
dejà pour votre attention...
resultat de USB fix
############################## | UsbFix V 7.145 | [Suppression]
Utilisateur: SOFTWARE-FIXE (Administrateur) # SOFTWARE-FIXE
Mis à jour le 17/10/2013 par El Desaparecido - Team SosVirus
Lancé à 14:26:04 | 24/10/2013
Site Web:
https://www.usbfix.net/
Forum :
https://www.sosvirus.net/
Upload Malware:
https://www.sosvirus.net/upload_malware.php
Contact:
https://www.usbfix.net/contact/
PC: Dell Inc. (0GDG8Y )
CPU: Intel(R) Pentium(R) CPU G630 @ 2.70GHz
RAM -> [Total : 3319 | Free : 1570]
Bios: Dell Inc.
Boot: Normal boot
OS: Microsoft Windows 7 à‰dition Intégrale (6.1.7601 32-Bit) # Service Pack 1
WB: Windows Internet Explorer 10.0.9200.16721
SC: Security Center Service [(!) Disabled]
WU: Windows Update Service [Enabled]
AV: Microsoft Security Essentials [Enabled | Updated]
FW: Windows FireWall Service [Enabled]
C:\ (%systemdrive%) -> Disque fixe # 98 Go (5 Go libre(s) - 5%) [] # NTFS
D:\ -> Disque fixe # 149 Go (8 Go libre(s) - 6%) [Save 2] # NTFS
E:\ -> Disque fixe # 368 Go (8 Go libre(s) - 2%) [Save 1] # NTFS
F:\ -> Disque fixe # 233 Go (68 Go libre(s) - 29%) [HDD DATA] # NTFS
G:\ -> CD-ROM
H:\ -> Disque amovible # 4 Go (689 Mo libre(s) - 18%) [KODESH 1] # FAT32
I:\ -> Disque amovible # 2 Go (283 Mo libre(s) - 18%) [T98] # FAT32
J:\ -> Disque amovible # 4 Go (68 Mo libre(s) - 2%) [] # FAT32
################## | Regedit Run |
HKLM\SOFTWARE | Run : [PWRISOVM.EXE] - C:\Program Files\PowerISO\PWRISOVM.EXE
HKLM\SOFTWARE | Run : [IgfxTray] - C:\Windows\system32\igfxtray.exe
HKLM\SOFTWARE | Run : [HotKeysCmds] - C:\Windows\system32\hkcmd.exe
HKLM\SOFTWARE | Run : [Persistence] - C:\Windows\system32\igfxpers.exe
HKLM\SOFTWARE | Run : [MSC] - "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
HKLM\SOFTWARE | Run : [AdobeAAMUpdater-1.0] - "C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
HKLM\SOFTWARE | Run : [SwitchBoard] - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
HKLM\SOFTWARE | Run : [AdobeCS6ServiceManager] - "C:\Program Files\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin
HKLM\SOFTWARE | Run : [Adobe] - C:\Users\SOFTWARE-FIXE\AppData\Roaming\Adobe\color.vbe
HKLM\SOFTWARE | Run : [APSDaemon] - "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
HKLM\SOFTWARE | Run : [RIMBBLaunchAgent.exe] - C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
HKLM\SOFTWARE | RunOnce : [] -
HKU\S-1-5-19\SOFTWARE | Run : [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-20\SOFTWARE | Run : [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-21-2605565546-127066393-2246236235-1000\SOFTWARE | Run : [IDMan] - C:\Program Files\Internet Download Manager\IDMan.exe /onboot
HKU\S-1-5-21-2605565546-127066393-2246236235-1000\SOFTWARE | Run : [uTorrent] - "C:\Program Files\uTorrent\uTorrent.exe" /MINIMIZED
HKU\S-1-5-21-2605565546-127066393-2246236235-1000\SOFTWARE | Run : [Cracked Steam Service] - "C:\Program Files\Cracked Steam\Cracked Steam.exe" /SERVICE
HKU\S-1-5-21-2605565546-127066393-2246236235-1000\SOFTWARE | Run : [SkyDrive] - "C:\Users\SOFTWARE-FIXE\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe" /background
HKU\S-1-5-21-2605565546-127066393-2246236235-1000\SOFTWARE | Run : [MySQL Notifier] - C:\Program Files\MySQL\MySQL Notifier 1.1.4\MySqlNotifier.exe
