############################## | UsbFix V 7.164 | [Recherche]
Utilisateur: Invité bienvenue (Administrateur) # JUJU
Mis à jour le05/02/2014 par El Desaparecido - Team SosVirus
Lancé à 01:02:55 | 12/02/2014
Site Web :
http://www.usbfix.net/
Changelog :
http://www.usbfix.net/maj/
Support :
http://www.sosvirus.net/
Upload Malware :
http://www.sosvirus.net/upload_malware.php
Contact :
http://www.usbfix.net/contact/
PC: eMachines (MCP61PM-GM)
CPU: AMD Athlon(tm) 7450 Dual-Core Processor
RAM - [Total : 2815 Mo| Free : 699 Mo]
Bios: AMI
Boot: Normal boot
OS: Microsoft Windows 7 Édition Familiale Premium (6.1.7601 64-Bit) Service Pack 1
WB: Windows Internet Explorer : 11.0.9600.16476
WB: Google Chrome : 32.0.1700.107
WB: Mozilla Firefox : 26.0
SC: Security Center [Enabled]
WU: Windows Update [Enabled]
AV: Microsoft Security Essentials [Enabled | Updated]
AV: avast! Antivirus [Enabled | Updated]
AS: Windows Defender [(!) Disabled | Updated]
AS: avast! Antivirus [Enabled | Updated]
AS: Microsoft Security Essentials [Enabled | Updated]
FW: Windows FireWall [(!) Disabled]
C:\ (%systemdrive%) - Disque fixe # 283 Go (107 Go libre(s) - 38%) [eMachines] # NTFS
D:\ - CD-ROM
E:\ - Disque amovible # 4 Go (4 Go libre(s) - 98%) [JULIEN] # FAT32
K:\ - Disque amovible # 4 Go (4 Go libre(s) - 98%) [E] # FAT32
################## | Processus Actif |
C:\Windows\system32\csrss.exe (ID: 428 |ParentID: 412)
C:\Windows\system32\wininit.exe (ID: 480 |ParentID: 412)
C:\Windows\system32\csrss.exe (ID: 504 |ParentID: 496)
C:\Windows\system32\services.exe (ID: 560 |ParentID: 480)
C:\Windows\system32\lsass.exe (ID: 568 |ParentID: 480)
C:\Windows\system32\lsm.exe (ID: 576 |ParentID: 480)
C:\Windows\system32\winlogon.exe (ID: 668 |ParentID: 496)
C:\Windows\system32\svchost.exe (ID: 760 |ParentID: 560)
C:\Windows\system32\nvvsvc.exe (ID: 840 |ParentID: 560)
C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (ID: 868 |ParentID: 560)
C:\Windows\system32\svchost.exe (ID: 916 |ParentID: 560)
c:\Program Files\Microsoft Security Client\MsMpEng.exe (ID: 980 |ParentID: 560)
C:\Windows\System32\svchost.exe (ID: 432 |ParentID: 560)
C:\Windows\System32\svchost.exe (ID: 508 |ParentID: 560)
C:\Windows\system32\svchost.exe (ID: 436 |ParentID: 560)
C:\Windows\system32\svchost.exe (ID: 1064 |ParentID: 560)
C:\Windows\system32\svchost.exe (ID: 1252 |ParentID: 560)
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (ID: 1332 |ParentID: 560)
C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (ID: 1388 |ParentID: 840)
C:\Windows\system32\nvvsvc.exe (ID: 1396 |ParentID: 840)
C:\Program Files (x86)\WinZipper\winzipersvc.exe (ID: 1620 |ParentID: 560)
C:\Windows\System32\spoolsv.exe (ID: 1760 |ParentID: 560)
C:\Windows\system32\svchost.exe (ID: 1796 |ParentID: 560)
C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE (ID: 1924 |ParentID: 560)
C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE (ID: 1976 |ParentID: 560)
C:\Program Files (x86)\eMachines\Registration\GregHSRW.exe (ID: 2016 |ParentID: 560)
c:\xampplite\srvany.exe (ID: 1028 |ParentID: 560)
C:\XAMPPLite\Apache\bin\apache.exe (ID: 1228 |ParentID: 1028)
c:\xampplite\srvany.exe (ID: 1284 |ParentID: 560)
C:\Windows\system32\conhost.exe (ID: 1320 |ParentID: 428)
