Rapport de usbfix

############################## | UsbFix V 7.169 | [Suppression]

Utilisateur: chaqouri ahmed (Administrateur) # MAISON-B496ED14
Mis à jour le 31/03/2014 par El Desaparecido - Team SosVirus
Lancé à 12:36:25 | 03/05/2014

Site Web : https://www.usbfix.net/
Changelog : https://www.usb-antivirus.com/fr/maj/
Support : https://depannageinformatique.org/acheter/reservation/?f=6
Upload Malware : http://www.sosvirus.net/upload_malware.php
Contact : https://www.usb-antivirus.com/fr/contact/

PC: FUJITSU SIEMENS (P5SD1-FM2)
CPU: Intel(R) Pentium(R) 4 CPU 3.00GHz
RAM -> [Total : 1023 Mo| Free : 532 Mo]
Bios: American Megatrends Inc.
Boot: Normal boot

OS: Microsoft Windows XP Professionnel (5.1.2600 32-Bit) Service Pack 3
WB: Windows Internet Explorer : 8.0.6001.18702
WB: Mozilla Firefox : 28.0

SC: Security Center [Enabled]
WU: Windows Update [Enabled]

FW: Windows FireWall [Enabled]

C:\ (%systemdrive%) -> Disque fixe # 100 Go (60 Go libre(s) - 60%) [] # NTFS
D:\ -> Disque fixe # 133 Go (133 Go libre(s) - 100%) [] # NTFS
J:\ -> CD-ROM
K:\ -> CD-ROM
M:\ -> Disque amovible # 4 Go (4 Go libre(s) - 100%) [POCKET] # FAT32

################## | Processus Actif |

C:\WINDOWS.0\System32\smss.exe (ID: 608 |ParentID: 4)
C:\WINDOWS.0\system32\winlogon.exe (ID: 712 |ParentID: 608)
C:\WINDOWS.0\system32\services.exe (ID: 760 |ParentID: 712)
C:\WINDOWS.0\system32\lsass.exe (ID: 772 |ParentID: 712)
C:\WINDOWS.0\system32\Ati2evxx.exe (ID: 940 |ParentID: 760)
C:\WINDOWS.0\system32\svchost.exe (ID: 960 |ParentID: 760)
C:\WINDOWS.0\System32\svchost.exe (ID: 1096 |ParentID: 760)
C:\WINDOWS.0\system32\spoolsv.exe (ID: 1408 |ParentID: 760)
C:\WINDOWS.0\system32\Ati2evxx.exe (ID: 1544 |ParentID: 712)
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe (ID: 1808 |ParentID: 760)
C:\Program Files\Bonjour\mDNSResponder.exe (ID: 1832 |ParentID: 760)
C:\WINDOWS.0\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (ID: 1856 |ParentID: 760)
C:\Documents and Settings\All Users.WINDOWS.0\Application Data\DatacardService\HWDeviceService.exe (ID: 1948 |ParentID: 760)
C:\WINDOWS.0\system32\dmwu.exe (ID: 1972 |ParentID: 760)
C:\Documents and Settings\All Users.WINDOWS.0\Application Data\Internet Mobile\OnlineUpdate\ouc.exe (ID: 228 |ParentID: 2024)
C:\WINDOWS.0\system32\wscntfy.exe (ID: 1704 |ParentID: 1096)
C:\WINDOWS.0\Explorer.EXE (ID: 1900 |ParentID: 1920)
C:\Program Files\Internet Mobile\Internet Mobile.exe (ID: 980 |ParentID: 1948)
C:\PROGRA~1\GAMING~2\bar\1.bin\AppIntegrator.exe (ID: 2188 |ParentID: 1900)
C:\PROGRA~1\GAMING~2\bar\1.bin\gtsrchmn.exe (ID: 2200 |ParentID: 1900)
C:\PROGRA~1\GAMING~2\bar\1.bin\gtbrmon.exe (ID: 2220 |ParentID: 1900)
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe (ID: 2252 |ParentID: 1900)
C:\WINDOWS.0\system32\ctfmon.exe (ID: 2276 |ParentID: 1900)
C:\Program Files\Modem Samsung SCH-U209\SamsungPnPServiceManager.exe (ID: 2284 |ParentID: 1900)
C:\Program Files\Modem Samsung SCH-U209\sysctrlU.exe (ID: 2304 |ParentID: 1900)
C:\Program Files\McAfee Security Scan\3.8.141\SSScheduler.exe (ID: 2316 |ParentID: 1900)
C:\Program Files\Free Spider Solitaire\FreeSpider.exe (ID: 2620 |ParentID: 1900)
C:\WINDOWS.0\system32\NOTEPAD.EXE (ID: 1864 |ParentID: 4088)
C:\Program Files\Mozilla Firefox\firefox.exe (ID: 4088 |ParentID: 3080)
C:\Program Files\Mozilla Firefox\plugin-container.exe (ID: 2324 |ParentID: 4088)
C:\Program Files\Mozilla Firefox\plugin-container.exe (ID: 3952 |ParentID: 4088)

