Dépannage Informatique clé usb infectée par virus créant des raccourcis

Dépannage Informatique : clé usb infectée par virus créant des raccourcis

Auteur
Messages
bunchie93
14 septembre 2014 à 21 h 11 min
Nombre d'articles : 0
#163888
Bonsoir,
Ma clé usb a été infectée sur les ordinateurs à mon travail et des fichiers et dossiers ont été transformés en raccourcis et quand je mets la clé sur mon ordi, AVG me signale des virus et ne me propose que la suppression alors que j’ai besoin de ces fichiers.
J’ai utilisé usb fix mais un seul fichier a été détecté alors qu’il y en a plusieurs.
Rapport d’Usb fix
[spoiler:3i28tx27]############################## | UsbFix V 7.182 | [Recherche]
Utilisateur: ismail1973 (Administrateur) # SAMSUNG
Mis à jour le 14/09/2014 par El Desaparecido – SosVirus
Lancé à 21:32:48 | 14/09/2014
Site Web : http://www.usbfix.net/
Changelog : http://www.usbfix.net/maj/
Assistance : https://www.sosvirus.net/aide-nettoyage-pc/
Upload Malware : https://www.sosvirus.net/upload_malware.php
Détection en Live : http://comment-supprimer.fr/
Contact : http://www.usbfix.net/contact/
################## | System information |
MB: SAMSUNG ELECTRONICS CO., LTD. (RV410/RV510/S3510/E3510)
CPU: Celeron(R) Dual-Core CPU T3500 @ 2.10GHz
GC: Mobile Intel(R) 4 Series Express Chipset Family
RAM -> [Total : 2009 Mo | Free : 442 Mo]
Bios: Phoenix Technologies Ltd.
Boot: Normal boot
OS: Microsoft™ Windows 7 Home Premium (6.1.7601 64-Bit) Service Pack 1
WB: Internet Explorer : 9.00.8112.16450
WB: Google Chrome : 37.0.2062.120
################## | Security Information |
AV: AVG Internet Security 2014 [Actif |A jour]
AS: Windows Defender [(!) Désactivé |A jour]
AS: AVG Internet Security 2014 [Actif |A jour]
FW: AVG Internet Security 2014 [Actif]
AS: Malwarebytes Anti-Malware : 2.0.2.1012
FW: Windows Firewall [Actif]
SC: Security Center [Actif]
WU: Windows Update [Actif]
################## | Disk Information |
C: (%SystemDrive%) -> Disque fixe # 279 Go (136 Go libre(s) – 49%) [compresser] # NTFS
G: -> Disque amovible # 15 Go (12 Go libre(s) – 80%) [] # FAT32
################## | Regedit Run |
F2 – HKLM..Winlogon : [Shell] explorer.exe
F2 – [x64] HKLM..Winlogon : [Shell] explorer.exe
F2 – HKLM..Winlogon : [Userinit] userinit.exe
F2 – [x64] HKLM..Winlogon : [Userinit] C:Windowssystem32userinit.exe,
04 – HKCU..Run : [cacaoweb] “C:Usersismail1973AppDataRoamingcacaowebcacaoweb.exe” -noplayer
04 – HKLM..Run : [Adobe ARM] “C:Program Files (x86)Common FilesAdobeARM1.0AdobeARM.exe”
04 – HKLM..Run : [HP Software Update] C:Program Files (x86)HPHP Software UpdateHPWuSchd2.exe
04 – HKLM..Run : [EaseUS EPM tray] C:Program Files (x86)EaseUSEaseUS Partition Master 9.2.2binEpmNews.exe
04 – HKLM..Run : [mobilegeni daemon] C:Program Files (x86)MobogenieDaemonProcess.exe
04 – HKLM..Run : [Microsoft Default Manager] “C:Program Files (x86)MicrosoftSearch Enhancement PackDefault ManagerDefMgr.exe” -resume
04 – HKLM..Run : [UCam_Menu] “C:Program Files (x86)CyberLinkYouCamMUITransferMUIStartMenu.exe” “C:Program Files (x86)CyberLinkYouCam” UpdateWithCreateOnce “SoftwareCyberLinkYouCam2.0”
04 – HKLM..Run : [AVG_UI] “C:Program Files (x86)AVGAVG2014avgui.exe” /TRAYONLY
04 – HKLM..Run : [hpqSRMon] C:Program Files (x86)HPDigital ImagingbinhpqSRMon.exe
04 – HKLM..Run : [SunJavaUpdateSched] “C:Program Files (x86)Common FilesJavaJava Updatejusched.exe”
04 – [x64] HKLM..Run : [RtHDVCpl] C:Program FilesRealtekAudioHDARAVCpl64.exe -s
04 – [x64] HKLM..Run : [IgfxTray] C:Windowssystem32igfxtray.exe
04 – [x64] HKLM..Run : [HotKeysCmds] C:Windowssystem32hkcmd.exe
04 – [x64] HKLM..Run : [Persistence] C:Windowssystem32igfxpers.exe
04 – HKUS-1-5-19..Run : [Sidebar] %ProgramFiles%Windows SidebarSidebar.exe /autoRun
04 – HKUS-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0..Run : [Sidebar] %ProgramFiles%Windows SidebarSidebar.exe /autoRun
04 – HKUS-1-5-20..Run : [Sidebar] %ProgramFiles%Windows SidebarSidebar.exe /autoRun
04 – HKUS-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0..Run : [Sidebar] %ProgramFiles%Windows SidebarSidebar.exe /autoRun
04 – HKUS-1-5-21-2052373595-2782729040-2076756327-1000..Run : [cacaoweb] “C:Usersismail1973AppDataRoamingcacaowebcacaoweb.exe” -noplayer
04 – HKUS-1-5-21-2052373595-2782729040-2076756327-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0..Run : [cacaoweb] “C:Usersismail1973AppDataRoamingcacaowebcacaoweb.exe” -noplayer
04 – HKUS-1-5-19..RunOnce : [mctadmin] C:WindowsSystem32mctadmin.exe
04 – HKUS-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0..RunOnce : [mctadmin] C:WindowsSystem32mctadmin.exe
04 – HKUS-1-5-20..RunOnce : [mctadmin] C:WindowsSystem32mctadmin.exe
04 – HKUS-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0..RunOnce : [mctadmin] C:WindowsSystem32mctadmin.exe
################## | Recherche générique |
################## | Registre |
################## | UsbFix – Information |
Info : Comment supprimer l'infection des raccourcis sur USB ? (Video)
Info : L'infection des raccourcis USB, c'est quoi ?