HKU\S-1-5-21-2605565546-127066393-2246236235-1000\SOFTWARE | Run : [Skype] - "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
HKU\S-1-5-19\SOFTWARE | RunOnce : [mctadmin] - C:\Windows\System32\mctadmin.exe
HKU\S-1-5-20\SOFTWARE | RunOnce : [mctadmin] - C:\Windows\System32\mctadmin.exe
HKU\S-1-5-21-2605565546-127066393-2246236235-1000\SOFTWARE | RunOnce : [Uninstall C:\Users\SOFTWARE-FIXE\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112] - C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\SOFTWARE-FIXE\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112"
HKU\S-1-5-21-2605565546-127066393-2246236235-1000\SOFTWARE | RunOnce : [Uninstall C:\Users\SOFTWARE-FIXE\AppData\Local\Microsoft\SkyDrive\17.0.2006.0314] - C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\SOFTWARE-FIXE\AppData\Local\Microsoft\SkyDrive\17.0.2006.0314"
HKU\S-1-5-21-2605565546-127066393-2246236235-1000\SOFTWARE | RunOnce : [Uninstall C:\Users\SOFTWARE-FIXE\AppData\Local\Microsoft\SkyDrive\17.0.2010.0530] - C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\SOFTWARE-FIXE\AppData\Local\Microsoft\SkyDrive\17.0.2010.0530"
HKU\S-1-5-21-2605565546-127066393-2246236235-1000\SOFTWARE | RunOnce : [Uninstall C:\Users\SOFTWARE-FIXE\AppData\Local\Microsoft\SkyDrive\17.0.2011.0627] - C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\SOFTWARE-FIXE\AppData\Local\Microsoft\SkyDrive\17.0.2011.0627"
################## | Processus Stoppés |
Stoppé! C:\Windows\system32\nvvsvc.exe (ID 840 |ParentID 596)
Stoppé! C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (ID 864 |ParentID 596)
Stoppé! c:\Program Files\Microsoft Security Client\MsMpEng.exe (ID 956 |ParentID 596)
Stoppé! C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (ID 1388 |ParentID 840)
Stoppé! C:\Windows\system32\nvvsvc.exe (ID 1396 |ParentID 840)
Stoppé! C:\Windows\System32\spoolsv.exe (ID 1664 |ParentID 596)
Stoppé! C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (ID 1848 |ParentID 596)
Stoppé! C:\Windows\system32\taskhost.exe (ID 1916 |ParentID 596)
Stoppé! C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (ID 2024 |ParentID 596)
Stoppé! C:\Program Files\Bonjour\mDNSResponder.exe (ID 404 |ParentID 596)
Stoppé! C:\Program Files\DefaultTab\DefaultTabSearch.exe (ID 484 |ParentID 596)
Stoppé! C:\Users\SOFTWARE-FIXE\AppData\Roaming\DefaultTab\DefaultTab\DTUpdate.exe (ID 724 |ParentID 596)
Stoppé! C:\Program Files\Intel\iCLS Client\HeciServer.exe (ID 1052 |ParentID 596)
Stoppé! C:\Program Files\InternetEverywhere\InternetEverywhere_Service.exe (ID 1416 |ParentID 596)
Stoppé! C:\Program Files\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe (ID 1816 |ParentID 596)
Stoppé! C:\Program Files\MySQL\MySQL Server 5.6\bin\mysqld.exe (ID 2008 |ParentID 596)
Stoppé! C:\Windows\Explorer.EXE (ID 2068 |ParentID 492)
Stoppé! C:\Program Files\TeamViewer\Version8\TeamViewer_Service.exe (ID 2384 |ParentID 596)
Stoppé! C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesService32.exe (ID 2624 |ParentID 596)
Stoppé! C:\Program Files\lucky leap\updateluckyleap.exe (ID 2692 |ParentID 596)
Stoppé! C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesApp32.exe (ID 2800 |ParentID 2624)
Stoppé! C:\Program Files\lucky leap\bin\utilluckyleap.exe (ID 2916 |ParentID 596)
Stoppé! c:\wamp\bin\apache\apache2.2.22\bin\httpd.exe (ID 2968 |ParentID 596)
Stoppé! c:\wamp\bin\mysql\mysql5.5.24\bin\mysqld.exe (ID 3048 |ParentID 596)
