############################## | UsbFix V 7.126 | [Recherche] Utilisateur: Anthony (Administrateur) # PC-ANTHO Mis à jour le 13/05/2013 par El Desaparecido Lancé à 21:50:36 | 01/06/2013 Site Web: http://sosvirus.org/ Upload Malware: http://upload.sosvirus.org/ Contact: contact@sosvirus.org PC: ASUSTeK COMPUTER INC. (K56CM) (x64-based PC) CPU: Intel(R) Core(TM) i5-3317U CPU @ 1.70GHz (1701) RAM -> [Total : 3982 | Free : 1433] BIOS: K56CM.206 BOOT: Normal boot OS: Microsoft Windows 8 (6.2.9200 64-Bit) # WB: Windows Internet Explorer 10.0.9200.16580 SC: Security Center Service [Enabled] WU: Windows Update Service [(!) Disabled] AV: Windows Defender [(!) Disabled | (!) Outdated] FW: Windows FireWall Service [Enabled] C:\ (%systemdrive%) -> Disque fixe # 264 Go (209 Go libre(s) - 79%) [OS] # NTFS D:\ -> Disque fixe # 398 Go (383 Go libre(s) - 96%) [DATA] # NTFS E:\ -> Disque amovible # 8 Go (7 Go libre(s) - 99%) [CRUZER] # NTFS G:\ -> CD-ROM H:\ -> Disque fixe # 931 Go (918 Go libre(s) - 99%) [My Passport] # NTFS I:\ -> Disque amovible # 2 Go (379 Mo libre(s) - 20%) [USB DISK] # FAT ################## | Processus Actif | C:\Windows\system32\csrss.exe (612) C:\Windows\system32\wininit.exe (688) C:\Windows\system32\csrss.exe (704) C:\Windows\system32\winlogon.exe (748) C:\Windows\system32\services.exe (792) C:\Windows\system32\lsass.exe (800) C:\Windows\system32\svchost.exe (908) C:\Windows\system32\nvvsvc.exe (952) C:\Windows\system32\svchost.exe (996) C:\Windows\System32\svchost.exe (384) C:\Windows\system32\svchost.exe (452) C:\Windows\system32\dwm.exe (620) C:\Windows\system32\svchost.exe (608) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (316) C:\Windows\system32\nvvsvc.exe (1036) C:\Windows\System32\svchost.exe (1120) C:\Windows\system32\svchost.exe (1364) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe (1420) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe (1472) C:\Windows\System32\spoolsv.exe (1576) C:\Windows\system32\svchost.exe (1656) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (1744) C:\Windows\system32\svchost.exe (1792) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (1908) C:\Program Files\Samsung\AllShare Framework DMS\1.3.06\AllShareFrameworkManagerDMS.exe (1944) C:\Program Files\Samsung\AllShare Play\AllShare Play Service.exe (1964) C:\Program Files\Samsung\AllShare Framework DMS\1.3.06\AllShareFrameworkDMS.exe (1972) C:\Windows\system32\conhost.exe (1984) C:\Program Files\Samsung\AllShare Play\AllShare Play Service.exe (2004) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (2016) C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnSrv.exe (1068) C:\Windows\system32\DptfParticipantProcessorService.exe (1560) C:\Windows\system32\DptfPolicyConfigTDPService.exe (1808) C:\Windows\system32\dashost.exe (1868) C:\Program Files\Diskeeper Corporation\ExpressCache\ExpressCache.exe (2080) C:\Program Files\Intel\iCLS Client\HeciServer.exe (2112) C:\Windows\SysWOW64\irstrtsv.exe (2176) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe (2212) C:\Windows\system32\svchost.exe (2368) C:\Program Files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe (2492) C:\Program Files (x86)\Western Digital\WD SmartWare\WDBackupEngine.exe (2760) C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe (3120) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe (3152) C:\Program Files\ASUS\P4G\BatteryLife.exe (3160) C:\Windows\system32\taskhostex.exe (3180) C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnWMI.exe (3208) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLoader.exe (3456) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x64\QuickGesture64.exe (3488) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x86\QuickGesture.exe (3500) C:\Windows\system32\wbem\wmiprvse.exe (3840) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe (3924) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (4000) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\LiveComm.exe (2276) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (4376) C:\Windows\system32\SearchIndexer.exe (4452) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (4552) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (4564) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPHelper.exe (4920) C:\Windows\System32\RuntimeBroker.exe (5040) C:\Windows\System32\igfxtray.exe (2896) C:\Windows\System32\hkcmd.exe (2908) C:\Windows\system32\svchost.exe (4900) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (5096) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe (5260) C:\Windows\system32\igfxpers.exe (5416) C:\Windows\SysWOW64\ACEngSvr.exe (5452) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (5704) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (5892) C:\Program Files (x86)\Western Digital\WD Security\WDDriveAutoUnlock.exe (5920) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe (5952) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (2432) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (4184) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (2632) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPCenter.exe (14408) C:\Windows\system32\wbem\wmiprvse.exe (5412) C:\Windows\explorer.exe (14732) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (3612) C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe (5992) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_202.exe (15480) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_202.exe (5976) C:\Windows\System32\WUDFHost.exe (184) \\?\C:\Windows\system32\wbem\WMIADAP.EXE (4164) C:\UsbFix\Go.exe (6448) ################## | El Desaparecido Section | HKLM\SOFTWARE | Run : [DivXUpdate] - "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW HKLM\SOFTWARE | Run : [avgnt] - "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min HKLM\SOFTWARE | Run : [SunJavaUpdateSched] - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" HKLM\SOFTWARE | Run : [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" HKLM\SOFTWARE | Run : [WD Drive Unlocker] - C:\Program Files (x86)\Western Digital\WD Security\WDDriveAutoUnlock.exe HKLM\SOFTWARE | Run : [WD Quick View] - C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe HKLM\SOFTWARE\wow6432Node | Run : [DivXUpdate] - "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW HKLM\SOFTWARE\wow6432Node | Run : [avgnt] - "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min HKLM\SOFTWARE\wow6432Node | Run : [SunJavaUpdateSched] - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" HKLM\SOFTWARE\wow6432Node | Run : [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" HKLM\SOFTWARE\wow6432Node | Run : [WD Drive Unlocker] - C:\Program Files (x86)\Western Digital\WD Security\WDDriveAutoUnlock.exe HKLM\SOFTWARE\wow6432Node | Run : [WD Quick View] - C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe HKLM\SOFTWARE | RunOnce : [] - HKLM\SOFTWARE\wow6432Node | RunOnce : [] - HKU\S-1-5-21-3124752941-3885292783-1113856017-1002\SOFTWARE | Run : [Spotify] - "C:\Users\Anthony\AppData\Roaming\Spotify\Spotify.exe" /uri spotify:autostart HKU\S-1-5-21-3124752941-3885292783-1113856017-1002\SOFTWARE | Run : [Spotify Web Helper] - "C:\Users\Anthony\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" ################## | Éléments infectieux | Présent! G:\WD Drive Unlock.exe Présent! G:\autorun.inf Présent! I:\Recycler\S-5-3-42-2819952290-8240758988-879315005-3665 ################## | Registre | Présent! HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System|DisableTaskMgr ################## | Mountpoints2 | HKCU\.\.\.\.\Explorer\MountPoints2\{0f63272f-5714-11e2-be85-50465de27868} Shell\AutoRun\Command = "F:\LaunchU3.exe" -a HKCU\.\.\.\.\Explorer\MountPoints2\{dd7f7032-c5da-11e2-bf60-50465de27868} Shell\AutoRun\Command = "G:\WD Drive Unlock.exe" autoplay=true ################## | Vaccin | (!) Cet ordinateur n'est pas vacciné! ################## | E.O.F | http://sosvirus.org |