############################## | UsbFix V 7.144 | [Recherche]

Utilisateur: Mon PC (Administrateur) # PC-DE-MONPC
Mis à jour le 08/10/2013 par El Desaparecido - Team SosVirus
Lancé à 22:35:07 | 14/10/2013

Site Web: http://www.usbfix.net/
Forum : http://www.sosvirus.net/
Upload Malware: http://www.sosvirus.net/upload_malware.php
Contact: http://www.usbfix.net/contact/

PC: ASUSTeK Computer INC. (M2A-VM)
CPU: AMD Athlon(tm) 64 X2 Dual Core Processor 5000+
RAM -> [Total : 2046 | Free : 817]
Bios: Phoenix Technologies, LTD
Boot: Normal boot

OS: Microsoft® Windows Vista™ Édition Familiale Premium  (6.0.6002 32-Bit) # Service Pack 2
WB: Windows Internet Explorer 9.0.8112.16421

SC: Security Center Service [Enabled]
WU: Windows Update Service [Enabled]
AV: ZoneAlarm Antivirus [Enabled | Updated]
FW: Windows FireWall Service [Enabled]

C:\ (%systemdrive%) -> Disque fixe # 149 Go (32 Go libre(s) - 21%) [Vista] # NTFS
D:\ -> CD-ROM
I:\ -> Disque fixe # 149 Go (34 Go libre(s) - 23%) [sauvegarde] # NTFS

################## | Processus Actif |

C:\Windows\system32\csrss.exe (ID 688 |ParentID 676)
C:\Windows\system32\wininit.exe (ID 744 |ParentID 676)
C:\Windows\system32\csrss.exe (ID 756 |ParentID 736)
C:\Windows\system32\services.exe (ID 792 |ParentID 744)
C:\Windows\system32\lsass.exe (ID 808 |ParentID 744)
C:\Windows\system32\lsm.exe (ID 816 |ParentID 744)
C:\Windows\system32\winlogon.exe (ID 932 |ParentID 736)
C:\Windows\system32\svchost.exe (ID 1004 |ParentID 792)
C:\Windows\system32\svchost.exe (ID 1064 |ParentID 792)
C:\Windows\System32\svchost.exe (ID 1108 |ParentID 792)
C:\Windows\system32\Ati2evxx.exe (ID 1196 |ParentID 792)
C:\Windows\System32\svchost.exe (ID 1216 |ParentID 792)
C:\Windows\System32\svchost.exe (ID 1292 |ParentID 792)
C:\Windows\system32\svchost.exe (ID 1336 |ParentID 792)
C:\Windows\system32\svchost.exe (ID 1420 |ParentID 792)
C:\Windows\system32\SLsvc.exe (ID 1440 |ParentID 792)
C:\Windows\system32\svchost.exe (ID 1488 |ParentID 792)
C:\Windows\system32\Ati2evxx.exe (ID 1576 |ParentID 1196)
C:\Windows\system32\svchost.exe (ID 1740 |ParentID 792)
C:\Program Files\CheckPoint\ZoneAlarm\vsmon.exe (ID 1868 |ParentID 792)
C:\Windows\system32\Dwm.exe (ID 1976 |ParentID 1292)
C:\Windows\Explorer.EXE (ID 2000 |ParentID 1956)
C:\Windows\System32\spoolsv.exe (ID 1384 |ParentID 792)
C:\Windows\system32\svchost.exe (ID 1584 |ParentID 792)
C:\Windows\system32\taskeng.exe (ID 1628 |ParentID 1336)
C:\Windows\system32\taskeng.exe (ID 1816 |ParentID 1336)
C:\Program Files\Google\Update\GoogleUpdate.exe (ID 1756 |ParentID 1628)
C:\Program Files\GoforFiles\GFFUpdater.exe (ID 2080 |ParentID 1816)
C:\Windows\system32\taskeng.exe (ID 2088 |ParentID 1336)
C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (ID 2436 |ParentID 792)
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (ID 2460 |ParentID 792)
C:\Program Files\Bonjour\mDNSResponder.exe (ID 2492 |ParentID 792)
C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe (ID 2528 |ParentID 792)
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe (ID 2728 |ParentID 792)
c:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe (ID 2752 |ParentID 792)
C:\Windows\system32\svchost.exe (ID 2812 |ParentID 792)
C:\Windows\system32\svchost.exe (ID 2840 |ParentID 792)
C:\Windows\System32\svchost.exe (ID 2856 |ParentID 792)
C:\Windows\System32\svchost.exe (ID 2916 |ParentID 792)
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (ID 2964 |ParentID 792)
C:\Windows\system32\SearchIndexer.exe (ID 3048 |ParentID 792)
C:\Program Files\CheckPoint\ZoneAlarm\ZAPrivacyService.exe (ID 3104 |ParentID 792)
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (ID 3164 |ParentID 2964)
C:\Windows\System32\alg.exe (ID 3760 |ParentID 792)
C:\Program Files\Windows Defender\MSASCui.exe (ID 3968 |ParentID 2000)
C:\Windows\RtHDVCpl.exe (ID 4016 |ParentID 2000)
C:\Windows\WindowsMobile\wmdc.exe (ID 2072 |ParentID 2000)
C:\Program Files\CheckPoint\ZoneAlarm\zatray.exe (ID 2268 |ParentID 2000)
C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe (ID 1532 |ParentID 2000)
C:\Program Files\iTunes\iTunesHelper.exe (ID 2824 |ParentID 2000)
C:\Windows\system32\svchost.exe (ID 2956 |ParentID 792)
C:\Windows\ehome\ehtray.exe (ID 2932 |ParentID 2000)
C:\Program Files\Windows Media Player\wmpnscfg.exe (ID 3404 |ParentID 2000)
C:\Program Files\Sony\Sony PC Companion\PCCompanion.exe (ID 3224 |ParentID 2000)
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (ID 3976 |ParentID 2000)
C:\Windows\ehome\ehmsas.exe (ID 1144 |ParentID 1004)
C:\Program Files\HomePlayer\HomePlayer.exe (ID 3816 |ParentID 2264)
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe (ID 3440 |ParentID 1004)
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe (ID 3236 |ParentID 1004)
C:\Program Files\Sony\Sony PC Companion\PCCompanionInfo.exe (ID 4148 |ParentID 3224)
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (ID 4172 |ParentID 792)
C:\Windows\system32\wbem\unsecapp.exe (ID 4404 |ParentID 1004)
C:\Windows\system32\wbem\wmiprvse.exe (ID 4508 |ParentID 1004)
C:\Program Files\iPod\bin\iPodService.exe (ID 4584 |ParentID 792)
C:\Windows\system32\svchost.exe (ID 5528 |ParentID 792)
C:\Windows\system32\svchost.exe (ID 5236 |ParentID 792)
C:\Program Files\Mozilla Firefox\firefox.exe (ID 3900 |ParentID 4484)
C:\Program Files\Common Files\Apple\Apple Application Support\distnoted.exe (ID 3484 |ParentID 5672)
C:\Program Files\Common Files\Apple\Mobile Device Support\SyncServer.exe (ID 3288 |ParentID 5672)
C:\Program Files\Windows Media Player\wmplayer.exe (ID 1940 |ParentID 4164)
C:\Windows\System32\WUDFHost.exe (ID 5816 |ParentID 1292)
C:\Windows\system32\SearchProtocolHost.exe (ID 5768 |ParentID 3048)
C:\Windows\system32\SearchFilterHost.exe (ID 1712 |ParentID 3048)
C:\UsbFix\Go.exe (ID 4880 |ParentID 4208)
C:\Windows\system32\wbem\wmiprvse.exe (ID 4140 |ParentID 1004)

