Bonjour,

############################## | UsbFix V6.053 |

User : nacera (Administrateurs) # FADILA-D4A55B25
Update on 14/11/2009 by Chiquitine29, C_XX & Chimay8
Start at: 22:34:19 | 15/11/2009
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com

Intel(R) Pentium(R) 4 CPU 3.00GHz
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 2
Internet Explorer 6.0.2900.2180
Windows Firewall Status : Enabled
AV : AntiVir Desktop 9.0.1.26 [ Enabled | Updated ]

A:\ -> Lecteur de disquettes 3 ½ pouces
C:\ -> Disque fixe local # 136,71 Go (78,69 Go free) # NTFS
D:\ -> Disque fixe local # 12,33 Go (2,78 Go free) # NTFS
E:\ -> Disque CD-ROM
F:\ -> Disque amovible # 1,88 Go (272,78 Mo free) [FADILA 2] # FAT32

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe 624
C:\WINDOWS\system32\csrss.exe 676
C:\WINDOWS\system32\winlogon.exe 700
C:\WINDOWS\system32\services.exe 744
C:\WINDOWS\system32\lsass.exe 756
C:\WINDOWS\system32\nvsvc32.exe 948
C:\WINDOWS\system32\svchost.exe 980
C:\WINDOWS\system32\svchost.exe 1048
C:\WINDOWS\System32\svchost.exe 1144
C:\WINDOWS\system32\svchost.exe 1260
C:\WINDOWS\system32\svchost.exe 1308
C:\WINDOWS\system32\spoolsv.exe 1504
C:\Program Files\Avira\AntiVir Desktop\sched.exe 1548
C:\WINDOWS\system32\svchost.exe 1612
C:\WINDOWS\RTHDCPL.EXE 1964
C:\WINDOWS\V0330Mon.exe 1988
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe 1996
C:\Program Files\SweetIM\Messenger\SweetIM.exe 2004
C:\WINDOWS\system32\RUNDLL32.EXE 2020
C:\Program Files\iTunes\iTunesHelper.exe 196
C:\Program Files\Java\jre6\bin\jusched.exe 204
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe 224
C:\WINDOWS\system32\ahr.exe 240
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe 1684
C:\Program Files\Bonjour\mDNSResponder.exe 1716
C:\Program Files\Java\jre6\bin\jqs.exe 188
C:\WINDOWS\system32\svchost.exe 760
C:\WINDOWS\system32\wdfmgr.exe 2152
C:\PROGRA~1\Bandoo\Bandoo.exe 2368
C:\Program Files\iPod\bin\iPodService.exe 3256
C:\WINDOWS\System32\alg.exe 3576
C:\Program Files\Windows Live\Messenger\msnmsgr.exe 3116
C:\Program Files\Windows Live\Contacts\wlcomm.exe 476
C:\PROGRA~1\Bandoo\BndCore.exe 1392
C:\WINDOWS\system32\wuauclt.exe 3932
C:\WINDOWS\system32\taskmgr.exe 3952
C:\Program Files\Avira\AntiVir Desktop\avguard.exe 1340
C:\WINDOWS\system32\taskmgr.exe 2312
C:\WINDOWS\explorer.exe 2068
C:\WINDOWS\system32\wbem\wmiprvse.exe 3752

################## | Fichiers # Dossiers infectieux |

C:\WINDOWS\System32\ahr.exe
C:\WINDOWS\System32\autorun.inf
C:\DOCUME~1\nacera\LOCALS~1\Temp\nsu40.tmp.exe
C:\DOCUME~1\nacera\LOCALS~1\Temp\a.dat
C:\khq
D:\khq
F:\autorun.inf
F:\antihost.exe

################## | Registre # Clés Run infectieuses |

[HKCU\SOFTWARE\PopRock]
[HKCU\SOFTWARE\XML]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Run] "antihost"
[HKLM\Software\Microsoft\Windows\CurrentVersion\Run] "Windows Upgrate Utility"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{500BCA15-57A7-4eaf-8143-8C619470B13D}]
[HKLM\Software\Classes\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}]
[HKCR\CLSID\{500BCA15-57A7-4EAF-8143-8C619470B13D}]

