############################## | UsbFix V 7.139 | [Recherche]
Utilisateur: messi 1 (Administrateur) # MESSI1-PC
Mis à jour le 26/09/2013 par El Desaparecido - Team SosVirus
Lancé à 19:06:32 | 27/09/2013
Site Web: http://www.usbfix.net/
Forum : http://www.sosvirus.net/
Upload Malware: http://www.sosvirus.net/upload_malware.php
Contact: http://www.usbfix.net/contact/
PC: Hewlett-Packard (HP Compaq dx2400 Microtower PC) (X86-based PC)
CPU: Intel(R) Pentium(R) Dual CPU E2180 @ 2.00GHz (2000)
RAM -> [Total : 1526 | Free : 327]
BIOS: BIOS Date: 11/07/08 17:35:47 Ver: 5.33
BOOT: Normal boot
OS: Microsoft Windows 7 Professionnel (6.1.7601 32-Bit) # Service Pack 1
WB: Windows Internet Explorer 10.0.9200.16686
SC: Security Center Service [Enabled]
WU: Windows Update Service [Enabled]
AV: Microsoft Security Essentials [Enabled | Updated]
FW: Windows FireWall Service [Enabled]
C:\ (%systemdrive%) -> Disque fixe # 58 Go (5 Go libre(s) - 8%) [] # NTFS
D:\ -> Disque fixe # 49 Go (7 Go libre(s) - 14%) [] # NTFS
E:\ -> Disque fixe # 42 Go (5 Go libre(s) - 13%) [] # NTFS
F:\ -> CD-ROM
G:\ -> CD-ROM
H:\ -> CD-ROM
I:\ -> Disque amovible # 948 Mo (946 Mo libre(s) - 100%) [FABIO CASSA] # FAT
################## | Processus Actif |
C:\Windows\system32\csrss.exe (380)
C:\Windows\system32\wininit.exe (432)
C:\Windows\system32\csrss.exe (440)
C:\Windows\system32\winlogon.exe (488)
C:\Windows\system32\services.exe (536)
C:\Windows\system32\lsass.exe (544)
C:\Windows\system32\lsm.exe (556)
C:\Windows\system32\svchost.exe (656)
C:\Windows\system32\svchost.exe (736)
c:\Program Files\Microsoft Security Client\MsMpEng.exe (776)
C:\Windows\System32\svchost.exe (908)
C:\Windows\System32\svchost.exe (952)
C:\Windows\system32\svchost.exe (1000)
C:\Windows\system32\svchost.exe (1036)
C:\Windows\system32\svchost.exe (1240)
C:\Windows\System32\spoolsv.exe (1424)
C:\Windows\system32\svchost.exe (1452)
C:\Program Files\SUPERAntiSpyware\SASCORE.EXE (1588)
C:\Windows\system32\taskhost.exe (1792)
C:\Windows\system32\Dwm.exe (1848)
C:\Program Files\Windows Live\Family Safety\fsssvc.exe (1896)
C:\Windows\Explorer.EXE (1908)
C:\Windows\system32\FsUsbExService.Exe (1960)
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe (1260)
C:\Windows\System32\hkcmd.exe (1472)
C:\Windows\System32\igfxpers.exe (1492)
C:\Windows\system32\igfxsrvc.exe (1760)
C:\Program Files\Microsoft Security Client\msseces.exe (2012)
C:\Windows\system32\PrintIsolationHost.exe (672)
C:\Program Files\Windows Live\Family Safety\fsui.exe (2156)
C:\Windows\vVX1000.exe (2316)
C:\Windows\System32\wscript.exe (2332)
C:\Program Files\Hosts_Anti_Adwares_PUPs\HOSTS_Anti-Adware_main.exe (2556)
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe (2576)
C:\Program Files\uTorrent\uTorrent.exe (2584)
C:\Program Files\Supercopier\Supercopier.exe (2660)
C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe (2704)
C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE (2792)
C:\Program Files\Skype\Phone\Skype.exe (2888)
C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe (2908)
C:\Program Files\Internet Download Manager\IDMan.exe (2924)
C:\Program Files\Sony\Sony PC Companion\PCCompanion.exe (2940)
