Publicité
Publicité
Format du document : text/plain
Prévisualisation
############################## | UsbFix V 7.149 | [Recherche]
Utilisateur: COULIBALY (Administrateur) # COULIBALY
Mis à jour le 03/11/2013 par El Desaparecido - Team SosVirus
Lancé à 20:34:39 | 06/01/2016
Site Web: http://www.usbfix.net/
Forum : http://www.sosvirus.net/
Upload Malware: http://www.sosvirus.net/upload_malware.php
Contact: http://www.usbfix.net/contact/
PC: Hewlett-Packard (184B)
CPU: AMD A8-4500M APU with Radeon(tm) HD Graphics
RAM -> [Total : 3560 | Free : 1371]
Bios: Insyde
Boot: Normal boot
OS: Microsoft Windows 10 Professionnel (6.3.10240 64-Bit)
WB: Windows Internet Explorer : 11.0.10240.16384
WB: Google Chrome : 47.0.2526.106
SC: Security Center Service [Enabled]
WU: Windows Update Service [(!) Disabled]
AV: Windows Defender [(!) Disabled | Updated]
AS: Windows Defender : 4.8.10240.16384 (th1.150709-1700)
FW: Windows FireWall Service [Enabled]
C:\ (%systemdrive%) -> Disque fixe # 502 Go (365 Go libre(s) - 73%) [COULIBALY] # NTFS
D:\ -> Disque fixe # 349 Mo (80 Mo libre(s) - 23%) [] # NTFS
E:\ -> Disque fixe # 195 Go (30 Go libre(s) - 15%) [COULIBALY] # NTFS
F:\ -> CD-ROM
G:\ -> Disque amovible # 4 Go (4 Go libre(s) - 100%) [GSP1RMCPRFR] # FAT
J:\ -> Disque amovible # 4 Go (4 Go libre(s) - 100%) [WINDOWS_XP_] # FAT32
K:\ -> Disque fixe # 112 Go (20 Go libre(s) - 18%) [DEUTCH] # NTFS
################## | Processus Actif |
C:\WINDOWS\system32\lsass.exe (ID: 828 |ParentID: 740)
C:\WINDOWS\system32\svchost.exe (ID: 920 |ParentID: 820)
C:\WINDOWS\system32\svchost.exe (ID: 980 |ParentID: 820)
C:\WINDOWS\system32\winlogon.exe (ID: 84 |ParentID: 732)
C:\WINDOWS\system32\dwm.exe (ID: 608 |ParentID: 84)
C:\WINDOWS\system32\svchost.exe (ID: 960 |ParentID: 820)
C:\WINDOWS\system32\svchost.exe (ID: 1096 |ParentID: 820)
C:\WINDOWS\System32\svchost.exe (ID: 1160 |ParentID: 820)
C:\WINDOWS\system32\svchost.exe (ID: 1220 |ParentID: 820)
C:\WINDOWS\system32\svchost.exe (ID: 1272 |ParentID: 820)
C:\WINDOWS\System32\svchost.exe (ID: 1440 |ParentID: 820)
C:\WINDOWS\system32\svchost.exe (ID: 1748 |ParentID: 820)
C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe (ID: 1792 |ParentID: 820)
C:\WINDOWS\System32\svchost.exe (ID: 2160 |ParentID: 820)
C:\WINDOWS\system32\svchost.exe (ID: 2520 |ParentID: 820)
C:\WINDOWS\SysWOW64\svchost.exe (ID: 2592 |ParentID: 820)
C:\WINDOWS\system32\svchost.exe (ID: 2632 |ParentID: 820)
C:\Program Files (x86)\360\Total Security\safemon\QHWatchdog.exe (ID: 4420 |ParentID: 1792)
C:\WINDOWS\system32\sihost.exe (ID: 3396 |ParentID: 960)
C:\WINDOWS\system32\wbem\wmiprvse.exe (ID: 5864 |ParentID: 920)
C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe (ID: 6196 |ParentID: 1792)
C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe (ID: 3616 |ParentID: 820)
C:\WINDOWS\system32\SearchIndexer.exe (ID: 3356 |ParentID: 820)
C:\Windows\System32\RuntimeBroker.exe (ID: 3492 |ParentID: 920)
C:\Program Files (x86)\Baidu Security\Baidu Antivirus\5.5.2.117090.0\bavhm.exe (ID: 6576 |ParentID: 7940)
C:\WINDOWS\System32\spoolsv.exe (ID: 884 |ParentID: 820)
C:\WINDOWS\system32\conhost.exe (ID: 3424 |ParentID: 6576)
C:\WINDOWS\system32\DllHost.exe (ID: 2608 |ParentID: 920)