Stoppé! C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (ID 3124 |ParentID 596)
Stoppé! C:\wamp\bin\apache\apache2.2.22\bin\httpd.exe (ID 3132 |ParentID 2968)
Stoppé! C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (ID 3572 |ParentID 3124)
Stoppé! C:\Program Files\TeamViewer\Version8\TeamViewer.exe (ID 3860 |ParentID 2384)
Stoppé! C:\Program Files\TeamViewer\Version8\tv_w32.exe (ID 2400 |ParentID 2384)
Stoppé! C:\Program Files\PowerISO\PWRISOVM.EXE (ID 4148 |ParentID 2068)
Stoppé! C:\Program Files\Microsoft Security Client\msseces.exe (ID 4200 |ParentID 2068)
Stoppé! C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe (ID 4436 |ParentID 2068)
Stoppé! C:\Program Files\Internet Download Manager\IDMan.exe (ID 4460 |ParentID 2068)
Stoppé! C:\Program Files\uTorrent\uTorrent.exe (ID 4504 |ParentID 2068)
Stoppé! C:\Users\SOFTWARE-FIXE\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe (ID 4560 |ParentID 2068)
Stoppé! C:\Program Files\MySQL\MySQL Notifier 1.1.4\MySQLNotifier.exe (ID 4572 |ParentID 2068)
Stoppé! C:\Program Files\Skype\Phone\Skype.exe (ID 4596 |ParentID 2068)
Stoppé! C:\Program Files\InternetEverywhere\InternetEverywhere_Launcher.exe (ID 4608 |ParentID 2068)
Stoppé! C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe (ID 4624 |ParentID 596)
Stoppé! C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (ID 5452 |ParentID 1388)
Stoppé! C:\Windows\system32\SearchIndexer.exe (ID 5792 |ParentID 596)
Stoppé! C:\Program Files\Windows Media Player\wmpnetwk.exe (ID 5876 |ParentID 596)
Stoppé! C:\Users\SOFTWA~1\AppData\Local\Temp\svchost.exe (ID 5144 |ParentID 4380)
Stoppé! C:\Windows\system32\conhost.exe (ID 4860 |ParentID 552)
Stoppé! C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE15\CSISYN~1.EXE (ID 380 |ParentID 780)
Stoppé! C:\Windows\system32\DllHost.exe (ID 2436 |ParentID 780)
Stoppé! C:\Windows\system32\DllHost.exe (ID 2580 |ParentID 780)
Stoppé! C:\Windows\explorer.exe (ID 5592 |ParentID 780)
Stoppé! C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (ID 6148 |ParentID 596)
Stoppé! C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (ID 6292 |ParentID 596)
Stoppé! C:\Program Files\Mozilla Firefox\firefox.exe (ID 6968 |ParentID 2068)
Stoppé! C:\Program Files\Mozilla Firefox\plugin-container.exe (ID 8016 |ParentID 6968)
Stoppé! C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe (ID 8092 |ParentID 8016)
Stoppé! C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe (ID 8116 |ParentID 8092)
Stoppé! C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe (ID 2772 |ParentID 7788)
Stoppé! C:\Windows\explorer.exe (ID 5912 |ParentID 780)
Stoppé! C:\Windows\System32\WUDFHost.exe (ID 7760 |ParentID 1144)
Stoppé! \\?\C:\Windows\system32\wbem\WMIADAP.EXE (ID 7952 |ParentID 1204)
Stoppé! C:\Windows\system32\SearchProtocolHost.exe (ID 6764 |ParentID 5792)
Stoppé! C:\Windows\system32\SearchFilterHost.exe (ID 7368 |ParentID 5792)
################## | à‰léments infectieux |
Supprimé! C:\Users\Public\e-book-Les 2 Clés universelles pour réussir en affaires.pdf
Supprimé! C:\Users\SOFTWARE-FIXE\AppData\Roaming\Adobe\color.vbe
Supprimé! C:\Users\SOFTWA~1\AppData\Local\Temp\svchost.exe
Supprimé! C:\Users\SOFTWARE-FIXE\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V0YNTB2B\svchost[4].exe
(!) Fichiers temporaires supprimés.
