############################## | UsbFix V 7.161 | [Recherche]

Utilisateur: Lixou (Administrateur) # LIX
Mis � jour le 15/01/2014 par El Desaparecido - Team SosVirus
Lanc� � 11:44:00 | 21/01/2014

Site Web : http://www.usbfix.net
Changelog : http://www.usbfix.net/maj/
Support : http://www.sosvirus.net/
Upload Malware : http://www.sosvirus.net/upload_malware.php
Contact : http://www.usbfix.net/contact/

PC: SAMSUNG ELECTRONICS CO., LTD. (NC10 )
CPU: Intel(R) Atom(TM) CPU N270 @ 1.60GHz
RAM -> [Total : 1014 Mo| Free : 170 Mo]
Bios: Phoenix Technologies Ltd.
Boot: Normal boot

OS: Microsoft Windows XP �dition familiale (5.1.2600 32-Bit) Service Pack 3
WB: Windows Internet Explorer : 8.0.6001.18702
WB: Google Chrome : 32.0.1700.76
WB: Mozilla Firefox : 26.0

SC: Security Center Service [Enabled]
WU: Windows Update Service [Enabled]
FW: Windows FireWall Service [Enabled]

C:\ (%systemdrive%) -> Disque fixe # 71 Go (36 Go libre(s) - 50%) [] # NTFS
D:\ -> Disque fixe # 72 Go (69 Go libre(s) - 96%) [] # NTFS
E:\ -> Disque amovible # 2 Go (2 Go libre(s) - 95%) [USB DISK] # FAT32

################## | Processus Actif |

C:\WINDOWS\System32\smss.exe (ID: 688 |ParentID: 4)
C:\WINDOWS\system32\winlogon.exe (ID: 768 |ParentID: 688)
C:\WINDOWS\system32\services.exe (ID: 812 |ParentID: 768)
C:\WINDOWS\system32\lsass.exe (ID: 824 |ParentID: 768)
C:\WINDOWS\system32\svchost.exe (ID: 984 |ParentID: 812)
C:\WINDOWS\System32\svchost.exe (ID: 1100 |ParentID: 812)
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe (ID: 1180 |ParentID: 812)
C:\WINDOWS\system32\svchost.exe (ID: 1212 |ParentID: 812)
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (ID: 1592 |ParentID: 812)
C:\WINDOWS\Explorer.EXE (ID: 1304 |ParentID: 1288)
C:\Program Files\Java\jre1.5.0\bin\jusched.exe (ID: 1692 |ParentID: 1304)
C:\WINDOWS\RTHDCPL.EXE (ID: 1700 |ParentID: 1304)
C:\Program Files\Samsung\Samsung EDS\EDSAgent.exe (ID: 1844 |ParentID: 1304)
C:\Program Files\Java\jre1.5.0\bin\jucheck.exe (ID: 1860 |ParentID: 1692)
C:\WINDOWS\system32\hkcmd.exe (ID: 1864 |ParentID: 1304)
C:\WINDOWS\system32\igfxpers.exe (ID: 1876 |ParentID: 1304)
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (ID: 1884 |ParentID: 1304)
C:\Program Files\Samsung\Samsung Battery Manager\BatteryManager.exe (ID: 1900 |ParentID: 1304)
C:\WINDOWS\system32\igfxsrvc.exe (ID: 1940 |ParentID: 984)
C:\Program Files\Alwil Software\Avast5\avastUI.exe (ID: 128 |ParentID: 1304)
C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe (ID: 188 |ParentID: 1892)
C:\WINDOWS\system32\wscript.exe (ID: 208 |ParentID: 1304)
C:\WINDOWS\system32\ctfmon.exe (ID: 220 |ParentID: 1304)
C:\Program Files\Skype\Phone\Skype.exe (ID: 232 |ParentID: 1304)
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (ID: 396 |ParentID: 1304)
C:\Program Files\SAMSUNG\MagicKBD\MagicKBD.exe (ID: 404 |ParentID: 1908)
C:\Program Files\Windows Desktop Search\WindowsSearch.exe (ID: 412 |ParentID: 1304)
C:\Program Files\SAMSUNG\MagicKBD\PerformanceManager.exe (ID: 428 |ParentID: 1908)
C:\Documents and Settings\All Users\Application Data\WPM\wprotectmanager.exe (ID: 1276 |ParentID: 812)
C:\WINDOWS\system32\spoolsv.exe (ID: 2100 |ParentID: 812)
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (ID: 2268 |ParentID: 812)
C:\Program Files\samsung\Samsung Network Manager\SNMWLANService.exe (ID: 2620 |ParentID: 812)
C:\WINDOWS\system32\svchost.exe (ID: 2676 |ParentID: 812)
C:\WINDOWS\system32\SearchIndexer.exe (ID: 2772 |ParentID: 812)
C:\WINDOWS\system32\igfxext.exe (ID: 3404 |ParentID: 984)
C:\Documents and Settings\Lixou\Application Data\Dropbox\bin\Dropbox.exe (ID: 3512 |ParentID: 884)
C:\WINDOWS\system32\wuauclt.exe (ID: 2164 |ParentID: 1100)
C:\Program Files\Microsoft Office\Office12\WINWORD.EXE (ID: 3304 |ParentID: 1304)
C:\Program Files\Mozilla Firefox\firefox.exe (ID: 3948 |ParentID: 1304)
C:\Program Files\Mozilla Firefox\plugin-container.exe (ID: 440 |ParentID: 3948)
C:\WINDOWS\system32\SearchProtocolHost.exe (ID: 2612 |ParentID: 2772)

