fichiers sur clé usb transformés en raccourcis

[TERESA]

Voilà ce que j'ai :

Code: Tout sélectionner

############################## | UsbFix V 7.140 | [Suppression]

Utilisateur: Famille Ben (Administrateur) # FAMILLEBEN-PC
Mis à jour le 30/09/2013 par El Desaparecido - Team SosVirus
Lancé à 20:13:01 | 30/09/2013

Site Web: https://www.usbfix.net/
Forum : https://www.sosvirus.net/
Upload Malware: https://www.sosvirus.net/upload_malware.php
Contact: https://www.usbfix.net/contact/

PC: Acer (JE51_MV)
CPU: Pentium(R) Dual-Core CPU T4500 @ 2.30GHz
RAM -> [Total : 4026 | Free : 1855]
Bios: Acer
Boot: Normal boot

OS: Microsoft Windows 7 à‰dition Familiale Premium (6.1.7600 64-Bit) #
WB: Windows Internet Explorer 9.0.8112.16421

SC: Security Center Service [Enabled]
WU: Windows Update Service [Enabled]
AV: avast! Antivirus [Enabled | Updated]
FW: Windows FireWall Service [Enabled]

C:\ (%systemdrive%) -> Disque fixe # 453 Go (84 Go libre(s) - 19%) [Acer] # NTFS
D:\ -> Disque fixe # 100 Mo (85 Mo libre(s) - 85%) [Réservé au système] # NTFS
E:\ -> CD-ROM
F:\ -> Disque amovible # 4 Go (4 Go libre(s) - 100%) [] # FAT32

################## | Regedit Run |

HKLM\SOFTWARE | Run : [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
HKLM\SOFTWARE | Run : [LManager] - C:\Program Files (x86)\Launch Manager\LManager.exe
HKLM\SOFTWARE | Run : [SuiteTray] - "C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe"
HKLM\SOFTWARE | Run : [EgisUpdate] - "C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe" -d
HKLM\SOFTWARE | Run : [EgisTecPMMUpdate] - "C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe"
HKLM\SOFTWARE | Run : [Norton Online Backup] - C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe
HKLM\SOFTWARE | Run : [Adobe Reader Speed Launcher] - "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
HKLM\SOFTWARE | Run : [BackupManagerTray] - "C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" -h -k
HKLM\SOFTWARE | Run : [Microsoft Default Manager] - "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
HKLM\SOFTWARE | Run : [avast] - "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
HKLM\SOFTWARE\wow6432Node | Run : [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
HKLM\SOFTWARE\wow6432Node | Run : [LManager] - C:\Program Files (x86)\Launch Manager\LManager.exe
HKLM\SOFTWARE\wow6432Node | Run : [SuiteTray] - "C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe"
HKLM\SOFTWARE\wow6432Node | Run : [EgisUpdate] - "C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe" -d
HKLM\SOFTWARE\wow6432Node | Run : [EgisTecPMMUpdate] - "C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe"
HKLM\SOFTWARE\wow6432Node | Run : [Norton Online Backup] - C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe
HKLM\SOFTWARE\wow6432Node | Run : [Adobe Reader Speed Launcher] - "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
HKLM\SOFTWARE\wow6432Node | Run : [BackupManagerTray] - "C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" -h -k
HKLM\SOFTWARE\wow6432Node | Run : [Microsoft Default Manager] - "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
HKLM\SOFTWARE\wow6432Node | Run : [avast] - "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
HKLM\SOFTWARE | RunOnce : [] -
HKLM\SOFTWARE\wow6432Node | RunOnce : [] -
HKU\S-1-5-19\SOFTWARE | Run : [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-20\SOFTWARE | Run : [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-21-3935719060-3070481686-271069799-1001\SOFTWARE | Run : [nBHfBEux] - wscript.exe //B "C:\Users\FAMILL~1\AppData\Local\Temp\nBHfBEux.vbs"
HKU\S-1-5-21-3935719060-3070481686-271069799-1001\SOFTWARE | Run : [Sidebar] - C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
HKU\S-1-5-21-3935719060-3070481686-271069799-1001\SOFTWARE | Run : [EPSON SX125 Series] - C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIGGE.EXE /FU "C:\Windows\TEMP\E_S9EE.tmp" /EF "HKCU"
HKU\S-1-5-19\SOFTWARE | RunOnce : [mctadmin] - C:\Windows\System32\mctadmin.exe
HKU\S-1-5-20\SOFTWARE | RunOnce : [mctadmin] - C:\Windows\System32\mctadmin.exe