################## | Registre |
Supprimé! HKLM\Software\Microsoft\Windows\CurrentVersion\Run|Adobe
Supprimé! HKCU\.\.\.\.\Explorer\MountPoints2\F
Supprimé! HKCU\.\.\.\.\Explorer\MountPoints2\{068c4024-1a05-11e3-90e9-d4bed9c4c8c6}
Supprimé! HKCU\.\.\.\.\Explorer\MountPoints2\{33e177d6-edea-11e2-8d5c-d4bed9c4c8c6}
Supprimé! HKCU\.\.\.\.\Explorer\MountPoints2\{a5f4a6f0-0347-11e3-8ca6-d4bed9c4c8c6}
Supprimé! HKCU\.\.\.\.\Explorer\MountPoints2\{fca286f1-5ad4-11e2-8b11-d4bed9c4c8c6}
################## | Listing |
[26/03/2013 - 14:59:10 | SHD ] C:\$Recycle.Bin
[10/06/2009 - 21:42:20 | N | 24] C:\autoexec.bat
[23/10/2013 - 17:04:14 | RASHD ] C:\Autorun.inf
[10/06/2009 - 21:42:20 | N | 10] C:\config.sys
[14/07/2009 - 04:53:55 | SHD ] C:\Documents and Settings
[23/10/2013 - 17:01:00 | ASH | 2609897472] C:\hiberfil.sys
[31/12/2012 - 16:12:33 | RHD ] C:\MSOCache
[23/10/2013 - 17:01:02 | ASH | 3479867392] C:\pagefile.sys
[08/10/2013 - 16:13:36 | D ] C:\Program Files
[08/10/2013 - 16:13:44 | HD ] C:\ProgramData
[28/12/2012 - 09:02:57 | SHD ] C:\Recovery
[21/10/2013 - 17:34:10 | SHD ] C:\System Volume Information
[24/10/2013 - 14:28:25 | D ] C:\UsbFix
[24/10/2013 - 14:29:26 | A | 11670] C:\UsbFix [Clean 2] SOFTWARE-FIXE.txt
[08/04/2013 - 17:15:20 | RD ] C:\Users
[23/01/2013 - 10:32:34 | D ] C:\wamp
[14/10/2013 - 10:58:33 | D ] C:\Windows
[24/06/2013 - 08:01:49 | SHD ] D:\$RECYCLE.BIN
[12/02/2013 - 13:58:33 | N | 314] D:\activer taskmgr.txt
[24/08/2013 - 12:55:29 | D ] D:\Anime
[23/10/2013 - 17:04:18 | RASHD ] D:\Autorun.inf
[06/09/2013 - 13:59:51 | D ] D:\Denis.2013.FRENCH.DVDRip.XviD-UTT
[06/09/2013 - 15:15:59 | N | 288642569] D:\epz-revenge.217.victoire.mkv
[12/02/2013 - 16:59:34 | N | 14610] D:\Nouveau Document Microsoft Word.docx
[06/09/2013 - 14:45:25 | N | 366645248] D:\Revenge.S02E18.FRENCH.LD.DVDRiP.XviD-ASPHiXiAS.avi
[30/08/2013 - 11:47:01 | D ] D:\Sauvegardes
[06/09/2013 - 14:00:52 | D ] D:\Scandal.S02E18.FRENCH.LD.DVDRIP.XviD-ATN
[06/09/2013 - 14:01:01 | D ] D:\Scandal.S02E19.FRENCH.LD.DVDRIP.XviD-ATN
[24/06/2013 - 08:01:42 | SHD ] D:\System Volume Information
[13/02/2013 - 08:43:18 | N | 17635] D:\tableau de distribution.docx
[23/09/2013 - 17:32:27 | D ] D:\Telechargements
[21/06/2013 - 18:19:09 | D ] D:\VIDEO_TS
[24/07/2013 - 12:44:32 | N | 2637702] D:\VN-20130724-00014.amr
[06/09/2013 - 14:45:50 | N | 207704341] D:\[Fansub-Resistance]Naruto Shippuuden 329 (1280x720).mp4
[28/12/2012 - 09:03:08 | SHD ] E:\$RECYCLE.BIN
[23/10/2013 - 17:04:19 | RASHD ] E:\Autorun.inf
[13/09/2013 - 15:20:10 | D ] E:\ESSOH
[10/09/2013 - 16:33:41 | D ] E:\jaye
[06/09/2013 - 16:00:09 | D ] E:\Sauvegardes
[27/12/2012 - 16:10:18 | SHD ] E:\System Volume Information
[09/08/2013 - 15:04:18 | SHD ] F:\$RECYCLE.BIN
[23/10/2013 - 17:04:21 | RASHD ] F:\Autorun.inf
[09/08/2013 - 15:04:07 | SHD ] F:\System Volume Information
[18/09/2013 - 07:36:57 | D ] F:\Séries
################## | Vaccin |
C:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
D:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
E:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
F:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
################## | E.O.F |
https://www.usbfix.net -
https://www.sosvirus.net |