C:\Windows\System32\WUDFHost.exe (ID: 5920 |ParentID: 1220)
C:\WINDOWS\system32\dashost.exe (ID: 3180 |ParentID: 1220)
C:\Program Files (x86)\TeamViewer\TeamViewer.exe (ID: 4552 |ParentID: 3616)
C:\WINDOWS\explorer.exe (ID: 5676 |ParentID: 84)
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe (ID: 5076 |ParentID: 920)
C:\Program Files (x86)\TeamViewer\tv_w32.exe (ID: 6712 |ParentID: 3616)
C:\Program Files (x86)\TeamViewer\tv_x64.exe (ID: 6448 |ParentID: 3616)
C:\WINDOWS\System32\svchost.exe (ID: 7512 |ParentID: 820)
C:\WINDOWS\system32\SettingSyncHost.exe (ID: 3588 |ParentID: 920)
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (ID: 3724 |ParentID: 820)
C:\Program Files (x86)\Baidu Security\Baidu Antivirus\5.5.2.117090.0\BavTray.exe (ID: 8000 |ParentID: 7148)
C:\Program Files (x86)\Maxthon\Bin\Maxthon.exe (ID: 5880 |ParentID: 8076)
C:\Program Files (x86)\Maxthon\Bin\Maxthon.exe (ID: 4584 |ParentID: 5880)
C:\Program Files (x86)\Maxthon\Bin\Maxthon.exe (ID: 3632 |ParentID: 5880)
C:\Program Files (x86)\Maxthon\Bin\Maxthon.exe (ID: 3388 |ParentID: 5880)
C:\WINDOWS\system32\fontdrvhost.exe (ID: 4840 |ParentID: 84)
C:\Program Files (x86)\Maxthon\Bin\Maxthon.exe (ID: 6420 |ParentID: 5880)
C:\Program Files (x86)\Maxthon\Bin\Maxthon.exe (ID: 4996 |ParentID: 5880)
C:\Program Files (x86)\Maxthon\Bin\Maxthon.exe (ID: 2528 |ParentID: 5880)
C:\UsbFix\Go.exe (ID: 5248 |ParentID: 4084)
C:\WINDOWS\system32\wbem\wmiprvse.exe (ID: 1068 |ParentID: 920)
C:\WINDOWS\system32\wermgr.exe (ID: 7504 |ParentID: 960)
C:\WINDOWS\system32\SearchProtocolHost.exe (ID: 5684 |ParentID: 3356)
C:\WINDOWS\system32\SearchFilterHost.exe (ID: 5536 |ParentID: 3356)
################## | Regedit Run |
04 - HKLM\SOFTWARE | Run : [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
04 - HKLM\SOFTWARE | Run : [NBKeyScan] - "C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
04 - HKLM\SOFTWARE | Run : [Wondershare Helper Compact.exe] - C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
04 - HKLM\SOFTWARE | Run : [StartCCC] - "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe" MSRun
04 - HKLM\SOFTWARE | Run : [Baidu Antivirus] - "C:\Program Files (x86)\Baidu Security\Baidu Antivirus\5.5.2.117090.0\BavTray.exe" -auto
04 - HKLM\SOFTWARE | Run : [HP Software Update] - C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
04 - HKLM\SOFTWARE | Run : [] -
04 - HKLM\SOFTWARE | Run : [PWRISOVM.EXE] - C:\Program Files\PowerISO\PWRISOVM.EXE -startup
04 - HKLM\SOFTWARE | Run : [QHSafeTray] - "C:\Program Files (x86)\360\Total Security\safemon\360Tray.exe" /start
04 - HKLM\SOFTWARE\wow6432Node | Run : [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
04 - HKLM\SOFTWARE\wow6432Node | Run : [NBKeyScan] - "C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
04 - HKLM\SOFTWARE\wow6432Node | Run : [Wondershare Helper Compact.exe] - C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
04 - HKLM\SOFTWARE\wow6432Node | Run : [StartCCC] - "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe" MSRun
04 - HKLM\SOFTWARE\wow6432Node | Run : [Baidu Antivirus] - "C:\Program Files (x86)\Baidu Security\Baidu Antivirus\5.5.2.117090.0\BavTray.exe" -auto
04 - HKLM\SOFTWARE\wow6432Node | Run : [HP Software Update] - C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
