Dropper.generic8.vny

bezulon · le 3 mai 2013

Je suis désolée, il y a un grand malentendu, j'avais simplement compris que je ne pouvais pas utiliser ce logiciel seule... loin de moi l'idée de mettre en doute vos compétences ! Je vous remercie au contraire de votre aide, c'est la première fois que je tente de résoudre un problème sur mon ordinateur via un forum.

Je m'apprête donc à utiliser ComboFix et à suivre précisemment vos conseils

bezulon · le 3 mai 2013

Voici le rapport ComboFix

AVG s'est relancé automatique pendant l'analyse, mais je l'ai rapidement de nouveau desactivé, j'espère que cela ne fausse rien

ComboFix 13-05-01.03 - Félicie 03/05/2013 16:36:16.1.2 - x64

Microsoft Windows 7 Édition Familiale Premium 6.1.7601.1.1252.33.1036.18.3948.2440 [GMT 2:00]

Lancé depuis: c:\users\FÚlicie\Desktop\ComboFix.exe

AV: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}

SP: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\install.exe

F:\autorun.inf

.

((((((((((((((((((((((((((((( Fichiers créés du 2013-04-03 au 2013-05-03 ))))))))))))))))))))))))))))))))))))

.

2013-05-03 14:49 . 2013-05-03 14:49 -------- d-----w- c:\users\Default\AppData\Local\temp

2013-04-26 15:57 . 2013-04-26 15:57 -------- d-----w- c:\users\Félicie\AppData\Roaming\Malwarebytes

2013-04-26 15:57 . 2013-04-26 15:57 -------- d-----w- c:\programdata\Malwarebytes

2013-04-26 15:57 . 2013-04-26 15:57 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware

2013-04-26 15:57 . 2013-04-04 12:50 25928 ----a-w- c:\windows\system32\drivers\mbam.sys

2013-04-26 15:56 . 2013-04-26 15:56 -------- d-----w- c:\users\Félicie\AppData\Local\Programs

2013-04-26 15:28 . 2013-04-26 15:28 -------- d-----w- c:\windows\ERUNT

2013-04-26 15:28 . 2013-04-26 15:28 -------- d-----w- C:\JRT

2013-04-26 14:27 . 2013-04-26 14:27 512 ----a-w- C:\PhysicalDisk0_MBR.bin

2013-04-26 14:17 . 2013-04-26 15:23 -------- d-----w- C:\ZHP

2013-04-26 14:17 . 2013-04-26 14:27 -------- d-----w- c:\program files (x86)\ZHPDiag

2013-04-24 17:30 . 2013-04-12 14:45 1656680 ----a-w- c:\windows\system32\drivers\ntfs.sys

2013-04-19 20:52 . 2010-03-31 00:05 53488 ------w- c:\windows\system32\drivers\PxHlpa64.sys

2013-04-19 20:52 . 2010-03-31 00:05 10224 ------w- c:\windows\system32\drivers\cdralw2k.sys

2013-04-19 20:52 . 2010-03-31 00:05 10224 ------w- c:\windows\system32\drivers\cdr4_xp.sys

2013-04-19 20:52 . 2013-04-19 20:52 -------- d-----w- c:\program files (x86)\Common Files\PX Storage Engine

2013-04-19 20:51 . 2013-04-19 20:51 -------- d-----w- c:\program files\Adobe

2013-04-11 01:18 . 2013-04-11 01:18 384800 ----a-w- c:\windows\system32\drivers\avgtdia.sys

2013-04-10 21:42 . 2013-04-26 13:07 -------- d-----w- C:\Temp

2013-04-10 08:23 . 2013-01-24 06:01 223752 ----a-w- c:\windows\system32\drivers\fvevol.sys

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-02-12 05:45 . 2013-03-13 11:09 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll

2013-02-12 05:45 . 2013-03-13 11:09 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll

2013-02-12 05:45 . 2013-03-13 11:09 308736 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll

2013-02-12 05:45 . 2013-03-13 11:09 111104 ----a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll

2013-02-12 04:48 . 2013-03-13 11:09 474112 ----a-w- c:\windows\apppatch\AcSpecfc.dll

2013-02-12 04:48 . 2013-03-13 11:09 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll

2013-02-12 04:12 . 2013-03-26 14:57 19968 ----a-w- c:\windows\system32\drivers\usb8023.sys

.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{0F6E720A-1A6B-40E1-A294-1D4D19F156C8}]

