Publicité
Publicité
Format du document : text/plain
Prévisualisation
[b]############################## | UsbFix V 7.177 | [Recherche][/b]
Utilisateur: Momo (Administrateur) # MOMO
Mis � jour le 29/07/2014 par El Desaparecido - SosVirus
Lanc� � 14:00:56 | 02/08/2014
Site Web : [url=http://www.usbfix.net/]http://www.usbfix.net/[/url]
Changelog : [url=http://www.usbfix.net/maj/]http://www.usbfix.net/maj/[/url]
Assistance : [url=http://www.sosvirus.net/forum-virus-securite.html]http://www.sosvirus.net/forum-virus-securite.html[/url]
Upload Malware : [url=http://www.sosvirus.net/upload_malware.php]http://www.sosvirus.net/upload_malware.php[/url]
Contact : [url=http://www.usbfix.net/contact/]http://www.usbfix.net/contact/[/url]
[b]################## | System information |[/b]
MB: Acer (EA50_CX)
CPU: Intel(R) Pentium(R) CPU 2117U @ 1.80GHz
RAM -> [Total : 8007 Mo | Free : 5845 Mo]
Bios: Insyde Corp.
Boot: Normal boot
OS: Microsoft� Windows 8.1 (6.3.9600 64-Bit)
WB: Internet Explorer : 11.00.9600.16384
WB: Google Chrome : 36.0.1985.125
[b]################## | Security Information |[/b]
AV: Windows Defender [[b](!) D�sactiv�[/b] |A jour]
AV: avast! Antivirus [Actif |A jour]
AS: Windows Defender [[b](!) D�sactiv�[/b] |A jour]
AS: avast! Antivirus [Actif |A jour]
AS: Malwarebytes Anti-Malware : 2.0.2.1012
FW: Windows Firewall [Actif]
SC: Security Center [Actif]
WU: Windows Update [Actif]
[b]################## | Disk Information |[/b]
C:\ (%SystemDrive%) -> Disque fixe # 913 Go (663 Go libre(s) - 73%) [Acer] # NTFS
E:\ -> Disque amovible # 4 Go (46 Mo libre(s) - 1%) [] # FAT32
F:\ -> Disque amovible # 4 Go (1 Go libre(s) - 31%) [MOMO USB] # FAT32
G:\ -> Disque amovible # 4 Go (708 Mo libre(s) - 19%) [ANGRY BIRD] # FAT32
[b]################## | Autorun |[/b]
F:\TPE.lnk -> F:\flashmemory.vbe - (SHA1: 0C9432A8F23136E7E4291CA3E987FB80CBDD72EA)
F:\ANGRY BIRD.lnk -> F:\flashmemory.vbe - (SHA1: 0C9432A8F23136E7E4291CA3E987FB80CBDD72EA)
G:\TPE.lnk -> G:\flashmemory.vbe - (SHA1: 0C9432A8F23136E7E4291CA3E987FB80CBDD72EA)
G:\synth�se MOMO.lnk -> G:\flashmemory.vbe - (SHA1: 0C9432A8F23136E7E4291CA3E987FB80CBDD72EA)
G:\SYNTHESE DAOUDA.lnk -> G:\flashmemory.vbe - (SHA1: 0C9432A8F23136E7E4291CA3E987FB80CBDD72EA)
G:\synthese erwan.lnk -> G:\flashmemory.vbe - (SHA1: 0C9432A8F23136E7E4291CA3E987FB80CBDD72EA)
G:\SECURITY.lnk -> G:\flashmemory.vbe - (SHA1: 0C9432A8F23136E7E4291CA3E987FB80CBDD72EA)
G:\.lnk -> G:\flashmemory.vbe - (SHA1: 0C9432A8F23136E7E4291CA3E987FB80CBDD72EA)
[b]################## | Regedit Run |[/b]
F2 - HKLM\..\Winlogon : [Shell] explorer.exe
F2 - [x64] HKLM\..\Winlogon : [Shell] explorer.exe
F2 - HKLM\..\Winlogon : [Userinit] userinit.exe
F2 - [x64] HKLM\..\Winlogon : [Userinit] C:\Windows\system32\userinit.exe,
04 - HKCU\..\Run : [EPSON Stylus SX400] C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIEGE.EXE /FU "C:\Windows\TEMP\E_S63CD.tmp" /EF "HKCU"
04 - HKCU\..\Run : [Spotify Web Helper] "C:\Users\Mohamed\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"
04 - HKCU\..\Run : [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
04 - HKLM\..\Run : [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
04 - HKLM\..\Run : [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
04 - HKLM\..\Run : [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
04 - HKLM\..\Run : [LogMeIn Hamachi Ui] "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
04 - HKLM\..\Policies\Explorer\run : [BtvStack] "C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe"
04 - [x64] HKLM\..\Run : [IgfxTray] "C:\WINDOWS\system32\igfxtray.exe"
04 - [x64] HKLM\..\Run : [HotKeysCmds] "C:\WINDOWS\system32\hkcmd.exe"
04 - [x64] HKLM\..\Run : [Persistence] "C:\WINDOWS\system32\igfxpers.exe"
04 - [x64] HKLM\..\Run : [ETDCtrl] %ProgramFiles%\Elantech\ETDCtrl.exe
04 - [x64] HKLM\..\Run : [RTHDVCPL] "C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
