C:\Windows\system32\taskhost.exe (ID: 1160 |ParentID: 556)
C:\Windows\system32\taskeng.exe (ID: 1528 |ParentID: 968)
C:\Windows\system32\Dwm.exe (ID: 1576 |ParentID: 892)
C:\Windows\Explorer.EXE (ID: 1768 |ParentID: 1420)
C:\Windows\system32\runonce.exe (ID: 2256 |ParentID: 1768)
C:\Windows\SysWOW64\runonce.exe (ID: 2276 |ParentID: 2256)
C:\Windows\system32\svchost.exe (ID: 2548 |ParentID: 556)
C:\Windows\system32\svchost.exe (ID: 2584 |ParentID: 556)
C:\Windows\System32\rundll32.exe (ID: 2820 |ParentID: 684)
C:\Windows\System32\WUDFHost.exe (ID: 2876 |ParentID: 892)
C:\Windows\system32\wbem\wmiprvse.exe (ID: 2060 |ParentID: 684)
################## | Recherche générique |
Supprimé! E:\jSugLyCC.vbs
Supprimé! G:\jSugLyCC.vbs
(!) Fichiers temporaires supprimés.
################## | Registre |
Supprimé! HKU\S-1-5-21-3331046427-1064584010-3109013383-500\Software\.\.\.\.\Mountpoints2\{36fc46cc-19c3-11e2-b328-cc52af824b4f}
################## | Regedit Run |
F2 - HKLM\..\Winlogon : [Shell] explorer.exe
F2 - [x64] HKLM\..\Winlogon : [Shell] explorer.exe
F2 - HKLM\..\Winlogon : [Userinit] userinit.exe,
F2 - [x64] HKLM\..\Winlogon : [Userinit] C:\Windows\system32\userinit.exe,
04 - HKCU\..\Run : [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
04 - HKCU\..\Run : [Google Update] "C:\Users\Administrateur\AppData\Local\Google\Update\GoogleUpdate.exe" /c
04 - HKCU\..\Run : [AdobeBridge]
04 - HKCU\..\Run : [HP Photosmart Plus B210 series (NET)] "C:\Program Files\HP\HP Photosmart Plus B210 series\Bin\ScanToPCActivationApp.exe" -deviceID "CN16H3251605J9:NW" -scfn "HP Photosmart Plus B210 series (NET)" -AutoStart 1
04 - HKCU\..\Run : [YouSendIt.exe] C:\Program Files (x86)\YouSendIt\Express\YouSendIt.exe -ui none
04 - HKCU\..\Run : [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
04 - HKLM\..\Run : [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
04 - HKLM\..\Run : [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
04 - HKLM\..\Run : [Adobe Acrobat Speed Launcher] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe"
04 - HKLM\..\Run : [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe"
04 - HKLM\..\Run : [AdobeCS4ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
04 - HKLM\..\Run : [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
04 - HKLM\..\Run : [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
04 - HKLM\..\Run : [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
04 - HKLM\..\Run : []
04 - [x64] HKLM\..\Run : [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
04 - [x64] HKLM\..\Run : [IgfxTray] C:\Windows\system32\igfxtray.exe
04 - [x64] HKLM\..\Run : [HotKeysCmds] C:\Windows\system32\hkcmd.exe
04 - [x64] HKLM\..\Run : [Persistence] C:\Windows\system32\igfxpers.exe
04 - [x64] HKLM\..\Run : [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
04 - HKU\S-1-5-19\..\Run : [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
04 - HKU\S-1-5-20\..\Run : [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
04 - HKU\S-1-5-21-3331046427-1064584010-3109013383-500\..\Run : [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