################## | Hijack |
################## | E.O.F | https://www.sosvirus.net/ | http://www.usbfix.net/ |[/spoiler:3i28tx27]
Rapport de ZHPDiag
[spoiler:3i28tx27]~ Rapport de ZHPDiag v2014.8.28.125 – Nicolas Coolman (28/08/2014)
~ Lancé par ismail1973 (14/09/2014 22:19:05)
~ Adresse du Site Web http://nicolascoolman.fr” onclick=”window.open(this.href);return false;
~ Adresse du Forum http://forum.nicolascoolman.fr” onclick=”window.open(this.href);return false;
~ Traduit par Nicolas Coolman
~ Etat de la version :
~ Liste blanche : Activée par le programme
~ Elévation des Privilèges : OK
~ User Account Control (UAC):
—\ Navigateurs Internet
MSIE: Internet Explorer v9.0.8112.16421
GCIE: Google Chrome v37.0.2062.120 (Defaut)
—\ Informations sur les produits Windows
~ Langage: Français
Windows 7 Home Premium, 64-bit Service Pack 1 (Build 7601)
Windows Server License Manager Script : OK
~ Windows Operating System – Windows(R) 7, OEM_SLP channel
System Locked Preinstallation (OEM_SLP) : OK
Windows ID Activation : OK
~ Windows Partial Key : 2BT4J
Windows License : OK
~ Windows Remaining Initializations Number : 4
Software Protection Service (Protection logicielle) : OK
Windows Automatic Updates : OK
Windows Activation Technologies : OK
—\ Logiciels de protection du système
AVG 2014 v14.0.4015
Malwarebytes Anti-Malware version 2.0.2.1012
Windows Defender W7 (Deactivate)
—\ Logiciels d'optimisation du système
—\ Logiciels de partage PeerToPeer
—\ Surveillance de Logiciels
Adobe Flash Player 15 Plugin
Adobe Reader XI
—\ Informations sur le système
~ Processor: Intel64 Family 6 Model 23 Stepping 10, GenuineIntel
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 2008 MB (34% free)
System Restore: Activé (Enable)
System drive C: has 136 GB (48%) free of 279 GB
—\ Mode de connexion au système
~ Computer Name: SAMSUNG
~ User Name: ismail1973
~ All Users Names: ismail1973, HomeGroupUser$, Administrateur,
~ Unselected Option: None
Logged in as Administrator
—\ Variables d'environnement
~ System Unit : C:
~ %AppZHP% : C:Usersismail1973AppDataRoamingZHP
~ %AppData% : C:Usersismail1973AppDataRoaming
~ %Desktop% : C:Usersismail1973Desktop
~ %Favorites% : C:Usersismail1973Favorites
~ %LocalAppData% : C:Usersismail1973AppDataLocal
~ %StartMenu% : C:Usersismail1973AppDataRoamingMicrosoftWindowsStart Menu
~ %Windir% : C:Windows
~ %System% : C:WindowsSystem32
—\ Enumération des unités disques
C: Hard drive, Flash drive, Thumb drive (Free 136 Go of 279 Go)
E: CD-ROM drive (Not Inserted)
G: Floppy drive, Flash card reader, USB Key (Free 12 Go of 15 Go)
Q: Hard drive, Flash drive, Thumb drive (Free 0 Go of 0 Go)
—\ Etat du Centre de Sécurité Windows
[HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer] NoActiveDesktopChanges: Modified
~ Security Center: 41 Legitimates Filtered in 00mn 00s
—\ Recherche particulière de fichiers génériques
[MD5.332FEAB1435662FC6C672E25BEB37BE3] – (.Microsoft Corporation – Explorateur Windows.) (.25/02/2011 – 07:19:30.) — C:WindowsExplorer.exe [2871808]
[MD5.94355C28C1970635A31B3FE52EB7CEBA] – (.Microsoft Corporation – Application de démarrage de Windows.) (.14/07/2009 – 02:39:52.) — C:WindowsSystem32Wininit.exe [129024]
[MD5.3D165C53E40236A68B7102D1A622D4E0] – (.Microsoft Corporation – Internet Extensions for Win32.) (.24/08/2012 – 11:21:18.) — C:WindowsSystem32wininet.dll [1392128]
[MD5.88AB9B72B4BF3963A0DE0820B4B0B06C] – (.Microsoft Corporation – Application d’ouverture de session Windows.) (.15/05/2014 – 02:31:37.) — C:WindowsSystem32Winlogon.exe [455168]
[MD5.067FA52BFB59A56110A12312EF9AF243] – (.Microsoft Corporation – Bibliothèque de licences.) (.20/11/2010 – 14:27:26.) — C:WindowsSystem32sppcomapi.dll [232448]
[MD5.FA886682CFC5D36718D3E436AACF10B9] – (.Microsoft Corporation – Ancillary Function Driver for WinSock.) (.24/07/2014 – 14:46:08.) — C:Windowssystem32DriversAFD.sys [497152]
[MD5.02062C0B390B7729EDC9E69C680A6F3C] – (.Microsoft Corporation – ATAPI IDE Miniport Driver.) (.14/07/2009 – 02:52:21.) — C:Windowssystem32Driversatapi.sys [24128]
[MD5.B8BD2BB284668C84865658C77574381A] – (.Microsoft Corporation – CD-ROM File System Driver.) (.14/07/2009 – 00:19:47.) — C:Windowssystem32DriversCdfs.sys [92160]
[MD5.F036CE71586E93D94DAB220D7BDF4416] – (.Microsoft Corporation – SCSI CD-ROM Driver.) (.20/11/2010 – 10:19:21.) — C:Windowssystem32DriversCdrom.sys [147456]
[MD5.9BB2EF44EAA163B29C4A4587887A0FE4] – (.Microsoft Corporation – DFS Namespace Client Driver.) (.20/11/2010 – 10:26:32.) — C:Windowssystem32DriversDfsC.sys [102400]
[MD5.97BFED39B6B79EB12CDDBFEED51F56BB] – (.Microsoft Corporation – High Definition Audio Bus Driver.) (.20/11/2010 – 11:43:43.) — C:Windowssystem32DriversHDAudBus.sys [122368]
[MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] – (.Microsoft Corporation – Pilote de port i8042.) (.14/07/2009 – 00:19:57.) — C:Windowssystem32Driversi8042prt.sys [105472]
[MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] – (.Microsoft Corporation – IP Network Address Translator.) (.14/07/2009 – 01:10:03.) — C:Windowssystem32DriversIpNat.sys [116224]
[MD5.A5D9106A73DC88564C825D317CAC68AC] – (.Microsoft Corporation – Windows NT SMB Minirdr.) (.27/04/2011 – 03:40:40.) — C:Windowssystem32DriversMRxSmb.sys [158208]
[MD5.09594D1089C523423B32A4229263F068] – (.Microsoft Corporation – MBT Transport driver.) (.20/11/2010 – 10:23:20.) — C:Windowssystem32DriversnetBT.sys [261632]
[MD5.1A29A59A4C5BA6F8C85062A613B7E2B2] – (.Microsoft Corporation – Pilote du système de fichiers NT.) (.11/04/2014 – 02:38:40.) — C:Windowssystem32Driversntfs.sys [1684928]
[MD5.0086431C29C35BE1DBC43F52CC273887] – (.Microsoft Corporation – Pilote de port parallèle.) (.14/07/2009 – 01:00:41.) — C:Windowssystem32DriversParport.sys [97280]
[MD5.471815800AE33E6F1C32FB1B97C490CA] – (.Microsoft Corporation – RAS L2TP mini-port/call-manager driver.) (.20/11/2010 – 11:52:35.) — C:Windowssystem32DriversRasl2tp.sys [129536]
[MD5.548260A7B8654E024DC30BF8A7C5BAA4] – (.Microsoft Corporation – SMB Transport driver.) (.14/07/2009 – 01:09:09.) — C:Windowssystem32Driverssmb.sys [93184]
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] – (.Microsoft Corporation – TDI Translation Driver.) (.20/11/2010 – 10:21:56.) — C:Windowssystem32Driverstdx.sys [119296]
[MD5.0D08D2F3B3FF84E433346669B5E0F639] – (.Microsoft Corporation – Pilote de cliché instantané du volume.) (.20/11/2010 – 14:34:02.) — C:Windowssystem32Driversvolsnap.sys [295808]
~ Generic Processes: Scanned in 00mn 00s
—\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 2/6889
~ Mes musiques (My Musics) : 1/188
~ Mes Videos (My Videos) : 2/36
~ Mes Favoris (My Favorites) : 1/48
~ Mes Documents (My Documents) : 3/3691
~ Mon Bureau (My Desktop) : 2/39
~ Menu demarrer (Programs) : 1/28
~ Hidden Files: Scanned in 00mn 02s
—\ Processus lancés
[MD5.B54921381A950C8215FB363B485C432B] – (.Hewlett-Packard Co. – HP Digital Imaging Monitor.) — C:Program Files (x86)HPDigital Imagingbinhpqtra08.exe [270336] [PID.2564]
[MD5.C637FC4638A96165256B28D38DE7B953] – (.Hewlett-Packard – hpwuSchd Application.) — C:Program Files (x86)HPHP Software Updatehpwuschd2.exe [49208] [PID.4204]
