Bonsoir,
merci bcp pour votre aide !!
voici le rapport :
############################## | UsbFix V 7.149 | [Suppression]
Utilisateur: Hélène (Administrateur) # Hà‰LENE-PC
Mis à jour le 03/11/2013 par El Desaparecido - Team SosVirus
Lancé à 20:13:46 | 07/11/2013
Site Web:
https://www.usbfix.net/
Forum :
https://www.sosvirus.net/
Upload Malware:
https://www.sosvirus.net/upload_malware.php
Contact:
https://www.usbfix.net/contact/
PC: SAMSUNG ELECTRONICS CO., LTD. (N150P )
CPU: Intel(R) Atom(TM) CPU N455 @ 1.66GHz
RAM -> [Total : 1013 | Free : 189]
Bios: Phoenix Technologies Ltd.
Boot: Normal boot
OS: Microsoft Windows 7 à‰dition Starter (6.1.7601 32-Bit) Service Pack 1
WB: Windows Internet Explorer : 10.0.9200.16721
SC: Security Center Service [Enabled]
WU: Windows Update Service [Enabled]
AV: avast! Antivirus [(!) Disabled | Updated]
AS: Windows Defender : 6.1.7600.16385 (win7_rtm.090713-1255)
FW: Windows FireWall Service [Enabled]
C:\ (%systemdrive%) -> Disque fixe # 112 Go (65 Go libre(s) - 58%) [] # NTFS
D:\ -> Disque fixe # 166 Go (166 Go libre(s) - 100%) [] # NTFS
E:\ -> Disque amovible # 4 Go (3 Go libre(s) - 76%) [Hà‰LàˆNE] # FAT32
################## | Référence de comparaison MD5 |
Md5 : DENIED -> C:\Users\HLNE~1\AppData\Local\Temp\Intel(R)Service.vbs
Md5 : 0432ea5e5d3d9897407715ac9a743ecc -> E:\Intel(R)Service.vbs
################## | Processus Stoppés |
Stoppé! C:\Program Files\AVAST Software\Avast\AvastSvc.exe (ID: 1460 |ParentID: 644)
Stoppé! C:\windows\system32\WLANExt.exe (ID: 1468 |ParentID: 1024)
Stoppé! C:\windows\system32\conhost.exe (ID: 1480 |ParentID: 500)
Stoppé! C:\windows\System32\spoolsv.exe (ID: 1588 |ParentID: 644)
Stoppé! C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe (ID: 1740 |ParentID: 644)
Stoppé! C:\windows\system32\taskhost.exe (ID: 2104 |ParentID: 644)
Stoppé! C:\windows\system32\taskeng.exe (ID: 2144 |ParentID: 1072)
Stoppé! C:\windows\Explorer.EXE (ID: 2296 |ParentID: 2220)
Stoppé! C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (ID: 2836 |ParentID: 2296)
Stoppé! C:\Program Files\Elantech\ETDCtrl.exe (ID: 2932 |ParentID: 2296)
Stoppé! C:\Program Files\AVAST Software\Avast\AvastUI.exe (ID: 2944 |ParentID: 2296)
Stoppé! C:\Windows\System32\wscript.exe (ID: 3012 |ParentID: 2296)
Stoppé! C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (ID: 3172 |ParentID: 2296)
Stoppé! C:\windows\system32\SearchIndexer.exe (ID: 3308 |ParentID: 644)
Stoppé! C:\Program Files\Elantech\ETDCtrlHelper.exe (ID: 3496 |ParentID: 2932)
Stoppé! C:\Program Files\OpenOffice.org 3\program\soffice.exe (ID: 4052 |ParentID: 3232)
Stoppé! C:\Program Files\OpenOffice.org 3\program\soffice.bin (ID: 1380 |ParentID: 4052)
Stoppé! C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe (ID: 2224 |ParentID: 780)
Stoppé! C:\Program Files\Microsoft\BingBar\SeaPort.EXE (ID: 2632 |ParentID: 644)
Stoppé! C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (ID: 1436 |ParentID: 644)
Stoppé! C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (ID: 3300 |ParentID: 1436)
Stoppé! C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe (ID: 2524 |ParentID: 2144)
Stoppé! C:\windows\system32\hkcmd.exe (ID: 984 |ParentID: 3184)
Stoppé! C:\windows\system32\igfxtray.exe (ID: 3228 |ParentID: 3184)