04 - HKU\S-1-5-21-3331046427-1064584010-3109013383-500\..\Run : [Google Update] "C:\Users\Administrateur\AppData\Local\Google\Update\GoogleUpdate.exe" /c
04 - HKU\S-1-5-21-3331046427-1064584010-3109013383-500\..\Run : [AdobeBridge]
04 - HKU\S-1-5-21-3331046427-1064584010-3109013383-500\..\Run : [HP Photosmart Plus B210 series (NET)] "C:\Program Files\HP\HP Photosmart Plus B210 series\Bin\ScanToPCActivationApp.exe" -deviceID "CN16H3251605J9:NW" -scfn "HP Photosmart Plus B210 series (NET)" -AutoStart 1
04 - HKU\S-1-5-21-3331046427-1064584010-3109013383-500\..\Run : [YouSendIt.exe] C:\Program Files (x86)\YouSendIt\Express\YouSendIt.exe -ui none
04 - HKU\S-1-5-21-3331046427-1064584010-3109013383-500\..\Run : [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
04 - HKU\S-1-5-19\..\RunOnce : [mctadmin] C:\Windows\System32\mctadmin.exe
04 - HKU\S-1-5-20\..\RunOnce : [mctadmin] C:\Windows\System32\mctadmin.exe
################## | Listing |
[12/03/2013 - 11:39:34 | SHD] - C:\$Recycle.Bin
[17/02/2014 - 17:59:26 | N | 0 Ko] - C:\AVScanner.ini
[31/01/2012 - 15:56:33 | D] - C:\certs
[04/04/2014 - 17:11:55 | N | 1 Ko | CA974E73AB3623A7C74124B45307B2D3] - C:\DelFix.txt
[14/07/2009 - 07:08:56 | SHD] - C:\Documents and Settings
[03/10/2013 - 15:24:36 | D] - C:\Drivers
[07/11/2007 - 08:00:40 | N | 17 Ko | 9147A93F43D8E58218EBCB15FDA888C9] - C:\eula.1028.txt
[07/11/2007 - 08:00:40 | N | 17 Ko | 9147A93F43D8E58218EBCB15FDA888C9] - C:\eula.1031.txt
[07/11/2007 - 08:00:40 | N | 10 Ko | 99C22D4A31F4EAD4351B71D6F4E5F6A1] - C:\eula.1033.txt
[07/11/2007 - 08:00:40 | N | 17 Ko | 9147A93F43D8E58218EBCB15FDA888C9] - C:\eula.1036.txt
[07/11/2007 - 08:00:40 | N | 17 Ko | 9147A93F43D8E58218EBCB15FDA888C9] - C:\eula.1040.txt
[07/11/2007 - 08:00:40 | N | 0 Ko | 9B15A3A055CC6E67EA191A1B7885649A] - C:\eula.1041.txt
[07/11/2007 - 08:00:40 | N | 17 Ko | 9147A93F43D8E58218EBCB15FDA888C9] - C:\eula.1042.txt
[07/11/2007 - 08:00:40 | N | 17 Ko | 9147A93F43D8E58218EBCB15FDA888C9] - C:\eula.2052.txt
[07/11/2007 - 08:00:40 | N | 17 Ko | 9147A93F43D8E58218EBCB15FDA888C9] - C:\eula.3082.txt
[18/10/2012 - 13:59:31 | D] - C:\GIRDAC
[07/11/2007 - 08:00:40 | N | 1 Ko] - C:\globdata.ini
[19/04/2014 - 09:49:48 | ASH | 3023220 Ko] - C:\hiberfil.sys
[07/11/2007 - 08:03:18 | N | 550 Ko | 520A6D1CBCC9CF642C625FE814C93C58] - C:\install.exe
[07/11/2007 - 08:00:40 | N | 1 Ko] - C:\install.ini
[31/01/2012 - 15:56:32 | N | 0 Ko] - C:\install.log
[07/11/2007 - 08:03:18 | N | 75 Ko | 4151A4D07640863783F837E588235837] - C:\install.res.1028.dll
[07/11/2007 - 08:03:18 | N | 94 Ko | 3B8A82E04238655EAEF97E074FB29911] - C:\install.res.1031.dll
[07/11/2007 - 08:03:18 | N | 89 Ko | 9EDEB8B1C5C0A4CD3A3016B85108127D] - C:\install.res.1033.dll
[07/11/2007 - 08:03:18 | N | 95 Ko | 5B6FF470CFA7087690E61F87E81EF78A] - C:\install.res.1036.dll
[07/11/2007 - 08:03:18 | N | 93 Ko | 6310AB8FC9E3DBEE80592FC453A34FEE] - C:\install.res.1040.dll
[07/11/2007 - 08:03:18 | N | 80 Ko | 13ED4517152203DE4BC52ACC0255D952] - C:\install.res.1041.dll
[07/11/2007 - 08:03:18 | N | 78 Ko | 0D4FB4095EA49C1EC89B9E8DB0B936A3] - C:\install.res.1042.dll
[07/11/2007 - 08:03:18 | N | 74 Ko | D7366B34E8AFB605C39EF56E2201FE85] - C:\install.res.2052.dll