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (2948)
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (2980)
C:\Program Files\Sony\Sony PC Companion\PCCompanionInfo.exe (3164)
C:\Windows\system32\svchost.exe (3628)
C:\Program Files\Common Files\LightScribe\LSSrvc.exe (3692)
C:\Program Files\Microsoft LifeCam\MSCamS32.exe (3712)
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe (3736)
C:\Windows\System32\svchost.exe (3788)
C:\Program Files\Nitro\Reader 3\NitroPDFReaderDriverService3.exe (3824)
C:\Windows\System32\svchost.exe (3884)
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe (3948)
C:\Windows\system32\svchost.exe (3988)
C:\Windows\System32\system\svchost.exe (4028)
C:\Program Files\Tor\tor.exe (4068)
C:\Windows\system32\wbem\wmiprvse.exe (2808)
C:\Windows\system32\svchost.exe (3444)
c:\Program Files\Microsoft Security Client\NisSrv.exe (3404)
C:\Windows\system32\UI0Detect.exe (872)
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe (1832)
C:\Windows\system32\SearchIndexer.exe (320)
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe (4284)
C:\Windows\system32\svchost.exe (4912)
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe (5544)
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe (5640)
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe (5752)
C:\Program Files\Mozilla Firefox\firefox.exe (5868)
C:\Windows\system32\wuauclt.exe (5560)
C:\Windows\system32\svchost.exe (3528)
C:\Program Files\Mozilla Firefox\plugin-container.exe (4472)
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe (2608)
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe (5132)
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (5408)
C:\Windows\system32\PrintIsolationHost.exe (5196)
C:\UsbFix\Go.exe (4828)
C:\Windows\System32\WUDFHost.exe (1176)
################## | Regedit Run |
HKLM\SOFTWARE | Run : [HP Software Update] - C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
HKLM\SOFTWARE | Run : [IgfxTray] - C:\Windows\system32\igfxtray.exe
HKLM\SOFTWARE | Run : [HotKeysCmds] - C:\Windows\system32\hkcmd.exe
HKLM\SOFTWARE | Run : [Persistence] - C:\Windows\system32\igfxpers.exe
HKLM\SOFTWARE | Run : [MSC] - "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
HKLM\SOFTWARE | Run : [BCSSync] - "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices
HKLM\SOFTWARE | Run : [AdobeAAMUpdater-1.0] - "C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
HKLM\SOFTWARE | Run : [NeroFilterCheck] - C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
HKLM\SOFTWARE | Run : [NBKeyScan] - "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
HKLM\SOFTWARE | Run : [fssui] - "C:\Program Files\Windows Live\Family Safety\fsui.exe" -autorun
HKLM\SOFTWARE | Run : [SwitchBoard] - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
HKLM\SOFTWARE | Run : [AdobeCS5ServiceManager] - "C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
HKLM\SOFTWARE | Run : [NPSStartup] -
HKLM\SOFTWARE | Run : [VX1000] - C:\Windows\vVX1000.exe
HKLM\SOFTWARE | Run : [LifeCam] - "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
HKLM\SOFTWARE | Run : [DEMcjWmz] - wscript.exe //B "C:\Users\MESSI1~1\AppData\Local\Temp\DEMcjWmz.vbs"