04 - HKLM\SOFTWARE\wow6432Node | Run : [] -
04 - HKLM\SOFTWARE\wow6432Node | Run : [PWRISOVM.EXE] - C:\Program Files\PowerISO\PWRISOVM.EXE -startup
04 - HKLM\SOFTWARE\wow6432Node | Run : [QHSafeTray] - "C:\Program Files (x86)\360\Total Security\safemon\360Tray.exe" /start
04 - HKLM\SOFTWARE | RunOnce : [] -
04 - HKLM\SOFTWARE\wow6432Node | RunOnce : [] -
04 - HKU\S-1-5-19\SOFTWARE | Run : [OneDriveSetup] - C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup
04 - HKU\S-1-5-20\SOFTWARE | Run : [OneDriveSetup] - C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup
04 - HKU\S-1-5-21-868442934-2450809455-2111623478-1001\SOFTWARE | Run : [OneDrive] - "C:\Users\COULIBALY\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /background
04 - HKU\S-1-5-21-868442934-2450809455-2111623478-1001\SOFTWARE | Run : [GUDelayStartup] - "C:\Program Files (x86)\Glary Utilities 5\StartupManager.exe" -delayrun
04 - HKU\S-1-5-21-868442934-2450809455-2111623478-1001\SOFTWARE | Run : [CCleaner Monitoring] - "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
04 - HKU\S-1-5-21-868442934-2450809455-2111623478-1001\SOFTWARE | Run : [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] - "C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
04 - HKU\S-1-5-21-868442934-2450809455-2111623478-1001\SOFTWARE | Run : [BingSvc] - C:\Users\COULIBALY\AppData\Local\Microsoft\BingSvc\BingSvc.exe
04 - HKU\S-1-5-21-868442934-2450809455-2111623478-1001\SOFTWARE | Run : [E09FXLRD_2654218] - "C:\Program Files (x86)\Microsoft Encarta\Microsoft Encarta 2009 - Collection DVD\EDICT.EXE" -m
04 - HKU\S-1-5-21-868442934-2450809455-2111623478-1001\SOFTWARE | Run : [Viber] - "C:\Users\COULIBALY\AppData\Local\Viber\Viber.exe" StartMinimized
04 - HKU\S-1-5-21-868442934-2450809455-2111623478-1001\SOFTWARE | Run : [Sony PC Companion] - "C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe" /Background
04 - HKU\S-1-5-21-868442934-2450809455-2111623478-1001\SOFTWARE | RunOnce : [Uninstall C:\Users\COULIBALY\AppData\Local\Microsoft\OneDrive\17.3.5892.0626\amd64] - C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\COULIBALY\AppData\Local\Microsoft\OneDrive\17.3.5892.0626\amd64"
04 - HKU\S-1-5-21-868442934-2450809455-2111623478-1001\SOFTWARE | RunOnce : [Uninstall C:\Users\COULIBALY\AppData\Local\Microsoft\OneDrive\17.3.5951.0827\amd64] - C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\COULIBALY\AppData\Local\Microsoft\OneDrive\17.3.5951.0827\amd64"
04 - HKU\S-1-5-21-868442934-2450809455-2111623478-1001\SOFTWARE | RunOnce : [Uninstall C:\Users\COULIBALY\AppData\Local\Microsoft\OneDrive\17.3.6201.1019\amd64] - C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\COULIBALY\AppData\Local\Microsoft\OneDrive\17.3.6201.1019\amd64"
################## | Recherche générique |
Présent! C:\ProgramData\Baidu Security\Duplicaterecord.js
Présent! C:\ProgramData\Baidu Security
################## | Registre |
################## | Vaccin |
C:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
D:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
E:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
K:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