[07/11/2007 - 08:03:18 | N | 94 Ko | 41BB37A347121F3E5E88D85100638B79] - C:\install.res.3082.dll
[31/01/2012 - 15:40:00 | D] - C:\Intel
[07/01/2014 - 20:35:06 | N | 0 Ko] - C:\lxct.log
[31/01/2012 - 15:45:17 | D] - C:\MININT
[02/10/2012 - 08:02:41 | RHD] - C:\MSOCache
[19/04/2014 - 09:49:52 | ASH | 6045696 Ko] - C:\pagefile.sys
[14/07/2009 - 05:20:08 | D] - C:\PerfLogs
[27/03/2014 - 18:28:07 | D] - C:\Program Files
[29/03/2014 - 18:39:51 | D] - C:\Program Files (x86)
[18/03/2014 - 11:34:26 | HD] - C:\ProgramData
[31/01/2012 - 15:44:07 | SHD] - C:\Recovery
[16/01/2014 - 02:42:40 | N | 594 Ko | ECFA4E7350DE3BB49AE671A9A3382A35] - C:\SecurityScanner.dll
[18/03/2014 - 14:41:20 | N | 219 Ko | 09F7E8F1D80416F7C17E8D76A65E93C9] - C:\Shortcut_Module_18_03_2014_13_41_20.txt
[18/04/2014 - 15:58:08 | SHD] - C:\System Volume Information
[19/04/2014 - 09:47:56 | D] - C:\UsbFix
[19/04/2014 - 09:57:11 | A | 10 Ko | 99CD7FAE9040BC3298D2AB135CD96F7C] - C:\UsbFix [Clean 10] UP1-LR3E2H7.txt
[15/04/2014 - 10:55:33 | N | 12 Ko | 3CC3307DEDD69021ABF7C2C8E0DB5049] - C:\UsbFix [Clean 2] UP1-LR3E2H7.txt
[15/04/2014 - 23:27:25 | N | 12 Ko | F35B8564A0A4DEE34A7F206657FB057D] - C:\UsbFix [Clean 4] UP1-LR3E2H7.txt
[15/04/2014 - 23:33:57 | N | 12 Ko | F916701323B46DAB5EF4DAD25262687D] - C:\UsbFix [Clean 6] UP1-LR3E2H7.txt
[15/04/2014 - 23:40:33 | N | 13 Ko | 30A405AB8D7F5B7938AAF9AB1CCC12D1] - C:\UsbFix [Clean 8] UP1-LR3E2H7.txt
[10/10/2013 - 09:33:33 | D] - C:\Users
[07/11/2007 - 08:00:40 | N | 6 Ko] - C:\vcredist.bmp
[07/11/2007 - 08:09:22 | N | 1409 Ko] - C:\VC_RED.cab
[07/11/2007 - 08:12:28 | N | 228 Ko] - C:\VC_RED.MSI
[04/04/2014 - 17:10:57 | D] - C:\Windows
[31/03/2014 - 16:33:08 | D] - C:\xampp
[28/01/2014 - 20:09:58 | N | 478565 Ko] - E:\Film PREDIT v30mn.wmv
[01/04/2014 - 17:12:18 | N | 3496 Ko] - E:\Diapo MEISSONNIER-8avril2014.odp
[11/04/2014 - 14:52:18 | N | 70 Ko] - E:\Com WCTR francophone - 14-03-14.odt
[31/10/2012 - 12:13:42 | SH | 4 Ko] - E:\._.Trashes
################## | Vaccin |
E:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
G:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
################## | E.O.F | https://www.usbfix.net/ - https://www.sosvirus.net/ | -
-
-
-
Hello ,
Pour avast oui réinstalle le mais je te conseil quelque chose d'un peut plus performant vu que tes clés naviguent entre chez toi et le travail :
-> https://www.bitdefender.fr/solutions/
Plus de soucis sinon avec les clés ? Les rapport sont OK
-
il semblerait que tout va bien.
Merci ! -
Bonjour !
A nouveau ce même virus : les dossiers sur clés usb se présentent sous forme de raccourcis.
Je suis en train de le désinfecter avec USB fix, j'ai le rapport d'erreur et vous demande de l'assistance pour mener à bien le nettoyage.
Merci ! -
Contributeur sécuritéOui poste le
-
voici le rapport
http://upload.sosvirus.net/www/?a=d&i=Jxn3myba05
merci -
Contributeur sécuritéfais suppression
-
Je t'ai bien compris. Merci de ton aide.
J'ai relancé USB fix et j'ai supprimé le dossier qui le bloquait.
Peux tu me dire si je peux m'atteler à supprimer les fichiers Thumbs.db qui ont envahi mes dossiers depuis que j'ai fait toutes ces manipulations ?
