- lun. 17 mars 2014 20:27
#110621
Bonjour,
Mon ordinateur et mon disque dur externe sont infectés par Win32:Kuckaka...
Quelqu'un peut il m'aider s'il vous plait ? Je n'ai plus accès à mes fichiers sur le disque dur maintenant...
J'ai lancé une analyse UsbFix et voici le rapport :
############################## | UsbFix V 7.167 | [Recherche]
Utilisateur: julie (Administrateur) # PC-DE-JULIE
Mis à jour le 13/03/2014 par El Desaparecido - Team SosVirus
Lancé à 20:08:18 | 17/03/2014
Site Web : http://www.usbfix.net/" onclick="window.open(this.href);return false;
Changelog : http://www.usbfix.net/maj/" onclick="window.open(this.href);return false;
Support : http://www.sosvirus.net/forum-virus-securite.html" onclick="window.open(this.href);return false;
Upload Malware : http://www.sosvirus.net/upload_malware.php" onclick="window.open(this.href);return false;
Contact : http://www.usbfix.net/contact/" onclick="window.open(this.href);return false;
PC: Wistron (30B2)
CPU: Intel(R) Core(TM) Duo CPU T2250 @ 1.73GHz
RAM -> [Total : 1013 Mo| Free : 113 Mo]
Bios: Hewlett-Packard
Boot: Normal boot
OS: Microsoft® Windows Vistaâ„¢ à‰dition Familiale Premium (6.0.6002 32-Bit) Service Pack 2
WB: Windows Internet Explorer : 9.0.8112.16421
WB: Google Chrome : 33.0.1750.154
WB: Safari : 534.57.2
SC: Security Center [Enabled]
WU: Windows Update [Enabled]
AV: avast! Antivirus [(!) Disabled | Updated]
AS: Windows Defender [Enabled | Updated]
AS: avast! Antivirus [(!) Disabled | Updated]
FW: Windows FireWall [(!) Disabled]
C:\ (%systemdrive%) -> Disque fixe # 107 Go (37 Go libre(s) - 34%) [] # NTFS
D:\ -> Disque fixe # 5 Go (1 Go libre(s) - 23%) [HP_RECOVERY] # NTFS
E:\ -> CD-ROM
F:\ -> Disque fixe # 902 Go (642 Go libre(s) - 71%) [LaCie] # NTFS
G:\ -> Disque fixe # 30 Go (29 Go libre(s) - 99%) [EXCHANGE] # FAT32
################## | Processus Actif |
C:\Windows\system32\csrss.exe (ID: 616 |ParentID: 604)
C:\Windows\system32\csrss.exe (ID: 660 |ParentID: 652)
C:\Windows\system32\wininit.exe (ID: 668 |ParentID: 604)
C:\Windows\system32\winlogon.exe (ID: 720 |ParentID: 652)
C:\Windows\system32\services.exe (ID: 748 |ParentID: 668)
C:\Windows\system32\lsass.exe (ID: 764 |ParentID: 668)
C:\Windows\system32\lsm.exe (ID: 772 |ParentID: 668)
C:\Windows\system32\svchost.exe (ID: 916 |ParentID: 748)
C:\Windows\system32\svchost.exe (ID: 1000 |ParentID: 748)
C:\Windows\System32\svchost.exe (ID: 1036 |ParentID: 748)
C:\Windows\System32\svchost.exe (ID: 1132 |ParentID: 748)
C:\Windows\System32\svchost.exe (ID: 1184 |ParentID: 748)
C:\Windows\system32\svchost.exe (ID: 1204 |ParentID: 748)
C:\Windows\system32\svchost.exe (ID: 1324 |ParentID: 748)
C:\Windows\system32\SLsvc.exe (ID: 1344 |ParentID: 748)
C:\Windows\system32\svchost.exe (ID: 1396 |ParentID: 748)
C:\Windows\system32\svchost.exe (ID: 1516 |ParentID: 748)
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (ID: 1664 |ParentID: 748)
C:\Windows\System32\spoolsv.exe (ID: 1812 |ParentID: 748)
C:\Windows\system32\svchost.exe (ID: 1968 |ParentID: 748)
C:\Windows\system32\taskeng.exe (ID: 620 |ParentID: 1204)
C:\Windows\system32\taskeng.exe (ID: 924 |ParentID: 1204)
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (ID: 2200 |ParentID: 748)
C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe (ID: 2252 |ParentID: 748)