2011-06-10 06:24 165256 ----a-w- c:\program files (x86)\SFR\Kit\SFRNavErrorHelper.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]

"Spotify Web Helper"="c:\users\Félicie\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2013-04-29 1105408]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"Norton Online Backup"="c:\program files (x86)\Symantec\Norton Online Backup\NOBuClient.exe" [2010-06-01 1155928]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]

"BackupManagerTray"="c:\program files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe" [2011-04-24 297280]

"LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2011-03-14 1081424]

"SuiteTray"="c:\program files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe" [2011-09-20 341360]

"ArcadeMovieService"="c:\program files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe" [2011-08-26 177448]

"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-20 59240]

"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-01-16 421736]

"AVG_TRAY"="c:\program files (x86)\AVG\AVG2012\avgtray.exe" [2012-11-19 2598520]

"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-04-18 421888]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"IsMyWinLockerReboot"="msiexec.exe" [2010-11-21 73216]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"LoadAppInit_DLLs"=1 (0x1)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"aux"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~2\AVG\AVG2012\avgrsa.exe /sync /restart

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

@=""

.

R2 AVGIDSAgent;AVGIDSAgent;c:\program files (x86)\AVG\AVG2012\AVGIDSAgent.exe [2012-11-02 5174392]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2013-01-08 161536]

R3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.SYS [2011-01-14 74840]

R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-06-07 191752]

R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]

R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2011-08-02 51712]

R3 WatAdminSvc;Service Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [2012-02-23 1255736]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]

S0 AVGIDSHA;AVGIDSHA;c:\windows\system32\DRIVERS\avgidsha.sys [2012-04-19 28480]

S0 Avgrkx64;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx64.sys [2012-01-31 36944]

S1 Avgldx64;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx64.sys [2012-11-08 307040]

S1 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\DRIVERS\avgmfx64.sys [2011-12-23 47696]

S1 Avgtdia;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdia.sys [2013-04-11 384800]

S1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx64.sys [2012-09-16 31080]

S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [2011-12-06 22648]

S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [2011-12-06 20520]

S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [2011-12-06 62776]

S2 avgwd;AVG WatchDog;c:\program files (x86)\AVG\AVG2012\avgwdsvc.exe [2012-02-14 193288]

S2 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE [2011-05-12 249648]

S2 DsiWMIService;Dritek WMI Service;c:\program files (x86)\Launch Manager\dsiwmis.exe [2011-03-14 352336]

S2 EgisTec Ticket Service;EgisTec Ticket Service;c:\program files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe [2011-06-21 173424]

S2 ePowerSvc;ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [2011-08-02 872552]

S2 GREGService;GREGService;c:\program files (x86)\Acer\Registration\GREGsvc.exe [2011-05-30 36456]

S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-09-14 13336]

S2 Live Updater Service;Live Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2011-04-22 244624]

S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-04-04 418376]

S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2013-04-04 701512]

S2 NOBU;Norton Online Backup;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE [x]

S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [2011-04-24 256832]

S2 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2011-02-01 2656280]

S2 vToolbarUpdater12.2.6;vToolbarUpdater12.2.6;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\12.2.6\ToolbarUpdater.exe [2012-09-16 722528]

S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdrivera.sys [2012-12-10 127328]

S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\avgidsfiltera.sys [2011-12-23 29776]

S3 IntcDAud;Son Intel® pour écrans;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-10-14 317440]

S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [2011-04-20 169584]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2013-04-04 25928]

.

Contenu du dossier 'Tâches planifiées'

.

--------- X64 Entries -----------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"AmIcoSinglun64"="c:\program files (x86)\AmIcoSingLun\AmIcoSinglun64.exe" [2011-01-26 368728]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-05-09 168216]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-05-09 391960]

"Persistence"="c:\windows\system32\igfxpers.exe" [2011-05-09 419096]

"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-06-09 11860072]

"Power Management"="c:\program files\Acer\Acer ePower Management\ePowerTray.exe" [2011-08-02 1831016]

.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService

FontCache

.

------- Examen supplémentaire -------

.

uStart Page = hxxp://www.sfr.fr/kit/adsl/

uLocal Page = c:\windows\system32\blank.htm

mDefault_Page_URL = hxxp://acer.msn.com

mStart Page = hxxp://acer.msn.com

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = *.local

IE: E&xporter vers Microsoft Excel - c:\progra~2\MICROS~4\Office12\EXCEL.EXE/3000

TCP: DhcpNameServer = 192.168.1.1

FF - ProfilePath - c:\users\Félicie\AppData\Roaming\Mozilla\Firefox\Profiles\zdltx9ir.default\

FF - prefs.js: browser.startup.homepage - about:home

FF - prefs.js: keyword.URL - hxxp://redirecterror.sfr.fr/?q=

.

