Re,
Comme prévu, me revoilà !
D'avance merci de votre aide
Ci-dessous le rapport de usbfix:
############################## | UsbFix V 7.155 | [Recherche]
Utilisateur: manon (Administrateur) # MANON-TOSH
Mis à jour le 16/12/2013 par El Desaparecido - Team SosVirus
Lancé à 22:08:14 | 18/12/2013
Site Web :
http://www.usbfix.net" onclick="window.open(this.href);return false;
Forum :
http://www.sosvirus.net/" onclick="window.open(this.href);return false;
Upload Malware :
http://www.sosvirus.net/upload_malware.php" onclick="window.open(this.href);return false;
Contact :
http://www.usbfix.net/contact/" onclick="window.open(this.href);return false;
PC: TOSHIBA (KSWAA)
CPU: Pentium(R) Dual-Core CPU T4300 @ 2.10GHz
RAM -> [Total : 3933 | Free : 2576]
Bios: TOSHIBA
Boot: Normal boot
OS: Microsoft Windows 7 à‰dition Familiale Premium (6.1.7601 64-Bit) Service Pack 1
WB: Windows Internet Explorer : 11.0.9600.16476
WB: Mozilla Firefox : 25.0.1
WB: Safari : 534.57.2
SC: Security Center Service [Enabled]
WU: Windows Update Service [Enabled]
AS: Windows Defender [Enabled | Updated]
AS: Windows Defender : 6.1.7600.16385 (win7_rtm.090713-1255)
AS: Malwarebytes' Anti-Malware : 1.75.0001
FW: Windows FireWall Service [Enabled]
C:\ (%systemdrive%) -> Disque fixe # 149 Go (23 Go libre(s) - 15%) [WINDOWS] # NTFS
D:\ -> Disque fixe # 149 Go (142 Go libre(s) - 95%) [Data] # NTFS
E:\ -> CD-ROM
F:\ -> Disque amovible # 7 Go (5 Go libre(s) - 72%) [] # FAT32
################## | Processus Actif |
C:\Windows\system32\csrss.exe (ID: 432 |ParentID: 424)
C:\Windows\system32\wininit.exe (ID: 484 |ParentID: 424)
C:\Windows\system32\csrss.exe (ID: 496 |ParentID: 476)
C:\Windows\system32\services.exe (ID: 544 |ParentID: 484)
C:\Windows\system32\lsass.exe (ID: 568 |ParentID: 484)
C:\Windows\system32\lsm.exe (ID: 576 |ParentID: 484)
C:\Windows\system32\winlogon.exe (ID: 616 |ParentID: 476)
C:\Windows\system32\svchost.exe (ID: 700 |ParentID: 544)
C:\Windows\system32\svchost.exe (ID: 784 |ParentID: 544)
C:\Windows\System32\svchost.exe (ID: 876 |ParentID: 544)
C:\Windows\System32\svchost.exe (ID: 916 |ParentID: 544)
C:\Windows\system32\svchost.exe (ID: 944 |ParentID: 544)
C:\Windows\system32\svchost.exe (ID: 980 |ParentID: 544)
C:\Windows\system32\svchost.exe (ID: 800 |ParentID: 544)
C:\Windows\System32\spoolsv.exe (ID: 1124 |ParentID: 544)
C:\Windows\system32\svchost.exe (ID: 1156 |ParentID: 544)
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (ID: 1240 |ParentID: 544)
C:\Windows\system32\Dwm.exe (ID: 1436 |ParentID: 916)
C:\Windows\Explorer.EXE (ID: 1460 |ParentID: 1428)
C:\Windows\system32\taskhost.exe (ID: 1476 |ParentID: 544)
C:\Windows\system32\taskeng.exe (ID: 1508 |ParentID: 980)
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (ID: 1592 |ParentID: 544)
C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe (ID: 1608 |ParentID: 1508)
C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe (ID: 1664 |ParentID: 1508)
C:\Windows\system32\svchost.exe (ID: 1832 |ParentID: 544)
C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe (ID: 1876 |ParentID: 544)
C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe (ID: 1968 |ParentID: 1460)
C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe (ID: 1976 |ParentID: 1460)
