cjoint

Publicité


Publicité

Format du document : text/plain

Prévisualisation

############################## | UsbFix V 7.163 | [Recherche]

Utilisateur: YASSEM (Administrateur) # SHIELD
Mis � jour le 02/02/2014 par El Desaparecido - Team SosVirus
Lanc� � 11:05:41 | 06/02/2014

Site Web : http://www.usbfix.net
Changelog : http://www.usbfix.net/maj/
Support : http://www.sosvirus.net/
Upload Malware : http://www.sosvirus.net/upload_malware.php
Contact : http://www.usbfix.net/contact/

PC: Sony Corporation (VAIO)
CPU: Intel(R) Core(TM)2 CPU T5300 @ 1.73GHz
RAM -> [Total : 2038 Mo| Free : 689 Mo]
Bios: Phoenix Technologies LTD
Boot: Normal boot

OS: Microsoft Windows XP Professionnel (5.1.2600 32-Bit) Service Pack 3
WB: Windows Internet Explorer : 6.0.2900.5512
WB: Google Chrome : 32.0.1700.102
WB: Mozilla Firefox : 1.8.1: 2006101023

SC: Security Center [Enabled]
WU: Windows Update [Enabled]

FW: Windows FireWall [Enabled]

C:\ (%systemdrive%) -> Disque fixe # 39 Go (13 Go libre(s) - 33%) [] # NTFS
D:\ -> Disque fixe # 73 Go (19 Go libre(s) - 26%) [] # NTFS
E:\ -> CD-ROM
F:\ -> CD-ROM
G:\ -> Disque amovible # 7 Go (7 Go libre(s) - 100%) [TOSHIBA] # FAT32
H:\ -> Disque amovible # 960 Mo (208 Mo libre(s) - 22%) [YVES] # FAT

