############################## | UsbFix V 7.138 | [Suppression]

Utilisateur: Zarechi (Administrateur) # OPTIMUSPRIME
Mis � jour le 20/09/2013 par El Desaparecido - Team SosVirus
Lanc� � 20:16:30 | 30/09/2013

Site Web: http://www.usbfix.net/
Forum : http://www.sosvirus.net/
Upload Malware: http://www.sosvirus.net/upload_malware.php
Contact: http://www.usbfix.net/contact/

PC: ASUSTeK COMPUTER INC. (K56CM) (x64-based PC)
CPU: Intel(R) Core(TM) i3-3217U CPU @ 1.80GHz (1801)
RAM -> [Total : 3982 | Free : 1063]
BIOS: K56CM.209
BOOT: Normal boot

OS: Microsoft Windows 8 (6.2.9200 64-Bit) #
WB: Windows Internet Explorer 10.0.9200.16688

SC: Security Center Service [Enabled]
WU: Windows Update Service [(!) Disabled]
AV: avast! Antivirus [Enabled | Updated]
FW: Windows FireWall Service [Enabled]

C:\ (%systemdrive%) -> Disque fixe # 279 Go (149 Go libre(s) - 53%) [OS] # NTFS
D:\ -> Disque fixe # 398 Go (397 Go libre(s) - 100%) [DATA] # NTFS
E:\ -> CD-ROM
F:\ -> CD-ROM
G:\ -> Disque fixe # 932 Go (283 Go libre(s) - 30%) [BumbleBee] # NTFS

################## | El Desaparecido Section |

HKLM\SOFTWARE | Run : [ASUSPRP] - "C:\Program Files (x86)\ASUS\APRP\APRP.EXE"
HKLM\SOFTWARE | Run : [ASUSWebStorage] - C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.10.123\AsusWSPanel.exe /S
HKLM\SOFTWARE | Run : [RemoteControl10] - "C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe"
HKLM\SOFTWARE | Run : [ATLauncher] - "C:\Program Files\McAfee\MSC\OOBE\ATLauncher.exe" /createshortcuts:1
HKLM\SOFTWARE | Run : [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
HKLM\SOFTWARE | Run : [avast] - "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
HKLM\SOFTWARE | Run : [SunJavaUpdateSched] - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
HKLM\SOFTWARE | Run : [SwitchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
HKLM\SOFTWARE | Run : [AdobeCS6ServiceManager] - "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin
HKLM\SOFTWARE | Run : [GrooveMonitor] - "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
HKLM\SOFTWARE\wow6432Node | Run : [ASUSPRP] - "C:\Program Files (x86)\ASUS\APRP\APRP.EXE"
HKLM\SOFTWARE\wow6432Node | Run : [ASUSWebStorage] - C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.10.123\AsusWSPanel.exe /S
HKLM\SOFTWARE\wow6432Node | Run : [RemoteControl10] - "C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe"
HKLM\SOFTWARE\wow6432Node | Run : [ATLauncher] - "C:\Program Files\McAfee\MSC\OOBE\ATLauncher.exe" /createshortcuts:1
HKLM\SOFTWARE\wow6432Node | Run : [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
HKLM\SOFTWARE\wow6432Node | Run : [avast] - "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
HKLM\SOFTWARE\wow6432Node | Run : [SunJavaUpdateSched] - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
HKLM\SOFTWARE\wow6432Node | Run : [SwitchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
HKLM\SOFTWARE\wow6432Node | Run : [AdobeCS6ServiceManager] - "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin
HKLM\SOFTWARE\wow6432Node | Run : [GrooveMonitor] - "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
HKLM\SOFTWARE | RunOnce : [] -
HKLM\SOFTWARE\wow6432Node | RunOnce : [] -
HKU\S-1-5-21-4154473169-124205256-1281812686-1002\SOFTWARE | Run : [Skype] - "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
HKU\S-1-5-21-4154473169-124205256-1281812686-1002\SOFTWARE | Run : [DAEMON Tools Lite] - "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
HKU\S-1-5-21-4154473169-124205256-1281812686-1002\SOFTWARE | Run : [Steam] - "C:\Program Files (x86)\Steam\Steam.exe" -silent
HKU\S-1-5-21-4154473169-124205256-1281812686-1002\SOFTWARE | Run : [AdobeBridge] -