################## | Processus Stoppés |

Stoppé! C:\Program Files\AVAST Software\Avast\AvastSvc.exe (ID 1340 |ParentID 612)
Stoppé! C:\Windows\System32\spoolsv.exe (ID 1460 |ParentID 612)
Stoppé! C:\Program Files (x86)\Launch Manager\dsiwmis.exe (ID 1596 |ParentID 612)
Stoppé! C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe (ID 1636 |ParentID 612)
Stoppé! C:\Program Files (x86)\Acer\Registration\GREGsvc.exe (ID 1688 |ParentID 612)
Stoppé! C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe (ID 1724 |ParentID 612)
Stoppé! C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe (ID 1760 |ParentID 612)
Stoppé! C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (ID 1864 |ParentID 612)
Stoppé! C:\Windows\system32\taskhost.exe (ID 1980 |ParentID 612)
Stoppé! C:\Program Files\Acer\Acer Updater\UpdaterService.exe (ID 1204 |ParentID 612)
Stoppé! C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (ID 1392 |ParentID 612)
Stoppé! C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (ID 384 |ParentID 1392)
Stoppé! C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (ID 2904 |ParentID 2684)
Stoppé! C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe (ID 2980 |ParentID 2684)
Stoppé! C:\Windows\System32\igfxtray.exe (ID 2996 |ParentID 2684)
Stoppé! C:\Windows\System32\hkcmd.exe (ID 3052 |ParentID 2684)
Stoppé! C:\Windows\System32\igfxpers.exe (ID 3060 |ParentID 2684)
Stoppé! C:\Windows\system32\igfxsrvc.exe (ID 2364 |ParentID 776)
Stoppé! C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (ID 2344 |ParentID 2684)
Stoppé! C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe (ID 2316 |ParentID 2684)
Stoppé! C:\Windows\System32\wscript.exe (ID 2612 |ParentID 2684)
Stoppé! C:\Program Files\Windows Sidebar\sidebar.exe (ID 2648 |ParentID 2684)
Stoppé! C:\Windows\system32\igfxext.exe (ID 2816 |ParentID 776)
Stoppé! C:\Windows\system32\SearchIndexer.exe (ID 3188 |ParentID 612)
Stoppé! C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (ID 3264 |ParentID 2344)
Stoppé! C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe (ID 3352 |ParentID 1636)
Stoppé! C:\Program Files\Windows Media Player\wmpnetwk.exe (ID 3504 |ParentID 612)
Stoppé! C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (ID 4012 |ParentID 2704)
Stoppé! C:\Program Files (x86)\Launch Manager\LManager.exe (ID 3180 |ParentID 2704)
Stoppé! C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe (ID 512 |ParentID 2704)
Stoppé! C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe (ID 2204 |ParentID 2704)
Stoppé! C:\Program Files\AVAST Software\Avast\AvastUI.exe (ID 676 |ParentID 2704)
Stoppé! C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe (ID 2436 |ParentID 3180)
Stoppé! C:\Program Files (x86)\Launch Manager\LMworker.exe (ID 2196 |ParentID 1596)
Stoppé! C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe (ID 3208 |ParentID 2328)
Stoppé! C:\Windows\system32\DllHost.exe (ID 4268 |ParentID 776)
Stoppé! C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (ID 4600 |ParentID 612)
Stoppé! C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe (ID 4648 |ParentID 612)
Stoppé! C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (ID 4772 |ParentID 612)
Stoppé! C:\Program Files (x86)\Mozilla Firefox\firefox.exe (ID 2792 |ParentID 2684)
Stoppé! C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe (ID 2556 |ParentID 2792)
Stoppé! C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe (ID 2760 |ParentID 2556)
Stoppé! C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe (ID 3612 |ParentID 2760)
Stoppé! C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE (ID 2212 |ParentID 612)
Stoppé! C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE (ID 2464 |ParentID 612)
Stoppé! C:\Program Files (x86)\Microsoft Office\Office12\MSPUB.EXE (ID 3144 |ParentID 2684)
Stoppé! C:\Windows\splwow64.exe (ID 4516 |ParentID 3144)
Stoppé! C:\Windows\SysWOW64\NOTEPAD.EXE (ID 4948 |ParentID 2884)
Stoppé! C:\Windows\System32\WUDFHost.exe (ID 4568 |ParentID 1008)
Stoppé! C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\mswinext.exe (ID 5196 |ParentID 3492)
Stoppé! C:\Windows\SysWOW64\werfault.exe (ID 2576 |ParentID 4956)
Stoppé! C:\Program Files (x86)\Microsoft Office\Office12\MSPUB.EXE (ID 3212 |ParentID 2684)
Stoppé! C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID 5804 |ParentID 2684)
Stoppé! C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID 4300 |ParentID 5804)
Stoppé! C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID 6016 |ParentID 5804)
Stoppé! C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID 4704 |ParentID 5804)
Stoppé! C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe (ID 5208 |ParentID 5144)
Stoppé! C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SCServer\SCServer.exe (ID 5632 |ParentID 776)
Stoppé! C:\Windows\system32\taskhost.exe (ID 4868 |ParentID 612)

################## | à‰léments infectieux |

Supprimé! F:\nBHfBEux.vbs
Supprimé! C:\Users\FAMILL~1\AppData\Local\Temp\nBHfBEux.vbs
Supprimé! C:\Users\Famille Ben\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nBHfBEux.vbs
Supprimé! F:\élèves points 3 et 4.lnk
Supprimé! F:\RECETTES.lnk
Supprimé! F:\Nouveau dossier.lnk
Supprimé! F:\Nouveau dossier (2).lnk
Supprimé! C:\Backup\teresa\AppData\Local\Temp\nBHfBEux.vbs
Supprimé! C:\Backup\teresa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nBHfBEux.vbs

(!) Fichiers temporaires supprimés.

