############################## | UsbFix V 7.138 | [Suppression] Utilisateur: Zarechi (Administrateur) # OPTIMUSPRIME Mis à jour le 20/09/2013 par El Desaparecido - Team SosVirus Lancé à 20:16:30 | 30/09/2013 Site Web: http://www.usbfix.net/ Forum : http://www.sosvirus.net/ Upload Malware: http://www.sosvirus.net/upload_malware.php Contact: http://www.usbfix.net/contact/ PC: ASUSTeK COMPUTER INC. (K56CM) (x64-based PC) CPU: Intel(R) Core(TM) i3-3217U CPU @ 1.80GHz (1801) RAM -> [Total : 3982 | Free : 1063] BIOS: K56CM.209 BOOT: Normal boot OS: Microsoft Windows 8 (6.2.9200 64-Bit) # WB: Windows Internet Explorer 10.0.9200.16688 SC: Security Center Service [Enabled] WU: Windows Update Service [(!) Disabled] AV: avast! Antivirus [Enabled | Updated] FW: Windows FireWall Service [Enabled] C:\ (%systemdrive%) -> Disque fixe # 279 Go (149 Go libre(s) - 53%) [OS] # NTFS D:\ -> Disque fixe # 398 Go (397 Go libre(s) - 100%) [DATA] # NTFS E:\ -> CD-ROM F:\ -> CD-ROM G:\ -> Disque fixe # 932 Go (283 Go libre(s) - 30%) [BumbleBee] # NTFS ################## | El Desaparecido Section | HKLM\SOFTWARE | Run : [ASUSPRP] - "C:\Program Files (x86)\ASUS\APRP\APRP.EXE" HKLM\SOFTWARE | Run : [ASUSWebStorage] - C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.10.123\AsusWSPanel.exe /S HKLM\SOFTWARE | Run : [RemoteControl10] - "C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe" HKLM\SOFTWARE | Run : [ATLauncher] - "C:\Program Files\McAfee\MSC\OOBE\ATLauncher.exe" /createshortcuts:1 HKLM\SOFTWARE | Run : [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" HKLM\SOFTWARE | Run : [avast] - "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui HKLM\SOFTWARE | Run : [SunJavaUpdateSched] - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" HKLM\SOFTWARE | Run : [SwitchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe HKLM\SOFTWARE | Run : [AdobeCS6ServiceManager] - "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin HKLM\SOFTWARE | Run : [GrooveMonitor] - "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" HKLM\SOFTWARE\wow6432Node | Run : [ASUSPRP] - "C:\Program Files (x86)\ASUS\APRP\APRP.EXE" HKLM\SOFTWARE\wow6432Node | Run : [ASUSWebStorage] - C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.10.123\AsusWSPanel.exe /S HKLM\SOFTWARE\wow6432Node | Run : [RemoteControl10] - "C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe" HKLM\SOFTWARE\wow6432Node | Run : [ATLauncher] - "C:\Program Files\McAfee\MSC\OOBE\ATLauncher.exe" /createshortcuts:1 HKLM\SOFTWARE\wow6432Node | Run : [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" HKLM\SOFTWARE\wow6432Node | Run : [avast] - "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui HKLM\SOFTWARE\wow6432Node | Run : [SunJavaUpdateSched] - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" HKLM\SOFTWARE\wow6432Node | Run : [SwitchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe HKLM\SOFTWARE\wow6432Node | Run : [AdobeCS6ServiceManager] - "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin HKLM\SOFTWARE\wow6432Node | Run : [GrooveMonitor] - "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" HKLM\SOFTWARE | RunOnce : [] - HKLM\SOFTWARE\wow6432Node | RunOnce : [] - HKU\S-1-5-21-4154473169-124205256-1281812686-1002\SOFTWARE | Run : [Skype] - "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun HKU\S-1-5-21-4154473169-124205256-1281812686-1002\SOFTWARE | Run : [DAEMON Tools Lite] - "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun HKU\S-1-5-21-4154473169-124205256-1281812686-1002\SOFTWARE | Run : [Steam] - "C:\Program Files (x86)\Steam\Steam.exe" -silent HKU\S-1-5-21-4154473169-124205256-1281812686-1002\SOFTWARE | Run : [AdobeBridge] - ################## | Processus Stoppés | Stoppé! C:\Windows\system32\nvvsvc.exe (80) Stoppé! C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe (1420) Stoppé! C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe (1512) Stoppé! C:\Program Files\AVAST Software\Avast\AvastSvc.exe (1548) Stoppé! C:\Windows\System32\spoolsv.exe (1980) Stoppé! C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (2368) Stoppé! C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnSrv.exe (2480) Stoppé! C:\Windows\system32\DptfParticipantProcessorService.exe (2540) Stoppé! C:\Windows\system32\dashost.exe (2584) Stoppé! C:\Windows\system32\DptfPolicyConfigTDPService.exe (2616) Stoppé! C:\Program Files\Diskeeper Corporation\ExpressCache\ExpressCache.exe (2676) Stoppé! C:\Program Files (x86)\Freemake\CaptureLib\CaptureLibService.exe (2708) Stoppé! C:\Program Files\Intel\iCLS Client\HeciServer.exe (2808) Stoppé! C:\Windows\SysWOW64\irstrtsv.exe (2900) Stoppé! C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe (2932) Stoppé! C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (2228) Stoppé! C:\Windows\system32\rundll32.exe (2440) Stoppé! C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (2412) Stoppé! C:\Windows\System32\alg.exe (3468) Stoppé! C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe (4924) Stoppé! C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (4952) Stoppé! C:\Windows\system32\SearchIndexer.exe (5072) Stoppé! C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (3576) Stoppé! C:\Program Files\Windows Media Player\wmpnetwk.exe (4324) Stoppé! C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (9536) Stoppé! C:\Windows\system32\nvvsvc.exe (4832) Stoppé! C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe (6908) Stoppé! C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnWMI.exe (5208) Stoppé! C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (9244) Stoppé! C:\Windows\system32\conhost.exe (2768) Stoppé! C:\Program Files\ASUS\P4G\BatteryLife.exe (6404) Stoppé! C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe (8232) Stoppé! C:\Windows\system32\taskhostex.exe (5504) Stoppé! C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe (3816) Stoppé! C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe (3624) Stoppé! C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe (7388) Stoppé! C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (10336) Stoppé! C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (3888) Stoppé! C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1114.318_x64__8wekyb3d8bbwe\LiveComm.exe (8912) Stoppé! C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (8524) Stoppé! C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLoader.exe (10232) Stoppé! C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x64\QuickGesture64.exe (8236) Stoppé! C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x86\QuickGesture.exe (7284) Stoppé! C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPCenter.exe (7628) Stoppé! C:\Windows\System32\RuntimeBroker.exe (1308) Stoppé! C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPHelper.exe (5876) Stoppé! C:\Windows\System32\igfxtray.exe (9620) Stoppé! C:\Windows\System32\hkcmd.exe (11176) Stoppé! C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (1464) Stoppé! C:\Program Files (x86)\ASUS\Splendid\ACMON.exe (5520) Stoppé! C:\Windows\system32\igfxpers.exe (6260) Stoppé! C:\Windows\SysWOW64\ACEngSvr.exe (6844) Stoppé! C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe (6236) Stoppé! C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe (7512) Stoppé! C:\Program Files (x86)\Skype\Phone\Skype.exe (6468) Stoppé! C:\Program Files (x86)\Steam\Steam.exe (6428) Stoppé! C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe (3724) Stoppé! C:\Program Files\AVAST Software\Avast\AvastUI.exe (2924) Stoppé! C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (9560) Stoppé! C:\Program Files (x86)\Common Files\Steam\SteamService.exe (9084) Stoppé! C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe (8120) Stoppé! C:\Program Files (x86)\Mozilla Firefox\firefox.exe (6760) Stoppé! C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe (8516) Stoppé! C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe (10168) Stoppé! C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe (8332) Stoppé! C:\Windows\System32\WUDFHost.exe (10020) Stoppé! C:\Users\Zarechi\Downloads\RogueKillerX64.exe (6552) Stoppé! C:\Windows\system32\taskeng.exe (6808) Stoppé! C:\Program Files (x86)\Google\Update\GoogleUpdate.exe (9828) Stoppé! C:\Program Files (x86)\Google\Update\GoogleUpdate.exe (10488) Stoppé! C:\Windows\syswow64\wwahost.exe (9000) ################## | Éléments infectieux | Supprimé! G:\$RECYCLE.BIN.lnk Supprimé! G:\Bibliothèque.lnk Supprimé! G:\bibliothèques.lnk Supprimé! G:\media.lnk Supprimé! G:\msdownld.tmp.lnk Supprimé! G:\ProgramData.lnk Supprimé! G:\Seagate.lnk Supprimé! G:\System Volume Information.lnk Supprimé! G:\UserGuides.lnk Supprimé! G:\_Memeo.lnk Supprimé! C:\Users\Zarechi\AppData\Local\Temp\7z.exe Non supprimé ! F:\Setup.exe Non supprimé ! F:\Autorun.inf Supprimé! G:\Autorun.inf Supprimé! G:\snkb0pt\desktop.ini Supprimé! G:\snkb0pt (!) Fichiers temporaires supprimés. ################## | Registre | ################## | Mountpoints2 | Supprimé! HKCU\.\.\.\.\Explorer\MountPoints2\{9c73e731-cb86-11e2-be7e-60a44c01870c} ################## | Listing | [25/05/2013 - 23:05:38 | SHD ] C:\$Recycle.Bin [22/09/2013 - 19:16:45 | RASD ] C:\Autorun.inf [27/11/2012 - 15:00:09 | SD ] C:\Boot [26/07/2012 - 05:44:30 | RAS | 398156] C:\bootmgr [02/06/2012 - 16:30:55 | N | 1] C:\BOOTNXT [29/09/2013 - 16:11:41 | D ] C:\Config.Msi [26/07/2012 - 09:22:08 | SHD ] C:\Documents and Settings [05/02/2013 - 19:02:05 | D ] C:\eSupport [28/09/2013 - 18:16:57 | ASH | 3339931648] C:\hiberfil.sys [05/02/2013 - 18:40:37 | D ] C:\Intel [13/11/2012 - 08:32:50 | N | 6293504] C:\K56CA.BIN [21/11/2012 - 08:22:54 | N | 6293504] C:\K56CM.BIN [28/08/2013 - 20:46:50 | RD ] C:\MSOCache [25/05/2013 - 18:58:13 | D ] C:\NVIDIA [28/09/2013 - 20:04:10 | ASH | 4294967296] C:\pagefile.sys [26/07/2012 - 09:33:46 | D ] C:\PerfLogs [26/07/2013 - 20:57:12 | D ] C:\Program Files [29/09/2013 - 17:36:22 | D ] C:\Program Files (x86) [29/09/2013 - 15:46:40 | D ] C:\ProgramData [29/09/2013 - 13:31:35 | D ] C:\PSFONTS [04/05/2013 - 22:36:08 | D ] C:\sources [28/09/2013 - 20:04:10 | ASH | 268435456] C:\swapfile.sys [27/09/2013 - 21:32:44 | SHD ] C:\System Volume Information [22/09/2013 - 19:16:47 | N | 6380089] C:\Upload_UsbFix.zip [30/09/2013 - 20:18:52 | D ] C:\UsbFix [30/09/2013 - 20:19:08 | A | 11179] C:\UsbFix [Clean 2] OPTIMUSPRIME.txt [22/05/2013 - 21:12:48 | D ] C:\Users [27/09/2013 - 17:24:41 | D ] C:\Windows [04/05/2013 - 01:58:56 | SHD ] D:\$RECYCLE.BIN [22/09/2013 - 19:16:45 | RASD ] D:\Autorun.inf [06/06/2013 - 21:59:38 | D ] D:\msdownld.tmp [05/02/2013 - 18:33:55 | SHD ] D:\System Volume Information [10/09/2013 - 19:33:21 | RD ] F:\Crack [10/09/2009 - 05:36:21 | R | 60] F:\Autorun.inf [10/09/2013 - 19:19:45 | R | 498125056] F:\Setup-1.bin [10/09/2013 - 19:20:36 | R | 500000000] F:\Setup-2.bin [10/09/2013 - 19:21:31 | R | 500000000] F:\Setup-3.bin [10/09/2013 - 19:23:51 | R | 500000000] F:\Setup-4.bin [10/09/2013 - 19:25:31 | R | 500000000] F:\Setup-5.bin [10/09/2013 - 19:27:13 | R | 287858500] F:\Setup-6.bin [10/09/2013 - 19:27:13 | R | 1874543] F:\Setup.exe [18/09/2013 - 13:40:38 | RSHD ] G:\$RECYCLE.BIN [21/09/2013 - 18:30:11 | D ] G:\Bibliothèque [21/09/2013 - 18:30:11 | D ] G:\bibliothèques [18/03/2010 - 09:49:00 | N | 65643] G:\GoFlex.ico [03/10/2012 - 21:15:56 | N | 10314] G:\https.docx [25/07/2011 - 19:39:38 | N | 37254817] G:\Mac Installer.dmg [22/08/2013 - 16:34:28 | D ] G:\media [05/05/2013 - 13:47:25 | D ] G:\msdownld.tmp [30/07/2012 - 17:28:29 | RSD ] G:\ProgramData [19/11/2011 - 19:06:09 | D ] G:\Seagate [16/01/2009 - 10:14:08 | N | 156312] G:\Setup.exe [28/09/2013 - 23:03:38 | SHD ] G:\System Volume Information [19/11/2011 - 19:06:17 | D ] G:\UserGuides [12/07/2012 - 09:25:45 | D ] G:\_Memeo [03/10/2012 - 21:22:34 | N | 162] G:\~$https.docx ################## | Vaccin | C:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido) D:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido) G:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido) ################## | E.O.F | http://www.usbfix.net - http://www.sosvirus.net |