################## | Processus Actif |

C:\WINDOWS\System32\smss.exe (ID: 732 |ParentID: 4)
C:\WINDOWS\system32\csrss.exe (ID: 996 |ParentID: 732)
C:\WINDOWS\system32\winlogon.exe (ID: 1020 |ParentID: 732)
C:\WINDOWS\system32\services.exe (ID: 1064 |ParentID: 1020)
C:\WINDOWS\system32\lsass.exe (ID: 1076 |ParentID: 1020)
C:\WINDOWS\system32\svchost.exe (ID: 1236 |ParentID: 1064)
C:\WINDOWS\system32\svchost.exe (ID: 1284 |ParentID: 1064)
C:\WINDOWS\System32\svchost.exe (ID: 1324 |ParentID: 1064)
C:\WINDOWS\system32\svchost.exe (ID: 1364 |ParentID: 1064)
C:\WINDOWS\system32\svchost.exe (ID: 1420 |ParentID: 1064)
C:\WINDOWS\system32\svchost.exe (ID: 1500 |ParentID: 1064)
C:\WINDOWS\system32\spoolsv.exe (ID: 1768 |ParentID: 1064)
C:\WINDOWS\Explorer.EXE (ID: 2004 |ParentID: 1912)
C:\Program Files\PowerISO\PWRISOVM.EXE (ID: 404 |ParentID: 2004)
C:\WINDOWS\system32\igfxtray.exe (ID: 416 |ParentID: 2004)
C:\WINDOWS\system32\hkcmd.exe (ID: 424 |ParentID: 2004)
C:\WINDOWS\system32\igfxsrvc.exe (ID: 448 |ParentID: 1236)
C:\WINDOWS\system32\igfxpers.exe (ID: 500 |ParentID: 2004)
C:\Program Files\QuickTime\qttask.exe (ID: 520 |ParentID: 2004)
C:\Program Files\AVG\AVG2014\avgui.exe (ID: 524 |ParentID: 2004)
C:\WINDOWS\system32\wscript.exe (ID: 724 |ParentID: 2004)
C:\WINDOWS\system32\ctfmon.exe (ID: 760 |ParentID: 2004)
C:\Program Files\Messenger\msmsgs.exe (ID: 876 |ParentID: 2004)
C:\Program Files\Launchy\Launchy.exe (ID: 1352 |ParentID: 2004)
C:\Program Files\Bible Verse\verse.exe (ID: 1452 |ParentID: 2004)
C:\WINDOWS\BricoPacks\Crystal Clear\RocketDock\RocketDock.exe (ID: 1440 |ParentID: 2004)
C:\WINDOWS\BricoPacks\Crystal Clear\UberIcon\UberIcon Manager.exe (ID: 1524 |ParentID: 2004)
C:\WINDOWS\BricoPacks\Crystal Clear\YzShadow\YzShadow.exe (ID: 1616 |ParentID: 2004)
C:\WINDOWS\BricoPacks\Crystal Clear\YzToolbar\YzToolBar.exe (ID: 1696 |ParentID: 2004)
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe (ID: 1960 |ParentID: 2004)
C:\Program Files\AVG\AVG2014\avgwdsvc.exe (ID: 556 |ParentID: 1064)
C:\Program Files\Freemake\CaptureLib\CaptureLibService.exe (ID: 1632 |ParentID: 1064)
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe (ID: 2076 |ParentID: 1960)
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe (ID: 2112 |ParentID: 1960)
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe (ID: 2168 |ParentID: 1960)
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe (ID: 2228 |ParentID: 1960)
C:\WINDOWS\System32\WScript.exe (ID: 2916 |ParentID: 388)
C:\WINDOWS\system32\wbem\wmiprvse.exe (ID: 4088 |ParentID: 1236)
C:\WINDOWS\System32\alg.exe (ID: 2144 |ParentID: 1064)
C:\WINDOWS\System32\svchost.exe (ID: 3292 |ParentID: 1064)
C:\Program Files\Google\Chrome\Application\chrome.exe (ID: 3772 |ParentID: 2004)
C:\Program Files\Google\Chrome\Application\chrome.exe (ID: 4016 |ParentID: 3772)
C:\Program Files\Google\Chrome\Application\chrome.exe (ID: 1448 |ParentID: 3772)
C:\Program Files\Google\Chrome\Application\chrome.exe (ID: 1604 |ParentID: 3772)
C:\Program Files\Google\Chrome\Application\chrome.exe (ID: 2896 |ParentID: 3772)
C:\Program Files\Google\Chrome\Application\chrome.exe (ID: 1672 |ParentID: 3772)
C:\Program Files\Google\Chrome\Application\chrome.exe (ID: 172 |ParentID: 3772)
C:\Program Files\Google\Chrome\Application\chrome.exe (ID: 3324 |ParentID: 3772)
C:\Program Files\Google\Chrome\Application\chrome.exe (ID: 1192 |ParentID: 3772)
C:\Program Files\Google\Chrome\Application\chrome.exe (ID: 3208 |ParentID: 3772)
C:\Program Files\Google\Chrome\Application\chrome.exe (ID: 3552 |ParentID: 3772)
C:\Program Files\Google\Chrome\Application\chrome.exe (ID: 2484 |ParentID: 3772)
C:\Program Files\Google\Chrome\Application\chrome.exe (ID: 1268 |ParentID: 3772)
C:\WINDOWS\system32\wuauclt.exe (ID: 4572 |ParentID: 1324)
C:\Program Files\Google\Update\GoogleUpdate.exe (ID: 5304 |ParentID: 1324)
C:\Program Files\Google\Update\GoogleUpdate.exe (ID: 3592 |ParentID: 1064)
C:\Program Files\Google\Chrome\Application\chrome.exe (ID: 4552 |ParentID: 3772)
C:\Documents and Settings\YASSEM\Bureau\RogueKiller.exe (ID: 536 |ParentID: 2004)
C:\WINDOWS\system32\cmd.exe (ID: 5048 |ParentID: 3772)
C:\Documents and Settings\YASSEM\Local Settings\Application Data\NativeMessaging\CT3307695\1_0_0_10\TBMessagingHost.exe (ID: 4856 |ParentID: 5048)
C:\Program Files\Google\Chrome\Application\chrome.exe (ID: 5552 |ParentID: 3772)
C:\Program Files\Microsoft Office\Office12\WINWORD.EXE (ID: 5692 |ParentID: 2004)
C:\WINDOWS\system32\wuauclt.exe (ID: 5500 |ParentID: 1324)
C:\WINDOWS\system32\wscntfy.exe (ID: 4144 |ParentID: 1324)

