Re
Merci pour ta recherche

j'ai réglé le prob directement dans les options du portable!
Je te post la recherche de usbfix (au cas ou)
############################## | UsbFix V 7.126 | [Recherche]
Utilisateur: roxanne (Administrateur) # ROXANNE-PC
Mis à jour le 13/05/2013 par El Desaparecido
Lancé à 15:33:01 | 28/05/2013
Site Web:
https://sosvirus.org/
Upload Malware:
https://upload.sosvirus.org/
Contact:
contact@sosvirus.org
PC: HP-Pavilion (WC963AA-ABF p6355fr) (x64-based PC)
CPU: Intel(R) Core(TM) i3 CPU 530 @ 2.93GHz (2933)
RAM -> [Total : 6071 | Free : 4025]
BIOS: 12/21/09 17:01:03 Ver: 5.07
BOOT: Normal boot
OS: Microsoft Windows 7 à‰dition Familiale Premium (6.1.7601 64-Bit) # Service Pack 1
WB: Windows Internet Explorer 10.0.9200.16576
SC: Security Center Service [Enabled]
WU: Windows Update Service [Enabled]
AV: Avira Desktop [Enabled | Updated]
FW: Windows FireWall Service [Enabled]
C:\ (%systemdrive%) -> Disque fixe # 919 Go (773 Go libre(s) - 84%) [HP] # NTFS
D:\ -> Disque fixe # 13 Go (2 Go libre(s) - 14%) [FACTORY_IMAGE] # NTFS
E:\ -> CD-ROM
J:\ -> Disque amovible # 2 Go (2 Go libre(s) - 87%) [BLACKBERRY] # FAT
################## | Processus Actif |
C:\Windows\system32\csrss.exe (460)
C:\Windows\system32\wininit.exe (528)
C:\Windows\system32\csrss.exe (552)
C:\Windows\system32\services.exe (584)
C:\Windows\system32\lsass.exe (608)
C:\Windows\system32\lsm.exe (616)
C:\Windows\system32\winlogon.exe (680)
C:\Windows\system32\svchost.exe (776)
C:\Windows\system32\svchost.exe (864)
C:\Windows\system32\atiesrxx.exe (928)
C:\Windows\System32\svchost.exe (988)
C:\Windows\System32\svchost.exe (1020)
C:\Windows\system32\svchost.exe (348)
C:\Windows\system32\svchost.exe (436)
C:\Windows\system32\svchost.exe (1100)
C:\Windows\System32\spoolsv.exe (1216)
C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (1256)
C:\Windows\system32\atieclxx.exe (1304)
C:\Windows\system32\svchost.exe (1384)
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (1516)
C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (1596)
C:\Windows\system32\taskhost.exe (1648)
C:\Windows\system32\Dwm.exe (1748)
C:\Program Files (x86)\Bonjour\mDNSResponder.exe (1832)
C:\Windows\Explorer.EXE (1840)
C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE (1888)
C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE (1948)
C:\Windows\SysWOW64\svchost.exe (1976)
C:\Windows\system32\svchost.exe (2004)
c:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe (1056)
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (1484)
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (1552)
C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (1672)
C:\Windows\system32\svchost.exe (2088)
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (2136)
C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe (2156)
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (2184)
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (2232)
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (2256)
C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesApp64.exe (2848)
C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (2304)
C:\Windows\system32\svchost.exe (2908)
C:\Windows\System32\WUDFHost.exe (1816)
C:\Windows\system32\taskeng.exe (3092)
c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe (3288)
C:\Program Files\Microsoft IntelliType Pro\itype.exe (3652)
C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe (3840)
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (3108)
C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (3244)
C:\Windows\system32\SearchIndexer.exe (3540)
C:\Program Files\Windows Media Player\wmpnetwk.exe (2312)
C:\Windows\System32\svchost.exe (3700)
C:\Windows\system32\DllHost.exe (2552)
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (3448)
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (3468)
C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe (3912)
C:\Windows\System32\svchost.exe (3824)
C:\Program Files (x86)\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe (4508)
C:\Windows\servicing\TrustedInstaller.exe (4520)
C:\Program Files (x86)\Mozilla Firefox\firefox.exe (3124)
C:\UsbFix\Go.exe (1736)
C:\Windows\system32\wbem\wmiprvse.exe (4512)
################## | El Desaparecido Section |