C:\ProgramData\EPSON\EPW!3 SSRP\E_S40ST7.EXE (ID: 2312 |ParentID: 748)
C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE (ID: 2332 |ParentID: 748)
C:\Program Files\Common Files\LightScribe\LSSrvc.exe (ID: 2384 |ParentID: 748)
C:\Windows\system32\lxbkcoms.exe (ID: 2460 |ParentID: 748)
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (ID: 2568 |ParentID: 748)
C:\Windows\system32\svchost.exe (ID: 2604 |ParentID: 748)
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (ID: 2624 |ParentID: 748)
C:\Windows\system32\svchost.exe (ID: 2700 |ParentID: 748)
C:\Windows\System32\svchost.exe (ID: 2740 |ParentID: 748)
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (ID: 2792 |ParentID: 748)
C:\Windows\system32\SearchIndexer.exe (ID: 2912 |ParentID: 748)
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (ID: 2988 |ParentID: 2792)
C:\Windows\system32\DRIVERS\xaudio.exe (ID: 3052 |ParentID: 748)
C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe (ID: 3068 |ParentID: 748)
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe (ID: 3104 |ParentID: 748)
C:\Windows\system32\svchost.exe (ID: 3300 |ParentID: 748)
C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe (ID: 2848 |ParentID: 748)
C:\Windows\system32\Dwm.exe (ID: 1088 |ParentID: 1184)
C:\Windows\Explorer.EXE (ID: 1080 |ParentID: 3500)
C:\Program Files\Windows Defender\MSASCui.exe (ID: 3820 |ParentID: 1080)
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (ID: 3992 |ParentID: 1080)
C:\Windows\System32\hkcmd.exe (ID: 3912 |ParentID: 1080)
C:\Windows\System32\igfxpers.exe (ID: 4020 |ParentID: 1080)
C:\Program Files\HP\QuickPlay\QPService.exe (ID: 2012 |ParentID: 1080)
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe (ID: 1232 |ParentID: 1080)
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe (ID: 2592 |ParentID: 1080)
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe (ID: 3828 |ParentID: 1080)
C:\Program Files\HP\HP Software Update\hpwuschd2.exe (ID: 2684 |ParentID: 1080)
C:\Program Files\Alwil Software\Avast5\AvastUI.exe (ID: 1844 |ParentID: 1080)
C:\Program Files\iTunes\iTunesHelper.exe (ID: 2096 |ParentID: 1080)
C:\Program Files\Windows Sidebar\sidebar.exe (ID: 2876 |ParentID: 1080)
C:\Windows\ehome\ehtray.exe (ID: 4052 |ParentID: 1080)
C:\Windows\System32\spool\drivers\w32x86\3\E_FATIEFE.EXE (ID: 2544 |ParentID: 1080)
C:\Program Files\Windows Media Player\wmpnscfg.exe (ID: 4028 |ParentID: 1080)
C:\Program Files\Skype\Phone\Skype.exe (ID: 3116 |ParentID: 1080)
C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe (ID: 1376 |ParentID: 1080)
C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe (ID: 2692 |ParentID: 1080)
C:\Windows\system32\wbem\unsecapp.exe (ID: 1092 |ParentID: 916)
C:\Windows\system32\wbem\wmiprvse.exe (ID: 2444 |ParentID: 916)
C:\Program Files\Windows Media Player\wmpnetwk.exe (ID: 2676 |ParentID: 748)
C:\Windows\ehome\ehmsas.exe (ID: 3472 |ParentID: 916)
C:\PROGRA~1\HEWLET~1\Shared\HPQTOA~1.EXE (ID: 3560 |ParentID: 916)
C:\Program Files\iPod\bin\iPodService.exe (ID: 4412 |ParentID: 748)
C:\Program Files\Common Files\Apple\Internet Services\APSDaemon.exe (ID: 4876 |ParentID: 916)
C:\Program Files\Google\Chrome\Application\chrome.exe (ID: 5252 |ParentID: 1080)
C:\Program Files\Google\Chrome\Application\chrome.exe (ID: 5596 |ParentID: 5252)