################## | Regedit Run |

04 - HKLM\..\Run : [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
04 - HKLM\..\Run : [RTHDCPL] RTHDCPL.EXE
04 - HKLM\..\Run : [Alcmtr] ALCMTR.EXE
04 - HKLM\..\Run : []
04 - HKLM\..\Run : [EDS] C:\Program Files\Samsung\Samsung EDS\EDSAgent.exe
04 - HKLM\..\Run : [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
04 - HKLM\..\Run : [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
04 - HKLM\..\Run : [Persistence] C:\WINDOWS\system32\igfxpers.exe
04 - HKLM\..\Run : [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
04 - HKLM\..\Run : [DMHotKey] C:\Program Files\Samsung\Easy Display Manager\DMLoader.exe
04 - HKLM\..\Run : [BatteryManager] C:\Program Files\Samsung\Samsung Battery Manager\BatteryManager.exe
04 - HKLM\..\Run : [MagicKeyboard] C:\Program Files\SAMSUNG\MagicKBD\PreMKBD.exe
04 - HKLM\..\Run : [avast] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
04 - HKLM\..\Run : [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
04 - HKLM\..\Run : [iTunesHelper] wscript.exe //B "C:\DOCUME~1\Lixou\LOCALS~1\Temp\iTunesHelper.vbe"
04 - HKLM\..\Run : [Adobe ARM] "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
04 - HKLM\..\RunOnce : []
04 - HKLM\Software\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\..\Run : []
04 - HKLM\Software\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\..\RunOnce : []
04 - HKU\S-1-5-19\..\Run : [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE
04 - HKU\S-1-5-20\..\Run : [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE
04 - HKU\S-1-5-21-230668399-936677607-3559390902-1005\..\Run : [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
04 - HKU\S-1-5-21-230668399-936677607-3559390902-1005\..\Run : [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
04 - HKU\S-1-5-21-230668399-936677607-3559390902-1005\..\Run : [iTunesHelper] wscript.exe //B "C:\DOCUME~1\Lixou\LOCALS~1\Temp\iTunesHelper.vbe"
04 - HKU\S-1-5-18\..\Run : [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE

################## | Recherche g�n�rique |

Pr�sent! C:\Documents and Settings\Lixou\Menu D�marrer\Programmes\D�marrage\iTunesHelper.vbe
Pr�sent! C:\DOCUME~1\Lixou\LOCALS~1\Temp\iTunesHelper.vbe
Pr�sent! E:\iTunesHelper.vbe
Pr�sent! E:\Assignation TGI BARBET.lnk
Pr�sent! E:\assignation tgi jadis pomeau.lnk
Pr�sent! E:\bouvet.lnk
Pr�sent! E:\divers clients.lnk
Pr�sent! E:\LOT 2 OPH DRANCY.lnk
Pr�sent! E:\LOT 5 OPH DRANCY.lnk
Pr�sent! E:\klein.lnk
Pr�sent! E:\~WRL2816.lnk

################## | Registre |

Pr�sent! HKLM\Software\iTunesHelper
Pr�sent! HKLM64\Software\iTunesHelper
Pr�sent! HKCU\Software\PowerPack
Pr�sent! HKCU64\Software\PowerPack
Pr�sent! HKU\S-1-5-21-230668399-936677607-3559390902-1005\Software\PowerPack
Pr�sent! HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowRecentDocs -> 0
Pr�sent! HKU\S-1-5-21-230668399-936677607-3559390902-1005\Software\Microsoft\Windows\CurrentVersion\Run|iTunesHelper
Pr�sent! HKLM\Software\Microsoft\Windows\CurrentVersion\Run|iTunesHelper
Pr�sent! HKLM64\Software\Microsoft\Windows\CurrentVersion\Run|iTunesHelper
Pr�sent! HKCU\Software\Microsoft\Windows\CurrentVersion\Run|iTunesHelper

################## | Vaccin |


################## | E.O.F | http://www.usbfix.net - http://www.sosvirus.net |