################## | Registre |

Supprimé! HKCU\Software\Microsoft\Windows\CurrentVersion\Run|nBHfBEux

################## | Listing |

[30/09/2013 - 06:57:12 | SHD ] C:\$Recycle.Bin
[17/06/2013 - 10:17:29 | N | 23924] C:\AdwCleaner[R1].txt
[17/06/2013 - 10:36:13 | N | 451] C:\AdwCleaner[S1].txt
[25/06/2013 - 20:06:28 | N | 0] C:\autoexec.bat
[30/09/2013 - 19:30:18 | RASHD ] C:\Autorun.inf
[30/09/2013 - 13:15:39 | D ] C:\Backup
[29/05/2012 - 23:45:31 | D ] C:\book
[22/11/2010 - 14:13:52 | SHD ] C:\Boot
[14/07/2009 - 03:38:58 | RASH | 383562] C:\bootmgr
[22/11/2010 - 14:13:54 | RASH | 8192] C:\BOOTSECT.BAK
[30/09/2013 - 17:38:26 | SHD ] C:\Config.Msi
[14/07/2009 - 07:08:56 | SHD ] C:\Documents and Settings
[23/05/2013 - 12:26:16 | D ] C:\drivers
[29/09/2013 - 11:11:52 | N | 9] C:\END
[30/09/2013 - 18:52:04 | ASH | 3166146560] C:\hiberfil.sys
[22/11/2010 - 14:39:44 | D ] C:\Intel
[02/06/2012 - 22:56:40 | N | 40] C:\log.txt
[17/03/2013 - 15:59:47 | RHD ] C:\MSOCache
[30/09/2013 - 06:57:00 | D ] C:\OEM
[30/09/2013 - 18:52:09 | ASH | 4221530112] C:\pagefile.sys
[14/07/2009 - 05:20:08 | D ] C:\PerfLogs
[30/09/2013 - 16:50:22 | D ] C:\Program Files
[30/09/2013 - 19:02:19 | D ] C:\Program Files (x86)
[30/09/2013 - 19:04:05 | HD ] C:\ProgramData
[30/09/2013 - 06:54:38 | SHD ] C:\Recovery
[22/11/2010 - 14:47:03 | N | 2264] C:\RHDSetup.log
[30/09/2013 - 19:03:15 | SHD ] C:\System Volume Information
[30/09/2013 - 20:13:51 | D ] C:\UsbFix
[30/09/2013 - 20:14:12 | A | 11613] C:\UsbFix [Clean 1] FAMILLEBEN-PC.txt
[30/09/2013 - 19:34:28 | N | 10801] C:\UsbFix [Scan 3] FAMILLEBEN-PC.txt
[30/09/2013 - 19:37:21 | N | 11421] C:\UsbFix [Scan 4] FAMILLEBEN-PC.txt
[26/07/2012 - 09:44:21 | N | 413] C:\user.js
[30/09/2013 - 06:54:45 | RD ] C:\Users
[30/09/2013 - 11:49:33 | D ] C:\Windows
[30/09/2013 - 06:57:12 | SHD ] D:\$RECYCLE.BIN
[30/09/2013 - 19:30:20 | RASHD ] D:\Autorun.inf
[03/03/2013 - 18:39:31 | N | 369] D:\INTENSO (G) - Raccourci.lnk
[29/05/2012 - 23:39:47 | SHD ] D:\System Volume Information
[29/09/2013 - 10:38:12 | N | 127972] F:\élèves points 3 et 4.pdf
[29/09/2013 - 10:41:24 | N | 522920] F:\RECETTES.pdf
[29/09/2013 - 12:53:50 | D ] F:\Nouveau dossier
[29/09/2013 - 12:53:56 | D ] F:\Nouveau dossier (2)

################## | Vaccin |

C:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
D:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
F:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)

################## | E.O.F | https://www.usbfix.net - https://www.sosvirus.net |

[H.A.W.X]

Bonjour et bienvenue

Bien pour commencer fait ceci stp :

• Télécharges (de El Desaparecido) sur ton Bureau !
• Fais clic droit dessus, exécuter en tant qu'administrateur sous Windows : 7/8 et Vista
• Choisi l'option Suppression
  
  Note : Si UsbFix bloque à 14%, démarrer en mode sans échec. (Voir >> ICI <<)
  
  
• Copie et Colle le contenu du rapport qui apparaît à la fin du scan dans ta réponse

++

[TERESA]

voilà ce que j'ai :

Code: Tout sélectionner

############################## | UsbFix V 7.140 | [Suppression]

Utilisateur: Famille Ben (Administrateur) # FAMILLEBEN-PC
Mis à jour le 30/09/2013 par El Desaparecido - Team SosVirus
Lancé à 20:13:01 | 30/09/2013

Site Web: https://www.usbfix.net/
Forum : https://www.sosvirus.net/
Upload Malware: https://www.sosvirus.net/upload_malware.php
Contact: https://www.usbfix.net/contact/

PC: Acer (JE51_MV)
CPU: Pentium(R) Dual-Core CPU T4500 @ 2.30GHz
RAM -> [Total : 4026 | Free : 1855]
Bios: Acer
Boot: Normal boot

OS: Microsoft Windows 7 à‰dition Familiale Premium (6.1.7600 64-Bit) #
WB: Windows Internet Explorer 9.0.8112.16421

SC: Security Center Service [Enabled]
WU: Windows Update Service [Enabled]
AV: avast! Antivirus [Enabled | Updated]
FW: Windows FireWall Service [Enabled]

C:\ (%systemdrive%) -> Disque fixe # 453 Go (84 Go libre(s) - 19%) [Acer] # NTFS
D:\ -> Disque fixe # 100 Mo (85 Mo libre(s) - 85%) [Réservé au système] # NTFS
E:\ -> CD-ROM
F:\ -> Disque amovible # 4 Go (4 Go libre(s) - 100%) [] # FAT32