################## | Registre # Mountpoints2 |

HKCU\..\..\Explorer\MountPoints2\{26af623b-85aa-11de-a012-001a4d6efb40}
Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL antihost.exe

HKCU\..\..\Explorer\MountPoints2\{2803f196-8a62-11de-a026-001a4d6efb40}
Shell\AutoRun\command =F:\xmjixk.exe
Shell\explore\Command =F:\xmjixk.exe
Shell\open\Command =F:\xmjixk.exe

HKCU\..\..\Explorer\MountPoints2\{2e499965-8534-11de-a00f-001a4d6efb40}
Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL antihost.exe

HKCU\..\..\Explorer\MountPoints2\{3453cd7e-94df-11de-a03e-001a4d6efb40}
Shell\AutoRun\command =G:\owxshj.exe
Shell\explore\Command =G:\owxshj.exe
Shell\open\Command =G:\owxshj.exe

HKCU\..\..\Explorer\MountPoints2\{573a862d-7f6b-11de-9ff9-001a4d6efb40}
Shell\AutoRun\command =F:\rmohqs.exe
Shell\explore\Command =F:\rmohqs.exe
Shell\open\Command =F:\rmohqs.exe

HKCU\..\..\Explorer\MountPoints2\{66e2e85c-8982-11de-a024-001a4d6efb40}
Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL antihost.exe

HKCU\..\..\Explorer\MountPoints2\{92396cb0-8c9b-11de-a02c-001a4d6efb40}
Shell\AutoRun\command =F:\xmjixk.exe
Shell\explore\Command =F:\xmjixk.exe
Shell\open\Command =F:\xmjixk.exe

HKCU\..\..\Explorer\MountPoints2\{bad1f347-7df9-11de-9fef-001a4d6efb40}
Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL antihost.exe

HKCU\..\..\Explorer\MountPoints2\{e548baf1-7ec9-11de-9ff6-001a4d6efb40}
Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL antihost.exe

HKCU\..\..\Explorer\MountPoints2\{fc904087-7eb4-11de-9ff5-001a4d6efb40}
Shell\AutoRun\command =F:\owxshj.exe
Shell\explore\Command =F:\owxshj.exe
Shell\open\Command =F:\owxshj.exe

HKCU\..\..\Explorer\MountPoints2\{fc90408a-7eb4-11de-9ff5-001a4d6efb40}
Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL antihost.exe

HKCU\..\..\Explorer\MountPoints2\{fc90408b-7eb4-11de-9ff5-001a4d6efb40}
Shell\AutoRun\command =F:\owxshj.exe
Shell\explore\Command =F:\owxshj.exe
Shell\open\Command =F:\owxshj.exe

################## | Suspect | http://www.virustotal.com |


################## | Cracks / Keygens / Serials |

"C:\Documents and Settings\nacera\Bureau\logiciel\Avast! Anti Virus Professional 4.8.1356 Incl. Serial + Skins [1337x] [Ahmed]\Setup\setupengpro.exe"
22/10/2009 14:00 |Size 39045408 |Crc32 46350630 |Md5 48c4885126123033702b3fb3259c5d73

"F:\dossier\flash\The Rise of Atlantis + Crack\The Rise of Atlantis + Crack\en_riseofatlantis_inst.exe"
06/01/2009 20:57 |Size 21453496 |Crc32 d207c8ba |Md5 c248c00767d1434f9fc4ea77293c8e2c

"F:\Avast! Anti Virus Professional 4.8.1356 Incl. Serial + Skins [1337x] [Ahmed]\Setup\setupengpro.exe"
22/10/2009 15:00 |Size 39045408 |Crc32 46350630 |Md5 48c4885126123033702b3fb3259c5d73


################## | ! Fin du rapport # UsbFix V6.053 ! |

Configuration: Windows XP Internet Explorer 6.0