[MD5.4536D8FD8F0DDC38BAFD0575120C568F] – (.Samsung Electronics Co., Ltd. – Easy Display Manager.) — C:Program Files (x86)SamsungEasy Display Managerdmhkcore.exe [862064] [PID.4516]
[MD5.361B0893A5C6741F347568A3232D2822] – (.AVG Technologies CZ, s.r.o. – AVG User Interface.) — C:Program Files (x86)AVGAVG2014avgui.exe [5188112] [PID.4596]
[MD5.72860972F8196EBB3C896F53D2B95470] – (.Hewlett-Packard – HpqSRmon.) — C:Program Files (x86)HPDigital ImagingbinHpqSRmon.exe [150528] [PID.4608]
[MD5.308F2EE28005510DE616409148CF077B] – (.Oracle Corporation – Java(TM) Update Scheduler.) — C:Program Files (x86)Common FilesJavaJava Updatejusched.exe [256896] [PID.4616]
[MD5.F16EEA6CCA9D8A7D1193AE80E43FBBC7] – (.Hewlett-Packard Co. – HP CUE Status Root.) — C:Program Files (x86)HPDigital ImagingbinhpqSTE08.exe [168960] [PID.5004]
[MD5.8A9FACCB684500829F7D0BCC67B386CC] – (.Hewlett-Packard Co. – HP CUE Alert Popup Window Objects.) — C:Program Files (x86)HPDigital Imagingbinhpqbam08.exe [559104] [PID.5048]
[MD5.883008A9B5BFF94A153D99DBA54CB5C1] – (.Hewlett-Packard – GPCore COM object.) — C:Program Files (x86)HPDigital Imagingbinhpqgpc01.exe [362496] [PID.4100]
[MD5.AC08A03D7E579E2903925736E7AB48F2] – (.Google Inc. – Google Chrome.) — C:Program Files (x86)GoogleChromeApplicationchrome.exe [852808] [PID.644]
[MD5.2381AE1E0E72423C80B5B5E13B070074] – (.SEC – Samsung Recovery Solution 5.) — C:Program Files (x86)SamsungSamsung Recovery Solution 5WCScheduler.exe [4382312] [PID.5736]
[MD5.E71335321BC3C5C46B041F8C2063F17B] – (.SAMSUNG Electronics – SSCKbdHk.) — C:Program Files (x86)SamsungSamsung Support CenterSSCKbdHk.exe [3398736] [PID.3220]
[MD5.B8C44BF5A86B4662458F4AA8F901C94B] – (.Samsung Electronics – Samsung Update Plus Background.) — C:Program Files (x86)SamsungSamsung Update PlusSUPBackground.exe [2782064] [PID.892]
[MD5.33BF80A2291C54DC7D7601CDEF63138E] – (.Nicolas Coolman – ZHPDiag.) — C:Program Files (x86)ZHPDiagZHPDiag.exe [8099328] [PID.5408]
[MD5.B362181ED3771DC03B4141927C80F801] – (.Adobe Systems Incorporated – Adobe Acrobat Update Service.) — C:Program Files (x86)Common FilesAdobeARM1.0armsvc.exe [65432] [PID.1620]
[MD5.1E7B74C93D85B1BFE3A291D62DD4DB29] – (.AVG Technologies CZ, s.r.o. – AVG Firewall Service.) — C:Program Files (x86)AVGAVG2014avgfws.exe [1417160] [PID.1640]
[MD5.B6E2D865C5936A4FEE68F11E97DF6B82] – (.AVG Technologies CZ, s.r.o. – AVG Identity Protection Service.) — C:Program Files (x86)AVGAVG2014avgidsagent.exe [3242000] [PID.1684]
[MD5.D7CBEEA4500BFDC63E99B06A1C512BE8] – (.AVG Technologies CZ, s.r.o. – AVG Watchdog Service.) — C:Program Files (x86)AVGAVG2014avgwdsvc.exe [289328] [PID.1704]
[MD5.595F362A7C2F64304EFC77C72E7B9F84] – (.Hewlett-Packard Company – SolutionsFrameworkService.) — C:Program Files (x86)HpCommonHPSupportSolutionsFrameworkService.exe [78088] [PID.1880]
[MD5.397D14958D6C9C2B365469A857B2AC4E] – (.Google Inc. – Google Crash Handler.) — C:Program Files (x86)GoogleUpdate1.3.24.15GoogleCrashHandler.exe [230792] [PID.2648]
[MD5.39B1D0A636A400304565D4521FAD6D77] – (.Microsoft Corporation – Microsoft Application Virtualization Virtua.) — C:Program Files (x86)Microsoft Application Virtualization Clientsftvsa.exe [207528] [PID.2340]
[MD5.77C5A741A7452812F278EF2C18478862] – (.Microsoft Corporation – Microsoft Application Virtualization Client.) — C:Program Files (x86)Microsoft Application Virtualization Clientsftlist.exe [523944] [PID.3200]
[MD5.FD557A50A65E44041CD2FCEF4BEB04DB] – (.Microsoft Corporation – Microsoft Office Client Virtualization Serv.) — C:Program Files (x86)Common FilesMicrosoft SharedVirtualization HandlerCVHSVC.exe [822504] [PID.3340]
~ Processes Running: Scanned in 00mn 00s
—\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
C:Usersismail1973AppDataLocalGoogleChromeUser DataDefaultPreferences
G0 – GCSP: Preference [User DataDefault][HomePage] http://www.search.ask.com” onclick=”window.open(this.href);return false;
—\ Liste des dossiers d'extension Google Chrome
~ Google Lines Browser: 2 Legitimates Filtered in 00mn 59s
—\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
C:Usersismail1973AppDataRoamingMozillaFirefoxProfilesvjk6jvac.defaultprefs.js
P2 – FPN: [HKCU] [@lightspark.github.com/Lightspark;version=1] – (…) — C:Program Files (x86)Lightspark 0.5.3-gitnplightsparkplugin.dll (.not file.)
~ Firefox Browser: 4 Legitimates Filtered in 00mn 00s
—\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4)
R1 – HKLMSOFTWAREWow6432NodeMicrosoftInternet ExplorerAboutURLs,Tabs = about:newtab
~ IE Browser: 20 Legitimates Filtered in 00mn 00s
—\ Internet Explorer, Proxy Management (R5)
R5 – HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyServer = no key
R5 – HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyEnable = 0
R5 – HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,MigrateProxy = 1
R5 – HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,EnableHttp1_1 = 1
R5 – HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyHttp1.1 = 1
R5 – HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s
—\ Analyse des lignes F0, F1, F2, F3 – IniFiles, Autoloading programs
F2 – REG:system.ini: USERINIT=C:Windowssystem32userinit.exe,
F2 – REG:system.ini: Shell=C:Windowsexplorer.exe
F2 – REG:system.ini: VMApplet=C:WindowsSystem32SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s
—\ Hosts file redirection (O1)
~ Le fichier hôte est sain (The hosts file is clean) (50)
~ Hosts File: Scanned in 00mn 00s
—\ Browser Helper Objects de navigateur (O2)
O2 – BHO: W2PBrowser Browser Helper [64Bits] – {AA609D72-8482-4076-8991-8CDAE5B93BCB} . (…) — C:Program FilesSamsung AnyWeb PrintW2PBrowser.dll
O2 – BHO: HP Smart BHO Class [64Bits] – {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} Clé orpheline
~ BHO: 8 Legitimates Filtered in 00mn 04s
—\ Internet Explorer Toolbars (O3)
O3 – ToolbarWebBrowser: (no name) – [HKCU]{2318C2B1-4965-11D4-9B18-009027A5CD4F} Clé orpheline
~ Toolbar: Scanned in 00mn 00s
—\ Applications lancées au démarrage du système (O4)
O4 – HKLM..Run: [RtHDVCpl] . (.Realtek Semiconductor – Gestionnaire audio HD Realtek.) — C:Program FilesRealtekAudioHDARAVCpl64.exe =>.Realtek Semiconductor Corp
O4 – HKLM..Run: [IgfxTray] . (.Intel Corporation – igfxTray Module.) — C:Windowssystem32igfxtray.exe
O4 – HKLM..Run: [HotKeysCmds] . (.Intel Corporation – hkcmd Module.) — C:Windowssystem32hkcmd.exe
O4 – HKLM..Run: [Persistence] . (.Intel Corporation – persistence Module.) — C:Windowssystem32igfxpers.exe
O4 – HKLM..Wow6432NodeRun: [Adobe ARM] . (.Adobe Systems Incorporated – Adobe Reader and Acrobat Manager.) — C:Program Files (x86)Common FilesAdobeARM1.0AdobeARM.exe =>.Adobe Systems Incorporated
O4 – HKLM..Wow6432NodeRun: [HP Software Update] . (.Hewlett-Packard – hpwuSchd Application.) — C:Program Files (x86)HPHP Software UpdateHPWuSchd2.exe =>.Hewlett-Packard Co
O4 – HKLM..Wow6432NodeRun: [startertv_fr_5] C:Program Files (x86)HPHP Software UpdateHPWuSchd2.exe =>Adware.StarterTV
O4 – HKLM..Wow6432NodeRun: [tuto4pc_fr_46] C:Program Files (x86)HPHP Software UpdateHPWuSchd2.exe =>PUP.AgenceExclusive
O4 – HKLM..Wow6432NodeRun: [EaseUS EPM tray] C:Program Files (x86)EaseUSEaseUS Partition Master 9.2.2binEpmNews.exe (.not file.)
