Sunteți pe pagina 1din 4

[b]############################## | UsbFix V 7.

172 | [Research][/b]
User: Asus (Administrator) # ASUS-PC
Updated 23/06/2014 by El Desaparecido - SosVirus
Started at 16:05:05 | 22/07/2014
Website : [url=http://www.en.usbfix.net/]http://www.en.usbfix.net/[/url]
Changelog : [url=http://www.en.usbfix.net/changelog/]http://www.en.usbfix.net/ch
angelog/[/url]
Support : [url=http://en.kioskea.net/forum/viruses-security-7]http://en.kioskea.
net/forum/viruses-security-7[/url]
Upload Malware : [url=http://www.sosvirus.net/upload_malware.php]http://www.sosv
irus.net/upload_malware.php[/url]
Contact : [url=http://www.en.usbfix.net/contact/]http://www.en.usbfix.net/contac
t/[/url]
[b]################## | System information |[/b]
MB: ASRock (FM2A55M-VG3)
CPU: AMD A4-4000 APU with Radeon(tm) HD Graphics
RAM -> [Total : 3042 Mo | Free : 1795 Mo]
Bios: American Megatrends Inc.
Boot: Normal boot
OS:
WB:
WB:
WB:

Microsoft Windows 7 Ultimate (6.1.7600 32-Bit)


Internet Explorer : 8.00.7600.16385
Google Chrome : 36.0.1985.125
Mozilla Firefox : 30.0

[b]################## | Security Information |[/b]


AV:
AS:
AS:
FW:
SC:
WU:

Avira Desktop [Enabled |Updated]


Avira Desktop [Enabled |Updated]
Windows Defender [Enabled |[b](!) Outdated[/b]]
Windows Firewall [Enabled]
Security Center [Enabled]
Windows Update [Enabled]

[b]################## | Disk Information |[/b]


C:\ (%SystemDrive%) -> Fixed disk # 173 Gb (104 Mb free - 60%) [] # NTFS
D:\ -> Fixed disk # 293 Gb (232 Mb free - 79%) [] # NTFS
[b]################## | Active Processes |[/b]
C:\Windows\System32\smss.exe (ID: 268|ParentID: 4|SYSTEM)
C:\Windows\System32\wininit.exe (ID: 484|ParentID: 344)
C:\Windows\System32\services.exe (ID: 532|ParentID: 484)
C:\Windows\System32\lsass.exe (ID: 548|ParentID: 484)
C:\Windows\System32\lsm.exe (ID: 556|ParentID: 484)
C:\Windows\System32\winlogon.exe (ID: 696|ParentID: 476)
C:\Windows\System32\svchost.exe (ID: 724|ParentID: 532)
C:\Windows\System32\svchost.exe (ID: 804|ParentID: 532)
C:\Windows\System32\atiesrxx.exe (ID: 852|ParentID: 532)
C:\Windows\System32\svchost.exe (ID: 924|ParentID: 532)
C:\Windows\System32\svchost.exe (ID: 980|ParentID: 532)
C:\Windows\System32\svchost.exe (ID: 1020|ParentID: 532)
C:\Windows\System32\audiodg.exe (ID: 1104|ParentID: 924)
C:\Windows\System32\svchost.exe (ID: 1168|ParentID: 532)
C:\Windows\System32\atieclxx.exe (ID: 1268|ParentID: 852)

C:\Windows\System32\svchost.exe (ID: 1292|ParentID: 532)