Du coup voici le rapport d'USB fix:
############################## | UsbFix V 7.166 | [Suppression]
Utilisateur: Administrateur (Administrateur) # UP1-LR3E2H7
Mis à jour le 26/02/2014 par El Desaparecido - Team SosVirus
Lancé à 11:10:41 | 17/03/2014
Site Web : https://www.usbfix.net/
Changelog : https://www.usb-antivirus.com/fr/maj/
Support : https://www.sosvirus.net/
Upload Malware : http://www.sosvirus.net/upload_malware.php
Contact : https://www.usb-antivirus.com/fr/contact/
PC: LENOVO (5017A78)
CPU: Intel(R) Core(TM) i5-2410M CPU @ 2.30GHz
RAM -> [Total : 3936 Mo| Free : 2693 Mo]
Bios: LENOVO
Boot: Normal boot
OS: Microsoft Windows 7 Professionnel (6.1.7601 64-Bit) Service Pack 1
WB: Windows Internet Explorer : 11.0.9600.16521
WB: Mozilla Firefox : 27.0.1
SC: Security Center [Enabled]
WU: Windows Update [Enabled]
AS: Windows Defender [Enabled | Updated]
FW: Windows FireWall [Enabled]
C:\ (%systemdrive%) -> Disque fixe # 298 Go (69 Go libre(s) - 23%) [OSDisk] # NTFS
D:\ -> CD-ROM
E:\ -> Disque amovible # 4 Go (4 Go libre(s) - 94%) [] # FAT32
F:\ -> CD-ROM
G:\ -> Disque fixe # 466 Go (107 Go libre(s) - 23%) [Iomega HDD] # NTFS
H:\ -> Disque amovible # 952 Mo (893 Mo libre(s) - 94%) [] # FAT
################## | Processus Actif |
C:\Windows\system32\csrss.exe (ID: 396 |ParentID: 384)
C:\Windows\system32\wininit.exe (ID: 476 |ParentID: 384)
C:\Windows\system32\csrss.exe (ID: 496 |ParentID: 484)
C:\Windows\system32\services.exe (ID: 536 |ParentID: 476)
C:\Windows\system32\lsass.exe (ID: 556 |ParentID: 476)
C:\Windows\system32\lsm.exe (ID: 564 |ParentID: 476)
C:\Windows\system32\winlogon.exe (ID: 676 |ParentID: 484)
C:\Windows\system32\svchost.exe (ID: 708 |ParentID: 536)
C:\Windows\system32\ibmpmsvc.exe (ID: 768 |ParentID: 536)
C:\Windows\system32\svchost.exe (ID: 824 |ParentID: 536)
C:\Windows\System32\svchost.exe (ID: 904 |ParentID: 536)
C:\Windows\System32\svchost.exe (ID: 952 |ParentID: 536)
C:\Windows\system32\svchost.exe (ID: 1004 |ParentID: 536)
C:\Windows\system32\svchost.exe (ID: 216 |ParentID: 536)
C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe (ID: 1064 |ParentID: 536)
C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (ID: 1088 |ParentID: 1064)
C:\Windows\system32\svchost.exe (ID: 1112 |ParentID: 536)
C:\Windows\System32\spoolsv.exe (ID: 1348 |ParentID: 536)
C:\Windows\system32\svchost.exe (ID: 1376 |ParentID: 536)
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (ID: 1472 |ParentID: 536)
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (ID: 1492 |ParentID: 536)
C:\Program Files\Bonjour\mDNSResponder.exe (ID: 1520 |ParentID: 536)
C:\Windows\system32\svchost.exe (ID: 1564 |ParentID: 536)
C:\Program Files (x86)\FusionInventory-Agent\perl\bin\perl.exe (ID: 1612 |ParentID: 536)
C:\Program Files (x86)\Skype\Updater\Updater.exe (ID: 1796 |ParentID: 536)
C:\Windows\system32\svchost.exe (ID: 1832 |ParentID: 536)
C:\Windows\system32\taskhost.exe (ID: 1236 |ParentID: 536)
C:\Windows\system32\taskeng.exe (ID: 1644 |ParentID: 216)
C:\Windows\system32\Dwm.exe (ID: 1552 |ParentID: 952)
C:\Windows\Explorer.EXE (ID: 1772 |ParentID: 2036)
C:\Windows\system32\runonce.exe (ID: 2288 |ParentID: 1772)
C:\Windows\SysWOW64\runonce.exe (ID: 2316 |ParentID: 2288)
C:\Windows\system32\svchost.exe (ID: 2476 |ParentID: 536)
C:\Windows\system32\svchost.exe (ID: 2528 |ParentID: 536)
C:\Windows\System32\WUDFHost.exe (ID: 2640 |ParentID: 952)
C:\Windows\System32\rundll32.exe (ID: 2760 |ParentID: 708)
C:\Windows\System32\WUDFHost.exe (ID: 2792 |ParentID: 952)
C:\Windows\system32\wbem\wmiprvse.exe (ID: 2184 |ParentID: 708)
################## | Regedit Run |
04 - HKCU\..\Run : [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