O4 – HKLM..Wow6432NodeRun: [Microsoft Default Manager] . (.Microsoft Corporation – Microsoft Default Manager.) — C:Program Files (x86)MicrosoftSearch Enhancement PackDefault ManagerDefMgr.exe =>.Microsoft Corporation
O4 – HKLM..Wow6432NodeRun: [UCam_Menu] . (.CyberLink Corp. – MUI StartMenu Application.) — C:Program Files (x86)CyberLinkYouCamMUITransferMUIStartMenu.exe
O4 – HKLM..Wow6432NodeRun: [AVG_UI] . (.AVG Technologies CZ, s.r.o. – AVG User Interface.) — C:Program Files (x86)AVGAVG2014avgui.exe
O4 – HKLM..Wow6432NodeRun: [hpqSRMon] . (.Hewlett-Packard – HpqSRmon.) — C:Program Files (x86)HPDigital ImagingbinhpqSRMon.exe
O4 – HKLM..Wow6432NodeRun: [SunJavaUpdateSched] . (.Oracle Corporation – Java(TM) Update Scheduler.) — C:Program Files (x86)Common FilesJavaJava Updatejusched.exe =>.Oracle Corporation
O4 – HKUSS-1-5-19..Run: [Sidebar] . (.Microsoft Corporation – Gadgets du Bureau Windows.) — C:Program Files (x86)Windows SidebarSidebar.exe =>.Microsoft Corporation
O4 – HKUSS-1-5-20..Run: [Sidebar] . (.Microsoft Corporation – Gadgets du Bureau Windows.) — C:Program Files (x86)Windows SidebarSidebar.exe =>.Microsoft Corporation
O4 – HKUSS-1-5-19..RunOnce: [mctadmin] . (.Microsoft Corporation – MCTAdmin.) — C:WindowsSystem32mctadmin.exe =>.Microsoft Corporation
O4 – HKUSS-1-5-20..RunOnce: [mctadmin] . (.Microsoft Corporation – MCTAdmin.) — C:WindowsSystem32mctadmin.exe =>.Microsoft Corporation
~ Application: Scanned in 00mn 04s
—\ Modification Domaine/Adresses DNS (O17)
O17 – HKLMSystemCCSServicesTcpip..{A1D16C5A-9975-4BF2-A2B7-6436FC618867}: DhcpNameServer = 192.168.0.254
O17 – HKLMSystemCS1ServicesTcpip..{A1D16C5A-9975-4BF2-A2B7-6436FC618867}: DhcpNameServer = 192.168.0.254
O17 – HKLMSystemCS2ServicesTcpip..{A1D16C5A-9975-4BF2-A2B7-6436FC618867}: DhcpNameServer = 192.168.0.254
O17 – HKLMSystemCCSServicesTcpipParameters: DhcpNameServer = 192.168.0.254
~ Domain: Scanned in 00mn 00s
—\ Protocole additionnel (O18)
O18 – Handler: wlpg [64Bits] – {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (…) —
O18 – Filter: application/x-msdownload [64Bits] – {1E66F26B-79EE-11D2-8710-00C04F79ED0D} . (.Microsoft Corporation – Microsoft .NET Runtime Execution Engine.) — C:WindowsSystem32mscoree.dll =>.Microsoft Corporation
~ Protocole Additionnel: Scanned in 00mn 00s
—\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 – Winlogon Notify: igfxcui . (.Intel Corporation – igfxdev Module.) — C:WindowsSystem32igfxdev.dll
~ Winlogon: Scanned in 00mn 00s
—\ Tâches planifiées en automatique (O39)
[MD5.00000000000000000000000000000000] [APT] [{44CE13CA-130A-4FCD-8A5A-B934D4F1E664}] (…) — C:Usersismail1973AppDataLocalTempTemp1_alphabet.exe.zipalphabet.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{4B8EEBEC-C8CA-4F03-8499-9D999133FDC1}] (…) — C:Program Files (x86)Free BeloteFreeBelote.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{5464E227-0BB2-4418-9878-2EA59257C652}] (…) — E:Setup.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{55585AB9-64B9-4D66-BC0B-75DDE544FAF5}] (…) — C:Program FilesBitdefenderBitdefender 2013seccenter.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{6D9CAC89-21A6-4185-9898-C1EF1A18E7F8}] (…) — C:Usersismail1973AppDataLocalTempShortcut_BundleSweetIMSetup-1-.exe (.not file.) [0] =>PUP.SweetIM
[MD5.00000000000000000000000000000000] [APT] [{9BA348C5-B355-4657-A711-944D5EAEEA91}] (…) — C:Program FilesBitdefenderBitdefender 2013seccenter.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{C2F89777-AF8C-4FE7-852D-AA64D03003BC}] (…) — C:Usersismail1973DesktopIE9-Windows7-x64-fra.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{C30ABA9E-AC0F-4A4B-919B-E99D980DD482}] (…) — C:Usersismail1973Downloadsoccupations_and_places (2).exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{DE45A7FD-0484-4019-8452-91AB0D47770B}] (…) — C:Program Files (x86)sweetpacks bundle uninstalleruninstaller.exe (.not file.) [0] =>PUP.SweetIM
[MD5.00000000000000000000000000000000] [APT] [{FA09C771-7CFB-4782-953C-86A06D80BBBF}] (…) — C:Usersismail1973AppDataLocalTempTemp1_alphabet.exe (.not file.) [0]
O39 – APT: – (..) — C:WindowsSystem32TasksAdobe Flash Player Updater [1002]
O39 – APT: – (..) — C:WindowsSystem32TasksGoogleUpdateTaskMachineCore [1072]
O39 – APT: – (..) — C:WindowsSystem32TasksGoogleUpdateTaskMachineUA [1076]
~ Scheduled Task: 35 Legitimates Filtered in 00mn 06s
—\ HKCU & HKLM Software Keys
[HKLMSoftwareWEDL] =>PUP.weDownloadManager
[HKLMSoftwareWow6432NodeSOSVirus]
[HKLMSoftwareWow6432NodeTUTO-4PC] =>PUP.AgenceExclusive
[HKLMSoftwareWow6432NodeWEDL] =>PUP.weDownloadManager
~ Key Software: 308 Legitimates Filtered in 00mn 01s
—\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 – CFD: 27/07/2013 – 03:21:13 – [0] —-D C:Program Files (x86)majtuto4pc_fr_a2 =>PUP.AgenceExclusive
O43 – CFD: 24/01/2013 – 20:37:53 – [] —-D C:ProgramDataboost_interprocess
O43 – CFD: 19/07/2013 – 19:46:07 – [] -SH-D C:ProgramData{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F}
O43 – CFD: 28/08/2014 – 15:18:59 – [0] —-D C:Usersismail1973AppDataRoamingT1F0D1F2W1G1I1F1T1Q
O43 – CFD: 24/03/2013 – 21:09:00 – [] —-D C:Usersismail1973AppDataRoaming{90140011-0066-040C-0000-0000000FF1CE}
O43 – CFD: 09/02/2013 – 01:37:59 – [] —-D C:Usersismail1973AppDataLocalblekkotb_001 =>Toolbar.Blekko