C:\Program Files\Google\Chrome\Application\chrome.exe (ID: 3336 |ParentID: 5252)
C:\Program Files\Google\Chrome\Application\chrome.exe (ID: 4496 |ParentID: 5252)
C:\Program Files\Google\Chrome\Application\chrome.exe (ID: 552 |ParentID: 5252)
C:\Program Files\Internet Explorer\iexplore.exe (ID: 3544 |ParentID: 4996)
C:\Program Files\Internet Explorer\iexplore.exe (ID: 5460 |ParentID: 3544)
C:\Program Files\Internet Explorer\iexplore.exe (ID: 976 |ParentID: 3544)
C:\Windows\System32\mobsync.exe (ID: 5492 |ParentID: 916)
C:\Windows\system32\taskeng.exe (ID: 1332 |ParentID: 1204)
C:\Windows\system32\SearchProtocolHost.exe (ID: 4032 |ParentID: 2912)
C:\Windows\system32\SearchFilterHost.exe (ID: 492 |ParentID: 2912)
C:\Windows\system32\wbem\wmiprvse.exe (ID: 1460 |ParentID: 916)
################## | Regedit Run |
F2 - HKLM\..\Winlogon : [Shell] explorer.exe
F2 - [64bit] HKLM\..\Winlogon : [Shell] explorer.exe
F2 - HKLM\..\Winlogon : [Userinit] C:\Windows\system32\userinit.exe,
F2 - [64bit] HKLM\..\Winlogon : [Userinit] C:\Windows\system32\userinit.exe,
04 - HKCU\..\Run : [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
04 - HKCU\..\Run : [ehTray.exe] C:\Windows\ehome\ehTray.exe
04 - HKCU\..\Run : [EPSON Stylus SX200 Series] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIEFE.EXE /FU "C:\Windows\TEMP\E_S27C3.tmp" /EF "HKCU"
04 - HKCU\..\Run : [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
04 - HKCU\..\Run : [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
04 - HKCU\..\Run : [iCloudServices] C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe
04 - HKCU\..\Run : [ApplePhotoStreams] C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
04 - HKLM\..\Run : [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
04 - HKLM\..\Run : [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
04 - HKLM\..\Run : [IgfxTray] C:\Windows\system32\igfxtray.exe
04 - HKLM\..\Run : [HotKeysCmds] C:\Windows\system32\hkcmd.exe
04 - HKLM\..\Run : [Persistence] C:\Windows\system32\igfxpers.exe
04 - HKLM\..\Run : [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
04 - HKLM\..\Run : [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
04 - HKLM\..\Run : [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
04 - HKLM\..\Run : [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
04 - HKLM\..\Run : [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
04 - HKLM\..\Run : [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
04 - HKLM\..\Run : [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
04 - HKLM\..\Run : [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
04 - HKLM\..\Run : [Browser companion helper] C:\Program Files\BrowserCompanion\BCHelper.exe /T=3 /CHI={$CHROM_GUID_UNINSTALLS}
04 - HKLM\..\Run : [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
04 - HKLM\..\Run : [AvastUI.exe] "C:\Program Files\Alwil Software\Avast5\AvastUI.exe" /nogui
04 - HKLM\..\Run : [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
04 - HKLM\..\RunOnce : [Launcher] %WINDIR%\SMINST\launcher.exe
04 - HKLM\..\RunOnce : []
04 - HKU\S-1-5-19\..\Run : [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem
04 - HKU\S-1-5-19\..\Run : [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