C:\XAMPPLite\MySQL\bin\mysqld.exe (ID: 1524 |ParentID: 1284)
C:\Program Files (x86)\PDF Architect\HelperService.exe (ID: 1888 |ParentID: 560)
C:\Program Files (x86)\PDF Architect\ConversionService.exe (ID: 2088 |ParentID: 560)
C:\Program Files (x86)\Security Updates Service\winupdsvc.exe (ID: 2124 |ParentID: 560)
C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe (ID: 2296 |ParentID: 560)
C:\Program Files\eMachines\eMachines Updater\UpdaterService.exe (ID: 2360 |ParentID: 560)
C:\Program Files (x86)\Wajam\Updater\WajamUpdaterV3.exe (ID: 2544 |ParentID: 560)
C:\PROGRA~2\SearchProtect\Main\bin\CltMngSvc.exe (ID: 2576 |ParentID: 560)
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe (ID: 2604 |ParentID: 560)
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe (ID: 2660 |ParentID: 560)
c:\Program Files\Microsoft Security Client\NisSrv.exe (ID: 3028 |ParentID: 560)
C:\Windows\System32\WUDFHost.exe (ID: 2932 |ParentID: 508)
C:\XAMPPLite\Apache\bin\apache.exe (ID: 3204 |ParentID: 1228)
C:\Windows\system32\svchost.exe (ID: 4468 |ParentID: 560)
C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (ID: 4700 |ParentID: 560)
C:\Program Files\Windows Media Player\wmpnetwk.exe (ID: 4756 |ParentID: 560)
C:\Windows\system32\SearchIndexer.exe (ID: 2744 |ParentID: 560)
C:\Windows\system32\taskhost.exe (ID: 376 |ParentID: 560)
C:\Windows\system32\Dwm.exe (ID: 1272 |ParentID: 508)
C:\Windows\Explorer.EXE (ID: 3176 |ParentID: 1204)
C:\PROGRA~2\SearchProtect\SearchProtect\bin\cltmng.exe (ID: 2848 |ParentID: 2576)
C:\Program Files (x86)\TeamViewer\Version8\TeamViewer.exe (ID: 1376 |ParentID: 2296)
C:\PROGRA~2\SearchProtect\UI\bin\cltmngui.exe (ID: 5132 |ParentID: 2576)
C:\Windows\system32\wbem\wmiprvse.exe (ID: 5268 |ParentID: 760)
C:\Windows\PixArt\Pac207\Monitor.exe (ID: 5356 |ParentID: 3176)
C:\Program Files\Microsoft Security Client\msseces.exe (ID: 5372 |ParentID: 3176)
C:\Program Files (x86)\TeamViewer\Version8\tv_w32.exe (ID: 5524 |ParentID: 2296)
C:\Windows\System32\spool\drivers\x64\3\E_IATIGGE.EXE (ID: 5640 |ParentID: 3176)
C:\Program Files (x86)\TeamViewer\Version8\tv_x64.exe (ID: 5676 |ParentID: 2296)
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (ID: 5832 |ParentID: 1388)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 5952 |ParentID: 3176)
C:\Program Files (x86)\Skype\Phone\Skype.exe (ID: 6056 |ParentID: 3176)
C:\Windows\System32\wscript.exe (ID: 6072 |ParentID: 3176)
C:\Program Files (x86)\Kiwee Toolbar\3.2\kwtbaim.exe (ID: 4920 |ParentID: 6136)
C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe (ID: 6200 |ParentID: 6136)
C:\Users\Invité bienvenue\AppData\Local\Temp\ehj5D53.tmp\UPDATER.EXE (ID: 6396 |ParentID: 3176)
C:\Windows\System32\svchost.exe (ID: 6532 |ParentID: 560)
C:\Program Files (x86)\Common Files\windows\win-xp-7.exe (ID: 6540 |ParentID: 6136)
C:\Windows\system32\wuauclt.exe (ID: 6604 |ParentID: 1064)
C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe (ID: 6624 |ParentID: 6136)
C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe (ID: 6664 |ParentID: 6136)
C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe (ID: 6672 |ParentID: 6068)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 6824 |ParentID: 5952)
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (ID: 6840 |ParentID: 6136)