~ 2 Dossier CLSID vide (CLSID Empty Folder)
~ Program Folder: 209 Legitimates Filtered in 00mn 01s
—\ Enumération des clés de registre PoliciesSystem (MWPS) (O55)
O55 – MWPS:[HKLM…PoliciesSystem] – “EnableUIADesktopToggle”=0
O55 – MWPS:[HKLM…PoliciesSystem] – “FilterAdministratorToken”=0
~ MWPS: 16 Legitimates Filtered in 00mn 00s
—\ Enumération des clés de registre PoliciesExplorer (MWPE) (O56)
O56 – MWPE:[HKLM…policiesExplorer] – “NoActiveDesktopChanges”=1
~ MWPE Keys: 3 Legitimates Filtered in 00mn 00s
—\ Liste des pilotes du système (SDL) (O58)
O58 – SDL:05/08/2006 – 17:21:04 —A- . (.ALWIL Software – avast! Base Kernel-Mode Device Driver for Windows NT/2000/XP.) — C:WindowsSystem32Driversaavmker4.sys [24920]
O58 – SDL:05/08/2006 – 17:25:42 —A- . (.ALWIL Software – avast! File System Filter Driver for Windows XP.) — C:WindowsSystem32Driversaswmon2.sys [75608]
O58 – SDL:14/07/2009 – 02:47:48 —A- . (.Emulex – Storport Miniport Driver for LightPulse HBAs.) — C:WindowsSystem32Driverselxstor.sys [530496]
O58 – SDL:10/08/2010 – 03:01:56 —A- . (.ELAN Microelectronics Corp. – ETD Kernel Center.) — C:WindowsSystem32DriversETD.sys [111616]
O58 – SDL:10/06/2009 – 21:31:59 —A- . (.Hauppauge Computer Works, Inc. – Hauppauge WinTV 885 Consumer IR Driver for eHome.) — C:WindowsSystem32Drivershcw85cir.sys [31232]
O58 – SDL:29/05/2010 – 21:29:50 —A- . (.Windows (R) Codename Longhorn DDK provider – Universal Serial Bus Camera Driver.) — C:WindowsSystem32Driversjl2005c.sys [77992]
O58 – SDL:14/07/2009 – 02:45:55 —A- . (.Promise Technology – Promise SuperTrak EX Series Driver for Windows.) — C:WindowsSystem32Driversstexstor.sys [24656]
O58 – SDL:13/12/2012 – 12:50:36 —A- . (.Apple, Inc. – Apple Mobile Device USB Driver.) — C:WindowsSystem32Driversusbaapl64.sys [54784]
O58 – SDL:17/03/2011 – 02:12:51 —A- . (.Windows (R) 2003 DDK 3790 provider – Generic Port I/O for Win64.) — C:WindowsSysWOW64driversrtport.sys [15144]
~ Drivers: 72 Legitimates Filtered in 00mn 28s
—\ Derniers fichiers modifiés ou crées (Utilisateur) (O61)
O61 – LFC: 14/09/2014 – 22:23:19 —A- . (…) — C:Usersismail1973Desktopadwcleaner_3.310.exe [1373475]
~ 561 Fichiers temporaires (Temporary files)
~ 3 Fichiers cookies (Cookies files)
~ Files: 8 Legitimates Filtered in 01mn 33s
—\ Liste des outils de désinfection (LATC) (O63)
O63 – Logiciel: UsbFix – (.El Desaparecido – http://www.usbfix.net” onclick=”window.open(this.href);return false; – https://www.sosvirus.net.)” onclick=”window.open(this.href);return false; [HKLM] — Usbfix
O63 – Logiciel: ZHPDiag 2014 – (.Nicolas Coolman.) [HKLM] — ZHPDiag_is1 =>.Nicolas Coolman
~ ADS: Scanned in 00mn 00s
—\ Associations Shell Spawning (O67)
O67 – Shell Spawning: < .html> [HKCU..openCommand] (.Not Key.)
~ FASS Keys: 11 Legitimates Filtered in 00mn 00s
—\ Menu de démarrage Internet (SMI) (O68)
O68 – StartMenuInternet: [HKLM..ShellopenCommand] (.Google Inc. – Google Chrome.) — C:Program Files (x86)GoogleChromeApplicationchrome.exe
O68 – StartMenuInternet: [HKLM..ShellopenCommand] (.Microsoft Corporation – Internet Explorer.) — C:Program Files (x86)Internet Exploreriexplore.exe
~ Keys: Scanned in 00mn 00s
—\ Recherche d'infection sur les navigateurs internet (SBI) (O69)
O69 – SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} – (Bing) – http://www.bing.com” onclick=”window.open(this.href);return false;
~ Keys: Scanned in 00mn 00s
—\ Recherche particulière à la racine du système (SPRF) (O84)
[MD5.679EE05CFC4E4B05DF55E572CE04F621] [SPRF][26/07/2013] (…) — C:ProgramData1374801838.bdinstall.bin [590212]
[MD5.325EC1EE688519C58E55B5D92772A8D6] [SPRF][26/07/2013] (…) — C:ProgramData1374803035.bdinstall.bin [383766]
[MD5.89EC4C16A27E08EDA6DD35FA7E83412B] [SPRF][26/07/2013] (…) — C:ProgramData1374803161.bdinstall.bin [57815]
[MD5.DCCABBEBD6B0790F8891F343C82F32CD] [SPRF][26/07/2013] (…) — C:ProgramData1374803396.bdinstall.bin [223784]
[MD5.0EAAFD09ED4CF11206359908D193BE12] [SPRF][26/07/2013] (…) — C:ProgramData1374862668.bdinstall.bin [446330]
[MD5.003E8D1779D422A98288D63AB7714015] [SPRF][26/07/2013] (…) — C:ProgramData1374864097.bdinstall.bin [223921]
[MD5.DF5A7D290A0BBFAF67F6B6EBF5930A97] [SPRF][04/10/2012] (…) — C:ProgramDatantuser.dat [262144]
[MD5.1B151CCE618BE06C22B55FD4B502B75E] [SPRF][14/09/2014] (…) — C:Usersismail1973Desktopadwcleaner_3.310.exe [1373475]
~ Files: 12 Legitimates Filtered in 00mn 07s
—\ Recherche des packages WindowsInstaller (WIS) (O93) (NTFS)
[MD5.9D46A5F17F05429700507885F3680915] [WIS][26/10/2013] (.Kreapixel – Webplayer.) — C:WindowsInstaller22cb787.msi [21504] =>Adware.SocialSkinz
~ WIS: 1 Legitimates Filtered in 00mn 38s
—\ Recherche de clés de registre Tracing (O100)
HKLMSOFTWAREMicrosoftTracingBackupStack_RASAPI32 =>PUP.MyPCBackup
HKLMSOFTWAREMicrosoftTracingBackupStack_RASMANCS =>PUP.MyPCBackup
HKLMSOFTWAREMicrosoftTracingDomaIQ10_RASAPI32 =>Adware.DomaIQ
HKLMSOFTWAREMicrosoftTracingDomaIQ10_RASMANCS =>Adware.DomaIQ
HKLMSOFTWAREMicrosoftTracingMyPC Backup_RASAPI32 =>PUP.MyPCBackup
HKLMSOFTWAREMicrosoftTracingMyPC Backup_RASMANCS =>PUP.MyPCBackup
HKLMSOFTWAREMicrosoftTracingSignup Wizard_RASAPI32 =>PUP.JDIBackup
HKLMSOFTWAREMicrosoftTracingSignup Wizard_RASMANCS =>PUP.JDIBackup
HKLMSOFTWAREMicrosoftTracingupdateBrowseFox_RASAPI32 =>Adware.BrowseFox
HKLMSOFTWAREMicrosoftTracingupdateBrowseFox_RASMANCS =>Adware.BrowseFox