04 - HKCU\..\Run : [Google Update] "C:\Users\Administrateur\AppData\Local\Google\Update\GoogleUpdate.exe" /c
04 - HKCU\..\Run : [AdobeBridge]
04 - HKCU\..\Run : [HP Photosmart Plus B210 series (NET)] "C:\Program Files\HP\HP Photosmart Plus B210 series\Bin\ScanToPCActivationApp.exe" -deviceID "CN16H3251605J9:NW" -scfn "HP Photosmart Plus B210 series (NET)" -AutoStart 1
04 - HKCU\..\Run : [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
04 - HKCU\..\Run : [jSugLyCC] wscript.exe //B "C:\Users\ADMINI~1\AppData\Local\Temp\jSugLyCC.vbs"
04 - HKLM\..\Run : [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
04 - HKLM\..\Run : [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
04 - HKLM\..\Run : []
04 - HKLM\..\Run : [Adobe Acrobat Speed Launcher] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe"
04 - HKLM\..\Run : [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe"
04 - HKLM\..\Run : [AdobeCS4ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
04 - HKLM\..\Run : [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
04 - HKLM\..\Run : [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
04 - HKLM\..\Run : [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
04 - HKLM64\..\Run : [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
04 - HKLM64\..\Run : [IgfxTray] C:\Windows\system32\igfxtray.exe
04 - HKLM64\..\Run : [HotKeysCmds] C:\Windows\system32\hkcmd.exe
04 - HKLM64\..\Run : [Persistence] C:\Windows\system32\igfxpers.exe
04 - HKLM64\..\Run : [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
04 - HKLM64\..\Run : [jSugLyCC] wscript.exe //B "C:\Users\ADMINI~1\AppData\Local\Temp\jSugLyCC.vbs"
04 - HKU\S-1-5-19\..\Run : [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
04 - HKU\S-1-5-20\..\Run : [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
04 - HKU\S-1-5-21-3331046427-1064584010-3109013383-500\..\Run : [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
04 - HKU\S-1-5-21-3331046427-1064584010-3109013383-500\..\Run : [Google Update] "C:\Users\Administrateur\AppData\Local\Google\Update\GoogleUpdate.exe" /c
04 - HKU\S-1-5-21-3331046427-1064584010-3109013383-500\..\Run : [AdobeBridge]
04 - HKU\S-1-5-21-3331046427-1064584010-3109013383-500\..\Run : [HP Photosmart Plus B210 series (NET)] "C:\Program Files\HP\HP Photosmart Plus B210 series\Bin\ScanToPCActivationApp.exe" -deviceID "CN16H3251605J9:NW" -scfn "HP Photosmart Plus B210 series (NET)" -AutoStart 1
04 - HKU\S-1-5-21-3331046427-1064584010-3109013383-500\..\Run : [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
04 - HKU\S-1-5-21-3331046427-1064584010-3109013383-500\..\Run : [jSugLyCC] wscript.exe //B "C:\Users\ADMINI~1\AppData\Local\Temp\jSugLyCC.vbs"
04 - HKU\S-1-5-19\..\RunOnce : [mctadmin] C:\Windows\System32\mctadmin.exe
04 - HKU\S-1-5-20\..\RunOnce : [mctadmin] C:\Windows\System32\mctadmin.exe
################## | Recherche générique |
Supprimé! C:\Users\Administrateur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jSugLyCC.vbs
Supprimé! E:\jSugLyCC.vbs
Supprimé! H:\jSugLyCC.vbs
Supprimé! C:\Users\ADMINI~1\AppData\Local\Temp\jSugLyCC.vbs
Supprimé! E:\presentation.lnk
Supprimé! E:\Publication1.lnk
Supprimé! E:\Libellule.lnk
Supprimé! E:\.lnk
Supprimé! E:\.Trashes.lnk
Supprimé! E:\.fseventsd.lnk
Supprimé! E:\.Spotlight-V100.lnk
Supprimé! E:\libellule-text.lnk
Supprimé! E:\P1000943.lnk
Supprimé! E:\P1000938.lnk
Supprimé! E:\P1000975.lnk
Supprimé! E:\plum2.lnk
Supprimé! H:\DCIM.lnk
Supprimé! H:\MISC.lnk
Supprimé! H:\ime.lnk
Supprimé! H:\FOUND.000.lnk
Supprimé! H:\BOOTEX.lnk
Supprimé! C:\Users\Administrateur\Cache
Supprimé! G:\pozuda
Supprimé! H:\ime
Supprimé! C:\_OTL\MovedFiles\03122014_183514\C_Users\Administrateur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jSugLyCC.vbs
(!) Fichiers temporaires supprimés.