################## | Regedit Run |

HKLM\SOFTWARE | Run : [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
HKLM\SOFTWARE | Run : [LManager] - C:\Program Files (x86)\Launch Manager\LManager.exe
HKLM\SOFTWARE | Run : [SuiteTray] - "C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe"
HKLM\SOFTWARE | Run : [EgisUpdate] - "C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe" -d
HKLM\SOFTWARE | Run : [EgisTecPMMUpdate] - "C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe"
HKLM\SOFTWARE | Run : [Norton Online Backup] - C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe
HKLM\SOFTWARE | Run : [Adobe Reader Speed Launcher] - "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
HKLM\SOFTWARE | Run : [BackupManagerTray] - "C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" -h -k
HKLM\SOFTWARE | Run : [Microsoft Default Manager] - "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
HKLM\SOFTWARE | Run : [avast] - "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
HKLM\SOFTWARE\wow6432Node | Run : [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
HKLM\SOFTWARE\wow6432Node | Run : [LManager] - C:\Program Files (x86)\Launch Manager\LManager.exe
HKLM\SOFTWARE\wow6432Node | Run : [SuiteTray] - "C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe"
HKLM\SOFTWARE\wow6432Node | Run : [EgisUpdate] - "C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe" -d
HKLM\SOFTWARE\wow6432Node | Run : [EgisTecPMMUpdate] - "C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe"
HKLM\SOFTWARE\wow6432Node | Run : [Norton Online Backup] - C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe
HKLM\SOFTWARE\wow6432Node | Run : [Adobe Reader Speed Launcher] - "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
HKLM\SOFTWARE\wow6432Node | Run : [BackupManagerTray] - "C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" -h -k
HKLM\SOFTWARE\wow6432Node | Run : [Microsoft Default Manager] - "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
HKLM\SOFTWARE\wow6432Node | Run : [avast] - "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
HKLM\SOFTWARE | RunOnce : [] -
HKLM\SOFTWARE\wow6432Node | RunOnce : [] -
HKU\S-1-5-19\SOFTWARE | Run : [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-20\SOFTWARE | Run : [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-21-3935719060-3070481686-271069799-1001\SOFTWARE | Run : [nBHfBEux] - wscript.exe //B "C:\Users\FAMILL~1\AppData\Local\Temp\nBHfBEux.vbs"
HKU\S-1-5-21-3935719060-3070481686-271069799-1001\SOFTWARE | Run : [Sidebar] - C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
HKU\S-1-5-21-3935719060-3070481686-271069799-1001\SOFTWARE | Run : [EPSON SX125 Series] - C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIGGE.EXE /FU "C:\Windows\TEMP\E_S9EE.tmp" /EF "HKCU"
HKU\S-1-5-19\SOFTWARE | RunOnce : [mctadmin] - C:\Windows\System32\mctadmin.exe
HKU\S-1-5-20\SOFTWARE | RunOnce : [mctadmin] - C:\Windows\System32\mctadmin.exe