04 - [x64] HKLM\..\Policies\Explorer\run : [BtvStack] "C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe"
04 - HKU\S-1-5-21-1555415473-1022194430-1092887353-1001\..\Run : [EPSON Stylus SX400] C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIEGE.EXE /FU "C:\Windows\TEMP\E_S63CD.tmp" /EF "HKCU"
04 - HKU\S-1-5-21-1555415473-1022194430-1092887353-1001\..\Run : [Spotify Web Helper] "C:\Users\Mohamed\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"
04 - HKU\S-1-5-21-1555415473-1022194430-1092887353-1001\..\Run : [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
04 - HKU\S-1-5-21-1555415473-1022194430-1092887353-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\..\Run : [EPSON Stylus SX400] C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIEGE.EXE /FU "C:\Windows\TEMP\E_S63CD.tmp" /EF "HKCU"
04 - HKU\S-1-5-21-1555415473-1022194430-1092887353-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\..\Run : [Spotify Web Helper] "C:\Users\Mohamed\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"
04 - HKU\S-1-5-21-1555415473-1022194430-1092887353-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\..\Run : [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
04 - HKU\S-1-5-21-1555415473-1022194430-1092887353-1006-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\..\Run : [Spotify Web Helper] "C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe"
04 - HKU\S-1-5-21-1555415473-1022194430-1092887353-501-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\..\Run : [Spotify Web Helper] "C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe"
04 - HKU\S-1-5-21-1555415473-1022194430-1092887353-501-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\..\Run : [GoogleChromeAutoLaunch_267FED9747A6CFFD89F00B97321EF136] "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --no-startup-window
[b]################## | Recherche g�n�rique |[/b]
Pr�sent! E:\DCIM.exe
Pr�sent! E:\explorer.exe
Pr�sent! E:\SysAnti.exe
Pr�sent! F:\flashmemory.vbe
Pr�sent! G:\flashmemory.vbe
Pr�sent! F:\TPE.lnk
Pr�sent! F:\ANGRY BIRD.lnk
Pr�sent! G:\TPE.lnk
Pr�sent! G:\synth�se MOMO.lnk
Pr�sent! G:\SYNTHESE DAOUDA.lnk
Pr�sent! G:\synthese erwan.lnk
Pr�sent! G:\SECURITY.lnk
Pr�sent! G:\.lnk
Pr�sent! E:\Autorun.inf
Pr�sent! F:\ANGRY BIRD\flashmemory.vbe
[b]################## | Registre |[/b]
[b]################## | UsbFix - Information |[/b]
Info : [url=https://www.youtube.com/watch?v=vUZYYASd7FE]Comment supprimer l'infection des raccourcis sur USB ? (Video)[/url]
Info : [url=http://www.en.usbfix.net/2014/03/remove-shortcut-virus-usb/]L'infection des raccourcis USB, c'est quoi ?[/url]
[b]################## | Hijack |[/b]
Hijacked! [HD] E:\DCIM
Hijacked! [SH] E:\SysAnti.exe
Hijacked! [RASH] E:\explorer.exe
Hijacked! [RASH] E:\AutoRun.inf
Hijacked! [SH] F:\flashmemory.vbe
Hijacked! [SHD] F:\ANGRY BIRD
Hijacked! [SH] F:\TPE.odt
Hijacked! [ASH] G:\flashmemory.vbe
Hijacked! [SH] G:\synth�se MOMO.odt
Hijacked! [SHD] G:\SECURITY
Hijacked! [SH] G:\synthese erwan.doc
Hijacked! [AH] G:\.~lock.dissert.odt#
[b]################## | E.O.F | [url=http://www.sosvirus.net/]http://www.sosvirus.net/[/url] | [url=http://www.usbfix.net/]http://www.usbfix.net/[/url] |[/b]
Utilisateur: Momo (Administrateur) # MOMO
Mis � jour le 29/07/2014 par El Desaparecido - SosVirus
Lanc� � 14:00:56 | 02/08/2014
Site Web : [url=http://www.usbfix.net/]http://www.usbfix.net/[/url]
Changelog : [url=http://www.usbfix.net/maj/]http://www.usbfix.net/maj/[/url]
Assistance : [url=http://www.sosvirus.net/forum-virus-securite.html]http://www.sosvirus.net/forum-virus-securite.html[/url]
Upload Malware : [url=http://www.sosvirus.net/upload_malware.php]http://www.sosvirus.net/upload_malware.php[/url]
Contact : [url=http://www.usbfix.net/contact/]http://www.usbfix.net/contact/[/url]
[b]################## | System information |[/b]
MB: Acer (EA50_CX)
CPU: Intel(R) Pentium(R) CPU 2117U @ 1.80GHz
RAM -> [Total : 8007 Mo | Free : 5845 Mo]
Bios: Insyde Corp.