################## | Registre |
Réparé ! HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System|EnableLUA -> 1
Réparé ! HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System|ConsentPromptBehaviorAdmin -> 5
Supprimé! HKU\S-1-5-21-3331046427-1064584010-3109013383-500\Software\Microsoft\Windows\CurrentVersion\Run|jSugLyCC
Supprimé! HKU\S-1-5-21-3331046427-1064584010-3109013383-500\Software\.\.\.\.\Mountpoints2\{36fc46cc-19c3-11e2-b328-cc52af824b4f}
################## | Listing |
[12/03/2013 - 10:39:34 | SHD] - C:\$Recycle.Bin
[17/02/2014 - 16:59:26 | N | 0 Ko] - C:\AVScanner.ini
[31/01/2012 - 14:56:33 | D] - C:\certs
[14/07/2009 - 06:08:56 | SHD] - C:\Documents and Settings
[03/10/2013 - 14:24:36 | D] - C:\Drivers
[18/10/2012 - 12:59:31 | D] - C:\GIRDAC
[17/03/2014 - 11:09:25 | ASH | 3023220 Ko] - C:\hiberfil.sys
[31/01/2012 - 14:56:32 | N | 0 Ko] - C:\install.log
[31/01/2012 - 14:40:00 | D] - C:\Intel
[07/01/2014 - 19:35:06 | N | 0 Ko] - C:\lxct.log
[31/01/2012 - 14:45:17 | D] - C:\MININT
[02/10/2012 - 07:02:41 | RHD] - C:\MSOCache
[17/03/2014 - 11:09:29 | ASH | 6045696 Ko] - C:\pagefile.sys
[14/07/2009 - 04:20:08 | D] - C:\PerfLogs
[12/03/2014 - 17:08:53 | D] - C:\Program Files
[19/02/2014 - 00:25:40 | D] - C:\Program Files (x86)
[12/03/2014 - 17:08:53 | HD] - C:\ProgramData
[31/01/2012 - 14:44:07 | SHD] - C:\Recovery
[16/01/2014 - 01:42:40 | N | 594 Ko | ECFA4E7350DE3BB49AE671A9A3382A35] - C:\SecurityScanner.dll
[28/09/2012 - 20:29:45 | SHD] - C:\System Volume Information
[11/03/2014 - 17:51:09 | D] - C:\UsbFix
[17/03/2014 - 11:21:05 | A | 9 Ko | 438CACD88E2FD3F1E7F661A7698BC44C] - C:\UsbFix [Clean 10] UP1-LR3E2H7.txt
[11/03/2014 - 17:56:57 | N | 7 Ko | 7872B64F3C6FBE46F5E3CE03A79D0196] - C:\UsbFix [Clean 2] UP1-LR3E2H7.txt
[12/03/2014 - 09:53:33 | N | 6 Ko | 622CCD794B099FBC4FD5F0D7E13C765E] - C:\UsbFix [Clean 4] UP1-LR3E2H7.txt
[12/03/2014 - 12:10:44 | N | 6 Ko | 5518A45D658A51631ED24DEB9F399EBD] - C:\UsbFix [Clean 6] UP1-LR3E2H7.txt
[17/03/2014 - 10:43:23 | N | 10 Ko | 9E9EFADC3087AAA4CA3E1A49A4C9903E] - C:\UsbFix [Clean 8] UP1-LR3E2H7.txt
[22/04/2012 - 18:55:32 | N | 0 Ko] - C:\user.js
[10/10/2013 - 08:33:33 | D] - C:\Users
[12/03/2014 - 12:07:32 | D] - C:\Windows
[12/03/2014 - 18:35:14 | D] - C:\_OTL
[29/11/2013 - 11:01:24 | N | 223007 Ko] - E:\presentation.pub
[05/03/2014 - 10:56:38 | SH | 4 Ko] - E:\._.Trashes
[05/03/2014 - 10:42:36 | N | 11 Ko | 8BA1269A0C1D0F8CCC76C6B2E5AD2783] - E:\Publication1.txt
[05/03/2014 - 10:38:16 | D] - E:\Libellule
[05/03/2014 - 10:56:38 | SHD] - E:\.Trashes
[05/03/2014 - 10:56:40 | SHD] - E:\.Spotlight-V100
[05/03/2014 - 12:14:14 | N | 4 Ko | A1118EA96ABE06694A27FFD666463965] - E:\libellule-text.txt
[27/11/2013 - 18:25:40 | N | 5393 Ko] - E:\P1000943.JPG
[27/11/2013 - 18:21:50 | N | 5268 Ko] - E:\P1000938.JPG
[04/12/2013 - 17:25:44 | N | 5003 Ko] - E:\P1000975.JPG
[12/11/2013 - 11:56:22 | N | 7308 Ko] - E:\plum2.jpg
[05/03/2014 - 12:26:24 | N | 16 Ko] - E:\libellule-text.rtf
[09/10/2013 - 12:36:26 | SHD] - G:\$RECYCLE.BIN
[18/04/2011 - 21:36:15 | D] - G:\092511zik
[03/05/2013 - 12:07:00 | D] - G:\2013-05 Mes images MEILO
[13/03/2013 - 22:13:55 | N | 7441 Ko] - G:\CASNAV.pub
[06/07/2012 - 23:51:29 | D] - G:\Copie Lezarde
[14/06/2013 - 11:29:52 | D] - G:\Documentaires
[01/06/2005 - 13:36:46 | N | 419 Ko] - G:\DSCN3968.JPG
[02/06/2005 - 13:37:38 | N | 427 Ko] - G:\DSCN3971.JPG
[22/04/2012 - 21:37:45 | D] - G:\films serkan bea
[22/04/2012 - 21:23:39 | D] - G:\Final cut express
[04/05/2010 - 07:26:16 | N | 1312 Ko] - G:\girafe (3).JPG
[29/03/2013 - 11:07:57 | D] - G:\laurence2
[17/12/2012 - 22:54:48 | D] - G:\laurencelenovosauv2012_12_17
[07/11/2012 - 14:38:02 | D] - G:\MAG ALTER JEUNS
[07/11/2012 - 14:38:45 | D] - G:\meiloperso
[01/03/2011 - 18:47:59 | D] - G:\Mes vidéos
[07/10/2013 - 07:32:52 | D] - G:\Mise en page 2013-09-23
[09/10/2013 - 16:42:27 | D] - G:\Mise en page2013-10-08
[17/04/2011 - 21:46:47 | D] - G:\Nico
[25/09/2012 - 14:09:19 | D] - G:\plans maison