HKLMSOFTWAREWow6432NodeMicrosoftTracingAllin1ConvertCrxSetup_RASAPI32 =>Adware.Allin1Convert
HKLMSOFTWAREWow6432NodeMicrosoftTracingAllin1ConvertCrxSetup_RASMANCS =>Adware.Allin1Convert
HKLMSOFTWAREWow6432NodeMicrosoftTracingamt_qvo6_RASAPI32 =>Hijacker.Qvo6
HKLMSOFTWAREWow6432NodeMicrosoftTracingamt_qvo6_RASMANCS =>Hijacker.Qvo6
HKLMSOFTWAREWow6432NodeMicrosoftTracingAnti-phishing Domain Advisor uninstall_RASAPI32 =>Adware.PUP.VisicomAntiPhishing
HKLMSOFTWAREWow6432NodeMicrosoftTracingAnti-phishing Domain Advisor uninstall_RASMANCS =>Adware.PUP.VisicomAntiPhishing
HKLMSOFTWAREWow6432NodeMicrosoftTracingAVG-Secure-Search-Update_0614t_RASAPI32 =>Toolbar.AVGSearch
HKLMSOFTWAREWow6432NodeMicrosoftTracingAVG-Secure-Search-Update_0614t_RASMANCS =>Toolbar.AVGSearch
HKLMSOFTWAREWow6432NodeMicrosoftTracingAVG-Secure-Search-Update_0814avt_RASAPI32 =>Toolbar.AVGSearch
HKLMSOFTWAREWow6432NodeMicrosoftTracingAVG-Secure-Search-Update_0814avt_RASMANCS =>Toolbar.AVGSearch
HKLMSOFTWAREWow6432NodeMicrosoftTracingAVG-Secure-Search-Update_RASAPI32 =>Toolbar.AVGSearch
HKLMSOFTWAREWow6432NodeMicrosoftTracingAVG-Secure-Search-Update_RASMANCS =>Toolbar.AVGSearch
HKLMSOFTWAREWow6432NodeMicrosoftTracingblekkotb_001Tb_1_RASAPI32 =>Toolbar.Blekko
HKLMSOFTWAREWow6432NodeMicrosoftTracingblekkotb_001Tb_1_RASMANCS =>Toolbar.Blekko
HKLMSOFTWAREWow6432NodeMicrosoftTracingBundleSweetIMSetup-1-_RASAPI32 =>PUP.SweetIM
HKLMSOFTWAREWow6432NodeMicrosoftTracingBundleSweetIMSetup-1-_RASMANCS =>PUP.SweetIM
HKLMSOFTWAREWow6432NodeMicrosoftTracingdeskSvc_RASAPI32 =>Hijacker.22Find
HKLMSOFTWAREWow6432NodeMicrosoftTracingdeskSvc_RASMANCS =>Hijacker.22Find
HKLMSOFTWAREWow6432NodeMicrosoftTracingHDvid Codec V1-codedownloader_RASAPI32 =>PUP.HDVidCodec
HKLMSOFTWAREWow6432NodeMicrosoftTracingHDvid Codec V1-codedownloader_RASMANCS =>PUP.HDVidCodec
HKLMSOFTWAREWow6432NodeMicrosoftTracingHDvid Codec V1-updater_RASAPI32 =>PUP.HDVidCodec
HKLMSOFTWAREWow6432NodeMicrosoftTracingHDvid Codec V1-updater_RASMANCS =>PUP.HDVidCodec
HKLMSOFTWAREWow6432NodeMicrosoftTracingiMeshMediaBar_RASAPI32 =>PUP.iMesh
HKLMSOFTWAREWow6432NodeMicrosoftTracingiMeshMediaBar_RASMANCS =>PUP.iMesh
HKLMSOFTWAREWow6432NodeMicrosoftTracingInstall_BubbleDock_RASAPI32 =>PUP.BubbleDock
HKLMSOFTWAREWow6432NodeMicrosoftTracingInstall_BubbleDock_RASMANCS =>PUP.BubbleDock
HKLMSOFTWAREWow6432NodeMicrosoftTracinginstall_eMule0_RASAPI32 =>P2P.eMule
HKLMSOFTWAREWow6432NodeMicrosoftTracinginstall_eMule0_RASMANCS =>P2P.eMule
HKLMSOFTWAREWow6432NodeMicrosoftTracingLollipopInstaller_RASAPI32 =>Adware.Lollipop
HKLMSOFTWAREWow6432NodeMicrosoftTracingLollipopInstaller_RASMANCS =>Adware.Lollipop
HKLMSOFTWAREWow6432NodeMicrosoftTracingOptimizer_Pro_RASAPI32 =>PUP.OptimizerPro
HKLMSOFTWAREWow6432NodeMicrosoftTracingOptimizer_Pro_RASMANCS =>PUP.OptimizerPro
HKLMSOFTWAREWow6432NodeMicrosoftTracingPCRegistryShield_RASAPI32 =>Rogue.PCRegistryShield
HKLMSOFTWAREWow6432NodeMicrosoftTracingPCRegistryShield_RASMANCS =>Rogue.PCRegistryShield
HKLMSOFTWAREWow6432NodeMicrosoftTracingPricora-chromeinstaller_RASAPI32 =>Adware.Pricora
HKLMSOFTWAREWow6432NodeMicrosoftTracingPricora-chromeinstaller_RASMANCS =>Adware.Pricora
HKLMSOFTWAREWow6432NodeMicrosoftTracingPricora-codedownloader_RASAPI32 =>Adware.Pricora
HKLMSOFTWAREWow6432NodeMicrosoftTracingPricora-codedownloader_RASMANCS =>Adware.Pricora
HKLMSOFTWAREWow6432NodeMicrosoftTracingPricora-updater_RASAPI32 =>Adware.Pricora
HKLMSOFTWAREWow6432NodeMicrosoftTracingPricora-updater_RASMANCS =>Adware.Pricora
HKLMSOFTWAREWow6432NodeMicrosoftTracingQtraxInstaller_RASAPI32 =>P2P.Qtrax
HKLMSOFTWAREWow6432NodeMicrosoftTracingQtraxInstaller_RASMANCS =>P2P.Qtrax
HKLMSOFTWAREWow6432NodeMicrosoftTracingSetupDataMngr_iMesh_RASAPI32 =>PUP.iMesh
HKLMSOFTWAREWow6432NodeMicrosoftTracingSetupDataMngr_iMesh_RASMANCS =>PUP.iMesh
HKLMSOFTWAREWow6432NodeMicrosoftTracingSpam Free Search Bar uninstall_RASAPI32 =>Spyware.SpamFreeSearch
HKLMSOFTWAREWow6432NodeMicrosoftTracingSpam Free Search Bar uninstall_RASMANCS =>Spyware.SpamFreeSearch
HKLMSOFTWAREWow6432NodeMicrosoftTracingupt4pc_fr_46_RASAPI32 =>PUP.Eorezo
HKLMSOFTWAREWow6432NodeMicrosoftTracingupt4pc_fr_46_RASMANCS =>PUP.Eorezo
HKLMSOFTWAREWow6432NodeMicrosoftTracingVAFPlayer_RASAPI32 =>PUP.VAFPlayer
HKLMSOFTWAREWow6432NodeMicrosoftTracingVAFPlayer_RASMANCS =>PUP.VAFPlayer
HKLMSOFTWAREWow6432NodeMicrosoftTracingWajamUpdaterV3_RASAPI32 =>PUP.Wajam
HKLMSOFTWAREWow6432NodeMicrosoftTracingWajamUpdaterV3_RASMANCS =>PUP.Wajam
HKLMSOFTWAREWow6432NodeMicrosoftTracingWajam_Installer_RASAPI32 =>PUP.Wajam
HKLMSOFTWAREWow6432NodeMicrosoftTracingWajam_Installer_RASMANCS =>PUP.Wajam
~ BTK: 810 Legitimates Filtered in 00mn 02s
—\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped)
SS – | Demand 11/09/2014 267440 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) – C:WindowsSysWOW64MacromedFlashFlashPlayerUpdateService.exe
SS – | Auto 04/11/2011 136176 | (gupdate) . (.Google Inc..) – C:Program Files (x86)GoogleUpdateGoogleUpdate.exe
SS – | Demand 04/11/2011 136176 | (gupdatem) . (.Google Inc..) – C:Program Files (x86)GoogleUpdateGoogleUpdate.exe
SS – | Demand 09/08/2010 166704 | (Samsung UPD Service) . (.Samsung Electronics CO., LTD..) – C:WindowsSystem32SUPDSvc.exe
SS – | Auto 23/10/2013 172192 | (SkypeUpdate) . (.Skype Technologies.) – C:Program Files (x86)SkypeUpdaterUpdater.exe