C:\Program Files\Alwil Software\Avast5\AvastUI.exe (ID: 6852 |ParentID: 6136)
C:\Windows\system32\svchost.exe (ID: 5220 |ParentID: 560)
C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin (ID: 6016 |ParentID: 6672)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 6268 |ParentID: 5952)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 6728 |ParentID: 5952)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 7380 |ParentID: 5952)
C:\Windows\system32\DllHost.exe (ID: 7052 |ParentID: 760)
C:\Windows\system32\calc.exe (ID: 7604 |ParentID: 3176)
C:\Windows\splwow64.exe (ID: 1596 |ParentID: 6016)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 8632 |ParentID: 5952)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 6648 |ParentID: 5952)
C:\Windows\system32\taskhost.exe (ID: 7884 |ParentID: 560)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 2736 |ParentID: 5952)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 412 |ParentID: 5952)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 7372 |ParentID: 5952)
C:\Program Files (x86)\Windows Media Player\wmplayer.exe (ID: 7780 |ParentID: 760)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 2524 |ParentID: 5952)
C:\Windows\SysWOW64\DllHost.exe (ID: 5412 |ParentID: 760)
C:\Windows\system32\SearchProtocolHost.exe (ID: 8552 |ParentID: 2744)
C:\Windows\system32\SearchFilterHost.exe (ID: 3132 |ParentID: 2744)
################## | Regedit Run |
04 - HKCU\..\Run : [EPSON SX125 Series] C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIGGE.EXE /FU "C:\Users\INVITB~1\AppData\Local\Temp\E_SED45.tmp" /EF "HKCU"
04 - HKCU\..\Run : [Facebook Update] "C:\Users\Invité bienvenue\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
04 - HKCU\..\Run : [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
04 - HKCU\..\Run : [SURVIVAL] wscript.exe //B "C:\Users\INVITB~1\AppData\Local\Temp\SURVIVAL.vbe"
04 - HKCU\..\RunOnce : [ehjkfdmkpocpileolmldepapdjbfegei Upgrader] "C:\Users\Invité bienvenue\AppData\Local\Temp\ehj5D53.tmp\UPDATER.EXE"
04 - HKLM\..\Run : [NortonOnlineBackupReminder] "C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe" UNATTENDED
04 - HKLM\..\Run : [KiweeHook] "C:\Program Files (x86)\Kiwee Toolbar\3.2\kwtbaim.exe"
04 - HKLM\..\Run : [TaskTray]
04 - HKLM\..\Run : [EEventManager] "C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe"
04 - HKLM\..\Run : [DATAMNGR] C:\PROGRA~2\SEARCH~1\Datamngr\DATAMN~1.EXE
04 - HKLM\..\Run : [win-xp-7] C:\Program Files (x86)\Common Files\windows\win-xp-7.exe
04 - HKLM\..\Run : [SweetIM] C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe
04 - HKLM\..\Run : [Sweetpacks Communicator] C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe
04 - HKLM\..\Run : [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
04 - HKLM\..\Run : [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
04 - HKLM\..\Run : [AvastUI.exe] "C:\Program Files\Alwil Software\Avast5\AvastUI.exe" /nogui
04 - HKLM\..\RunOnce : []
04 - HKLM64\..\Run : [Monitor] C:\Windows\PixArt\PAC207\Monitor.exe
04 - HKLM64\..\Run : [LogMeIn GUI] "C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe"
04 - HKLM64\..\Run : [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
04 - HKU\S-1-5-19\..\Run : [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