[05/02/2013 - 09:22:50 | D] - G:\PLUME
[15/04/2010 - 12:19:36 | N | 7989 Ko] - G:\pour zo.jpg
[11/11/2010 - 20:49:17 | D] - G:\RASED 2010
[15/02/2010 - 07:24:20 | SHD] - G:\RECYCLER
[31/08/2011 - 09:51:10 | D] - G:\sauvJO
[31/08/2011 - 09:50:03 | D] - G:\sauvLILLE
[24/01/2012 - 00:32:16 | D] - G:\sauvLO
[31/08/2011 - 09:53:31 | D] - G:\sauvMA MUSIQUE
[31/08/2011 - 09:55:03 | D] - G:\sauvMa musique meilo
[07/10/2013 - 13:06:15 | D] - G:\SEYYAR 2013-09-23
[06/02/2014 - 09:53:23 | D] - G:\SEYYAR IMPRIMEUR
[02/05/2013 - 13:23:30 | D] - G:\SEYYAR sauv 2009
[02/05/2013 - 13:31:42 | D] - G:\SEYYAR sauv 2012
[18/11/2012 - 10:52:44 | D] - G:\stage musique rome
[02/09/2011 - 08:28:16 | SHD] - G:\System Volume Information
[25/07/2010 - 23:26:22 | D] - G:\video posetmoset
[01/02/2009 - 21:43:22 | D] - H:\DCIM
[06/07/2012 - 17:00:22 | D] - H:\MISC
[17/01/2014 - 19:12:06 | D] - H:\FOUND.000
[14/03/2014 - 09:40:38 | N | 1 Ko] - H:\BOOTEX.LOG
################## | Vaccin |
E:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
G:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
H:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
################## | E.O.F | https://www.usbfix.net/ - https://www.sosvirus.net/ | -
Re,
Copie les lignes en gras ci dessous :
OTL:
IE - HKU\S-1-5-21-3331046427-1064584010-3109013383-500\SOFTWARE\Microsoft\Internet Explorer\Main,bProtector Start Page = http://www.holasearch.com/?affID=121962&tt=gc_&babsrc=HP_ss&mntrId=30A4D0DF9A1047C1
IE - HKU\S-1-5-21-3331046427-1064584010-3109013383-500\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://isearch.babylon.com/?q={searchTerms}&affID=121962&tt=gc_&babsrc=SP_ssbtis1&mntrId=30A4D0DF9A1047C1
IE - HKU\S-1-5-21-3331046427-1064584010-3109013383-500\..\SearchScopes\4A98C7D3984B4F9B8BE3AAFA4A28BD96: "URL" = https://isearch.avg.com/?cid={96451353-8C13-479C-9138-2CC46ACE7252}&mid=34938d7a0a6447d0b7af1d1be966a2bc-4751d8bbc384ee28e3e373ec40af4b23ef571cf9&lang=fr&ds=pd011&pr=sa&d=2012-10-12 13:14:03&v=15.3.0.11&pid=avg&sg=0&sap=dsp&q={searchTerms}
FF - prefs.js..keyword.URL: "http://search.babylon.com/?affID=111020&babsrc=KW_ss&mntrId=30a4d849000000000000cc52af824b4f&q="
[2013/06/02 23:06:15 | 000,006,498 | ---- | M] () -- C:\Users\Administrateur\AppData\Roaming\Mozilla\Firefox\Profiles\hzf3w85m.default\searchplugins\babylon.xml
[2013/06/02 23:06:19 | 000,001,304 | ---- | M] () -- C:\Users\Administrateur\AppData\Roaming\Mozilla\Firefox\Profiles\hzf3w85m.default\searchplugins\holasearch.xml
[2013/07/03 12:30:09 | 000,001,418 | ---- | M] () -- C:\Users\Administrateur\AppData\Roaming\Mozilla\Firefox\Profiles\hzf3w85m.default\searchplugins\BitGuard.xml
[2013/08/19 16:31:43 | 000,002,273 | ---- | M] () -- C:\Users\Administrateur\AppData\Roaming\Mozilla\Firefox\Profiles\hzf3w85m.default\searchplugins\BrowserDefender.xml
O3 - HKLM\..\Toolbar: (Holasearch Toolbar) - {C510DFFB-0AFE-484C-BA40-CED5B74C4EEF} - C:\Program Files (x86)\holasearch\holasearch\1.8.16.16\holasearchTlbr.dll File not found
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\S-1-5-21-3331046427-1064584010-3109013383-500\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O4:[b]64bit:/b - HKLM..\Run: [jSugLyCC] wscript.exe //B "C:\Users\ADMINI~1\AppData\Local\Temp\jSugLyCC.vbs" File not found
O4 - HKLM..\Run: [] File not found
O20:[b]64bit:/b - AppInit_DLLs: (c:\progra~3\bitguard\271769~1.27\{c16c1~1\loader.dll) - File not found
reg:
[-HKEY_CURRENT_USER\Software\AppDataLow\Software\Crossrider]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\Plus-HD-2_RASAPI32]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\Plus-HD-2_RASMANCS]
[-HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\Plus-HD-2_RASAPI32]
[-HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\Plus-HD-2_RASMANCS]
:files
C:\Program Files (x86)\holasearch
C:\ProgramData\BitGuard
C:\Users\Administrateur\Desktop\cacaoweb.exe
C:\Users\Administrateur\AppData\Roaming\cacaoweb
C:\ProgramData\Babylon
C:\Users\All Users\Babylon
:commands
[reboot]
Relance OTL.