################## | Regedit Run |

HKLM\SOFTWARE | Run : [Windows Defender] - %ProgramFiles%\Windows Defender\MSASCui.exe -hide
HKLM\SOFTWARE | Run : [RtHDVCpl] - RtHDVCpl.exe
HKLM\SOFTWARE | Run : [StartCCC] - "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
HKLM\SOFTWARE | Run : [Windows Mobile Device Center] - %windir%\WindowsMobile\wmdc.exe
HKLM\SOFTWARE | Run : [APSDaemon] - "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
HKLM\SOFTWARE | Run : [Adobe ARM] - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
HKLM\SOFTWARE | Run : [QuickTime Task] - "C:\Program Files\QuickTime\QTTask.exe" -atboottime
HKLM\SOFTWARE | Run : [ZoneAlarm] - "C:\Program Files\CheckPoint\ZoneAlarm\zatray.exe"
HKLM\SOFTWARE | Run : [LogitechQuickCamRibbon] - "C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe" /hide
HKLM\SOFTWARE | Run : [HomePlayer] - C:\Program Files\HomePlayer\HomePlayer.exe -autostart
HKLM\SOFTWARE | Run : [AppleSyncNotifier] - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
HKLM\SOFTWARE | Run : [iTunesHelper] - "C:\Program Files\iTunes\iTunesHelper.exe"
HKLM\SOFTWARE | RunOnce : [] - 
HKU\S-1-5-19\SOFTWARE | Run : [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem
HKU\S-1-5-19\SOFTWARE | Run : [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20\SOFTWARE | Run : [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem
HKU\S-1-5-20\SOFTWARE | Run : [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-2696754555-2683832322-2093072346-1000\SOFTWARE | Run : [ehTray.exe] - C:\Windows\ehome\ehTray.exe
HKU\S-1-5-21-2696754555-2683832322-2093072346-1000\SOFTWARE | Run : [WMPNSCFG] - C:\Program Files\Windows Media Player\WMPNSCFG.exe
HKU\S-1-5-21-2696754555-2683832322-2093072346-1000\SOFTWARE | Run : [Sony PC Companion] - "C:\Program Files\Sony\Sony PC Companion\PCCompanion.exe" /Background
HKU\S-1-5-21-2696754555-2683832322-2093072346-1000\SOFTWARE | Run : [MobileDocuments] - C:\Program Files\Common Files\Apple\Internet Services\ubd.exe
HKU\S-1-5-21-2696754555-2683832322-2093072346-1000\SOFTWARE | Run : [Facebook Update] - "C:\Users\Mon PC\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
HKU\S-1-5-21-2696754555-2683832322-2093072346-1000\SOFTWARE | Run : [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] - "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"

################## | Éléments infectieux |


################## | Registre |

HKCU\.\.\.\.\Explorer\MountPoints2\{fd253f17-f3fe-11e1-91f9-001bfc71ec52}
Shell\AutoRun\Command = G:\Startme.exe



################## | Vaccin |

(!) Cet ordinateur n'est pas vacciné!

################## | E.O.F | http://www.usbfix.net - http://www.sosvirus.net |