- - - - ORPHELINS SUPPRIMES - - - -

.

Toolbar-Locked - (no file)

Wow6432Node-HKLM-Run-vProt - c:\program files (x86)\AVG Secure Search\vprot.exe

Wow6432Node-HKLM-Run-ROC_ROC_NT - c:\program files (x86)\AVG Secure Search\ROC_ROC_NT.exe

Toolbar-Locked - (no file)

HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe

AddRemove-BitTorrent - c:\program files (x86)\BitTorrent\BitTorrent.exe

.

--------------------- CLES DE REGISTRE BLOQUEES ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10x_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10x_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10x.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.10"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10x.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10x.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10x.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]

"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Nico Mak Computing\WinZip]

"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,6f,00,66,00,\

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Heure de fin: 2013-05-03 16:54:46

ComboFix-quarantined-files.txt 2013-05-03 14:54

.

Avant-CF: 459 509 800 960 octets libres

Après-CF: 459 141 001 216 octets libres

.

- - End Of File - - 562A536A6EB4DCBB460D3EA7CEC4D640

Apollo · le 3 mai 2013

Bonjour,

Prépare tes supports de stockage USB 'clés, disque externe, etc.

Téléchargez UsbFix (créé par El Desaparecido) sur votre Bureau.
Si votre antivirus affiche une alerte, ignorez-la et désactivez l'antivirus temporairement.

Si vous ne savez pas comment faire, reportez-vous à cet article.
Branchez toutes vos sources de données externes à votre PC (clé USB, disque dur externe, etc...) sans les ouvrir.

Double cliquez sur UsbFix.exe.
Cliquez sur recherche.

Laissez travailler l'outil.
À la fin du scan, un rapport va s'afficher, postez-le dans votre prochaine réponse sur le forum.
Le rapport est aussi sauvegardé à la racine du disque système ( C:\UsbFix.txt ).
Tutoriel en images

++

NB: certains antivirus râlent sur USBFIX, c'est un faux positif, désactiver l'AV momentanément.

Modifié le 3 mai 2013 par Apollo

bezulon · le 3 mai 2013

Voici le nouveau rapport

############################## | UsbFix V 7.125 | [Recherche]

Utilisateur: Félicie (Administrateur) # FÉLICIE-PC

Mis à jour le 01/05/2013 par El Desaparecido

Lancé à 18:03:06 | 03/05/2013

Site Web: http://sosvirus.org/

Upload Malware: http://upload.sosvirus.org/

Contact: contact@sosvirus.org

PC: Acer (Aspire 5749Z) (x64-based PC)

CPU: Intel® Pentium® CPU B960 @ 2.20GHz (2200)

RAM -> [Total : 3948 | Free : 2138]

BIOS: InsydeH2O Version V1.06

BOOT: Normal boot

OS: Microsoft Windows 7 Édition Familiale Premium (6.1.7601 64-Bit) # Service Pack 1

WB: Windows Internet Explorer 9.0.8112.16421

SC: Security Center Service [Enabled]

WU: Windows Update Service [Enabled]

AV: AVG Anti-Virus Free Edition 2012 [(!) Disabled | Updated]

FW: Windows FireWall Service [Enabled]

C:\ (%systemdrive%) -> Disque fixe # 581 Go (429 Go libre(s) - 74%) [Acer] # NTFS

D:\ -> CD-ROM

F:\ -> Disque fixe # 466 Go (359 Go libre(s) - 77%) [Disque dur Félicie] # NTFS

################## | Processus Actif |

C:\Windows\system32\csrss.exe (672)

C:\Windows\system32\csrss.exe (748)

C:\Windows\system32\wininit.exe (756)

C:\Windows\system32\services.exe (808)

C:\Windows\system32\lsass.exe (816)

C:\Windows\system32\lsm.exe (824)

C:\Windows\system32\winlogon.exe (880)

C:\Windows\system32\svchost.exe (980)

C:\Windows\system32\svchost.exe (400)

C:\Windows\System32\svchost.exe (700)

C:\Windows\System32\svchost.exe (924)

C:\Windows\system32\svchost.exe (1056)