04 - HKU\S-1-5-20\..\Run : [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem
04 - HKU\S-1-5-20\..\Run : [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
04 - HKU\S-1-5-21-1847606186-1684757730-2542122442-1000\..\Run : [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
04 - HKU\S-1-5-21-1847606186-1684757730-2542122442-1000\..\Run : [ehTray.exe] C:\Windows\ehome\ehTray.exe
04 - HKU\S-1-5-21-1847606186-1684757730-2542122442-1000\..\Run : [EPSON Stylus SX200 Series] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIEFE.EXE /FU "C:\Windows\TEMP\E_S27C3.tmp" /EF "HKCU"
04 - HKU\S-1-5-21-1847606186-1684757730-2542122442-1000\..\Run : [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
04 - HKU\S-1-5-21-1847606186-1684757730-2542122442-1000\..\Run : [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
04 - HKU\S-1-5-21-1847606186-1684757730-2542122442-1000\..\Run : [iCloudServices] C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe
04 - HKU\S-1-5-21-1847606186-1684757730-2542122442-1000\..\Run : [ApplePhotoStreams] C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
04 - HKU\S-1-5-18\..\Run : [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
################## | Recherche générique |
Présent! F:\._autorun.inf
Présent! G:\._autorun.inf
################## | Registre |
Présent! HKLM\Software\Microsoft\Security Center|UacDisableNotify -> 1
################## | E.O.F | http://www.usbfix.net/" onclick="window.open(this.href);return false; - http://www.sosvirus.net" onclick="window.open(this.href);return false; |
Savez vous ce que je dois faire ?
Je vous remercie beaucoup par avance et j'espere que vous saurez m'aider...
Julie
Mon ordinateur et mon disque dur externe sont infectés par Win32:Kuckaka...
Quelqu'un peut il m'aider s'il vous plait ? Je n'ai plus accès à mes fichiers sur le disque dur maintenant...
J'ai lancé une analyse UsbFix et voici le rapport :
############################## | UsbFix V 7.167 | [Recherche]
Utilisateur: julie (Administrateur) # PC-DE-JULIE
Mis à jour le 13/03/2014 par El Desaparecido - Team SosVirus
Lancé à 20:08:18 | 17/03/2014
Site Web : http://www.usbfix.net/" onclick="window.open(this.href);return false;
Changelog : http://www.usbfix.net/maj/" onclick="window.open(this.href);return false;
Support : http://www.sosvirus.net/forum-virus-securite.html" onclick="window.open(this.href);return false;
Upload Malware : http://www.sosvirus.net/upload_malware.php" onclick="window.open(this.href);return false;
Contact : http://www.usbfix.net/contact/" onclick="window.open(this.href);return false;
PC: Wistron (30B2)
CPU: Intel(R) Core(TM) Duo CPU T2250 @ 1.73GHz
RAM -> [Total : 1013 Mo| Free : 113 Mo]
Bios: Hewlett-Packard
Boot: Normal boot
OS: Microsoft® Windows Vistaâ„¢ à‰dition Familiale Premium (6.0.6002 32-Bit) Service Pack 2
WB: Windows Internet Explorer : 9.0.8112.16421
WB: Google Chrome : 33.0.1750.154
WB: Safari : 534.57.2
SC: Security Center [Enabled]
WU: Windows Update [Enabled]
AV: avast! Antivirus [(!) Disabled | Updated]
AS: Windows Defender [Enabled | Updated]
AS: avast! Antivirus [(!) Disabled | Updated]
FW: Windows FireWall [(!) Disabled]
C:\ (%systemdrive%) -> Disque fixe # 107 Go (37 Go libre(s) - 34%) [] # NTFS
D:\ -> Disque fixe # 5 Go (1 Go libre(s) - 23%) [HP_RECOVERY] # NTFS
