Voici le rapport USBFIX :
############################## | UsbFix V 7.147 | [Recherche]
Utilisateur: Gregoire (Administrateur) # SEVENCPU
Mis à jour le 30/10/2013 par El Desaparecido - Team SosVirus
Lancé à 20:38:46 | 31/10/2013
Site Web:
https://www.usbfix.net/
Forum :
https://www.sosvirus.net/
Upload Malware:
https://www.sosvirus.net/upload_malware.php
Contact:
https://www.usbfix.net/contact/
PC: ASUSTeK Computer INC. (P6T)
CPU: Intel(R) Core(TM) i7 CPU 920 @ 2.67GHz
RAM -> [Total : 6134 | Free : 3986]
Bios: American Megatrends Inc.
Boot: Normal boot
OS: Microsoft Windows 7 à‰dition Familiale Premium (6.1.7601 64-Bit) Service Pack 1
WB: Windows Internet Explorer : 10.0.9200.16721
WB: Google Chrome : 30.0.1599.101
WB: Mozilla Firefox : 24.0
WB: Safari : 534.50
SC: Security Center Service [Enabled]
WU: Windows Update Service [Enabled]
AV: Avira Desktop [(!) Disabled | Updated]
AS: Windows Defender : 6.1.7600.16385 (win7_rtm.090713-1255)
AS: Malwarebytes' Anti-Malware : 1.75.0001
FW: Windows FireWall Service [Enabled]
C:\ (%systemdrive%) -> Disque fixe # 140 Go (33 Go libre(s) - 23%) [Velociraptor_A] # NTFS
D:\ -> CD-ROM
E:\ -> Disque fixe # 17 Go (10 Go libre(s) - 60%) [] # NTFS
F:\ -> Disque fixe # 144 Go (23 Go libre(s) - 16%) [Sam_2] # NTFS
G:\ -> Disque fixe # 140 Go (9 Go libre(s) - 6%) [Velociraptor_B] # NTFS
H:\ -> Disque fixe # 137 Go (24 Go libre(s) - 17%) [Sam_3] # NTFS
I:\ -> Disque fixe # 466 Go (34 Go libre(s) - 7%) [Samsung F1_A] # NTFS
J:\ -> Disque amovible # 2 Go (791 Mo libre(s) - 40%) [] # FAT
L:\ -> Disque fixe # 466 Go (128 Go libre(s) - 28%) [LACIE RiKiKi] # NTFS
################## | Référence de comparaison MD5 |
Md5 : e89028d8068170e606aa0996d457aaa3 -> C:\Users\Public\jusched.exe
################## | Processus Actif |
C:\Windows\system32\csrss.exe (ID: 428 |ParentID: 408)
C:\Windows\system32\wininit.exe (ID: 500 |ParentID: 408)
C:\Windows\system32\csrss.exe (ID: 524 |ParentID: 508)
C:\Windows\system32\services.exe (ID: 556 |ParentID: 500)
C:\Windows\system32\lsass.exe (ID: 572 |ParentID: 500)
C:\Windows\system32\lsm.exe (ID: 580 |ParentID: 500)
C:\Windows\system32\svchost.exe (ID: 684 |ParentID: 556)
C:\Windows\system32\svchost.exe (ID: 772 |ParentID: 556)
C:\Windows\system32\atiesrxx.exe (ID: 832 |ParentID: 556)
C:\Windows\system32\winlogon.exe (ID: 880 |ParentID: 508)
C:\Windows\System32\svchost.exe (ID: 920 |ParentID: 556)
C:\Windows\System32\svchost.exe (ID: 956 |ParentID: 556)
C:\Windows\system32\svchost.exe (ID: 1004 |ParentID: 556)
C:\Windows\system32\svchost.exe (ID: 152 |ParentID: 556)
C:\Windows\system32\svchost.exe (ID: 1140 |ParentID: 556)
C:\Windows\system32\atieclxx.exe (ID: 1248 |ParentID: 832)
C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (ID: 1348 |ParentID: 556)
C:\Windows\system32\svchost.exe (ID: 1372 |ParentID: 556)
C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (ID: 1556 |ParentID: 556)
C:\Program Files (x86)\CDBurnerXP\NMSAccessU.exe (ID: 1664 |ParentID: 556)
C:\Windows\SysWOW64\PnkBstrA.exe (ID: 1708 |ParentID: 556)
C:\Windows\system32\svchost.exe (ID: 1800 |ParentID: 556)
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (ID: 1840 |ParentID: 556)
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (ID: 1904 |ParentID: 1840)
C:\Windows\system32\taskhost.exe (ID: 976 |ParentID: 556)
C:\Windows\system32\Dwm.exe (ID: 1108 |ParentID: 956)
C:\Windows\Explorer.EXE (ID: 1052 |ParentID: 1684)
C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe (ID: 2388 |ParentID: 2240)
C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (ID: 2396 |ParentID: 2240)
C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (ID: 2440 |ParentID: 2240)
C:\Program Files (x86)\Razer\DeathAdder\razertra.exe (ID: 2460 |ParentID: 2388)
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (ID: 2484 |ParentID: 2432)
C:\Program Files (x86)\Razer\DeathAdder\razerofa.exe (ID: 2524 |ParentID: 2388)
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (ID: 2628 |ParentID: 2484)
C:\Windows\SysWOW64\explorer.exe (ID: 2804 |ParentID: 2708)
C:\Windows\SysWOW64\explorer.exe (ID: 2820 |ParentID: 2716)
C:\Windows\SysWOW64\explorer.exe (ID: 2828 |ParentID: 2724)