################## | Processus Stoppés |

Stoppé! C:\Program Files\AVAST Software\Avast\AvastSvc.exe (ID 1340 |ParentID 612)
Stoppé! C:\Windows\System32\spoolsv.exe (ID 1460 |ParentID 612)
Stoppé! C:\Program Files (x86)\Launch Manager\dsiwmis.exe (ID 1596 |ParentID 612)
Stoppé! C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe (ID 1636 |ParentID 612)
Stoppé! C:\Program Files (x86)\Acer\Registration\GREGsvc.exe (ID 1688 |ParentID 612)
Stoppé! C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe (ID 1724 |ParentID 612)
Stoppé! C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe (ID 1760 |ParentID 612)
Stoppé! C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (ID 1864 |ParentID 612)
Stoppé! C:\Windows\system32\taskhost.exe (ID 1980 |ParentID 612)
Stoppé! C:\Program Files\Acer\Acer Updater\UpdaterService.exe (ID 1204 |ParentID 612)
Stoppé! C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (ID 1392 |ParentID 612)
Stoppé! C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (ID 384 |ParentID 1392)
Stoppé! C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (ID 2904 |ParentID 2684)
Stoppé! C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe (ID 2980 |ParentID 2684)
Stoppé! C:\Windows\System32\igfxtray.exe (ID 2996 |ParentID 2684)
Stoppé! C:\Windows\System32\hkcmd.exe (ID 3052 |ParentID 2684)
Stoppé! C:\Windows\System32\igfxpers.exe (ID 3060 |ParentID 2684)
Stoppé! C:\Windows\system32\igfxsrvc.exe (ID 2364 |ParentID 776)
Stoppé! C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (ID 2344 |ParentID 2684)
Stoppé! C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe (ID 2316 |ParentID 2684)
Stoppé! C:\Windows\System32\wscript.exe (ID 2612 |ParentID 2684)
Stoppé! C:\Program Files\Windows Sidebar\sidebar.exe (ID 2648 |ParentID 2684)
Stoppé! C:\Windows\system32\igfxext.exe (ID 2816 |ParentID 776)
Stoppé! C:\Windows\system32\SearchIndexer.exe (ID 3188 |ParentID 612)
Stoppé! C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (ID 3264 |ParentID 2344)
Stoppé! C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe (ID 3352 |ParentID 1636)
Stoppé! C:\Program Files\Windows Media Player\wmpnetwk.exe (ID 3504 |ParentID 612)
Stoppé! C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (ID 4012 |ParentID 2704)
Stoppé! C:\Program Files (x86)\Launch Manager\LManager.exe (ID 3180 |ParentID 2704)
Stoppé! C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe (ID 512 |ParentID 2704)
Stoppé! C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe (ID 2204 |ParentID 2704)
Stoppé! C:\Program Files\AVAST Software\Avast\AvastUI.exe (ID 676 |ParentID 2704)
Stoppé! C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe (ID 2436 |ParentID 3180)
Stoppé! C:\Program Files (x86)\Launch Manager\LMworker.exe (ID 2196 |ParentID 1596)
Stoppé! C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe (ID 3208 |ParentID 2328)
Stoppé! C:\Windows\system32\DllHost.exe (ID 4268 |ParentID 776)
Stoppé! C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (ID 4600 |ParentID 612)
Stoppé! C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe (ID 4648 |ParentID 612)
Stoppé! C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (ID 4772 |ParentID 612)
Stoppé! C:\Program Files (x86)\Mozilla Firefox\firefox.exe (ID 2792 |ParentID 2684)
Stoppé! C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe (ID 2556 |ParentID 2792)
Stoppé! C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe (ID 2760 |ParentID 2556)
Stoppé! C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe (ID 3612 |ParentID 2760)
Stoppé! C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE (ID 2212 |ParentID 612)
Stoppé! C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE (ID 2464 |ParentID 612)
Stoppé! C:\Program Files (x86)\Microsoft Office\Office12\MSPUB.EXE (ID 3144 |ParentID 2684)
Stoppé! C:\Windows\splwow64.exe (ID 4516 |ParentID 3144)
Stoppé! C:\Windows\SysWOW64\NOTEPAD.EXE (ID 4948 |ParentID 2884)
Stoppé! C:\Windows\System32\WUDFHost.exe (ID 4568 |ParentID 1008)
Stoppé! C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\mswinext.exe (ID 5196 |ParentID 3492)
Stoppé! C:\Windows\SysWOW64\werfault.exe (ID 2576 |ParentID 4956)
Stoppé! C:\Program Files (x86)\Microsoft Office\Office12\MSPUB.EXE (ID 3212 |ParentID 2684)
Stoppé! C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID 5804 |ParentID 2684)
Stoppé! C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID 4300 |ParentID 5804)
Stoppé! C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID 6016 |ParentID 5804)
Stoppé! C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID 4704 |ParentID 5804)
Stoppé! C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe (ID 5208 |ParentID 5144)
Stoppé! C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SCServer\SCServer.exe (ID 5632 |ParentID 776)
Stoppé! C:\Windows\system32\taskhost.exe (ID 4868 |ParentID 612)

################## | à‰léments infectieux |

Supprimé! F:\nBHfBEux.vbs
Supprimé! C:\Users\FAMILL~1\AppData\Local\Temp\nBHfBEux.vbs
Supprimé! C:\Users\Famille Ben\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nBHfBEux.vbs
Supprimé! F:\élèves points 3 et 4.lnk
Supprimé! F:\RECETTES.lnk
Supprimé! F:\Nouveau dossier.lnk
Supprimé! F:\Nouveau dossier (2).lnk
Supprimé! C:\Backup\teresa\AppData\Local\Temp\nBHfBEux.vbs
Supprimé! C:\Backup\teresa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nBHfBEux.vbs

(!) Fichiers temporaires supprimés.