E:\ -> CD-ROM
F:\ -> Disque fixe # 902 Go (642 Go libre(s) - 71%) [LaCie] # NTFS
G:\ -> Disque fixe # 30 Go (29 Go libre(s) - 99%) [EXCHANGE] # FAT32
################## | Processus Actif |
C:\Windows\system32\csrss.exe (ID: 616 |ParentID: 604)
C:\Windows\system32\csrss.exe (ID: 660 |ParentID: 652)
C:\Windows\system32\wininit.exe (ID: 668 |ParentID: 604)
C:\Windows\system32\winlogon.exe (ID: 720 |ParentID: 652)
C:\Windows\system32\services.exe (ID: 748 |ParentID: 668)
C:\Windows\system32\lsass.exe (ID: 764 |ParentID: 668)
C:\Windows\system32\lsm.exe (ID: 772 |ParentID: 668)
C:\Windows\system32\svchost.exe (ID: 916 |ParentID: 748)
C:\Windows\system32\svchost.exe (ID: 1000 |ParentID: 748)
C:\Windows\System32\svchost.exe (ID: 1036 |ParentID: 748)
C:\Windows\System32\svchost.exe (ID: 1132 |ParentID: 748)
C:\Windows\System32\svchost.exe (ID: 1184 |ParentID: 748)
C:\Windows\system32\svchost.exe (ID: 1204 |ParentID: 748)
C:\Windows\system32\svchost.exe (ID: 1324 |ParentID: 748)
C:\Windows\system32\SLsvc.exe (ID: 1344 |ParentID: 748)
C:\Windows\system32\svchost.exe (ID: 1396 |ParentID: 748)
C:\Windows\system32\svchost.exe (ID: 1516 |ParentID: 748)
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (ID: 1664 |ParentID: 748)
C:\Windows\System32\spoolsv.exe (ID: 1812 |ParentID: 748)
C:\Windows\system32\svchost.exe (ID: 1968 |ParentID: 748)
C:\Windows\system32\taskeng.exe (ID: 620 |ParentID: 1204)
C:\Windows\system32\taskeng.exe (ID: 924 |ParentID: 1204)
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (ID: 2200 |ParentID: 748)
C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe (ID: 2252 |ParentID: 748)
C:\ProgramData\EPSON\EPW!3 SSRP\E_S40ST7.EXE (ID: 2312 |ParentID: 748)
C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE (ID: 2332 |ParentID: 748)
C:\Program Files\Common Files\LightScribe\LSSrvc.exe (ID: 2384 |ParentID: 748)
C:\Windows\system32\lxbkcoms.exe (ID: 2460 |ParentID: 748)
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (ID: 2568 |ParentID: 748)
C:\Windows\system32\svchost.exe (ID: 2604 |ParentID: 748)
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (ID: 2624 |ParentID: 748)
C:\Windows\system32\svchost.exe (ID: 2700 |ParentID: 748)
C:\Windows\System32\svchost.exe (ID: 2740 |ParentID: 748)
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (ID: 2792 |ParentID: 748)
C:\Windows\system32\SearchIndexer.exe (ID: 2912 |ParentID: 748)
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (ID: 2988 |ParentID: 2792)
C:\Windows\system32\DRIVERS\xaudio.exe (ID: 3052 |ParentID: 748)
C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe (ID: 3068 |ParentID: 748)
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe (ID: 3104 |ParentID: 748)
C:\Windows\system32\svchost.exe (ID: 3300 |ParentID: 748)
C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe (ID: 2848 |ParentID: 748)
C:\Windows\system32\Dwm.exe (ID: 1088 |ParentID: 1184)
C:\Windows\Explorer.EXE (ID: 1080 |ParentID: 3500)
C:\Program Files\Windows Defender\MSASCui.exe (ID: 3820 |ParentID: 1080)
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (ID: 3992 |ParentID: 1080)
C:\Windows\System32\hkcmd.exe (ID: 3912 |ParentID: 1080)
C:\Windows\System32\igfxpers.exe (ID: 4020 |ParentID: 1080)
C:\Program Files\HP\QuickPlay\QPService.exe (ID: 2012 |ParentID: 1080)