################## | Processus Stopp�s |

Stopp�! C:\Windows\system32\nvvsvc.exe (80)
Stopp�! C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe (1420)
Stopp�! C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe (1512)
Stopp�! C:\Program Files\AVAST Software\Avast\AvastSvc.exe (1548)
Stopp�! C:\Windows\System32\spoolsv.exe (1980)
Stopp�! C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (2368)
Stopp�! C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnSrv.exe (2480)
Stopp�! C:\Windows\system32\DptfParticipantProcessorService.exe (2540)
Stopp�! C:\Windows\system32\dashost.exe (2584)
Stopp�! C:\Windows\system32\DptfPolicyConfigTDPService.exe (2616)
Stopp�! C:\Program Files\Diskeeper Corporation\ExpressCache\ExpressCache.exe (2676)
Stopp�! C:\Program Files (x86)\Freemake\CaptureLib\CaptureLibService.exe (2708)
Stopp�! C:\Program Files\Intel\iCLS Client\HeciServer.exe (2808)
Stopp�! C:\Windows\SysWOW64\irstrtsv.exe (2900)
Stopp�! C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe (2932)
Stopp�! C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (2228)
Stopp�! C:\Windows\system32\rundll32.exe (2440)
Stopp�! C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (2412)
Stopp�! C:\Windows\System32\alg.exe (3468)
Stopp�! C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe (4924)
Stopp�! C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (4952)
Stopp�! C:\Windows\system32\SearchIndexer.exe (5072)
Stopp�! C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (3576)
Stopp�! C:\Program Files\Windows Media Player\wmpnetwk.exe (4324)
Stopp�! C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (9536)
Stopp�! C:\Windows\system32\nvvsvc.exe (4832)
Stopp�! C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe (6908)
Stopp�! C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnWMI.exe (5208)
Stopp�! C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (9244)
Stopp�! C:\Windows\system32\conhost.exe (2768)
Stopp�! C:\Program Files\ASUS\P4G\BatteryLife.exe (6404)
Stopp�! C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe (8232)
Stopp�! C:\Windows\system32\taskhostex.exe (5504)
Stopp�! C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe (3816)
Stopp�! C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe (3624)
Stopp�! C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe (7388)
Stopp�! C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (10336)
Stopp�! C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (3888)
Stopp�! C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1114.318_x64__8wekyb3d8bbwe\LiveComm.exe (8912)
Stopp�! C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (8524)
Stopp�! C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLoader.exe (10232)
Stopp�! C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x64\QuickGesture64.exe (8236)
Stopp�! C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x86\QuickGesture.exe (7284)
Stopp�! C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPCenter.exe (7628)
Stopp�! C:\Windows\System32\RuntimeBroker.exe (1308)
Stopp�! C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPHelper.exe (5876)
Stopp�! C:\Windows\System32\igfxtray.exe (9620)
Stopp�! C:\Windows\System32\hkcmd.exe (11176)
Stopp�! C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (1464)
Stopp�! C:\Program Files (x86)\ASUS\Splendid\ACMON.exe (5520)
Stopp�! C:\Windows\system32\igfxpers.exe (6260)
Stopp�! C:\Windows\SysWOW64\ACEngSvr.exe (6844)
Stopp�! C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe (6236)
Stopp�! C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe (7512)
Stopp�! C:\Program Files (x86)\Skype\Phone\Skype.exe (6468)
Stopp�! C:\Program Files (x86)\Steam\Steam.exe (6428)
Stopp�! C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe (3724)
Stopp�! C:\Program Files\AVAST Software\Avast\AvastUI.exe (2924)
Stopp�! C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (9560)
Stopp�! C:\Program Files (x86)\Common Files\Steam\SteamService.exe (9084)
Stopp�! C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe (8120)
Stopp�! C:\Program Files (x86)\Mozilla Firefox\firefox.exe (6760)
Stopp�! C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe (8516)
Stopp�! C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe (10168)
Stopp�! C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe (8332)
Stopp�! C:\Windows\System32\WUDFHost.exe (10020)
Stopp�! C:\Users\Zarechi\Downloads\RogueKillerX64.exe (6552)
Stopp�! C:\Windows\system32\taskeng.exe (6808)
Stopp�! C:\Program Files (x86)\Google\Update\GoogleUpdate.exe (9828)
Stopp�! C:\Program Files (x86)\Google\Update\GoogleUpdate.exe (10488)
Stopp�! C:\Windows\syswow64\wwahost.exe (9000)

################## | �l�ments infectieux |

Supprim�! G:\$RECYCLE.BIN.lnk
Supprim�! G:\Biblioth�que.lnk
Supprim�! G:\biblioth�ques.lnk
Supprim�! G:\media.lnk
Supprim�! G:\msdownld.tmp.lnk
Supprim�! G:\ProgramData.lnk
Supprim�! G:\Seagate.lnk
Supprim�! G:\System Volume Information.lnk
Supprim�! G:\UserGuides.lnk
Supprim�! G:\_Memeo.lnk
Supprim�! C:\Users\Zarechi\AppData\Local\Temp\7z.exe
Non supprim� ! F:\Setup.exe
Non supprim� ! F:\Autorun.inf
Supprim�! G:\Autorun.inf
Supprim�! G:\snkb0pt\desktop.ini
Supprim�! G:\snkb0pt

(!) Fichiers temporaires supprim�s.