HKLM\SOFTWARE | Run : [HOSTS Anti-Adware_PUPs] - C:\Program Files\Hosts_Anti_Adwares_PUPs\HOSTS_Anti-Adware_main.exe
HKLM\SOFTWARE | RunOnce : [] -
HKLM\SOFTWARE | Policies\Explorer\run : [rescue] - "C:\ProgramData\rescue.vbe"
HKU\S-1-5-19\SOFTWARE | Run : [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-20\SOFTWARE | Run : [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-21-1375623356-3893037246-3339133492-1000\SOFTWARE | Run : [LightScribe Control Panel] - C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
HKU\S-1-5-21-1375623356-3893037246-3339133492-1000\SOFTWARE | Run : [uTorrent] - "C:\Program Files\uTorrent\uTorrent.exe" /MINIMIZED
HKU\S-1-5-21-1375623356-3893037246-3339133492-1000\SOFTWARE | Run : [BitTorrent] - "C:\Program Files\BitTorrent\BitTorrent.exe" /MINIMIZED
HKU\S-1-5-21-1375623356-3893037246-3339133492-1000\SOFTWARE | Run : [AlcoholAutomount] - "C:\Program Files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe" -automount
HKU\S-1-5-21-1375623356-3893037246-3339133492-1000\SOFTWARE | Run : [Supercopier.exe] - C:\Program Files\Supercopier\Supercopier.exe
HKU\S-1-5-21-1375623356-3893037246-3339133492-1000\SOFTWARE | Run : [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] - "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"
HKU\S-1-5-21-1375623356-3893037246-3339133492-1000\SOFTWARE | Run : [DAEMON Tools Lite] - "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
HKU\S-1-5-21-1375623356-3893037246-3339133492-1000\SOFTWARE | Run : [wLite] - "C:\Program Files\wLite\wLite.exe" -auto
HKU\S-1-5-21-1375623356-3893037246-3339133492-1000\SOFTWARE | Run : [AdobeBridge] -
HKU\S-1-5-21-1375623356-3893037246-3339133492-1000\SOFTWARE | Run : [IpSharkk] - "C:\Program Files\IpSharkk\IpSharkk.exe" /auto
HKU\S-1-5-21-1375623356-3893037246-3339133492-1000\SOFTWARE | Run : [OfficeSyncProcess] - "C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE"
HKU\S-1-5-21-1375623356-3893037246-3339133492-1000\SOFTWARE | Run : [Skype] - "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
HKU\S-1-5-21-1375623356-3893037246-3339133492-1000\SOFTWARE | Run : [SplitCam] - C:\Program Files\SplitCam\SplitCam.exe
HKU\S-1-5-21-1375623356-3893037246-3339133492-1000\SOFTWARE | Run : [AutoStartNPSAgent] - C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe
HKU\S-1-5-21-1375623356-3893037246-3339133492-1000\SOFTWARE | Run : [IDMan] - C:\Program Files\Internet Download Manager\IDMan.exe /onboot
HKU\S-1-5-21-1375623356-3893037246-3339133492-1000\SOFTWARE | Run : [DEMcjWmz] - wscript.exe //B "C:\Users\MESSI1~1\AppData\Local\Temp\DEMcjWmz.vbs"
HKU\S-1-5-21-1375623356-3893037246-3339133492-1000\SOFTWARE | Run : [Sony PC Companion] - "C:\Program Files\Sony\Sony PC Companion\PCCompanion.exe" /Background
HKU\S-1-5-21-1375623356-3893037246-3339133492-1000\SOFTWARE | Run : [SUPERAntiSpyware] - C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
HKU\S-1-5-19\SOFTWARE | RunOnce : [mctadmin] - C:\Windows\System32\mctadmin.exe
HKU\S-1-5-20\SOFTWARE | RunOnce : [mctadmin] - C:\Windows\System32\mctadmin.exe
################## | Éléments infectieux |
Service présent! system
Présent! C:\Users\messi 1\AppData\Roaming\SUPERAntiSpyware.com
Présent! C:\ProgramData\SUPERAntiSpyware.com