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe (ID: 1232 |ParentID: 1080)
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe (ID: 2592 |ParentID: 1080)
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe (ID: 3828 |ParentID: 1080)
C:\Program Files\HP\HP Software Update\hpwuschd2.exe (ID: 2684 |ParentID: 1080)
C:\Program Files\Alwil Software\Avast5\AvastUI.exe (ID: 1844 |ParentID: 1080)
C:\Program Files\iTunes\iTunesHelper.exe (ID: 2096 |ParentID: 1080)
C:\Program Files\Windows Sidebar\sidebar.exe (ID: 2876 |ParentID: 1080)
C:\Windows\ehome\ehtray.exe (ID: 4052 |ParentID: 1080)
C:\Windows\System32\spool\drivers\w32x86\3\E_FATIEFE.EXE (ID: 2544 |ParentID: 1080)
C:\Program Files\Windows Media Player\wmpnscfg.exe (ID: 4028 |ParentID: 1080)
C:\Program Files\Skype\Phone\Skype.exe (ID: 3116 |ParentID: 1080)
C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe (ID: 1376 |ParentID: 1080)
C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe (ID: 2692 |ParentID: 1080)
C:\Windows\system32\wbem\unsecapp.exe (ID: 1092 |ParentID: 916)
C:\Windows\system32\wbem\wmiprvse.exe (ID: 2444 |ParentID: 916)
C:\Program Files\Windows Media Player\wmpnetwk.exe (ID: 2676 |ParentID: 748)
C:\Windows\ehome\ehmsas.exe (ID: 3472 |ParentID: 916)
C:\PROGRA~1\HEWLET~1\Shared\HPQTOA~1.EXE (ID: 3560 |ParentID: 916)
C:\Program Files\iPod\bin\iPodService.exe (ID: 4412 |ParentID: 748)
C:\Program Files\Common Files\Apple\Internet Services\APSDaemon.exe (ID: 4876 |ParentID: 916)
C:\Program Files\Google\Chrome\Application\chrome.exe (ID: 5252 |ParentID: 1080)
C:\Program Files\Google\Chrome\Application\chrome.exe (ID: 5596 |ParentID: 5252)
C:\Program Files\Google\Chrome\Application\chrome.exe (ID: 3336 |ParentID: 5252)
C:\Program Files\Google\Chrome\Application\chrome.exe (ID: 4496 |ParentID: 5252)
C:\Program Files\Google\Chrome\Application\chrome.exe (ID: 552 |ParentID: 5252)
C:\Program Files\Internet Explorer\iexplore.exe (ID: 3544 |ParentID: 4996)
C:\Program Files\Internet Explorer\iexplore.exe (ID: 5460 |ParentID: 3544)
C:\Program Files\Internet Explorer\iexplore.exe (ID: 976 |ParentID: 3544)
C:\Windows\System32\mobsync.exe (ID: 5492 |ParentID: 916)
C:\Windows\system32\taskeng.exe (ID: 1332 |ParentID: 1204)
C:\Windows\system32\SearchProtocolHost.exe (ID: 4032 |ParentID: 2912)
C:\Windows\system32\SearchFilterHost.exe (ID: 492 |ParentID: 2912)
C:\Windows\system32\wbem\wmiprvse.exe (ID: 1460 |ParentID: 916)
################## | Regedit Run |
F2 - HKLM\..\Winlogon : [Shell] explorer.exe
F2 - [64bit] HKLM\..\Winlogon : [Shell] explorer.exe
F2 - HKLM\..\Winlogon : [Userinit] C:\Windows\system32\userinit.exe,
F2 - [64bit] HKLM\..\Winlogon : [Userinit] C:\Windows\system32\userinit.exe,
04 - HKCU\..\Run : [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
04 - HKCU\..\Run : [ehTray.exe] C:\Windows\ehome\ehTray.exe
04 - HKCU\..\Run : [EPSON Stylus SX200 Series] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIEFE.EXE /FU "C:\Windows\TEMP\E_S27C3.tmp" /EF "HKCU"
04 - HKCU\..\Run : [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
04 - HKCU\..\Run : [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
04 - HKCU\..\Run : [iCloudServices] C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe
04 - HKCU\..\Run : [ApplePhotoStreams] C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
04 - HKLM\..\Run : [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
04 - HKLM\..\Run : [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
04 - HKLM\..\Run : [IgfxTray] C:\Windows\system32\igfxtray.exe
04 - HKLM\..\Run : [HotKeysCmds] C:\Windows\system32\hkcmd.exe
04 - HKLM\..\Run : [Persistence] C:\Windows\system32\igfxpers.exe
04 - HKLM\..\Run : [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
04 - HKLM\..\Run : [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
04 - HKLM\..\Run : [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
04 - HKLM\..\Run : [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
04 - HKLM\..\Run : [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
04 - HKLM\..\Run : [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
04 - HKLM\..\Run : [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
04 - HKLM\..\Run : [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
04 - HKLM\..\Run : [Browser companion helper] C:\Program Files\BrowserCompanion\BCHelper.exe /T=3 /CHI={$CHROM_GUID_UNINSTALLS}
04 - HKLM\..\Run : [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
04 - HKLM\..\Run : [AvastUI.exe] "C:\Program Files\Alwil Software\Avast5\AvastUI.exe" /nogui
04 - HKLM\..\Run : [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
04 - HKLM\..\RunOnce : [Launcher] %WINDIR%\SMINST\launcher.exe
04 - HKLM\..\RunOnce : []
04 - HKU\S-1-5-19\..\Run : [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem
04 - HKU\S-1-5-19\..\Run : [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
04 - HKU\S-1-5-20\..\Run : [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem
04 - HKU\S-1-5-20\..\Run : [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
04 - HKU\S-1-5-21-1847606186-1684757730-2542122442-1000\..\Run : [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
04 - HKU\S-1-5-21-1847606186-1684757730-2542122442-1000\..\Run : [ehTray.exe] C:\Windows\ehome\ehTray.exe
04 - HKU\S-1-5-21-1847606186-1684757730-2542122442-1000\..\Run : [EPSON Stylus SX200 Series] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIEFE.EXE /FU "C:\Windows\TEMP\E_S27C3.tmp" /EF "HKCU"
04 - HKU\S-1-5-21-1847606186-1684757730-2542122442-1000\..\Run : [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
04 - HKU\S-1-5-21-1847606186-1684757730-2542122442-1000\..\Run : [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
04 - HKU\S-1-5-21-1847606186-1684757730-2542122442-1000\..\Run : [iCloudServices] C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe
04 - HKU\S-1-5-21-1847606186-1684757730-2542122442-1000\..\Run : [ApplePhotoStreams] C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
04 - HKU\S-1-5-18\..\Run : [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
################## | Recherche générique |
Présent! F:\._autorun.inf
Présent! G:\._autorun.inf
################## | Registre |
Présent! HKLM\Software\Microsoft\Security Center|UacDisableNotify -> 1
################## | E.O.F | http://www.usbfix.net/" onclick="window.open(this.href);return false; - http://www.sosvirus.net" onclick="window.open(this.href);return false; |
Savez vous ce que je dois faire ?
Je vous remercie beaucoup par avance et j'espere que vous saurez m'aider...
Julie