Boot: Normal boot
OS: Microsoft� Windows 8.1 (6.3.9600 64-Bit)
WB: Internet Explorer : 11.00.9600.16384
WB: Google Chrome : 36.0.1985.125
[b]################## | Security Information |[/b]
AV: Windows Defender [[b](!) D�sactiv�[/b] |A jour]
AV: avast! Antivirus [Actif |A jour]
AS: Windows Defender [[b](!) D�sactiv�[/b] |A jour]
AS: avast! Antivirus [Actif |A jour]
AS: Malwarebytes Anti-Malware : 2.0.2.1012
FW: Windows Firewall [Actif]
SC: Security Center [Actif]
WU: Windows Update [Actif]
[b]################## | Disk Information |[/b]
C:\ (%SystemDrive%) -> Disque fixe # 913 Go (663 Go libre(s) - 73%) [Acer] # NTFS
E:\ -> Disque amovible # 4 Go (46 Mo libre(s) - 1%) [] # FAT32
F:\ -> Disque amovible # 4 Go (1 Go libre(s) - 31%) [MOMO USB] # FAT32
G:\ -> Disque amovible # 4 Go (708 Mo libre(s) - 19%) [ANGRY BIRD] # FAT32
[b]################## | Autorun |[/b]
F:\TPE.lnk -> F:\flashmemory.vbe - (SHA1: 0C9432A8F23136E7E4291CA3E987FB80CBDD72EA)
F:\ANGRY BIRD.lnk -> F:\flashmemory.vbe - (SHA1: 0C9432A8F23136E7E4291CA3E987FB80CBDD72EA)
G:\TPE.lnk -> G:\flashmemory.vbe - (SHA1: 0C9432A8F23136E7E4291CA3E987FB80CBDD72EA)
G:\synth�se MOMO.lnk -> G:\flashmemory.vbe - (SHA1: 0C9432A8F23136E7E4291CA3E987FB80CBDD72EA)
G:\SYNTHESE DAOUDA.lnk -> G:\flashmemory.vbe - (SHA1: 0C9432A8F23136E7E4291CA3E987FB80CBDD72EA)
G:\synthese erwan.lnk -> G:\flashmemory.vbe - (SHA1: 0C9432A8F23136E7E4291CA3E987FB80CBDD72EA)
G:\SECURITY.lnk -> G:\flashmemory.vbe - (SHA1: 0C9432A8F23136E7E4291CA3E987FB80CBDD72EA)
G:\.lnk -> G:\flashmemory.vbe - (SHA1: 0C9432A8F23136E7E4291CA3E987FB80CBDD72EA)
[b]################## | Regedit Run |[/b]
F2 - HKLM\..\Winlogon : [Shell] explorer.exe
F2 - [x64] HKLM\..\Winlogon : [Shell] explorer.exe
F2 - HKLM\..\Winlogon : [Userinit] userinit.exe
F2 - [x64] HKLM\..\Winlogon : [Userinit] C:\Windows\system32\userinit.exe,
04 - HKCU\..\Run : [EPSON Stylus SX400] C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIEGE.EXE /FU "C:\Windows\TEMP\E_S63CD.tmp" /EF "HKCU"
04 - HKCU\..\Run : [Spotify Web Helper] "C:\Users\Mohamed\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"
04 - HKCU\..\Run : [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
04 - HKLM\..\Run : [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
04 - HKLM\..\Run : [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
04 - HKLM\..\Run : [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
04 - HKLM\..\Run : [LogMeIn Hamachi Ui] "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
04 - HKLM\..\Policies\Explorer\run : [BtvStack] "C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe"
04 - [x64] HKLM\..\Run : [IgfxTray] "C:\WINDOWS\system32\igfxtray.exe"
04 - [x64] HKLM\..\Run : [HotKeysCmds] "C:\WINDOWS\system32\hkcmd.exe"
04 - [x64] HKLM\..\Run : [Persistence] "C:\WINDOWS\system32\igfxpers.exe"
04 - [x64] HKLM\..\Run : [ETDCtrl] %ProgramFiles%\Elantech\ETDCtrl.exe
04 - [x64] HKLM\..\Run : [RTHDVCPL] "C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
04 - [x64] HKLM\..\Policies\Explorer\run : [BtvStack] "C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe"