C:\Windows\SysWOW64\explorer.exe (ID: 2844 |ParentID: 2756)
C:\Users\Public\jusched.exe (ID: 3284 |ParentID: 2708)
C:\Users\Public\jusched.exe (ID: 3292 |ParentID: 2756)
C:\Users\Public\jusched.exe (ID: 3608 |ParentID: 2716)
C:\Users\Public\jusched.exe (ID: 3836 |ParentID: 2724)
C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (ID: 4252 |ParentID: 1556)
C:\Windows\system32\SearchIndexer.exe (ID: 4452 |ParentID: 556)
C:\Windows\system32\svchost.exe (ID: 4664 |ParentID: 556)
C:\Windows\system32\taskmgr.exe (ID: 3424 |ParentID: 880)
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe (ID: 2112 |ParentID: 556)
C:\Windows\system32\svchost.exe (ID: 3008 |ParentID: 556)
C:\Program Files (x86)\Mozilla Firefox\firefox.exe (ID: 1072 |ParentID: 1052)
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe (ID: 3184 |ParentID: 1072)
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe (ID: 2944 |ParentID: 3184)
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe (ID: 4808 |ParentID: 2944)
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (ID: 736 |ParentID: 556)
C:\Windows\system32\wbem\wmiprvse.exe (ID: 5204 |ParentID: 684)
C:\UsbFix\Go.exe (ID: 5356 |ParentID: 4504)
################## | Regedit Run |
HKLM\SOFTWARE | Run : [] -
HKLM\SOFTWARE | Run : [DeathAdder] - C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe
HKLM\SOFTWARE | Run : [NUSB3MON] - "C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"
HKLM\SOFTWARE | Run : [StartCCC] - "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
HKLM\SOFTWARE | Run : [avgnt] - "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
HKLM\SOFTWARE | Run : [jusched7] - C:\Users\Public\jusched.exe
HKLM\SOFTWARE\wow6432Node | Run : [] -
HKLM\SOFTWARE\wow6432Node | Run : [DeathAdder] - C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe
HKLM\SOFTWARE\wow6432Node | Run : [NUSB3MON] - "C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"
HKLM\SOFTWARE\wow6432Node | Run : [StartCCC] - "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
HKLM\SOFTWARE\wow6432Node | Run : [avgnt] - "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
HKLM\SOFTWARE\wow6432Node | Run : [jusched7] - C:\Users\Public\jusched.exe
HKLM\SOFTWARE | RunOnce : [] -
HKLM\SOFTWARE\wow6432Node | RunOnce : [] -
HKLM\SOFTWARE | Policies\Explorer\run : [jusched9] - C:\Users\Public\jusched.exe
HKU\S-1-5-19\SOFTWARE | Run : [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-20\SOFTWARE | Run : [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-21-2841560078-4150325420-3540864128-1001\SOFTWARE | Run : [8jusched] - C:\Users\Public\jusched.exe
HKU\S-1-5-19\SOFTWARE | RunOnce : [mctadmin] - C:\Windows\System32\mctadmin.exe
HKU\S-1-5-20\SOFTWARE | RunOnce : [mctadmin] - C:\Windows\System32\mctadmin.exe
HKU\S-1-5-21-2841560078-4150325420-3540864128-1001\SOFTWARE | Policies\Explorer\run : [jusched9] - C:\Users\Public\jusched.exe
################## | Recherche générique |
Présent! C:\Users\Gregoire\AppData\Roaming\03140000\ak.tmp
Présent! C:\Users\Gregoire\AppData\Roaming\03140000
Présent! C:\Users\Gregoire\AppData\Roaming\03180000\ak.tmp
Présent! C:\Users\Gregoire\AppData\Roaming\03180000
Présent! C:\Users\Gregoire\AppData\Roaming\04100000\ak.tmp
Présent! C:\Users\Gregoire\AppData\Roaming\04100000
Présent! C:\Users\Public\jusched.exe
Présent! C:\Users\Gregoire\AppData\Roaming\Gregoire-wchelper.dll
Présent! C:\Users\Gregoire\AppData\Local\Temp\Gregoire7
Présent! C:\Users\Gregoire\AppData\Local\Temp\Gregoire8
################## | Comparaison MD5 |
################## | Registre |
Présent! HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System|EnableLUA -> 0
Présent! HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System|ConsentPromptBehaviorAdmin -> 0
Présent! HKU\S-1-5-21-2841560078-4150325420-3540864128-1001\Software\Microsoft\Windows\CurrentVersion\Run|8jusched
Présent! HKCU\Software\Microsoft\Windows\CurrentVersion\Run|8jusched
################## | Vaccin |
J:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
################## | E.O.F |
https://www.usbfix.net -
https://www.sosvirus.net |
Bonne soirée et