################## | Registre |

Supprimé! HKCU\Software\Microsoft\Windows\CurrentVersion\Run|nBHfBEux

################## | Listing |

[30/09/2013 - 06:57:12 | SHD ] C:\$Recycle.Bin
[17/06/2013 - 10:17:29 | N | 23924] C:\AdwCleaner[R1].txt
[17/06/2013 - 10:36:13 | N | 451] C:\AdwCleaner[S1].txt
[25/06/2013 - 20:06:28 | N | 0] C:\autoexec.bat
[30/09/2013 - 19:30:18 | RASHD ] C:\Autorun.inf
[30/09/2013 - 13:15:39 | D ] C:\Backup
[29/05/2012 - 23:45:31 | D ] C:\book
[22/11/2010 - 14:13:52 | SHD ] C:\Boot
[14/07/2009 - 03:38:58 | RASH | 383562] C:\bootmgr
[22/11/2010 - 14:13:54 | RASH | 8192] C:\BOOTSECT.BAK
[30/09/2013 - 17:38:26 | SHD ] C:\Config.Msi
[14/07/2009 - 07:08:56 | SHD ] C:\Documents and Settings
[23/05/2013 - 12:26:16 | D ] C:\drivers
[29/09/2013 - 11:11:52 | N | 9] C:\END
[30/09/2013 - 18:52:04 | ASH | 3166146560] C:\hiberfil.sys
[22/11/2010 - 14:39:44 | D ] C:\Intel
[02/06/2012 - 22:56:40 | N | 40] C:\log.txt
[17/03/2013 - 15:59:47 | RHD ] C:\MSOCache
[30/09/2013 - 06:57:00 | D ] C:\OEM
[30/09/2013 - 18:52:09 | ASH | 4221530112] C:\pagefile.sys
[14/07/2009 - 05:20:08 | D ] C:\PerfLogs
[30/09/2013 - 16:50:22 | D ] C:\Program Files
[30/09/2013 - 19:02:19 | D ] C:\Program Files (x86)
[30/09/2013 - 19:04:05 | HD ] C:\ProgramData
[30/09/2013 - 06:54:38 | SHD ] C:\Recovery
[22/11/2010 - 14:47:03 | N | 2264] C:\RHDSetup.log
[30/09/2013 - 19:03:15 | SHD ] C:\System Volume Information
[30/09/2013 - 20:13:51 | D ] C:\UsbFix
[30/09/2013 - 20:14:12 | A | 11613] C:\UsbFix [Clean 1] FAMILLEBEN-PC.txt
[30/09/2013 - 19:34:28 | N | 10801] C:\UsbFix [Scan 3] FAMILLEBEN-PC.txt
[30/09/2013 - 19:37:21 | N | 11421] C:\UsbFix [Scan 4] FAMILLEBEN-PC.txt
[26/07/2012 - 09:44:21 | N | 413] C:\user.js
[30/09/2013 - 06:54:45 | RD ] C:\Users
[30/09/2013 - 11:49:33 | D ] C:\Windows
[30/09/2013 - 06:57:12 | SHD ] D:\$RECYCLE.BIN
[30/09/2013 - 19:30:20 | RASHD ] D:\Autorun.inf
[03/03/2013 - 18:39:31 | N | 369] D:\INTENSO (G) - Raccourci.lnk
[29/05/2012 - 23:39:47 | SHD ] D:\System Volume Information
[29/09/2013 - 10:38:12 | N | 127972] F:\élèves points 3 et 4.pdf
[29/09/2013 - 10:41:24 | N | 522920] F:\RECETTES.pdf
[29/09/2013 - 12:53:50 | D ] F:\Nouveau dossier
[29/09/2013 - 12:53:56 | D ] F:\Nouveau dossier (2)

################## | Vaccin |

C:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
D:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
F:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)

################## | E.O.F | https://www.usbfix.net - https://www.sosvirus.net |

[TERESA]

Suis super contente d'avoir enfin retrouvé mes dossiers sains et saufs, ouffffffffffffff !!!!!! UN ENOOOOOOOOOOOOOOOOOOOOOOOORME MERCI :bravo1:

[H.A.W.X]

Bonsoir,

Ravis d'avoir pu t'aider

Si tu le souhaites tu as notre page facebook pour nous faire connaitre autour de toi

[pagefan][/pagefan]

++

[TERESA]

encore merci et pas de soucis, je publie sur mon facebook, si ça peut aider d'autres personnes ..... super !!!

[H.A.W.X]

Bonsoir,

C'est super de ta part

Amicalement l'équipe du forum.

[Alhan]

Bonjour à tous,

voilà j'ai attrapé le même virus qui me pourri la vie....

Est-ce que quelqu'un pourrait me le dénicher?

voici mon rapport,

############################## | UsbFix V 7.139 | [Recherche]

Utilisateur: Alhan (Administrateur) # ALHAN-PC
Mis à jour le 29/09/2013 par El Desaparecido - Team SosVirus
Lancé à 09:37:48 | 04/10/2013

Site Web:
Forum : https://www.sosvirus.net/
Upload Malware: https://www.sosvirus.net/upload_malware.php
Contact:

PC: ASUSTeK Computer Inc. (N71Jq)
CPU: Intel(R) Core(TM) i7 CPU Q 720 @ 1.60GHz
RAM -> [Total : 4021 | Free : 2127]
Bios: American Megatrends Inc.
Boot: Normal boot

OS: Microsoft Windows 7 à‰dition Familiale Premium (6.1.7600 64-Bit) #
WB: Windows Internet Explorer 8.0.7600.16385

SC: Security Center Service [Enabled]
WU: Windows Update Service [Enabled]
AV: Avira Desktop [Enabled | Updated]
FW: Windows FireWall Service [Enabled]

C:\ (%systemdrive%) -> Disque fixe # 681 Go (141 Go libre(s) - 21%) [OS] # NTFS
D:\ -> Disque fixe # 298 Go (8 Go libre(s) - 3%) [] # NTFS
E:\ -> CD-ROM
F:\ -> Disque fixe # 298 Go (70 Go libre(s) - 23%) [] # NTFS
G:\ -> Disque amovible # 7 Go (7 Go libre(s) - 100%) [STORE N GO] # FAT32