04 - HKU\S-1-5-20\..\Run : [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
04 - HKU\S-1-5-21-3689307825-2388042978-3138353921-1006\..\Run : [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
04 - HKU\S-1-5-21-3689307825-2388042978-3138353921-1144\..\Run : [EPSON SX125 Series] C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIGGE.EXE /FU "C:\Users\INVITB~1\AppData\Local\Temp\E_SED45.tmp" /EF "HKCU"
04 - HKU\S-1-5-21-3689307825-2388042978-3138353921-1144\..\Run : [Facebook Update] "C:\Users\Invité bienvenue\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
04 - HKU\S-1-5-21-3689307825-2388042978-3138353921-1144\..\Run : [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
04 - HKU\S-1-5-21-3689307825-2388042978-3138353921-1144\..\Run : [SURVIVAL] wscript.exe //B "C:\Users\INVITB~1\AppData\Local\Temp\SURVIVAL.vbe"
04 - HKU\S-1-5-19\..\RunOnce : [mctadmin] C:\Windows\System32\mctadmin.exe
04 - HKU\S-1-5-20\..\RunOnce : [mctadmin] C:\Windows\System32\mctadmin.exe
04 - HKU\S-1-5-21-3689307825-2388042978-3138353921-1006\..\RunOnce : [mctadmin] C:\Windows\System32\mctadmin.exe
04 - HKU\S-1-5-21-3689307825-2388042978-3138353921-1006\..\RunOnce : [ScrSav] C:\Program Files (x86)\eMachines\Screensaver\run_eMachines.exe /default
04 - HKU\S-1-5-21-3689307825-2388042978-3138353921-1144\..\RunOnce : [ehjkfdmkpocpileolmldepapdjbfegei Upgrader] "C:\Users\Invité bienvenue\AppData\Local\Temp\ehj5D53.tmp\UPDATER.EXE"
04 - HKU\S-1-5-18\..\RunOnce : [DeleteEngineAfterUpdate] reg DELETE HKCU\Software\AppDataLow\Software\ConduitEngine /f
04 - HKU\S-1-5-18\..\RunOnce : [SPReview] "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"
http://go.microsoft.com/fwlink/?LinkID=122915" /build:7601
################## | Recherche générique |
Présent! C:\Users\Invité bienvenue\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SURVIVAL.vbe
Présent! C:\Users\INVITB~1\AppData\Local\Temp\SURVIVAL.vbe
Présent! E:\SURVIVAL.vbe
Présent! K:\SURVIVAL.vbe
Présent! E:\Marry Me- Jason Derulo [ Lyrics ].lnk
Présent! E:\Indila - Dernière Danse.lnk
Présent! E:\Tony Junior - Twerk Anthem.lnk
Présent! E:\Katy Perry - Unconditionally (Lyric Video).lnk
Présent! E:\Imagine Dragons - Demons.lnk
Présent! E:\oui_mem_leak.lnk
Présent! K:\AUTRES.lnk
Présent! K:\Vente de crêpes.lnk
Présent! C:\Users\Public\sdelevURL.tmp
Présent! C:\Users\Invité bienvenue\AppData\Local\Temp\SURVIVAL.vbe
Présent! C:\Users\public.juju\AppData\Local\Temp\SURVIVAL.vbe
Présent! C:\Users\public.juju\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SURVIVAL.vbe
Présent! C:\Users\standar\AppData\Local\Temp\SURVIVAL.vbe
Présent! C:\Users\standar\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SURVIVAL.vbe
################## | Registre |
Présent! HKU\S-1-5-21-3689307825-2388042978-3138353921-1144\Software\Microsoft\Windows\CurrentVersion\Run|SURVIVAL
Présent! HKCU\Software\Microsoft\Windows\CurrentVersion\Run|SURVIVAL
Présent! HKU\S-1-5-21-3689307825-2388042978-3138353921-1144\Software\Microsoft\Windows\CurrentVersion\Run|SURVIVAL
Présent! HKCU\Software\Microsoft\Windows\CurrentVersion\Run|SURVIVAL
################## | Vaccin |
################## | E.O.F |
http://www.usbfix.net/ -
http://www.sosvirus.net |
Bonjour,