Présent! C:\Users\MESSI1~1\AppData\Local\Temp\DEMcjWmz.vbs
Présent! C:\Users\messi 1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DEMcjWmz.vbs
Présent! D:\$RECYCLE.BIN.lnk
Présent! E:\$RECYCLE.BIN.lnk
Présent! C:\ProgramData\rescue.vbe
Présent! C:\Program Files\Common Files\System\Windows Update
Présent! C:\Windows\system32\system\svchost.exe
Présent! C:\Users\MESSI1~1\AppData\Local\Temp\utt9928.tmp.exe
Présent! C:\Users\MESSI1~1\AppData\Local\Temp\dds.vbs
Présent! C:\Windows\svchost .exe
Présent! C:\config.dat
Présent! C:\security\svchost.exe
Présent! C:\kernel
Présent! D:\config.dat
Présent! E:\config.dat
Présent! E:\desktop.ini
Présent! C:\Users\All Users\rescue.vbe
################## | Registre |
Présent! HKLM\SYSTEM\CurrentControlSet\Services\system
Présent! HKLM\SYSTEM\ControlSet001\Services\system
Présent! HKLM\SYSTEM\ControlSet002\Services\system
Présent! HKCU\Software\Microsoft\Windows\CurrentVersion\Run|SUPERAntiSpyware
Présent! HKCU\Software\Microsoft\Windows\CurrentVersion\Run|SUPERAntiSpyware
Présent! HKLM\Software\Microsoft\Windows\CurrentVersion\Run|DEMcjWmz
Présent! HKCU\Software\Microsoft\Windows\CurrentVersion\Run|DEMcjWmz
Présent! HKLM\Software\Microsoft\Windows\CurrentVersion\Run|DEMcjWmz
Présent! HKCU\Software\Microsoft\Windows\CurrentVersion\Run|DEMcjWmz
Présent! HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\policies\System|DisableRegistryTools
Présent! HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\policies\System|DisableRegistryTools
Présent! HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\policies\System|DisableTaskMgr
Présent! HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\policies\System|DisableTaskMgr
Présent! HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System|DisableTaskMgr
Présent! HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run|rescue
################## | Mountpoints2 |
HKCU\.\.\.\.\Explorer\MountPoints2\{173ae512-2331-11e2-b08d-0022642601a7}
Shell\AutoRun\Command = G:\.\Setup.exe AUTORUN=1
HKCU\.\.\.\.\Explorer\MountPoints2\{173ae529-2331-11e2-b08d-0022642601a7}
Shell\AutoRun\Command = G:\.\Setup.exe AUTORUN=1
HKCU\.\.\.\.\Explorer\MountPoints2\{384eb4c6-d819-11e2-adbb-0022642601a7}
Shell\AutoRun\Command = I:\Data\setup.exe
HKCU\.\.\.\.\Explorer\MountPoints2\{4202db7c-6955-11e2-8fcf-0022642601a7}
Shell\AutoRun\Command = G:\AutoRun.exe {D2D77DC2-8299-11D1-8949-444553540000} 5.2066.1.A11B02 PID_0083
HKCU\.\.\.\.\Explorer\MountPoints2\{638c9dec-002b-11e3-8a54-0022642601a7}
Shell\AutoRun\Command = I:\AutoRun.exe
HKCU\.\.\.\.\Explorer\MountPoints2\{9268af16-5cac-11e2-b496-0022642601a7}
Shell\AutoRun\Command = G:\.\Setup.exe AUTORUN=1
HKCU\.\.\.\.\Explorer\MountPoints2\{93767456-f548-11e2-a551-0022642601a7}
Shell\AutoRun\Command = J:\iLinker.exe
HKCU\.\.\.\.\Explorer\MountPoints2\{9bea7f69-fe75-11e2-88ff-0022642601a7}
Shell\AutoRun\Command = I:\Setup.exe
HKCU\.\.\.\.\Explorer\MountPoints2\{a651369e-36f4-11e2-b96c-0022642601a7}
Shell\AutoRun\Command = G:\LaunchU3.exe -a
################## | Vaccin |
(!) Cet ordinateur n'est pas vacciné!
################## | E.O.F | http://www.usbfix.net - http://www.sosvirus.net |
Afficher la suite