################## | Processus Actif |

C:\Windows\system32\csrss.exe (ID 472 |ParentID 460)
C:\Windows\system32\wininit.exe (ID 536 |ParentID 460)
C:\Windows\system32\csrss.exe (ID 556 |ParentID 544)
C:\Windows\system32\services.exe (ID 592 |ParentID 536)
C:\Windows\system32\lsass.exe (ID 620 |ParentID 536)
C:\Windows\system32\lsm.exe (ID 628 |ParentID 536)
C:\Windows\system32\svchost.exe (ID 724 |ParentID 592)
C:\Windows\system32\winlogon.exe (ID 792 |ParentID 544)
C:\Windows\system32\svchost.exe (ID 852 |ParentID 592)
C:\Windows\system32\atiesrxx.exe (ID 912 |ParentID 592)
C:\Windows\System32\svchost.exe (ID 972 |ParentID 592)
C:\Windows\System32\svchost.exe (ID 1012 |ParentID 592)
C:\Windows\system32\svchost.exe (ID 144 |ParentID 592)
C:\Windows\system32\svchost.exe (ID 164 |ParentID 592)
C:\Windows\system32\svchost.exe (ID 1104 |ParentID 592)
C:\Windows\system32\atieclxx.exe (ID 1264 |ParentID 912)
C:\Windows\system32\FBAgent.exe (ID 1368 |ParentID 592)
C:\Program Files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exe (ID 1392 |ParentID 592)
C:\Program Files\ATKGFNEX\GFNEXSrv.exe (ID 1432 |ParentID 592)
C:\Windows\System32\spoolsv.exe (ID 1528 |ParentID 592)
C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (ID 1592 |ParentID 592)
C:\Windows\system32\svchost.exe (ID 1624 |ParentID 592)
C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (ID 1728 |ParentID 592)
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (ID 1764 |ParentID 592)
C:\Program Files\Bonjour\mDNSResponder.exe (ID 1936 |ParentID 592)
C:\Windows\system32\svchost.exe (ID 1984 |ParentID 592)
C:\Windows\SysWOW64\svchost.exe (ID 2012 |ParentID 592)
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (ID 2040 |ParentID 592)
C:\Program Files\ma-config.com\MaConfigAgent.exe (ID 1644 |ParentID 592)
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (ID 432 |ParentID 592)
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (ID 2056 |ParentID 592)
C:\Windows\System32\svchost.exe (ID 2076 |ParentID 592)
C:\Windows\System32\svchost.exe (ID 2164 |ParentID 592)
C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (ID 2204 |ParentID 592)
C:\Windows\system32\svchost.exe (ID 2308 |ParentID 592)
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (ID 2384 |ParentID 592)
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (ID 2724 |ParentID 2384)
C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (ID 3048 |ParentID 1728)
C:\Windows\system32\svchost.exe (ID 3588 |ParentID 592)
C:\Windows\system32\svchost.exe (ID 3712 |ParentID 592)
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (ID 3676 |ParentID 2056)
C:\Windows\system32\Dwm.exe (ID 1828 |ParentID 1012)
C:\Windows\system32\taskhost.exe (ID 2524 |ParentID 592)
C:\Windows\Explorer.EXE (ID 3868 |ParentID 3768)
C:\Program Files (x86)\ASUS\ATK Hotkey\HControl.exe (ID 3616 |ParentID 1392)
C:\Windows\system32\taskeng.exe (ID 1584 |ParentID 144)
C:\Windows\system32\wbem\wmiprvse.exe (ID 3512 |ParentID 724)
C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe (ID 3692 |ParentID 1584)
C:\Program Files (x86)\ASUS\Splendid\ACMON.exe (ID 1044 |ParentID 1584)
C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe (ID 2808 |ParentID 1584)
C:\Program Files\P4G\BatteryLife.exe (ID 3816 |ParentID 1584)
C:\Program Files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe (ID 3420 |ParentID 1584)
C:\Program Files (x86)\ASUS\ATK Hotkey\ATKOSD.exe (ID 3976 |ParentID 3616)
C:\Windows\SysWOW64\ACEngSvr.exe (ID 3268 |ParentID 724)
C:\Program Files (x86)\ASUS\ATK Hotkey\WDC.exe (ID 3436 |ParentID 3616)
C:\Program Files\Elantech\ETDCtrl.exe (ID 452 |ParentID 3868)
C:\Program Files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe (ID 3404 |ParentID 3868)
C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe (ID 3972 |ParentID 3868)
C:\Windows\System32\wscript.exe (ID 3960 |ParentID 3868)
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (ID 4012 |ParentID 3868)
C:\Program Files\SRS Labs\SRS Premium Sound Control Panel\SRSPremiumPanel_64.exe (ID 3480 |ParentID 3868)
C:\Windows\system32\wbem\wmiprvse.exe (ID 3652 |ParentID 724)
C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe (ID 4000 |ParentID 3096)
C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe (ID 2444 |ParentID 3096)
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (ID 2336 |ParentID 1188)
C:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exe (ID 3628 |ParentID 3096)
C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (ID 3640 |ParentID 3096)
C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (ID 3856 |ParentID 3096)
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (ID 3768 |ParentID 3096)
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (ID 1572 |ParentID 3096)
C:\Program Files (x86)\HP\HP Software Update\hpwuSchd2.exe (ID 2980 |ParentID 3096)
C:\Program Files (x86)\iTunes\iTunesHelper.exe (ID 560 |ParentID 3096)
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (ID 4208 |ParentID 2336)
C:\Program Files\iPod\bin\iPodService.exe (ID 4908 |ParentID 592)
C:\Program Files\Windows Media Player\wmpnetwk.exe (ID 660 |ParentID 592)
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe (ID 4364 |ParentID 4012)
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe (ID 4100 |ParentID 724)
C:\windows\Intel(TM)7z.exe (ID 4576 |ParentID 4556)
C:\Windows\AsScrPro.exe (ID 4712 |ParentID 1368)
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe (ID 4528 |ParentID 724)
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (ID 5080 |ParentID 1368)
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (ID 4168 |ParentID 592)
C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE (ID 5488 |ParentID 3868)
C:\Windows\splwow64.exe (ID 5656 |ParentID 5488)
C:\Program Files (x86)\Microsoft\Office Live\OfficeLiveSignIn.exe (ID 5800 |ParentID 724)
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe (ID 3820 |ParentID 3768)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID 5228 |ParentID 3868)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID 3356 |ParentID 5228)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID 748 |ParentID 5228)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID 4812 |ParentID 5228)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID 4588 |ParentID 5228)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID 5612 |ParentID 5228)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID 5848 |ParentID 5228)
C:\Windows\System32\svchost.exe (ID 5296 |ParentID 592)
C:\Windows\system32\WUDFHost.exe (ID 4552 |ParentID 1012)
C:\UsbFix\Go.exe (ID 4124 |ParentID 5888)