################## | Recherche générique |


(!) Fichiers temporaires supprimés.

################## | Registre |

Supprimé! HKU\S-1-5-21-1957994488-764733703-1644491937-1003\Software\.\.\.\.\Mountpoints2\{1604a5bb-c028-11e3-a1d8-0015f261e323}
Supprimé! HKU\S-1-5-21-1957994488-764733703-1644491937-1003\Software\.\.\.\.\Mountpoints2\{55f54f0a-c33a-11e3-a1db-0015f261e323}
Supprimé! HKU\S-1-5-21-1957994488-764733703-1644491937-1003\Software\.\.\.\.\Mountpoints2\{9cb015b6-c02d-11e3-a1d9-0015f261e323}

################## | Regedit Run |

F2 - HKLM\..\Winlogon : [Shell] Explorer.exe
F2 - [x64] HKLM\..\Winlogon : [Shell] Explorer.exe
F2 - HKLM\..\Winlogon : [Userinit] C:\WINDOWS.0\system32\userinit.exe,
F2 - [x64] HKLM\..\Winlogon : [Userinit] C:\WINDOWS.0\system32\userinit.exe,
04 - HKCU\..\Run : [CTFMON.EXE] C:\WINDOWS.0\system32\ctfmon.exe
04 - HKCU\..\Run : [Z810PNP] C:\Program Files\Modem Samsung SCH-U209\SamsungPnPServiceManager.exe
04 - HKCU\..\Run : [Z810SysStart] C:\Program Files\Modem Samsung SCH-U209\sysctrlU.exe
04 - HKLM\..\Run : [GamingWonderland Home Page Guard 32 bit] "C:\PROGRA~1\GAMING~2\bar\1.bin\AppIntegrator.exe"
04 - HKLM\..\Run : [GamingWonderland Search Scope Monitor] "C:\PROGRA~1\GAMING~2\bar\1.bin\gtsrchmn.exe" /m=2 /w /h
04 - HKLM\..\Run : [GamingWonderland Browser Plugin Loader] C:\PROGRA~1\GAMING~2\bar\1.bin\gtbrmon.exe
04 - HKLM\..\Run : [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
04 - HKLM\..\Run : [Adobe ARM] "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
04 - HKLM\..\RunOnce : []
04 - HKLM\Software\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\..\Run : []
04 - HKLM\Software\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\..\RunOnce : []
04 - HKU\S-1-5-19\..\Run : [CTFMON.EXE] C:\WINDOWS.0\system32\CTFMON.EXE
04 - HKU\S-1-5-20\..\Run : [CTFMON.EXE] C:\WINDOWS.0\system32\CTFMON.EXE
04 - HKU\S-1-5-21-1957994488-764733703-1644491937-1003\..\Run : [CTFMON.EXE] C:\WINDOWS.0\system32\ctfmon.exe
04 - HKU\S-1-5-21-1957994488-764733703-1644491937-1003\..\Run : [Z810PNP] C:\Program Files\Modem Samsung SCH-U209\SamsungPnPServiceManager.exe
04 - HKU\S-1-5-21-1957994488-764733703-1644491937-1003\..\Run : [Z810SysStart] C:\Program Files\Modem Samsung SCH-U209\sysctrlU.exe
04 - HKU\S-1-5-18\..\Run : [CTFMON.EXE] C:\WINDOWS.0\system32\CTFMON.EXE