C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe (ID: 1984 |ParentID: 1460)
C:\Windows\System32\igfxtray.exe (ID: 1996 |ParentID: 1460)
C:\Windows\System32\hkcmd.exe (ID: 2004 |ParentID: 1460)
C:\Windows\System32\igfxpers.exe (ID: 2016 |ParentID: 1460)
C:\Windows\system32\igfxsrvc.exe (ID: 1176 |ParentID: 700)
C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe (ID: 964 |ParentID: 1460)
C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe (ID: 1208 |ParentID: 1460)
C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe (ID: 1892 |ParentID: 1460)
C:\Program Files\TOSHIBA\TECO\TEco.exe (ID: 2060 |ParentID: 1460)
C:\Program Files (x86)\TOSHIBA\Toshiba Online Product Information\TOPI.exe (ID: 2140 |ParentID: 1460)
C:\Users\manon\AppData\Roaming\Dropbox\bin\Dropbox.exe (ID: 2172 |ParentID: 1460)
C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (ID: 2180 |ParentID: 1460)
C:\Windows\system32\igfxext.exe (ID: 2400 |ParentID: 700)
C:\Windows\system32\TODDSrv.exe (ID: 2992 |ParentID: 544)
C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe (ID: 3032 |ParentID: 544)
C:\Program Files\TOSHIBA\TECO\TecoService.exe (ID: 3060 |ParentID: 544)
C:\Windows\System32\svchost.exe (ID: 2280 |ParentID: 544)
C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe (ID: 2252 |ParentID: 1508)
C:\Windows\system32\wbem\wmiprvse.exe (ID: 3092 |ParentID: 700)
C:\Windows\system32\SearchIndexer.exe (ID: 3316 |ParentID: 544)
C:\Windows\system32\svchost.exe (ID: 3632 |ParentID: 544)
C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe (ID: 3724 |ParentID: 2252)
C:\Windows\system32\svchost.exe (ID: 3824 |ParentID: 544)
C:\Windows\System32\svchost.exe (ID: 732 |ParentID: 544)
C:\Program Files\Windows Media Player\wmpnetwk.exe (ID: 4364 |ParentID: 544)
C:\Windows\system32\wbem\wmiprvse.exe (ID: 4776 |ParentID: 700)
C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe (ID: 3516 |ParentID: 544)
C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe (ID: 3508 |ParentID: 1956)
C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe (ID: 2768 |ParentID: 544)
C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe (ID: 148 |ParentID: 2092)
C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe (ID: 1396 |ParentID: 544)
C:\Program Files (x86)\TOSHIBA\ConfigFree\CFProcSRVC.exe (ID: 2916 |ParentID: 544)
C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe (ID: 1168 |ParentID: 544)
C:\Program Files (x86)\Mozilla Firefox\firefox.exe (ID: 1960 |ParentID: 1460)
C:\Windows\servicing\TrustedInstaller.exe (ID: 4104 |ParentID: 544)
C:\Windows\system32\wuauclt.exe (ID: 612 |ParentID: 980)
C:\Windows\System32\WUDFHost.exe (ID: 4968 |ParentID: 916)
C:\UsbFix\Go.exe (ID: 1716 |ParentID: 4764)
C:\Windows\system32\SearchProtocolHost.exe (ID: 2088 |ParentID: 3316)
C:\Windows\system32\SearchFilterHost.exe (ID: 4160 |ParentID: 3316)
C:\Windows\system32\taskeng.exe (ID: 3812 |ParentID: 980)
################## | Regedit Run |
04 - HKLM\SOFTWARE | Run : [SVPWUTIL] - C:\Program Files (x86)\TOSHIBA\Utilities\SVPWUTIL.exe SVPwUTIL
04 - HKLM\SOFTWARE | Run : [HWSetup] - "C:\Program Files\TOSHIBA\Utilities\HWSetup.exe" hwSetUP
04 - HKLM\SOFTWARE | Run : [KeNotify] - C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe
04 - HKLM\SOFTWARE | Run : [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