################## | E.O.F | http://www.usbfix.net - http://www.sosvirus.net |
Utilisateur: COULIBALY (Administrateur) # COULIBALY
Mis à jour le 03/11/2013 par El Desaparecido - Team SosVirus
Lancé à 20:34:39 | 06/01/2016
Site Web: http://www.usbfix.net/
Forum : http://www.sosvirus.net/
Upload Malware: http://www.sosvirus.net/upload_malware.php
Contact: http://www.usbfix.net/contact/
PC: Hewlett-Packard (184B)
CPU: AMD A8-4500M APU with Radeon(tm) HD Graphics
RAM -> [Total : 3560 | Free : 1371]
Bios: Insyde
Boot: Normal boot
OS: Microsoft Windows 10 Professionnel (6.3.10240 64-Bit)
WB: Windows Internet Explorer : 11.0.10240.16384
WB: Google Chrome : 47.0.2526.106
SC: Security Center Service [Enabled]
WU: Windows Update Service [(!) Disabled]
AV: Windows Defender [(!) Disabled | Updated]
AS: Windows Defender : 4.8.10240.16384 (th1.150709-1700)
FW: Windows FireWall Service [Enabled]
C:\ (%systemdrive%) -> Disque fixe # 502 Go (365 Go libre(s) - 73%) [COULIBALY] # NTFS
D:\ -> Disque fixe # 349 Mo (80 Mo libre(s) - 23%) [] # NTFS
E:\ -> Disque fixe # 195 Go (30 Go libre(s) - 15%) [COULIBALY] # NTFS
F:\ -> CD-ROM
G:\ -> Disque amovible # 4 Go (4 Go libre(s) - 100%) [GSP1RMCPRFR] # FAT
J:\ -> Disque amovible # 4 Go (4 Go libre(s) - 100%) [WINDOWS_XP_] # FAT32
K:\ -> Disque fixe # 112 Go (20 Go libre(s) - 18%) [DEUTCH] # NTFS
################## | Processus Actif |
C:\WINDOWS\system32\lsass.exe (ID: 828 |ParentID: 740)
C:\WINDOWS\system32\svchost.exe (ID: 920 |ParentID: 820)
C:\WINDOWS\system32\svchost.exe (ID: 980 |ParentID: 820)
C:\WINDOWS\system32\winlogon.exe (ID: 84 |ParentID: 732)
C:\WINDOWS\system32\dwm.exe (ID: 608 |ParentID: 84)
C:\WINDOWS\system32\svchost.exe (ID: 960 |ParentID: 820)
C:\WINDOWS\system32\svchost.exe (ID: 1096 |ParentID: 820)
C:\WINDOWS\System32\svchost.exe (ID: 1160 |ParentID: 820)
C:\WINDOWS\system32\svchost.exe (ID: 1220 |ParentID: 820)
C:\WINDOWS\system32\svchost.exe (ID: 1272 |ParentID: 820)
C:\WINDOWS\System32\svchost.exe (ID: 1440 |ParentID: 820)
C:\WINDOWS\system32\svchost.exe (ID: 1748 |ParentID: 820)
C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe (ID: 1792 |ParentID: 820)
C:\WINDOWS\System32\svchost.exe (ID: 2160 |ParentID: 820)
C:\WINDOWS\system32\svchost.exe (ID: 2520 |ParentID: 820)
C:\WINDOWS\SysWOW64\svchost.exe (ID: 2592 |ParentID: 820)
C:\WINDOWS\system32\svchost.exe (ID: 2632 |ParentID: 820)
C:\Program Files (x86)\360\Total Security\safemon\QHWatchdog.exe (ID: 4420 |ParentID: 1792)
C:\WINDOWS\system32\sihost.exe (ID: 3396 |ParentID: 960)
C:\WINDOWS\system32\wbem\wmiprvse.exe (ID: 5864 |ParentID: 920)
C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe (ID: 6196 |ParentID: 1792)
C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe (ID: 3616 |ParentID: 820)
C:\WINDOWS\system32\SearchIndexer.exe (ID: 3356 |ParentID: 820)
C:\Windows\System32\RuntimeBroker.exe (ID: 3492 |ParentID: 920)
C:\Program Files (x86)\Baidu Security\Baidu Antivirus\5.5.2.117090.0\bavhm.exe (ID: 6576 |ParentID: 7940)
C:\WINDOWS\System32\spoolsv.exe (ID: 884 |ParentID: 820)
C:\WINDOWS\system32\conhost.exe (ID: 3424 |ParentID: 6576)
C:\WINDOWS\system32\DllHost.exe (ID: 2608 |ParentID: 920)
C:\Windows\System32\WUDFHost.exe (ID: 5920 |ParentID: 1220)