C:\Windows\system32\svchost.exe (1092)

C:\Program Files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe (1244)

C:\Windows\system32\svchost.exe (1328)

C:\Windows\System32\spoolsv.exe (1524)

C:\Windows\system32\svchost.exe (1560)

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (1648)

C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (1668)

C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe (1740)

C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE (1768)

C:\Program Files\Bonjour\mDNSResponder.exe (1808)

C:\Program Files (x86)\Launch Manager\dsiwmis.exe (1856)

C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe (1888)

C:\Program Files (x86)\Launch Manager\LMutilps32.exe (1924)

C:\Program Files (x86)\Acer\Registration\GREGsvc.exe (1960)

C:\Program Files\Acer\Acer Updater\UpdaterService.exe (1988)

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (2024)

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (1048)

C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe (1180)

C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe (1580)

C:\Windows\system32\svchost.exe (2788)

C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\12.2.6\ToolbarUpdater.exe (2144)

C:\Windows\system32\taskhost.exe (2360)

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (2388)

C:\Windows\system32\Dwm.exe (2088)

C:\Windows\Explorer.EXE (2520)

C:\Windows\system32\svchost.exe (2720)

C:\Windows\System32\rundll32.exe (2984)

C:\Windows\System32\igfxtray.exe (3224)

C:\Windows\System32\hkcmd.exe (3300)

C:\Windows\System32\igfxpers.exe (3360)

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (3752)

C:\Windows\system32\taskeng.exe (3524)

C:\Program Files (x86)\Acer\clear.fi\MVP\clear.fiAgent.exe (4084)

C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (3852)

C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (3216)

C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe (3552)

C:\Program Files\Windows Sidebar\sidebar.exe (3128)

C:\Program Files (x86)\Acer\clear.fi\MVP\.\Kernel\DMR\DMREngine.exe (3496)

C:\Windows\system32\SearchIndexer.exe (3148)

C:\Windows\SysWOW64\Adobe\Shockwave 12\SwHelper_1200112.exe (3468)

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (1496)

C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe (4012)

C:\Program Files (x86)\Launch Manager\LManager.exe (3980)

C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe (3504)

C:\Program Files (x86)\iTunes\iTunesHelper.exe (3932)

C:\Program Files (x86)\AVG\AVG2012\avgtray.exe (3876)

C:\Windows\system32\igfxext.exe (3792)

C:\Program Files\Windows Media Player\wmpnetwk.exe (3444)

C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe (3264)

C:\Program Files (x86)\Launch Manager\LMworker.exe (4048)

C:\Windows\system32\wbem\wmiprvse.exe (1032)

C:\Windows\system32\svchost.exe (624)

C:\Windows\system32\igfxsrvc.exe (976)

C:\Windows\system32\wbem\unsecapp.exe (5036)

C:\Program Files\iPod\bin\iPodService.exe (4396)

C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe (4736)

C:\Windows\System32\svchost.exe (4816)

C:\Windows\system32\DllHost.exe (3828)

C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe (5904)

C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (5868)

C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (4516)

C:\Windows\system32\wuauclt.exe (5608)

C:\Program Files\EgisTec IPS\PMMUpdate.exe (4520)

C:\Program Files\EgisTec IPS\EgisUpdate.exe (5988)

C:\Program Files (x86)\AVG\AVG2012\avgcfgex.exe (3200)

C:\Program Files (x86)\Mozilla Firefox\firefox.exe (5948)

C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe (6076)

C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe (1072)

C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AcroRd32.exe (4700)

C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AcroRd32.exe (5436)

C:\UsbFix\Go.exe (2584)

C:\Windows\system32\wbem\wmiprvse.exe (2664)

C:\Windows\system32\taskhost.exe (908)

################## | El Desaparecido Section |

HKLM\SOFTWARE | Run : [Norton Online Backup] - C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe

HKLM\SOFTWARE | Run : [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

HKLM\SOFTWARE | Run : [backupManagerTray] - "C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe" -h -k

HKLM\SOFTWARE | Run : [LManager] - C:\Program Files (x86)\Launch Manager\LManager.exe

HKLM\SOFTWARE | Run : [suiteTray] - "C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe"

HKLM\SOFTWARE | Run : [ArcadeMovieService] - "C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe"

HKLM\SOFTWARE | Run : [APSDaemon] - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

HKLM\SOFTWARE | Run : [iTunesHelper] - "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