################## | Registre |


################## | Mountpoints2 |

Supprim�! HKCU\.\.\.\.\Explorer\MountPoints2\{9c73e731-cb86-11e2-be7e-60a44c01870c}

################## | Listing |

[25/05/2013 - 23:05:38 | SHD ] C:\$Recycle.Bin
[22/09/2013 - 19:16:45 | RASD ] C:\Autorun.inf
[27/11/2012 - 15:00:09 | SD ] C:\Boot
[26/07/2012 - 05:44:30 | RAS | 398156] C:\bootmgr
[02/06/2012 - 16:30:55 | N | 1] C:\BOOTNXT
[29/09/2013 - 16:11:41 | D ] C:\Config.Msi
[26/07/2012 - 09:22:08 | SHD ] C:\Documents and Settings
[05/02/2013 - 19:02:05 | D ] C:\eSupport
[28/09/2013 - 18:16:57 | ASH | 3339931648] C:\hiberfil.sys
[05/02/2013 - 18:40:37 | D ] C:\Intel
[13/11/2012 - 08:32:50 | N | 6293504] C:\K56CA.BIN
[21/11/2012 - 08:22:54 | N | 6293504] C:\K56CM.BIN
[28/08/2013 - 20:46:50 | RD ] C:\MSOCache
[25/05/2013 - 18:58:13 | D ] C:\NVIDIA
[28/09/2013 - 20:04:10 | ASH | 4294967296] C:\pagefile.sys
[26/07/2012 - 09:33:46 | D ] C:\PerfLogs
[26/07/2013 - 20:57:12 | D ] C:\Program Files
[29/09/2013 - 17:36:22 | D ] C:\Program Files (x86)
[29/09/2013 - 15:46:40 | D ] C:\ProgramData
[29/09/2013 - 13:31:35 | D ] C:\PSFONTS
[04/05/2013 - 22:36:08 | D ] C:\sources
[28/09/2013 - 20:04:10 | ASH | 268435456] C:\swapfile.sys
[27/09/2013 - 21:32:44 | SHD ] C:\System Volume Information
[22/09/2013 - 19:16:47 | N | 6380089] C:\Upload_UsbFix.zip
[30/09/2013 - 20:18:52 | D ] C:\UsbFix
[30/09/2013 - 20:19:08 | A | 11179] C:\UsbFix [Clean 2] OPTIMUSPRIME.txt
[22/05/2013 - 21:12:48 | D ] C:\Users
[27/09/2013 - 17:24:41 | D ] C:\Windows
[04/05/2013 - 01:58:56 | SHD ] D:\$RECYCLE.BIN
[22/09/2013 - 19:16:45 | RASD ] D:\Autorun.inf
[06/06/2013 - 21:59:38 | D ] D:\msdownld.tmp
[05/02/2013 - 18:33:55 | SHD ] D:\System Volume Information
[10/09/2013 - 19:33:21 | RD ] F:\Crack
[10/09/2009 - 05:36:21 | R | 60] F:\Autorun.inf
[10/09/2013 - 19:19:45 | R | 498125056] F:\Setup-1.bin
[10/09/2013 - 19:20:36 | R | 500000000] F:\Setup-2.bin
[10/09/2013 - 19:21:31 | R | 500000000] F:\Setup-3.bin
[10/09/2013 - 19:23:51 | R | 500000000] F:\Setup-4.bin
[10/09/2013 - 19:25:31 | R | 500000000] F:\Setup-5.bin
[10/09/2013 - 19:27:13 | R | 287858500] F:\Setup-6.bin
[10/09/2013 - 19:27:13 | R | 1874543] F:\Setup.exe
[18/09/2013 - 13:40:38 | RSHD ] G:\$RECYCLE.BIN
[21/09/2013 - 18:30:11 | D ] G:\Biblioth�que
[21/09/2013 - 18:30:11 | D ] G:\biblioth�ques
[18/03/2010 - 09:49:00 | N | 65643] G:\GoFlex.ico
[03/10/2012 - 21:15:56 | N | 10314] G:\https.docx
[25/07/2011 - 19:39:38 | N | 37254817] G:\Mac Installer.dmg
[22/08/2013 - 16:34:28 | D ] G:\media
[05/05/2013 - 13:47:25 | D ] G:\msdownld.tmp
[30/07/2012 - 17:28:29 | RSD ] G:\ProgramData
[19/11/2011 - 19:06:09 | D ] G:\Seagate
[16/01/2009 - 10:14:08 | N | 156312] G:\Setup.exe
[28/09/2013 - 23:03:38 | SHD ] G:\System Volume Information
[19/11/2011 - 19:06:17 | D ] G:\UserGuides
[12/07/2012 - 09:25:45 | D ] G:\_Memeo
[03/10/2012 - 21:22:34 | N | 162] G:\~$https.docx

################## | Vaccin |

C:\Autorun.inf -> Vaccin cr�� par UsbFix (El Desaparecido)
D:\Autorun.inf -> Vaccin cr�� par UsbFix (El Desaparecido)
G:\Autorun.inf -> Vaccin cr�� par UsbFix (El Desaparecido)

################## | E.O.F | http://www.usbfix.net - http://www.sosvirus.net |