################## | Regedit Run |

04 - HKCU\..\Run : [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
04 - HKCU\..\Run : [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
04 - HKCU\..\Run : [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
04 - HKCU\..\Run : [TBHostSupport] "C:\WINDOWS\system32\Rundll32.exe" "C:\Documents and Settings\YASSEM\Local Settings\Application Data\TBHostSupport\TBHostSupport.dll",DLLRunTBHostSupportPlugin
04 - HKCU\..\Run : [LiveSupport] "C:\Program Files\LiveSupport\LiveSupport.exe" /noshow /log
04 - HKCU\..\Run : [iLivid] "C:\Documents and Settings\YASSEM\Local Settings\Application Data\iLivid\iLivid.exe" -autorun
04 - HKCU\..\Run : [hCbnTNLj] wscript.exe //B "C:\DOCUME~1\YASSEM\LOCALS~1\Temp\hCbnTNLj.vbs"
04 - HKCU\..\Run : [AVG-Secure-Search-Update_0214c] C:\Documents and Settings\YASSEM\Application Data\AVG 0214c Campaign\AVG-Secure-Search-Update-0214c.exe /PROMPT /mid=83ef938c632647d3b6aed15038c84540-fe15dc9c2ecd4f8b8aedfc32e01bbd11e392d4ab /CMPID=0214c
04 - HKCU\..\Run : [APISupport] "C:\WINDOWS\system32\Rundll32.exe" "C:\Documents and Settings\YASSEM\Local Settings\Application Data\Conduit\APISupport\APISupport.dll",DLLRunAPISupport
04 - HKCU\..\RunOnce : [Bkr] "C:\Documents and Settings\YASSEM\Microsoft\bkr.bat"
04 - HKLM\..\Run : [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
04 - HKLM\..\Run : [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
04 - HKLM\..\Run : [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
04 - HKLM\..\Run : [Persistence] C:\WINDOWS\system32\igfxpers.exe
04 - HKLM\..\Run : [MySight 2006 BS Check&Random] C:\Program Files\MySight 2006\quickbs.exe
04 - HKLM\..\Run : [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
04 - HKLM\..\Run : [AVG_UI] "C:\Program Files\AVG\AVG2014\avgui.exe" /TRAYONLY
04 - HKLM\..\Run : [DrvIcon] C:\Program Files\Vista Drive Icon\DrvIcon.exe
04 - HKLM\..\Run : [Fling] "C:\Program Files\NCH Software\Fling\fling.exe" -logon
04 - HKLM\..\Run : [Adobe ARM] "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
04 - HKLM\..\Run : [hCbnTNLj] wscript.exe //B "C:\DOCUME~1\YASSEM\LOCALS~1\Temp\hCbnTNLj.vbs"
04 - HKLM\..\RunOnce : []
04 - HKLM\..\Policies\Explorer\run : [Updates] "C:\Documents and Settings\YASSEM\Securities\scan.vbe"
04 - HKLM\Software\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\..\Run : []
04 - HKLM\Software\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\..\RunOnce : []
04 - HKU\S-1-5-19\..\Run : [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE
04 - HKU\S-1-5-20\..\Run : [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE
04 - HKU\S-1-5-21-1060284298-776561741-1417001333-1003\..\Run : [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
04 - HKU\S-1-5-21-1060284298-776561741-1417001333-1003\..\Run : [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
04 - HKU\S-1-5-21-1060284298-776561741-1417001333-1003\..\Run : [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
04 - HKU\S-1-5-21-1060284298-776561741-1417001333-1003\..\Run : [TBHostSupport] "C:\WINDOWS\system32\Rundll32.exe" "C:\Documents and Settings\YASSEM\Local Settings\Application Data\TBHostSupport\TBHostSupport.dll",DLLRunTBHostSupportPlugin
04 - HKU\S-1-5-21-1060284298-776561741-1417001333-1003\..\Run : [LiveSupport] "C:\Program Files\LiveSupport\LiveSupport.exe" /noshow /log
04 - HKU\S-1-5-21-1060284298-776561741-1417001333-1003\..\Run : [iLivid] "C:\Documents and Settings\YASSEM\Local Settings\Application Data\iLivid\iLivid.exe" -autorun
04 - HKU\S-1-5-21-1060284298-776561741-1417001333-1003\..\Run : [hCbnTNLj] wscript.exe //B "C:\DOCUME~1\YASSEM\LOCALS~1\Temp\hCbnTNLj.vbs"
04 - HKU\S-1-5-21-1060284298-776561741-1417001333-1003\..\Run : [AVG-Secure-Search-Update_0214c] C:\Documents and Settings\YASSEM\Application Data\AVG 0214c Campaign\AVG-Secure-Search-Update-0214c.exe /PROMPT /mid=83ef938c632647d3b6aed15038c84540-fe15dc9c2ecd4f8b8aedfc32e01bbd11e392d4ab /CMPID=0214c
04 - HKU\S-1-5-21-1060284298-776561741-1417001333-1003\..\Run : [APISupport] "C:\WINDOWS\system32\Rundll32.exe" "C:\Documents and Settings\YASSEM\Local Settings\Application Data\Conduit\APISupport\APISupport.dll",DLLRunAPISupport
04 - HKU\S-1-5-18\..\Run : [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE
04 - HKU\S-1-5-21-1060284298-776561741-1417001333-1003\..\RunOnce : [Bkr] "C:\Documents and Settings\YASSEM\Microsoft\bkr.bat"

