[b]############################## | UsbFix V 7.181 | [Recherche][/b]

Utilisateur: Princesse Cynthia (Administrateur) # PRINCESSE_PC
Mis � jour le 31/08/2014 par El Desaparecido - SosVirus
Lanc� � 21:37:47 | 03/09/2014

Site Web : [url=http://www.usbfix.net/]http://www.usbfix.net/[/url]
Changelog : [url=http://www.usbfix.net/maj/]http://www.usbfix.net/maj/[/url]
Assistance : [url=http://www.sosvirus.net/forum-virus-securite.html]http://www.sosvirus.net/forum-virus-securite.html[/url]
Upload Malware : [url=http://www.sosvirus.net/upload_malware.php]http://www.sosvirus.net/upload_malware.php[/url]
Contact : [url=http://www.usbfix.net/contact/]http://www.usbfix.net/contact/[/url]

[b]################## | System information |[/b]

MB: FUJITSU SIEMENS (D48)
CPU: Celeron(R) Dual-Core CPU T3000 @ 1.80GHz
GC: Mobile Intel(R) 4 Series Express Chipset Family
RAM -> [Total : 2009 Mo | Free : 804 Mo]
Bios: Phoenix Technologies LTD
Boot: Normal boot

OS: Microsoft� Windows 7 Professional (6.1.7601 32-Bit) Service Pack 1
WB: Internet Explorer : 11.00.9600.16428
WB: Google Chrome : 37.0.2062.102
WB: Mozilla Firefox : 31.0

[b]################## | Security Information |[/b]

AV: avast! Antivirus [Actif |A jour]
AS: Windows Defender [Actif |A jour]
AS: avast! Antivirus [Actif |A jour]
FW: Windows Firewall [Actif]
SC: Security Center [Actif]
WU: Windows Update [Actif]

[b]################## | Disk Information |[/b]

C:\ (%SystemDrive%) -> Disque fixe # 231 Go (60 Go libre(s) - 26%) [System] # NTFS
F:\ -> Disque amovible # 30 Go (30 Go libre(s) - 100%) [P CYNTHIA] # FAT32

[b]################## | Regedit Run |[/b]

F2 - HKLM\..\Winlogon : [Shell] explorer.exe
F2 - HKLM\..\Winlogon : [Userinit] C:\Windows\system32\userinit.exe,
04 - HKCU\..\Run : [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
04 - HKCU\..\Run : [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
04 - HKCU\..\Run : [Facebook Update] "C:\Users\Princesse Cynthia\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
04 - HKCU\..\Run : [Berzerk] wscript.exe //B "C:\Users\PRINCE~1\AppData\Local\Temp\Berzerk.vbe"
04 - HKLM\..\Run : [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
04 - HKLM\..\Run : [HotkeyApp] "C:\Program Files\Launch Manager\HotkeyApp.exe"
04 - HKLM\..\Run : [IgfxTray] C:\Windows\system32\igfxtray.exe
04 - HKLM\..\Run : [HotKeysCmds] C:\Windows\system32\hkcmd.exe
04 - HKLM\..\Run : [Persistence] C:\Windows\system32\igfxpers.exe
04 - HKLM\..\Run : [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
04 - HKLM\..\Run : [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
04 - HKLM\..\Run : [SSDMonitor] C:\Program Files\Common Files\PC Tools\sMonitor\SSDMonitor.exe
04 - HKLM\..\Run : [YouCam Mirage] "C:\Program Files\CyberLink\YouCam\YCMMirage.exe"
04 - HKLM\..\Run : [YouCam Tray] "C:\Program Files\CyberLink\YouCam\YouCam.exe" /s
04 - HKLM\..\Run : [AvastUI.exe] "C:\Program Files\Alwil Software\Avast5\AvastUI.exe" /nogui
04 - HKLM\..\Run : [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
04 - HKU\S-1-5-19\..\Run : [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
04 - HKU\S-1-5-20\..\Run : [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
04 - HKU\S-1-5-21-1121260622-2233863223-3392804685-1000\..\Run : [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
04 - HKU\S-1-5-21-1121260622-2233863223-3392804685-1000\..\Run : [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
04 - HKU\S-1-5-21-1121260622-2233863223-3392804685-1000\..\Run : [Facebook Update] "C:\Users\Princesse Cynthia\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
04 - HKU\S-1-5-21-1121260622-2233863223-3392804685-1000\..\Run : [Berzerk] wscript.exe //B "C:\Users\PRINCE~1\AppData\Local\Temp\Berzerk.vbe"
04 - HKU\S-1-5-18\..\Run : [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
04 - HKU\S-1-5-19\..\RunOnce : [mctadmin] C:\Windows\System32\mctadmin.exe
04 - HKU\S-1-5-20\..\RunOnce : [mctadmin] C:\Windows\System32\mctadmin.exe

[b]################## | Recherche g�n�rique |[/b]

Pr�sent! C:\Users\Princesse Cynthia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Berzerk.vbe
Pr�sent! C:\Users\PRINCE~1\AppData\Local\Temp\Berzerk.vbe
Pr�sent! F:\Berzerk.vbe
Pr�sent! C:\Users\Princesse Cynthia\AppData\Local\Temp\Berzerk.vbe

[b]################## | Registre |[/b]

Pr�sent! HKU\S-1-5-21-1121260622-2233863223-3392804685-1000\Software\Microsoft\Windows\CurrentVersion\Run|Berzerk
Pr�sent! HKCU\Software\Microsoft\Windows\CurrentVersion\Run|Berzerk

[b]################## | UsbFix - Information |[/b]

Info : [url=https://www.youtube.com/watch?v=vUZYYASd7FE]Comment supprimer l'infection des raccourcis sur USB ? (Video)[/url]
Info : [url=http://www.en.usbfix.net/2014/03/remove-shortcut-virus-usb/]L'infection des raccourcis USB, c'est quoi ?[/url]

[b]################## | Hijack |[/b]

Hijacked! [SH] F:\Berzerk.vbe
Hijacked! [SH] F:\CV Pharmacie.pdf
Hijacked! [SH] F:\CV Etudiante.pdf
Hijacked! [SH] F:\Demande APL.pdf
Hijacked! [SH] F:\Attestation d'assurance professionnelle.PDF
Hijacked! [SH] F:\dde_passeport.jpg

[b]################## | E.O.F | [url=http://www.sosvirus.net/]http://www.sosvirus.net/[/url] | [url=http://www.usbfix.net/]http://www.usbfix.net/[/url] |[/b]