HKLM\SOFTWARE | Run : [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
HKLM\SOFTWARE | Run : [StartCCC] - "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
HKLM\SOFTWARE | Run : [avgnt] - "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
HKLM\SOFTWARE | Run : [BlackBerryAutoUpdate] - C:\Program Files (x86)\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe /background
HKLM\SOFTWARE\wow6432Node | Run : [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
HKLM\SOFTWARE\wow6432Node | Run : [StartCCC] - "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
HKLM\SOFTWARE\wow6432Node | Run : [avgnt] - "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
HKLM\SOFTWARE\wow6432Node | Run : [BlackBerryAutoUpdate] - C:\Program Files (x86)\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe /background
HKLM\SOFTWARE | RunOnce : [] -
HKLM\SOFTWARE\wow6432Node | RunOnce : [] -
HKU\S-1-5-19\SOFTWARE | Run : [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-20\SOFTWARE | Run : [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-19\SOFTWARE | RunOnce : [mctadmin] - C:\Windows\System32\mctadmin.exe
HKU\S-1-5-20\SOFTWARE | RunOnce : [mctadmin] - C:\Windows\System32\mctadmin.exe
################## | à‰léments infectieux |
Présent! J:\._.Trashes.lnk
Présent! J:\.DS_Store.lnk
Présent! J:\BlackBerry.lnk
Présent! J:\.Trashes.lnk
Présent! J:\Facebook.vbs
################## | Registre |
################## | Mountpoints2 |
################## | Vaccin |
C:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
D:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
################## | E.O.F |
https://sosvirus.org |
et la suppression que j'ai effectué en mode sans échec :
############################## | UsbFix V 7.126 | [Suppression]
Utilisateur: roxanne (Administrateur) # ROXANNE-PC
Mis à jour le 13/05/2013 par El Desaparecido
Lancé à 15:40:15 | 28/05/2013
Site Web:
https://sosvirus.org/
Upload Malware:
https://upload.sosvirus.org/
Contact:
contact@sosvirus.org
PC: HP-Pavilion (WC963AA-ABF p6355fr) (x64-based PC)
CPU: Intel(R) Core(TM) i3 CPU 530 @ 2.93GHz (2926)
RAM -> [Total : 6071 | Free : 4900]
BIOS: 12/21/09 17:01:03 Ver: 5.07
BOOT: Fail-safe with network boot
OS: Microsoft Windows 7 à‰dition Familiale Premium (6.1.7601 64-Bit) # Service Pack 1
WB: Windows Internet Explorer 10.0.9200.16576
SC: Security Center Service [Enabled]
WU: Windows Update Service [Enabled]
AV: Avira Desktop [Enabled | Updated]
FW: Windows FireWall Service [Enabled]
C:\ (%systemdrive%) -> Disque fixe # 919 Go (774 Go libre(s) - 84%) [HP] # NTFS
D:\ -> Disque fixe # 13 Go (2 Go libre(s) - 14%) [FACTORY_IMAGE] # NTFS
E:\ -> CD-ROM
J:\ -> Disque amovible # 2 Go (2 Go libre(s) - 87%) [BLACKBERRY] # FAT
################## | El Desaparecido Section |
HKLM\SOFTWARE | Run : [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
HKLM\SOFTWARE | Run : [StartCCC] - "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
HKLM\SOFTWARE | Run : [avgnt] - "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
HKLM\SOFTWARE | Run : [BlackBerryAutoUpdate] - C:\Program Files (x86)\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe /background
HKLM\SOFTWARE\wow6432Node | Run : [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
HKLM\SOFTWARE\wow6432Node | Run : [StartCCC] - "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
HKLM\SOFTWARE\wow6432Node | Run : [avgnt] - "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
HKLM\SOFTWARE\wow6432Node | Run : [BlackBerryAutoUpdate] - C:\Program Files (x86)\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe /background
HKLM\SOFTWARE | RunOnce : [] -
HKLM\SOFTWARE\wow6432Node | RunOnce : [] -
HKU\S-1-5-19\SOFTWARE | Run : [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-20\SOFTWARE | Run : [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-19\SOFTWARE | RunOnce : [mctadmin] - C:\Windows\System32\mctadmin.exe
HKU\S-1-5-20\SOFTWARE | RunOnce : [mctadmin] - C:\Windows\System32\mctadmin.exe
################## | Processus Stoppés |
Stoppé! C:\Windows\Explorer.EXE (1328)
Stoppé! C:\Windows\system32\ctfmon.exe (1404)
Stoppé! C:\Windows\helppane.exe (1572)
Stoppé! C:\Windows\system32\DllHost.exe (1872)
################## | à‰léments infectieux |
(!) Fichiers temporaires supprimés.