SS – | Demand 14/07/2009 27136 | C:Program Files (x86)Windows Defendermpsvc.dll (WinDefend) . (.Microsoft Corporation.) – C:WindowsSystem32svchost.exe
SR – | Auto 21/12/2013 65432 | (AdobeARMservice) . (.Adobe Systems Incorporated.) – C:Program Files (x86)Common FilesAdobeARM1.0armsvc.exe
SR – | Auto 25/08/2014 1417160 | (avgfws) . (.AVG Technologies CZ, s.r.o..) – C:Program Files (x86)AVGAVG2014avgfws.exe
SR – | Auto 25/08/2014 3242000 | (AVGIDSAgent) . (.AVG Technologies CZ, s.r.o..) – C:Program Files (x86)AVGAVG2014avgidsagent.exe
SR – | Auto 25/08/2014 289328 | (avgwd) . (.AVG Technologies CZ, s.r.o..) – C:Program Files (x86)AVGAVG2014avgwdsvc.exe
SR – | Demand 14/07/2009 27136 | C:Program Files (x86)HPDigital Imagingbinhpqcxs08.dll (hpqcxs08) . (.Hewlett-Packard Co..) – C:WindowsSystem32svchost.exe
SR – | Auto 14/07/2009 27136 | C:Program Files (x86)HPDigital Imagingbinhpqddsvc.dll (hpqddsvc) . (.Hewlett-Packard Co..) – C:WindowsSystem32svchost.exe
SR – | Auto 14/07/2009 27136 | C:Usersismail1973AppDataLocalTemp7zS5CF1HPSLPSVC64.dll (HPSLPSVC) . (.Hewlett-Packard Co..) – C:WindowsSystem32svchost.exe
SR – | Auto 26/08/2014 78088 | (HPSupportSolutionsFrameworkService) . (.Hewlett-Packard Company.) – C:Program Files (x86)HpCommonHPSupportSolutionsFrameworkService.exe
SR – | Auto 14/07/2009 27136 | C:Windowssystem32HPZinw12.dll (Net Driver HPZ12) . (.Hewlett-Packard.) – C:WindowsSystem32svchost.exe
SR – | Auto 14/07/2009 27136 | C:Windowssystem32HPZipm12.dll (Pml Driver HPZ12) . (.Hewlett-Packard.) – C:WindowsSystem32svchost.exe
SR – | Auto 10/07/1658 0 | (WMPNetworkSvc) . (…) – C:Program Files (x86)Windows Media Playerwmpnetwk.exe =>.Microsoft Corporation
SR – | Auto 14/07/2009 27136 | C:WindowsSystem32wuaueng.dll (wuauserv) . (.Microsoft Corporation.) – C:WindowsSystem32svchost.exe
~ Services: Scanned in 00mn 21s
—\ Recherche d'infection sur le Master Boot Record (MBR)(O80)
Run by ismail1973 at 14/09/2014 22:27:01
~ OS 64 not supported by MBR tool
~ MBR: 0 Legitimates Filtered in 00mn 00s
—\ Recherche d'infection sur le Master Boot Record (MBRCheck)(O80)
Written by ad13, http://ad13.geekstog” onclick=”window.open(this.href);return false;
Run by ismail1973 at 14/09/2014 22:27:03
********* Dump file Name *********
C:PhysicalDisk0_MBR.bin
~ MBR: Scanned in 00mn 02s
—\ Scan Additionnel (O88)
Database Version : 13026 – (28/08/2014)
Clés trouvées (Keys found) : 8
Valeurs trouvées (Values found) : 1
Dossiers trouvés (Folders found) : 6
Fichiers trouvés (Files found) : 4
[HKCUSoftwareMicrosoftWindowsCurrentVersionExtStats{493CCB71-DCAD-4257-9F08-8750F63BD792}] =>Toolbar.Agent
[HKLMSoftwareWow6432NodeMicrosoftWindowsCurrentVersionExtPreApproved{493CCB71-DCAD-4257-9F08-8750F63BD792}] =>Toolbar.Agent
[HKLMSoftwareMicrosoftTracingupdateBrowseFox_RASMANCS] =>Adware.BrowseFox
[HKLMSoftwareMicrosoftTracingupdateBrowseFox_RASAPI32] =>Adware.BrowseFox
[HKLMSoftwareClassesInterface{03480F0D-7897-4FC0-86D8-18B6FF450D2A}] =>Adware.MapsGalaxy
[HKLMSoftwareClassesInterface{09B8C335-1622-42C7-8650-A79D56551343}] =>Adware.MapsGalaxy
[HKLMSoftwareWow6432NodeGoogleChromeExtensionshggpkhijoeadmdfmlbdepfbngmhaldci] =>PUP.DealPly
[HKLMSoftwareWow6432NodeMicrosoftWindowsCurrentVersionExtPreApproved{11111111-1111-1111-1111-110011221158}] =>PUP.CrossRider
[HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun]:startertv_fr_5 =>Adware.StarterTV^
C:Program Files (x86)majtuto4pc_fr_a2 =>PUP.AgenceExclusive^
C:Usersismail1973AppDataLocalblekkotb_001 =>Toolbar.Blekko^
C:ProgramDataSoftware =>Adware.Boxore
C:Usersismail1973AppDataLocalGoogleChromeUser DataDefaultExtensionsmocblcnaofikinigmceddfghppkkjbog =>Adware.SmileyBar
C:Usersismail1973AppDataLocalGoogleChromeUser DataDefaultExtensionsamfclgbdpgndipgoegfpkkgobahigbcl =>PUP.QuickShare
C:Usersismail1973AppDataLocalGoogleChromeUser DataDefaultExtensionskpepfkjapeclaafmhoelccknpfedainn =>Adware.Downware
[HKLMSoftwareWEDL] =>PUP.weDownloadManager^
[HKLMSoftwareWow6432NodeTUTO-4PC] =>PUP.AgenceExclusive^
[HKLMSoftwareWow6432NodeWEDL] =>PUP.weDownloadManager^
C:WindowsInstaller22cb787.msi =>Adware.SocialSkinz^
~ Additionnel Scan: 282860 Items scanned in 01mn 05s
—\ Informations complémentaires sur les modules
~ http://nicolascoolman.fr/g0-page-de-demarrage-google-chrome/” onclick=”window.open(this.href);return false; =>.Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
~ http://nicolascoolman.fr/r5-internet-explorer-proxy-management-iepm/” onclick=”window.open(this.href);return false; =>.Internet Explorer, Proxy Management (R5)
~ http://nicolascoolman.fr/o2-browser-helper-objects-de-navigateur/” onclick=”window.open(this.href);return false; =>.Browser Helper Objects de navigateur (O2)
~ http://nicolascoolman.fr/o3-internet-explorer-toolbars/” onclick=”window.open(this.href);return false; =>.Internet Explorer Toolbars (O3)
~ http://nicolascoolman.fr/o4-applications-demarrees-par-le-registre/” onclick=”window.open(this.href);return false; =>.Applications lancées au démarrage du système (O4)
~ AMI: 5 Legitimates Filtered in 00mn 00s
—\ Récapitulatif des détections trouvées sur votre station
http://nicolascoolman.fr/adware-startertv” onclick=”window.open(this.href);return false; =>Adware.StarterTV
