############################## | UsbFix V 7.145 | [Recherche]

Utilisateur: GeekMan (Administrateur) # GEEKMAN-PC
Mis � jour le 17/10/2013 par El Desaparecido - Team SosVirus
Lanc� � 15:48:39 | 24/10/2013

Site Web: http://www.usbfix.net/
Forum : http://www.sosvirus.net/
Upload Malware: http://www.sosvirus.net/upload_malware.php
Contact: http://www.usbfix.net/contact/

PC: MSIT (MS-9162)
CPU: Intel(R) Pentium(R) 4 CPU 3.80GHz
RAM -> [Total : 4094 | Free : 2286]
Bios: IBM
Boot: Normal boot

OS: Microsoft Windows�7 �dition Familiale Premium (6.1.7601 64-Bit) # Service Pack 1
WB: Windows Internet Explorer 10.0.9200.16721

SC: Security Center Service [Enabled]
WU: Windows Update Service [Enabled]
AV: avast! Antivirus [(!) Disabled | Updated]
FW: Windows FireWall Service [Enabled]

C:\ (%systemdrive%) -> Disque fixe # 149 Go (60 Go libre(s) - 40%) [] # NTFS
D:\ -> CD-ROM
E:\ -> CD-ROM
F:\ -> Disque fixe # 466 Go (297 Go libre(s) - 64%) [Val S.] # NTFS

################## | Processus Actif |

C:\Windows\system32\csrss.exe (ID 416 |ParentID 408)
C:\Windows\system32\wininit.exe (ID 468 |ParentID 408)
C:\Windows\system32\csrss.exe (ID 496 |ParentID 476)
C:\Windows\system32\services.exe (ID 528 |ParentID 468)
C:\Windows\system32\lsass.exe (ID 544 |ParentID 468)
C:\Windows\system32\lsm.exe (ID 552 |ParentID 468)
C:\Windows\system32\winlogon.exe (ID 616 |ParentID 476)
C:\Windows\system32\svchost.exe (ID 696 |ParentID 528)
C:\Windows\system32\svchost.exe (ID 812 |ParentID 528)
C:\Windows\System32\svchost.exe (ID 908 |ParentID 528)
C:\Windows\System32\svchost.exe (ID 964 |ParentID 528)
C:\Windows\system32\svchost.exe (ID 996 |ParentID 528)
C:\Windows\system32\svchost.exe (ID 1020 |ParentID 528)
C:\Windows\system32\svchost.exe (ID 796 |ParentID 528)
C:\Windows\system32\svchost.exe (ID 1188 |ParentID 528)
C:\Program Files\AVAST Software\Avast\AvastSvc.exe (ID 1256 |ParentID 528)
C:\Windows\System32\spoolsv.exe (ID 1476 |ParentID 528)
C:\Windows\system32\svchost.exe (ID 1516 |ParentID 528)
C:\Windows\system32\svchost.exe (ID 2000 |ParentID 528)
C:\Windows\system32\svchost.exe (ID 2408 |ParentID 528)
C:\Windows\system32\svchost.exe (ID 2448 |ParentID 528)
C:\Windows\system32\taskhost.exe (ID 2800 |ParentID 528)
C:\Windows\system32\Dwm.exe (ID 2876 |ParentID 964)
C:\Windows\Explorer.EXE (ID 2928 |ParentID 2860)
C:\Windows\SOUNDMAN.EXE (ID 2492 |ParentID 2928)
C:\Users\GeekMan\AppData\Local\Akamai\netsession_win.exe (ID 2652 |ParentID 2928)
C:\Users\GeekMan\AppData\Local\Akamai\netsession_win.exe (ID 2680 |ParentID 2652)
C:\Windows\system32\SearchIndexer.exe (ID 3068 |ParentID 528)
C:\Program Files\AVAST Software\Avast\AvastUI.exe (ID 2752 |ParentID 3048)
C:\Windows\explorer.exe (ID 3740 |ParentID 696)
C:\Windows\servicing\TrustedInstaller.exe (ID 3324 |ParentID 528)
C:\Windows\system32\taskhost.exe (ID 4120 |ParentID 528)
C:\Program Files (x86)\Skype\Phone\Skype.exe (ID 3972 |ParentID 2928)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID 3836 |ParentID 2928)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID 4092 |ParentID 3836)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID 1720 |ParentID 3836)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID 4868 |ParentID 3836)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID 1648 |ParentID 3836)
C:\Windows\system32\SearchProtocolHost.exe (ID 1712 |ParentID 3068)
C:\Windows\system32\SearchFilterHost.exe (ID 2992 |ParentID 3068)
C:\UsbFix\Go.exe (ID 2352 |ParentID 3748)
C:\Windows\system32\wbem\wmiprvse.exe (ID 4296 |ParentID 696)

################## | Regedit Run |

HKLM\SOFTWARE | Run : [LogMeIn Hamachi Ui] - "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
HKLM\SOFTWARE | Run : [AvastUI.exe] - "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
HKLM\SOFTWARE\wow6432Node | Run : [LogMeIn Hamachi Ui] - "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
HKLM\SOFTWARE\wow6432Node | Run : [AvastUI.exe] - "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
HKLM\SOFTWARE | RunOnce : [] -
HKLM\SOFTWARE\wow6432Node | RunOnce : [] -
HKU\S-1-5-19\SOFTWARE | Run : [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-20\SOFTWARE | Run : [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-21-3310874896-599731479-1942284075-1001\SOFTWARE | Run : [Akamai NetSession Interface] - "C:\Users\GeekMan\AppData\Local\Akamai\netsession_win.exe"
HKU\S-1-5-21-3310874896-599731479-1942284075-1001\SOFTWARE | Run : [uTorrent] - "C:\Users\GeekMan\AppData\Roaming\uTorrent\uTorrent.exe" /MINIMIZED
HKU\S-1-5-21-3310874896-599731479-1942284075-1001\SOFTWARE | Run : [DAEMON Tools Lite] - "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
HKU\S-1-5-21-3310874896-599731479-1942284075-1001\SOFTWARE | Run : [Facebook Update] - "C:\Users\GeekMan\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
HKU\S-1-5-19\SOFTWARE | RunOnce : [mctadmin] - C:\Windows\System32\mctadmin.exe
HKU\S-1-5-20\SOFTWARE | RunOnce : [mctadmin] - C:\Windows\System32\mctadmin.exe

################## | �l�ments infectieux |

Pr�sent! C:\Users\GeekMan\AppData\Roaming\java
Pr�sent! D:\autorun.exe
Pr�sent! D:\autorun.inf
Pr�sent! F:\autorun.inf

################## | Registre |

HKCU\.\.\.\.\Explorer\MountPoints2\{7421fb66-cd1e-11e2-8dd0-001125a3a945}
Shell\AutoRun\Command = E:\Setup.exe

HKCU\.\.\.\.\Explorer\MountPoints2\{9bf6151d-7d07-11e2-87d8-806e6f6e6963}
Shell\AutoRun\Command = D:\autorun.exe



################## | Vaccin |

(!) Cet ordinateur n'est pas vaccin�!

################## | E.O.F | http://www.usbfix.net - http://www.sosvirus.net |