################## | Registre |
################## | Mountpoints2 |
################## | Listing |
[22/09/2010 - 16:32:58 | SHD ] C:\$Recycle.Bin
[20/09/2010 - 21:39:00 | D ] C:\alaplaya
[26/05/2013 - 15:30:48 | RASHD ] C:\Autorun.inf
[27/03/2012 - 11:18:06 | D ] C:\c2a27cc0728fc402c5ec34
[28/05/2013 - 11:31:06 | N | 2633] C:\DelFix.txt
[14/07/2009 - 07:08:56 | SHD ] C:\Documents and Settings
[07/11/2007 - 08:00:40 | N | 17734] C:\eula.1028.txt
[07/11/2007 - 08:00:40 | N | 17734] C:\eula.1031.txt
[07/11/2007 - 08:00:40 | N | 10134] C:\eula.1033.txt
[16/01/2008 - 13:48:06 | N | 12246] C:\eula.1036.txt
[07/11/2007 - 08:00:40 | N | 17734] C:\eula.1040.txt
[07/11/2007 - 08:00:40 | N | 118] C:\eula.1041.txt
[07/11/2007 - 08:00:40 | N | 17734] C:\eula.1042.txt
[07/11/2007 - 08:00:40 | N | 17734] C:\eula.2052.txt
[07/11/2007 - 08:00:40 | N | 17734] C:\eula.3082.txt
[27/09/2010 - 14:40:25 | N | 125] C:\FINIS_IT.TXT
[07/11/2007 - 08:00:40 | N | 1110] C:\globdata.ini
[28/05/2013 - 15:37:33 | ASH | 4774490112] C:\hiberfil.sys
[30/04/2011 - 10:02:22 | D ] C:\hp
[07/11/2007 - 08:00:40 | N | 843] C:\install.ini
[07/11/2007 - 08:44:20 | N | 75280] C:\install.res.1028.dll
[07/11/2007 - 08:44:20 | N | 95248] C:\install.res.1031.dll
[07/11/2007 - 08:44:20 | N | 90128] C:\install.res.1033.dll
[07/11/2007 - 08:44:20 | N | 96272] C:\install.res.1036.dll
[07/11/2007 - 08:44:20 | N | 94224] C:\install.res.1040.dll
[07/11/2007 - 08:44:20 | N | 80400] C:\install.res.1041.dll
[07/11/2007 - 08:44:20 | N | 78864] C:\install.res.1042.dll
[07/11/2007 - 08:44:20 | N | 74768] C:\install.res.2052.dll
[07/11/2007 - 08:44:20 | N | 95248] C:\install.res.3082.dll
[02/12/2006 - 00:37:14 | N | 904704] C:\msdia80.dll
[18/09/2010 - 22:18:08 | RHD ] C:\MSOCache
[28/05/2013 - 15:37:35 | ASH | 6365986816] C:\pagefile.sys
[14/07/2009 - 05:20:08 | D ] C:\PerfLogs
[04/08/2012 - 11:06:27 | D ] C:\Philips
[21/01/2013 - 23:31:37 | D ] C:\Program Files
[28/05/2013 - 11:29:32 | D ] C:\Program Files (x86)
[28/05/2013 - 15:19:48 | HD ] C:\ProgramData
[28/05/2013 - 15:19:25 | SHD ] C:\System Volume Information
[28/05/2013 - 15:43:48 | D ] C:\UsbFix
[28/05/2013 - 15:43:56 | A | 5076] C:\UsbFix [Clean 1] ROXANNE-PC.txt
[28/05/2013 - 12:45:40 | N | 6203] C:\UsbFix [Scan 1] ROXANNE-PC.txt
[28/05/2013 - 12:54:46 | N | 6086] C:\UsbFix [Scan 2] ROXANNE-PC.txt
[28/05/2013 - 12:57:01 | N | 6085] C:\UsbFix [Scan 3] ROXANNE-PC.txt
[28/05/2013 - 15:25:31 | N | 6381] C:\UsbFix [Scan 4] ROXANNE-PC.txt
[28/05/2013 - 15:34:20 | N | 6407] C:\UsbFix [Scan 5] ROXANNE-PC.txt
[18/09/2010 - 21:40:14 | D ] C:\Users
[07/11/2007 - 08:00:40 | N | 5686] C:\vcredist.bmp
[16/01/2008 - 13:58:54 | N | 1442522] C:\VC_RED.cab
[16/01/2008 - 14:00:56 | N | 233984] C:\VC_RED.MSI
[28/05/2013 - 15:37:33 | D ] C:\Windows
[18/09/2010 - 21:47:27 | SHD ] D:\$RECYCLE.BIN
[26/05/2013 - 15:30:48 | RASHD ] D:\Autorun.inf
[18/09/2010 - 21:47:24 | SHD ] D:\boot
[13/07/2009 - 19:39:00 | ASH | 383562] D:\bootmgr
[18/09/2010 - 21:47:22 | N | 0] D:\BT_HP.FLG
[06/01/2010 - 20:56:30 | N | 485] D:\CSP.DAT
[06/01/2010 - 21:18:25 | N | 15537] D:\DeployRp.log
[18/09/2010 - 21:47:24 | D ] D:\hp
[18/09/2010 - 21:47:22 | N | 22] D:\language.ini
[18/09/2010 - 21:47:24 | SHD ] D:\preload
[18/09/2010 - 21:47:24 | SD ] D:\Recovery
[06/01/2010 - 21:18:24 | N | 0] D:\RPCONFIG.LOG
[06/02/2010 - 15:32:23 | SHD ] D:\System Volume Information
################## | Vaccin |
C:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
D:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
################## | E.O.F |
https://sosvirus.org |
Je n'ai pas l'impression qu'il a supprimé facebook.vbs.. mais je me trompe peut être