Colle ces lignes dans la partie du bas.
Clic sur Correction
Poste le rapport. -
Oui, mais je me suis trompé -_-'
Copie les lignes en gras :
:OTL
IE - HKU\S-1-5-21-3331046427-1064584010-3109013383-500\SOFTWARE\Microsoft\Internet Explorer\Main,bProtector Start Page = http://www.holasearch.com/?affID=121962&tt=gc_&babsrc=HP_ss&mntrId=30A4D0DF9A1047C1
IE - HKU\S-1-5-21-3331046427-1064584010-3109013383-500\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://isearch.babylon.com/?q={searchTerms}&affID=121962&tt=gc_&babsrc=SP_ssbtis1&mntrId=30A4D0DF9A1047C1
IE - HKU\S-1-5-21-3331046427-1064584010-3109013383-500\..\SearchScopes\4A98C7D3984B4F9B8BE3AAFA4A28BD96: "URL" = https://isearch.avg.com/?cid={96451353-8C13-479C-9138-2CC46ACE7252}&mid=34938d7a0a6447d0b7af1d1be966a2bc-4751d8bbc384ee28e3e373ec40af4b23ef571cf9&lang=fr&ds=pd011&pr=sa&d=2012-10-12 13:14:03&v=15.3.0.11&pid=avg&sg=0&sap=dsp&q={searchTerms}
FF - prefs.js..keyword.URL: "http://search.babylon.com/?affID=111020&babsrc=KW_ss&mntrId=30a4d849000000000000cc52af824b4f&q="
[2013/06/02 23:06:15 | 000,006,498 | ---- | M] () -- C:\Users\Administrateur\AppData\Roaming\Mozilla\Firefox\Profiles\hzf3w85m.default\searchplugins\babylon.xml
[2013/06/02 23:06:19 | 000,001,304 | ---- | M] () -- C:\Users\Administrateur\AppData\Roaming\Mozilla\Firefox\Profiles\hzf3w85m.default\searchplugins\holasearch.xml
[2013/07/03 12:30:09 | 000,001,418 | ---- | M] () -- C:\Users\Administrateur\AppData\Roaming\Mozilla\Firefox\Profiles\hzf3w85m.default\searchplugins\BitGuard.xml
[2013/08/19 16:31:43 | 000,002,273 | ---- | M] () -- C:\Users\Administrateur\AppData\Roaming\Mozilla\Firefox\Profiles\hzf3w85m.default\searchplugins\BrowserDefender.xml
O3 - HKLM\..\Toolbar: (Holasearch Toolbar) - {C510DFFB-0AFE-484C-BA40-CED5B74C4EEF} - C:\Program Files (x86)\holasearch\holasearch\1.8.16.16\holasearchTlbr.dll File not found
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\S-1-5-21-3331046427-1064584010-3109013383-500\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O4:[b]64bit:/b - HKLM..\Run: [jSugLyCC] wscript.exe //B "C:\Users\ADMINI~1\AppData\Local\Temp\jSugLyCC.vbs" File not found
O4 - HKLM..\Run: [] File not found
O20:[b]64bit:/b - AppInit_DLLs: (c:\progra~3\bitguard\271769~1.27\{c16c1~1\loader.dll) - File not found
:reg
[-HKEY_CURRENT_USER\Software\AppDataLow\Software\Crossrider]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\Plus-HD-2_RASAPI32]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\Plus-HD-2_RASMANCS]
[-HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\Plus-HD-2_RASAPI32]
[-HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\Plus-HD-2_RASMANCS]
Relance OTL.
Colle ces lignes dans la partie du bas.
Clic sur Correction
Poste le rapport. -
si vous avez le virus recycler sur E:/
tu dois cliquez sur le button démarrer puis executer puis tapez cmd et cliquez ok
tu dois allez sur c:/ windows /systeme32/attrib.exe copier attrib.exe vers E:/
aprés on doit allez vers cmd et tapez E:/
puis tapez:attrib- s h / s / d *. *
après tu dois allez sous E:/ et supprimer le virus recycler
attends quelques secondes et le problème et résolu!!!!
Précédent
- 1
- 2
- 3