HKLM\SOFTWARE | Run : [AVG_TRAY] - "C:\Program Files (x86)\AVG\AVG2012\avgtray.exe"

HKLM\SOFTWARE | Run : [QuickTime Task] - "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

HKLM\SOFTWARE\wow6432Node | Run : [Norton Online Backup] - C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe

HKLM\SOFTWARE\wow6432Node | Run : [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

HKLM\SOFTWARE\wow6432Node | Run : [backupManagerTray] - "C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe" -h -k

HKLM\SOFTWARE\wow6432Node | Run : [LManager] - C:\Program Files (x86)\Launch Manager\LManager.exe

HKLM\SOFTWARE\wow6432Node | Run : [suiteTray] - "C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe"

HKLM\SOFTWARE\wow6432Node | Run : [ArcadeMovieService] - "C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe"

HKLM\SOFTWARE\wow6432Node | Run : [APSDaemon] - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

HKLM\SOFTWARE\wow6432Node | Run : [iTunesHelper] - "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

HKLM\SOFTWARE\wow6432Node | Run : [AVG_TRAY] - "C:\Program Files (x86)\AVG\AVG2012\avgtray.exe"

HKLM\SOFTWARE\wow6432Node | Run : [QuickTime Task] - "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

HKLM\SOFTWARE | RunOnce : [] -

HKLM\SOFTWARE\wow6432Node | RunOnce : [] -

HKU\S-1-5-21-4221014721-1838162589-818214966-1000\SOFTWARE | Run : [sidebar] - C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

HKU\S-1-5-21-4221014721-1838162589-818214966-1000\SOFTWARE | Run : [spotify Web Helper] - "C:\Users\Félicie\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"

HKU\S-1-5-18\SOFTWARE | RunOnce : [isMyWinLockerReboot] - msiexec.exe /qn /x{voidguid}

################## | Éléments infectieux |

Présent! C:\Disque dur Félicie (466GB).lnk

Présent! F:\Disque dur Félicie (466GB).lnk

Présent! F:\desktop.ini

Présent! F:\Thumbs.db

################## | Registre |

Présent! HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System|DisableRegistryTools

################## | Mountpoints2 |

################## | Vaccin |

(!) Cet ordinateur n'est pas vacciné!

################## | E.O.F | http://sosvirus.org |

Apollo · le 3 mai 2013

Ok!

Ce sera un peu plus long, donc ne t'étonne pas, laisse travailler l'outil.

Si votre antivirus affiche une alerte, ignorez-la et désactivez l'antivirus temporairement.

Si vous ne savez pas comment faire, reportez-vous à cet article.
Branchez toutes vos sources de données externes à votre PC (clé USB, disque dur externe, etc...) sans les ouvrir.

Double cliquez sur UsbFix.exe.
Cliquez sur Supression

Laissez travailler l'outil.
À la fin du scan, un rapport va s'afficher, postez-le dans votre prochaine réponse sur le forum.
Le rapport est aussi sauvegardé à la racine du disque système ( C:\UsbFix.txt ).
Tutoriel en images

@++

bezulon · le 3 mai 2013

J'ai lancé deux fois de suite l'analyse avec usbFix et mon ordi plante (le logiciel ne répond pas et je ne peux donc plus rien faire) à partir de 14%

Apollo · le 3 mai 2013

fais le en mode sans échec: Comment démarrer Windows en mode sans échec : Astuces pour Dépanner Windows XP

bezulon · le 3 mai 2013

En effet ça marche mieux !

Le rapport :

############################## | UsbFix V 7.125 | [suppression]

Utilisateur: Félicie (Administrateur) # FÉLICIE-PC

Mis à jour le 01/05/2013 par El Desaparecido

Lancé à 21:59:39 | 03/05/2013

Site Web: http://sosvirus.org/

Upload Malware: http://upload.sosvirus.org/

Contact: contact@sosvirus.org

PC: Acer (Aspire 5749Z) (x64-based PC)

CPU: Intel® Pentium® CPU B960 @ 2.20GHz (2195)

RAM -> [Total : 3948 | Free : 2934]

BIOS: InsydeH2O Version V1.06

BOOT: Fail-safe boot

OS: Microsoft Windows 7 Édition Familiale Premium (6.1.7601 64-Bit) # Service Pack 1

WB: Windows Internet Explorer 9.0.8112.16421

SC: Security Center Service [Enabled]

WU: Windows Update Service [Enabled]

AV: AVG Anti-Virus Free Edition 2012 [Enabled | Updated]