C:\WINDOWS\system32\dashost.exe (ID: 3180 |ParentID: 1220)
C:\Program Files (x86)\TeamViewer\TeamViewer.exe (ID: 4552 |ParentID: 3616)
C:\WINDOWS\explorer.exe (ID: 5676 |ParentID: 84)
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe (ID: 5076 |ParentID: 920)
C:\Program Files (x86)\TeamViewer\tv_w32.exe (ID: 6712 |ParentID: 3616)
C:\Program Files (x86)\TeamViewer\tv_x64.exe (ID: 6448 |ParentID: 3616)
C:\WINDOWS\System32\svchost.exe (ID: 7512 |ParentID: 820)
C:\WINDOWS\system32\SettingSyncHost.exe (ID: 3588 |ParentID: 920)
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (ID: 3724 |ParentID: 820)
C:\Program Files (x86)\Baidu Security\Baidu Antivirus\5.5.2.117090.0\BavTray.exe (ID: 8000 |ParentID: 7148)
C:\Program Files (x86)\Maxthon\Bin\Maxthon.exe (ID: 5880 |ParentID: 8076)
C:\Program Files (x86)\Maxthon\Bin\Maxthon.exe (ID: 4584 |ParentID: 5880)
C:\Program Files (x86)\Maxthon\Bin\Maxthon.exe (ID: 3632 |ParentID: 5880)
C:\Program Files (x86)\Maxthon\Bin\Maxthon.exe (ID: 3388 |ParentID: 5880)
C:\WINDOWS\system32\fontdrvhost.exe (ID: 4840 |ParentID: 84)
C:\Program Files (x86)\Maxthon\Bin\Maxthon.exe (ID: 6420 |ParentID: 5880)
C:\Program Files (x86)\Maxthon\Bin\Maxthon.exe (ID: 4996 |ParentID: 5880)
C:\Program Files (x86)\Maxthon\Bin\Maxthon.exe (ID: 2528 |ParentID: 5880)
C:\UsbFix\Go.exe (ID: 5248 |ParentID: 4084)
C:\WINDOWS\system32\wbem\wmiprvse.exe (ID: 1068 |ParentID: 920)
C:\WINDOWS\system32\wermgr.exe (ID: 7504 |ParentID: 960)
C:\WINDOWS\system32\SearchProtocolHost.exe (ID: 5684 |ParentID: 3356)
C:\WINDOWS\system32\SearchFilterHost.exe (ID: 5536 |ParentID: 3356)
################## | Regedit Run |
04 - HKLM\SOFTWARE | Run : [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
04 - HKLM\SOFTWARE | Run : [NBKeyScan] - "C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
04 - HKLM\SOFTWARE | Run : [Wondershare Helper Compact.exe] - C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
04 - HKLM\SOFTWARE | Run : [StartCCC] - "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe" MSRun
04 - HKLM\SOFTWARE | Run : [Baidu Antivirus] - "C:\Program Files (x86)\Baidu Security\Baidu Antivirus\5.5.2.117090.0\BavTray.exe" -auto
04 - HKLM\SOFTWARE | Run : [HP Software Update] - C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
04 - HKLM\SOFTWARE | Run : [] -
04 - HKLM\SOFTWARE | Run : [PWRISOVM.EXE] - C:\Program Files\PowerISO\PWRISOVM.EXE -startup
04 - HKLM\SOFTWARE | Run : [QHSafeTray] - "C:\Program Files (x86)\360\Total Security\safemon\360Tray.exe" /start
04 - HKLM\SOFTWARE\wow6432Node | Run : [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
04 - HKLM\SOFTWARE\wow6432Node | Run : [NBKeyScan] - "C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
04 - HKLM\SOFTWARE\wow6432Node | Run : [Wondershare Helper Compact.exe] - C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
04 - HKLM\SOFTWARE\wow6432Node | Run : [StartCCC] - "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe" MSRun
04 - HKLM\SOFTWARE\wow6432Node | Run : [Baidu Antivirus] - "C:\Program Files (x86)\Baidu Security\Baidu Antivirus\5.5.2.117090.0\BavTray.exe" -auto
04 - HKLM\SOFTWARE\wow6432Node | Run : [HP Software Update] - C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