################## | Listing |

[31/01/2014 - 15:06:04 | D] - C:\ATI
[31/01/2014 - 13:54:50 | A | 0 Ko] - C:\AUTOEXEC.BAT
[09/04/2014 - 16:24:38 | SH | 0 Ko] - C:\boot.ini
[28/08/2001 - 14:00:00 | N | 5 Ko] - C:\Bootfont.bin
[03/05/2014 - 01:12:55 | D] - C:\Config.Msi
[31/01/2014 - 13:54:50 | N | 0 Ko] - C:\CONFIG.SYS
[28/08/2008 - 04:06:27 | N | 55 Ko | C4B470269324517EE838789C7CF5E606] - C:\devcon.exe
[22/04/2014 - 13:30:00 | D] - C:\Documents and Settings
[10/01/2009 - 04:37:59 | N | 284 Ko | FF653522310E19E82A4C505B340F2AE5] - C:\DPsFnshr.exe
[05/02/2009 - 02:26:39 | N | 1 Ko] - C:\DPsFnshr.ini
[25/11/2008 - 02:52:47 | N | 9 Ko | 21B3ECB566CCFD9D7D04CE24EC6C27D3] - C:\DP_Misc_wnt5_x86-32 Changelog.txt
[25/11/2008 - 03:03:19 | N | 5 Ko | D45BCA6F9C89985E644DFA431B914895] - C:\DP_Misc_wnt5_x86-32 Contents.txt
[21/10/2008 - 10:55:02 | N | 1 Ko] - C:\DriverPack_Bluetooth_wnt5_x86-32.ini
[07/04/2007 - 20:52:09 | N | 0 Ko] - C:\DriverPack_CPU_wnt5_x86-32.ini
[14/12/2008 - 00:20:52 | N | 3 Ko] - C:\DriverPack_Graphics_A_wnt5_x86-32.ini
[14/12/2008 - 00:23:04 | N | 5 Ko] - C:\DriverPack_Graphics_B_wnt5_x86-32.ini
[22/12/2008 - 15:21:31 | N | 3 Ko] - C:\DriverPack_Graphics_C_wnt5_x86-32.ini
[23/12/2008 - 06:24:24 | N | 1 Ko] - C:\DriverPack_LAN_wnt5_x86-32.ini
[07/01/2009 - 23:44:38 | | 110 Ko] - C:\DriverPack_MassStorage_wnt5_x86-32.ini
[19/10/2008 - 16:40:09 | N | 7 Ko] - C:\DriverPack_Misc_wnt5_x86-32.ini
[01/04/2008 - 17:37:53 | N | 4 Ko] - C:\DriverPack_Sound_A_wnt5_x86-32.ini
[12/04/2008 - 11:47:12 | | 3 Ko] - C:\DriverPack_Sound_B_wnt5_x86-32.ini
[10/01/2009 - 04:38:02 | N | 244 Ko | E5D5A052723651C924EB53B5EABD5261] - C:\DSPdsblr.exe
[13/03/2014 - 23:30:32 | D] - C:\educampa
[03/05/2014 - 09:57:30 | ASH | 1047220 Ko] - C:\hiberfil.sys
[09/04/2014 - 16:36:45 | N | 11 Ko] - C:\hwids.dat
[31/01/2014 - 13:54:50 | RASH | 0 Ko] - C:\IO.SYS
[28/08/2008 - 04:06:26 | N | 21 Ko | 749F39EC981D04E4323CBAAE5EC78A4D] - C:\makePNF.exe
[27/06/2008 - 18:00:04 | N | 8 Ko] - C:\MessengerStyleSheet.xsl
[31/01/2014 - 13:54:50 | RASH | 0 Ko] - C:\MSDOS.SYS
[31/01/2014 - 14:26:35 | RHD] - C:\MSOCache