################## | Regedit Run |

HKLM\SOFTWARE | Run : [UpdatePSTShortCut] - "C:\Program Files (x86)\Cyberlink\DVD Suite\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Cyberlink\DVD Suite" UpdateWithCreateOnce "Software\CyberLink\PowerStarter"
HKLM\SOFTWARE | Run : [StartCCC] - "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
HKLM\SOFTWARE | Run : [HControlUser] - C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe
HKLM\SOFTWARE | Run : [ATKMEDIA] - C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe
HKLM\SOFTWARE | Run : [ATKOSD2] - C:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exe
HKLM\SOFTWARE | Run : [NUSB3MON] - "C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"
HKLM\SOFTWARE | Run : [Setwallpaper] - c:\programdata\SetWallpaper.cmd
HKLM\SOFTWARE | Run : [avgnt] - "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
HKLM\SOFTWARE | Run : [APSDaemon] - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
HKLM\SOFTWARE | Run : [SunJavaUpdateSched] - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
HKLM\SOFTWARE | Run : [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
HKLM\SOFTWARE | Run : [Adobe Reader Speed Launcher] - "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
HKLM\SOFTWARE | Run : [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
HKLM\SOFTWARE | Run : [iTunesHelper] - "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
HKLM\SOFTWARE | Run : [Intel(TM)7z] - "C:\windows\Intel(TM)7z.exe"
HKLM\SOFTWARE\wow6432Node | Run : [UpdatePSTShortCut] - "C:\Program Files (x86)\Cyberlink\DVD Suite\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Cyberlink\DVD Suite" UpdateWithCreateOnce "Software\CyberLink\PowerStarter"
HKLM\SOFTWARE\wow6432Node | Run : [StartCCC] - "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
HKLM\SOFTWARE\wow6432Node | Run : [HControlUser] - C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe
HKLM\SOFTWARE\wow6432Node | Run : [ATKMEDIA] - C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe
HKLM\SOFTWARE\wow6432Node | Run : [ATKOSD2] - C:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exe
HKLM\SOFTWARE\wow6432Node | Run : [NUSB3MON] - "C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"
HKLM\SOFTWARE\wow6432Node | Run : [Setwallpaper] - c:\programdata\SetWallpaper.cmd
HKLM\SOFTWARE\wow6432Node | Run : [avgnt] - "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
HKLM\SOFTWARE\wow6432Node | Run : [APSDaemon] - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
HKLM\SOFTWARE\wow6432Node | Run : [SunJavaUpdateSched] - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
HKLM\SOFTWARE\wow6432Node | Run : [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
HKLM\SOFTWARE\wow6432Node | Run : [Adobe Reader Speed Launcher] - "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
HKLM\SOFTWARE\wow6432Node | Run : [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
HKLM\SOFTWARE\wow6432Node | Run : [iTunesHelper] - "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
HKLM\SOFTWARE\wow6432Node | Run : [Intel(TM)7z] - "C:\windows\Intel(TM)7z.exe"
HKLM\SOFTWARE | RunOnce : [] -
HKLM\SOFTWARE\wow6432Node | RunOnce : [] -
HKU\S-1-5-21-2351134466-4085927225-1477360203-1000\SOFTWARE | Run : [Facebook Update] - "C:\Users\Alhan\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
HKU\S-1-5-21-2351134466-4085927225-1477360203-1000\SOFTWARE | Run : [A7KGEquN] - wscript.exe //B "C:\Users\Alhan\AppData\Local\Temp\A7KGEquN.vbs"

################## | à‰léments infectieux |

Présent! G:\A7KGEquN.vbs
Présent! C:\Users\Alhan\AppData\Local\Temp\A7KGEquN.vbs
Présent! C:\Users\Alhan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\A7KGEquN.vbs
Présent! G:\Autorun.inf.lnk
Présent! G:\P04-1708.lnk
Présent! C:\Users\Public\9eimmD.vbe
Présent! C:\Users\Public\9stiemD.VBE
Présent! C:\Users\Public\Intel(R)Graph.exe
Présent! C:\Users\Alhan\AppData\Local\Temp\iiiii9.hta

################## | Registre |

Présent! HKCU\Software\Microsoft\Windows\CurrentVersion\Run|A7KGEquN
Présent! HKCU\Software\Microsoft\Windows\CurrentVersion\Run|A7KGEquN
Présent! HKCU\Software\Microsoft\Windows\CurrentVersion\Run|A7KGEquN
Présent! HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System|DisableRegistryTools


################## | Vaccin |

C:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
D:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
F:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
G:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)

################## | E.O.F | - https://www.sosvirus.net |

[El Desaparecido]

Hello Alhan,

Il faut que tu ouvres ton propre sujet en cliquant sur "Nouveau" dans le forum Virus-Sécurité

[Alhan]

ok merci