04 - HKLM\SOFTWARE | Run : [QuickTime Task] - "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
04 - HKLM\SOFTWARE | Run : [APSDaemon] - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
04 - HKLM\SOFTWARE\wow6432Node | Run : [SVPWUTIL] - C:\Program Files (x86)\TOSHIBA\Utilities\SVPWUTIL.exe SVPwUTIL
04 - HKLM\SOFTWARE\wow6432Node | Run : [HWSetup] - "C:\Program Files\TOSHIBA\Utilities\HWSetup.exe" hwSetUP
04 - HKLM\SOFTWARE\wow6432Node | Run : [KeNotify] - C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe
04 - HKLM\SOFTWARE\wow6432Node | Run : [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
04 - HKLM\SOFTWARE\wow6432Node | Run : [QuickTime Task] - "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
04 - HKLM\SOFTWARE\wow6432Node | Run : [APSDaemon] - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
04 - HKLM\SOFTWARE | RunOnce : [] -
04 - HKLM\SOFTWARE\wow6432Node | RunOnce : [] -
04 - HKU\S-1-5-19\SOFTWARE | Run : [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
04 - HKU\S-1-5-20\SOFTWARE | Run : [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
04 - HKU\S-1-5-21-1693259841-3922508296-1710566763-1001\SOFTWARE | Run : [TOSHIBA Online Product Information] - C:\Program Files (x86)\TOSHIBA\Toshiba Online Product Information\topi.exe
04 - HKU\S-1-5-21-1693259841-3922508296-1710566763-1001\SOFTWARE | Run : [iTunesHelper] - wscript.exe //B "C:\Users\manon\AppData\Local\Temp\iTunesHelper.vbe"
04 - HKU\S-1-5-18\SOFTWARE | Run : [TOSHIBA Online Product Information] - C:\Program Files (x86)\TOSHIBA\Toshiba Online Product Information\topi.exe
04 - HKU\S-1-5-19\SOFTWARE | RunOnce : [mctadmin] - C:\Windows\System32\mctadmin.exe
04 - HKU\S-1-5-20\SOFTWARE | RunOnce : [mctadmin] - C:\Windows\System32\mctadmin.exe
################## | Recherche générique |
Présent! C:\Users\manon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iTunesHelper.vbe
Présent! C:\Users\manon\AppData\Local\Temp\iTunesHelper.vbe
Présent! F:\iTunesHelper.vbe
Présent! F:\Autorun.inf.lnk
Présent! F:\a recup.lnk
################## | Référence de comparaison MD5 |
Md5 : 2BCBCF86077A7E0F77BDB82F331F2957 -> C:\Users\manon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iTunesHelper.vbe
Md5 : 2BCBCF86077A7E0F77BDB82F331F2957 -> C:\Users\manon\AppData\Local\Temp\iTunesHelper.vbe
Md5 : AD627CFED7817A7474E50D99C3E47DA8 -> F:\iTunesHelper.vbe
################## | Comparaison MD5 |
Présent! Md5 : 2BCBCF86077A7E0F77BDB82F331F2957 -> C:\Users\manon\AppData\Local\Temp\iTunesHelper.vbe
Présent! Md5 : 2BCBCF86077A7E0F77BDB82F331F2957 -> C:\Users\manon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iTunesHelper.vbe
Présent! Md5 : AD627CFED7817A7474E50D99C3E47DA8 -> F:\iTunesHelper.vbe
################## | Registre |
Présent! HKU\S-1-5-21-1693259841-3922508296-1710566763-1001\Software\Microsoft\Windows\CurrentVersion\Run|iTunesHelper
Présent! HKCU\Software\Microsoft\Windows\CurrentVersion\Run|iTunesHelper
################## | Vaccin |
D:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
F:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
################## | E.O.F |
http://www.usbfix.net" onclick="window.open(this.href);return false; -
http://www.sosvirus.net" onclick="window.open(this.href);return false; |