################## | Recherche g�n�rique |

Pr�sent! C:\Documents and Settings\YASSEM\Menu D�marrer\Programmes\D�marrage\hCbnTNLj.vbs
Pr�sent! C:\DOCUME~1\YASSEM\LOCALS~1\Temp\scan.vbe
Pr�sent! C:\Documents and Settings\YASSEM\Microsoft\PC_BOOSTER.vbe
Pr�sent! C:\Documents and Settings\YASSEM\Securities\scan.vbe
Pr�sent! C:\Documents and Settings\YASSEM\Securities\update.exe
Pr�sent! D:\usbdriver.vbe
Pr�sent! G:\hCbnTNLj.vbs
Pr�sent! H:\hCbnTNLj.vbs
Pr�sent! C:\DOCUME~1\YASSEM\LOCALS~1\Temp\hCbnTNLj.vbs
Pr�sent! G:\graphlog.lnk
Pr�sent! G:\59secretstemps.lnk
Pr�sent! G:\DOCS.lnk
Pr�sent! H:\La.lnk
Pr�sent! H:\DOCS.lnk
Pr�sent! H:\CV.lnk
Pr�sent! C:\Documents and Settings\YASSEM\Microsoft\sys32.bin
Pr�sent! C:\Documents and Settings\YASSEM\Securities
Pr�sent! C:\Documents and Settings\YASSEM\Local Settings\Temp\hCbnTNLj.vbs
Pr�sent! C:\Documents and Settings\YASSEM\Local Settings\Temp\scan.vbe
Pr�sent! C:\System Volume Information\_restore{F0FE4340-AAAA-4374-8C83-E7B0171146FA}\RP79\A0026597.vbs
Pr�sent! C:\System Volume Information\_restore{F0FE4340-AAAA-4374-8C83-E7B0171146FA}\RP79\A0026643.vbs
Pr�sent! C:\System Volume Information\_restore{F0FE4340-AAAA-4374-8C83-E7B0171146FA}\RP79\A0026783.vbs
Pr�sent! C:\System Volume Information\_restore{F0FE4340-AAAA-4374-8C83-E7B0171146FA}\RP80\A0026860.vbs
Pr�sent! C:\System Volume Information\_restore{F0FE4340-AAAA-4374-8C83-E7B0171146FA}\RP80\A0026877.vbs
Pr�sent! C:\System Volume Information\_restore{F0FE4340-AAAA-4374-8C83-E7B0171146FA}\RP81\A0026934.vbs
Pr�sent! C:\System Volume Information\_restore{F0FE4340-AAAA-4374-8C83-E7B0171146FA}\RP81\A0026954.vbs
Pr�sent! C:\System Volume Information\_restore{F0FE4340-AAAA-4374-8C83-E7B0171146FA}\RP81\A0027029.vbs
Pr�sent! C:\System Volume Information\_restore{F0FE4340-AAAA-4374-8C83-E7B0171146FA}\RP81\A0027078.vbs
Pr�sent! C:\System Volume Information\_restore{F0FE4340-AAAA-4374-8C83-E7B0171146FA}\RP82\A0027246.vbs
Pr�sent! C:\System Volume Information\_restore{F0FE4340-AAAA-4374-8C83-E7B0171146FA}\RP83\A0027262.vbs
Pr�sent! C:\System Volume Information\_restore{F0FE4340-AAAA-4374-8C83-E7B0171146FA}\RP84\A0027317.vbs
Pr�sent! C:\System Volume Information\_restore{F0FE4340-AAAA-4374-8C83-E7B0171146FA}\RP84\A0027397.vbs

################## | Registre |

Pr�sent! HKLM\SYSTEM\CurrentControlSet\Services\npf
Pr�sent! HKLM\SYSTEM\ControlSet001\Services\npf
Pr�sent! HKLM\SYSTEM\ControlSet002\Services\npf
Pr�sent! HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System|EnableLUA -> 0
Pr�sent! HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System|ConsentPromptBehaviorAdmin -> 0
Pr�sent! HKU\S-1-5-21-1060284298-776561741-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\RunOnce|Bkr
Pr�sent! HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run|Updates
Pr�sent! HKU\S-1-5-21-1060284298-776561741-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Run|hCbnTNLj
Pr�sent! HKLM\Software\Microsoft\Windows\CurrentVersion\Run|hCbnTNLj
Pr�sent! HKCU\Software\Microsoft\Windows\CurrentVersion\Run|hCbnTNLj

################## | Vaccin |

C:\Autorun.inf -> Vaccin cr�� par UsbFix (El Desaparecido)
D:\Autorun.inf -> Vaccin cr�� par UsbFix (El Desaparecido)

################## | E.O.F | http://www.usbfix.net - http://www.sosvirus.net |

Publicité


Signaler le contenu de ce document

Publicité