[28/08/2008 - 04:06:26 | N | 135 Ko | 4928FA5ED61C213B66AE8036A96037D1] - C:\mute.exe
[13/04/2008 - 09:43:04 | N | 46 Ko | B2DE3452DE03674C6CEC68B8C8CE7C78] - C:\NTDETECT.COM
[13/04/2008 - 11:31:52 | RASH | 246 Ko] - C:\ntldr
[03/05/2014 - 09:57:27 | ASH | 1572864 Ko] - C:\pagefile.sys
[10/01/2009 - 04:38:05 | N | 235 Ko | 352599A9284C07DEBD5287D9F31642DD] - C:\pmtimer.exe
[06/02/2014 - 02:01:26 | D] - C:\pnp
[27/04/2014 - 20:59:38 | D] - C:\Program Files
[14/04/2014 - 23:15:02 | SHD] - C:\RECYCLER
[09/04/2014 - 16:32:56 | SHD] - C:\System Volume Information
[03/05/2014 - 12:22:45 | D] - C:\UsbFix
[03/05/2014 - 12:37:02 | A | 9 Ko | C608C312AB44673D57D242CD989CFEAE] - C:\UsbFix [Clean 2] MAISON-B496ED14.txt
[03/05/2014 - 12:24:14 | N | 5 Ko | 98E63946532B394158EA8F11CEB0F834] - C:\UsbFix [Scan 1] MAISON-B496ED14.txt
[09/04/2014 - 15:51:47 | D] - C:\WINDOWS
[03/05/2014 - 11:52:49 | D] - C:\WINDOWS.0
[08/02/2014 - 09:12:26 | D] - D:\74838f5a94514d36f3435a9b05
[08/04/2014 - 23:45:54 | D] - D:\774d3c26886b5ac2250ed5bc2ee33702
[10/02/2014 - 04:10:54 | D] - D:\8f357dedc17fb1e3220d4c59d36c80b6
[12/02/2014 - 01:15:46 | D] - D:\ee06bdb7ad4e173949fe96bb4c7bb2
[25/04/2014 - 01:09:38 | SHD] - D:\RECYCLER
[09/04/2014 - 16:32:55 | SHD] - D:\System Volume Information
[17/12/2013 - 14:41:00 | D] - M:\usb
[18/01/2014 - 23:36:56 | N | 95 Ko] - M:\Photo.jpg
[14/12/2013 - 16:04:24 | N | 54 Ko] - M:\do3aa.jpg
[14/12/2013 - 16:22:44 | N | 63 Ko] - M:\agadir 1954.jpg
[21/04/2014 - 11:43:08 | N | 12 Ko] - M:\bartal facture 2.docx
[21/04/2014 - 11:43:32 | N | 11 Ko] - M:\facure bartal.docx
[22/04/2014 - 18:00:20 | N | 13 Ko] - M:\devis haj abid iligh.docx
[24/04/2014 - 17:17:04 | N | 12 Ko] - M:\MOSTACHE ARGRAG.docx
[28/04/2014 - 12:48:36 | D] - M:\afod
[29/04/2014 - 12:15:48 | N | 13 Ko] - M:\facture nakari.docx
[02/05/2014 - 23:06:08 | N | 24 Ko] - M:\OFFRE_DE_PRIX_MAISON_ENERGIE.PDF

################## | Vaccin |

D:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
M:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)

################## | E.O.F | https://www.usbfix.net/ - https://www.sosvirus.net/ |
Bonjour,