04 - HKU\S-1-5-21-1555415473-1022194430-1092887353-1001\..\Run : [EPSON Stylus SX400] C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIEGE.EXE /FU "C:\Windows\TEMP\E_S63CD.tmp" /EF "HKCU"
04 - HKU\S-1-5-21-1555415473-1022194430-1092887353-1001\..\Run : [Spotify Web Helper] "C:\Users\Mohamed\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"
04 - HKU\S-1-5-21-1555415473-1022194430-1092887353-1001\..\Run : [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
04 - HKU\S-1-5-21-1555415473-1022194430-1092887353-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\..\Run : [EPSON Stylus SX400] C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIEGE.EXE /FU "C:\Windows\TEMP\E_S63CD.tmp" /EF "HKCU"
04 - HKU\S-1-5-21-1555415473-1022194430-1092887353-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\..\Run : [Spotify Web Helper] "C:\Users\Mohamed\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"
04 - HKU\S-1-5-21-1555415473-1022194430-1092887353-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\..\Run : [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
04 - HKU\S-1-5-21-1555415473-1022194430-1092887353-1006-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\..\Run : [Spotify Web Helper] "C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe"
04 - HKU\S-1-5-21-1555415473-1022194430-1092887353-501-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\..\Run : [Spotify Web Helper] "C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe"
04 - HKU\S-1-5-21-1555415473-1022194430-1092887353-501-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\..\Run : [GoogleChromeAutoLaunch_267FED9747A6CFFD89F00B97321EF136] "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --no-startup-window
[b]################## | Recherche g�n�rique |[/b]
Pr�sent! E:\DCIM.exe
Pr�sent! E:\explorer.exe
Pr�sent! E:\SysAnti.exe
Pr�sent! F:\flashmemory.vbe
Pr�sent! G:\flashmemory.vbe
Pr�sent! F:\TPE.lnk
Pr�sent! F:\ANGRY BIRD.lnk
Pr�sent! G:\TPE.lnk
Pr�sent! G:\synth�se MOMO.lnk
Pr�sent! G:\SYNTHESE DAOUDA.lnk
Pr�sent! G:\synthese erwan.lnk
Pr�sent! G:\SECURITY.lnk
Pr�sent! G:\.lnk
Pr�sent! E:\Autorun.inf
Pr�sent! F:\ANGRY BIRD\flashmemory.vbe
[b]################## | Registre |[/b]
[b]################## | UsbFix - Information |[/b]
Info : [url=https://www.youtube.com/watch?v=vUZYYASd7FE]Comment supprimer l'infection des raccourcis sur USB ? (Video)[/url]
Info : [url=http://www.en.usbfix.net/2014/03/remove-shortcut-virus-usb/]L'infection des raccourcis USB, c'est quoi ?[/url]
[b]################## | Hijack |[/b]
Hijacked! [HD] E:\DCIM
Hijacked! [SH] E:\SysAnti.exe
Hijacked! [RASH] E:\explorer.exe
Hijacked! [RASH] E:\AutoRun.inf
Hijacked! [SH] F:\flashmemory.vbe
Hijacked! [SHD] F:\ANGRY BIRD
Hijacked! [SH] F:\TPE.odt
Hijacked! [ASH] G:\flashmemory.vbe
Hijacked! [SH] G:\synth�se MOMO.odt
Hijacked! [SHD] G:\SECURITY
Hijacked! [SH] G:\synthese erwan.doc
Hijacked! [AH] G:\.~lock.dissert.odt#
[b]################## | E.O.F | [url=http://www.sosvirus.net/]http://www.sosvirus.net/[/url] | [url=http://www.usbfix.net/]http://www.usbfix.net/[/url] |[/b]