04 - HKLM\SOFTWARE\wow6432Node | Run : [] -
04 - HKLM\SOFTWARE\wow6432Node | Run : [PWRISOVM.EXE] - C:\Program Files\PowerISO\PWRISOVM.EXE -startup
04 - HKLM\SOFTWARE\wow6432Node | Run : [QHSafeTray] - "C:\Program Files (x86)\360\Total Security\safemon\360Tray.exe" /start
04 - HKLM\SOFTWARE | RunOnce : [] -
04 - HKLM\SOFTWARE\wow6432Node | RunOnce : [] -
04 - HKU\S-1-5-19\SOFTWARE | Run : [OneDriveSetup] - C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup
04 - HKU\S-1-5-20\SOFTWARE | Run : [OneDriveSetup] - C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup
04 - HKU\S-1-5-21-868442934-2450809455-2111623478-1001\SOFTWARE | Run : [OneDrive] - "C:\Users\COULIBALY\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /background
04 - HKU\S-1-5-21-868442934-2450809455-2111623478-1001\SOFTWARE | Run : [GUDelayStartup] - "C:\Program Files (x86)\Glary Utilities 5\StartupManager.exe" -delayrun
04 - HKU\S-1-5-21-868442934-2450809455-2111623478-1001\SOFTWARE | Run : [CCleaner Monitoring] - "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
04 - HKU\S-1-5-21-868442934-2450809455-2111623478-1001\SOFTWARE | Run : [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] - "C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
04 - HKU\S-1-5-21-868442934-2450809455-2111623478-1001\SOFTWARE | Run : [BingSvc] - C:\Users\COULIBALY\AppData\Local\Microsoft\BingSvc\BingSvc.exe
04 - HKU\S-1-5-21-868442934-2450809455-2111623478-1001\SOFTWARE | Run : [E09FXLRD_2654218] - "C:\Program Files (x86)\Microsoft Encarta\Microsoft Encarta 2009 - Collection DVD\EDICT.EXE" -m
04 - HKU\S-1-5-21-868442934-2450809455-2111623478-1001\SOFTWARE | Run : [Viber] - "C:\Users\COULIBALY\AppData\Local\Viber\Viber.exe" StartMinimized
04 - HKU\S-1-5-21-868442934-2450809455-2111623478-1001\SOFTWARE | Run : [Sony PC Companion] - "C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe" /Background
04 - HKU\S-1-5-21-868442934-2450809455-2111623478-1001\SOFTWARE | RunOnce : [Uninstall C:\Users\COULIBALY\AppData\Local\Microsoft\OneDrive\17.3.5892.0626\amd64] - C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\COULIBALY\AppData\Local\Microsoft\OneDrive\17.3.5892.0626\amd64"
04 - HKU\S-1-5-21-868442934-2450809455-2111623478-1001\SOFTWARE | RunOnce : [Uninstall C:\Users\COULIBALY\AppData\Local\Microsoft\OneDrive\17.3.5951.0827\amd64] - C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\COULIBALY\AppData\Local\Microsoft\OneDrive\17.3.5951.0827\amd64"
04 - HKU\S-1-5-21-868442934-2450809455-2111623478-1001\SOFTWARE | RunOnce : [Uninstall C:\Users\COULIBALY\AppData\Local\Microsoft\OneDrive\17.3.6201.1019\amd64] - C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\COULIBALY\AppData\Local\Microsoft\OneDrive\17.3.6201.1019\amd64"
################## | Recherche générique |
Présent! C:\ProgramData\Baidu Security\Duplicaterecord.js
Présent! C:\ProgramData\Baidu Security
################## | Registre |
################## | Vaccin |
C:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
D:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
E:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
K:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
################## | E.O.F | http://www.usbfix.net - http://www.sosvirus.net |