http://nicolascoolman.fr/spyware-agenceexclusive” onclick=”window.open(this.href);return false; =>PUP.AgenceExclusive
http://nicolascoolman.fr/pup-sweetim” onclick=”window.open(this.href);return false; =>PUP.SweetIM
http://nicolascoolman.fr/pup-wedownloadmanager” onclick=”window.open(this.href);return false; =>PUP.weDownloadManager
http://nicolascoolman.fr/32164901-toolbar-blekko” onclick=”window.open(this.href);return false; =>Toolbar.Blekko
http://nicolascoolman.fr/adware-socialskinz” onclick=”window.open(this.href);return false; =>Adware.SocialSkinz
http://nicolascoolman.fr/pup-mypcbackup” onclick=”window.open(this.href);return false; =>PUP.MyPCBackup
http://nicolascoolman.fr/adware-domaiq” onclick=”window.open(this.href);return false; =>Adware.DomaIQ
http://nicolascoolman.fr/adware-browsefox” onclick=”window.open(this.href);return false; =>Adware.BrowseFox
http://nicolascoolman.fr/adware-allin1convert” onclick=”window.open(this.href);return false; =>Adware.Allin1Convert
http://nicolascoolman.fr/hijacker-qvo6” onclick=”window.open(this.href);return false; =>Hijacker.Qvo6
http://nicolascoolman.fr/hijacker-22find” onclick=”window.open(this.href);return false; =>Hijacker.22Find
http://nicolascoolman.fr/pup-hdvidcodec” onclick=”window.open(this.href);return false; =>PUP.HDVidCodec
http://nicolascoolman.fr/pup-imesh” onclick=”window.open(this.href);return false; =>PUP.iMesh
http://nicolascoolman.fr/pup-bubbledock” onclick=”window.open(this.href);return false; =>PUP.BubbleDock
http://nicolascoolman.fr/adware-lollipop” onclick=”window.open(this.href);return false; =>Adware.Lollipop
http://nicolascoolman.fr/pup-optimizerpro” onclick=”window.open(this.href);return false; =>PUP.OptimizerPro
http://nicolascoolman.fr/rogue-pcregistryshield” onclick=”window.open(this.href);return false; =>Rogue.PCRegistryShield
http://nicolascoolman.fr/adware-pricora” onclick=”window.open(this.href);return false; =>Adware.Pricora
http://nicolascoolman.fr/33386243-spyware-spamfreesearch” onclick=”window.open(this.href);return false; =>Spyware.SpamFreeSearch
http://nicolascoolman.fr/pup-eorezo” onclick=”window.open(this.href);return false; =>PUP.Eorezo
http://nicolascoolman.fr/pup-vafplayer” onclick=”window.open(this.href);return false; =>PUP.VAFPlayer
http://nicolascoolman.fr/pup-wajam” onclick=”window.open(this.href);return false; =>PUP.Wajam
http://nicolascoolman.fr/adware-mapsgalaxy” onclick=”window.open(this.href);return false; =>Adware.MapsGalaxy
http://nicolascoolman.fr/pup-dealply” onclick=”window.open(this.href);return false; =>PUP.DealPly
http://nicolascoolman.fr/pup-crossrider” onclick=”window.open(this.href);return false; =>PUP.CrossRider
http://nicolascoolman.fr/adware-boxore” onclick=”window.open(this.href);return false; =>Adware.Boxore
http://nicolascoolman.fr/adware-smileybar” onclick=”window.open(this.href);return false; =>Adware.SmileyBar
http://nicolascoolman.fr/pup-quickshare” onclick=”window.open(this.href);return false; =>PUP.QuickShare
http://nicolascoolman.fr/adware-downware” onclick=”window.open(this.href);return false; =>Adware.Downware
~ MSI: 30 link(s) detected in 00mn 00s
~ 874 Legitimates filtered by white list
End of the scan (556 lines in 09mn 04s)(0)[/spoiler:3i28tx27]
J’ai aussi un rapport de Adwcleaner et Malwarebytes mais si je les mets le message a trop de caractères.
Merci d’avance pour votre aide.
g3n-h@ckm@n
Admin bbPress
14 septembre 2014 à 21 h 26 min
Nombre d'articles : 8435
#204803
salut ton pc est une poubelle numérique mais pas d’infection usb visible
- Désactive ton antivirus le temps du téléchargement et de l’utilisation.
- Télécharge AdsFix sur ton bureau.
  Note : Enregistrer votre travail avant de continuer !
- Lance AdsFix
- Pour un pc assez infecté , il peut mettre plusieurs secondes à se charger
- Inscrit ton pays
- Clique sur Nettoyer , après l’avoir débloqué dans les options
  
  Note : Patiente le temps du scan
- Laisse travailler l’outil même s’il te parait bloqué
- Si l’outil détecte un proxy que tu ne connais pas clic sur : “Supprimer le proxy“
- Héberge le rapport C:AdsFix_date_heure.txt sur SOSUpload puis donne le lien obtenu.
Aide:
- Tutoriel AdsFix – Option “Nettoyage”
- Désactiver temporairement sa protection résidentielle
bunchie93
15 septembre 2014 à 11 h 11 min
Nombre d'articles : 0
#204804
J’ai lancé Adsfix mais à 80 % il se bloque. Je l’ai laissé toute la nuit et çà n’a pas bougé. Je l’ai stoppé et je l’ai relancé ce matin mais il rebloque à 80%.
g3n-h@ckm@n
Admin bbPress
15 septembre 2014 à 17 h 37 min
Nombre d'articles : 8435
#204805
salut il ya écrit quoi sous la barre de progression quand il bloque ?
bunchie93
15 septembre 2014 à 18 h 30 min
Nombre d'articles : 0
#204806
[ismail1973|Firefox|Prefs.js]
g3n-h@ckm@n
Admin bbPress
15 septembre 2014 à 22 h 17 min
Nombre d'articles : 8435
#204807
ok retélécharge-le ca devrait passer
bunchie93
16 septembre 2014 à 10 h 19 min
Nombre d'articles : 0
#204808
Bonjour,
J’ai désinstallé puis réinstallé le logiciel et il s’arrête encore à 80 % avec les mêmes choses écrites sous la barre de progression. En plus, j’avais besoin d’ouvrir des docs word et open office et je ne peux plus le faire quand faisant clique droit “ouvrir avec…” alors qu’avant je n’avais pas ce problème.
Auteur
Messages

Le sujet ‘clé usb infectée par virus créant des raccourcis’ est fermé à de nouvelles réponses.