Stoppé! C:\windows\system32\igfxpers.exe (ID: 2620 |ParentID: 3184)
Stoppé! C:\windows\system32\igfxsrvc.exe (ID: 1752 |ParentID: 780)
Stoppé! C:\Program Files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe (ID: 1900 |ParentID: 3184)
Stoppé! C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe (ID: 3728 |ParentID: 3184)
Stoppé! C:\Program Files\Samsung\SFB\SmartRestarter.exe (ID: 1164 |ParentID: 3184)
Stoppé! C:\windows\system32\igfxext.exe (ID: 3072 |ParentID: 780)
Stoppé! C:\Program Files\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe (ID: 3928 |ParentID: 2144)
Stoppé! C:\PROGRA~1\samsung\SAMSUN~2\SUPNOT~1.EXE (ID: 3812 |ParentID: 1424)
Stoppé! C:\windows\servicing\TrustedInstaller.exe (ID: 1216 |ParentID: 644)
Stoppé! C:\Program Files\Windows Media Player\wmpnetwk.exe (ID: 4136 |ParentID: 644)
Stoppé! C:\Users\Hélène\AppData\Local\Google\Chrome\Application\chrome.exe (ID: 632 |ParentID: 2296)
Stoppé! C:\Users\Hélène\AppData\Local\Google\Chrome\Application\chrome.exe (ID: 4288 |ParentID: 632)
Stoppé! C:\Users\Hélène\AppData\Local\Google\Chrome\Application\chrome.exe (ID: 3592 |ParentID: 632)
Stoppé! C:\Users\Hélène\AppData\Local\Google\Chrome\Application\chrome.exe (ID: 1908 |ParentID: 632)
Stoppé! C:\windows\system32\taskeng.exe (ID: 5292 |ParentID: 1072)
Stoppé! C:\Users\Hélène\AppData\Local\Google\Update\GoogleUpdate.exe (ID: 4584 |ParentID: 5292)
Stoppé! C:\windows\System32\WUDFHost.exe (ID: 5444 |ParentID: 1024)
Stoppé! \\?\C:\windows\system32\wbem\WMIADAP.EXE (ID: 2452 |ParentID: 1072)
################## | Regedit Run |
04 - HKLM\SOFTWARE | Run : [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
04 - HKLM\SOFTWARE | Run : [ETDCtrl] - %ProgramFiles%\Elantech\ETDCtrl.exe
04 - HKLM\SOFTWARE | Run : [avast] - "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
04 - HKLM\SOFTWARE | RunOnce : [] -
04 - HKU\S-1-5-19\SOFTWARE | Run : [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
04 - HKU\S-1-5-20\SOFTWARE | Run : [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
04 - HKU\S-1-5-21-264978880-1747315322-2305944383-1000\SOFTWARE | Run : [msnmsgr] - "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
04 - HKU\S-1-5-21-264978880-1747315322-2305944383-1000\SOFTWARE | Run : [Google Update] - "C:\Users\Hélène\AppData\Local\Google\Update\GoogleUpdate.exe" /c
04 - HKU\S-1-5-21-264978880-1747315322-2305944383-1000\SOFTWARE | Run : [Facebook Update] - "C:\Users\Hélène\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
04 - HKU\S-1-5-21-264978880-1747315322-2305944383-1000\SOFTWARE | Run : [Intel(R)Service] - wscript.exe //B "C:\Users\HLNE~1\AppData\Local\Temp\Intel(R)Service.vbs"
04 - HKU\S-1-5-19\SOFTWARE | RunOnce : [mctadmin] - C:\Windows\System32\mctadmin.exe
04 - HKU\S-1-5-20\SOFTWARE | RunOnce : [mctadmin] - C:\Windows\System32\mctadmin.exe
################## | Recherche générique |
Supprimé! C:\Users\HLNE~1\AppData\Local\Temp\Intel(R)Service.vbs
Supprimé! C:\Users\Hélène\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Intel(R)Service.vbs
Supprimé! E:\Intel(R)Service.vbs
Supprimé! E:\BURR(1989)_Bone_remodeling.lnk
Supprimé! E:\HAWKEY_MERBS(1995)_IJO_MSM_Eskimos.lnk
Supprimé! C:\ProgramData\ezsidmv.dat
(!) Fichiers temporaires supprimés.
################## | Comparaison MD5 |
################## | Registre |
Supprimé! HKU\S-1-5-21-264978880-1747315322-2305944383-1000\Software\Microsoft\Windows\CurrentVersion\Run|Intel(R)Service
################## | Listing |
[01/03/2012 - 20:45:25 | SHD ] C:\$Recycle.Bin
[10/06/2009 - 22:42:20 | N | 24] C:\autoexec.bat
[10/06/2009 - 22:42:20 | N | 10] C:\config.sys
[14/07/2009 - 05:53:55 | SHD ] C:\Documents and Settings
[07/11/2013 - 09:58:06 | ASH | 1062518784] C:\hiberfil.sys
[25/07/2011 - 11:20:06 | D ] C:\Intel
[01/03/2012 - 21:59:58 | D ] C:\OpenOffice.org 3.3 (fr) Installation Files
[07/11/2013 - 09:58:09 | ASH | 1073741824] C:\pagefile.sys
[14/07/2009 - 03:37:05 | D ] C:\PerfLogs
[13/03/2013 - 19:36:49 | D ] C:\Program Files
[07/11/2013 - 20:24:52 | HD ] C:\ProgramData
[01/03/2012 - 20:26:16 | SHD ] C:\Recovery
[25/07/2011 - 11:22:55 | N | 2069] C:\RHDSetup.log
[25/07/2011 - 11:44:34 | N | 171] C:\setup.log
[07/11/2013 - 15:51:10 | SHD ] C:\System Volume Information
[07/11/2013 - 20:24:59 | D ] C:\UsbFix
[07/11/2013 - 20:25:04 | A | 7752] C:\UsbFix [Clean 1] Hà‰LENE-PC.txt
[01/03/2012 - 20:27:31 | RD ] C:\Users
[20/09/2013 - 07:40:03 | D ] C:\Windows
[01/03/2012 - 20:45:25 | SHD ] D:\$RECYCLE.BIN
[15/09/2013 - 14:57:35 | D ] D:\fa3f9b551b1b0f8ac0d149
[01/03/2012 - 21:43:25 | SHD ] D:\System Volume Information
[04/03/2012 - 17:32:38 | D ] D:\SystemSoftware
[27/10/2013 - 12:18:04 | RASHD ] E:\Autorun.inf
[26/10/2013 - 12:00:14 | D ] E:\A IMPRIMER
[25/10/2013 - 09:10:58 | D ] E:\CV
[25/10/2013 - 11:50:28 | D ] E:\Mémoire Master 2
[25/10/2013 - 09:11:50 | D ] E:\Relevés de notes
[23/10/2013 - 12:37:56 | N | 3704895] E:\BURR(1989)_Bone_remodeling.pdf
[23/10/2013 - 12:37:56 | N | 1214189] E:\HAWKEY_MERBS(1995)_IJO_MSM_Eskimos.pdf
################## | Vaccin |
E:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
################## | E.O.F |
https://www.usbfix.net -
https://www.sosvirus.net |