C:\Windows\System32\spoolsv.exe (ID: 1460|ParentID: 532)
C:\Program Files\Avira\AntiVir Desktop\sched.exe (ID: 1496|ParentID: 532)
C:\Windows\System32\svchost.exe (ID: 1524|ParentID: 532)
C:\Windows\System32\dwm.exe (ID: 1708|ParentID: 980|Asus)
C:\Windows\explorer.exe (ID: 1724|ParentID: 1700|Asus)
C:\Windows\System32\taskhost.exe (ID: 1732|ParentID: 532|Asus)
C:\Windows\System32\taskeng.exe (ID: 1804|ParentID: 1020)
C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (ID: 1948|Parent
ID: 532)
C:\Program Files\Avira\AntiVir Desktop\avguard.exe (ID: 1980|ParentID: 532)
C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe (ID: 2040|ParentID: 532)
C:\Windows\System32\taskeng.exe (ID: 316|ParentID: 1020|Asus)
C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe (ID: 788|Pa
rentID: 532)
C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe (ID: 1228|ParentID: 53
2)
C:\Users\Asus\Desktop\Copy Paste Games\Garena (KENNETH-PC)\ggdllhost.exe (ID: 41
2|ParentID: 316|Asus)
C:\Windows\System32\svchost.exe (ID: 308|ParentID: 532)
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (ID: 2284|ParentID: 1724|Asus)
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe (ID: 2308|ParentID:
1724|Asus)
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (ID: 2316|ParentID: 1724)
C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe (ID: 2324|Pare
ntID: 1724|Asus)
C:\Windows\System32\wscript.exe (ID: 2336|ParentID: 1724|Asus)
C:\Program Files\Hostless Modem\3G Mobile Hotspot\CheckNDISPort_df.exe (ID: 2352
|ParentID: 1724|Asus)
C:\Program Files\Common Files\Java\Java Update\jusched.exe (ID: 2364|ParentID: 1
724|Asus)
C:\Program Files\Windows Sidebar\sidebar.exe (ID: 2392|ParentID: 1724|Asus)
C:\Users\Asus\AppData\Roaming\uTorrent\uTorrent.exe (ID: 2468|ParentID: 1724|Asu
s)
C:\Program Files\BitTorrent Sync\BTSync.exe (ID: 2484|ParentID: 1724|Asus)
C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (ID: 2548|ParentID
: 1724|Asus)
C:\Program Files\Yahoo!\Messenger\Ymsgr_tray.exe (ID: 3704|ParentID: 2376|Asus)
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (ID: 3852|ParentID: 1980)
C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe (ID: 3964|ParentID: 532)
C:\Windows\System32\SearchIndexer.exe (ID: 4028|ParentID: 532)
C:\Windows\System32\svchost.exe (ID: 1536|ParentID: 532)
C:\Windows\System32\svchost.exe (ID: 616|ParentID: 532)
C:\Windows\System32\svchost.exe (ID: 3624|ParentID: 532)
C:\Program Files\Windows Media Player\wmpnetwk.exe (ID: 3804|ParentID: 532)
C:\Windows\System32\svchost.exe (ID: 4536|ParentID: 532)
C:\Program Files\Google\Chrome\Application\chrome.exe (ID: 5008|ParentID: 1724|A
sus)
C:\Program Files\Google\Chrome\Application\chrome.exe (ID: 5108|ParentID: 5008|A
sus)
C:\Program Files\Google\Chrome\Application\chrome.exe (ID: 5480|ParentID: 5008|A
sus)
C:\Windows\System32\sppsvc.exe (ID: 5984|ParentID: 532)
C:\Program Files\Google\Chrome\Application\chrome.exe (ID: 4344|ParentID: 5008|A
sus)
C:\Program Files\Google\Chrome\Application\chrome.exe (ID: 1568|ParentID: 5008|A
sus)
C:\Program Files\Google\Chrome\Application\chrome.exe (ID: 3056|ParentID: 5008|A
sus)
C:\Windows\System32\SearchProtocolHost.exe (ID: 4516|ParentID: 4028)

C:\Windows\System32\SearchFilterHost.exe (ID: 1428|ParentID: 4028|SYSTEM)


C:\Program Files\Google\Chrome\Application\chrome.exe (ID: 4448|ParentID: 5008|A
sus)
C:\UsbFix\UsbFix.exe (ID: 4232|ParentID: 4696|Asus)
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (ID: 1112|ParentID
: 2292|Asus)
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (ID: 3284|ParentID
: 1112|Asus)
[b]################## | Autorun |[/b]
[b]################## | Regedit Run |[/b]
F2 - HKLM\..\Winlogon : [Shell] explorer.exe
F2 - HKLM\..\Winlogon : [Userinit] C:\Windows\System32\Userinit.exe,
04 - HKCU\..\Run : [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\Yahoo
Messenger.exe" -quiet
04 - HKCU\..\Run : [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /
regrun
04 - HKCU\..\Run : [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoR
un
04 - HKCU\..\Run : [uTorrent] "C:\Users\Asus\AppData\Roaming\uTorrent\uTorrent.e
xe" /MINIMIZED
04 - HKCU\..\Run : [BitTorrent Sync] "C:\Program Files\BitTorrent Sync\BTSync.ex
e" /MINIMIZED
04 - HKCU\..\Run : [kpcgrhynko] wscript.exe //B "C:\Users\Asus\AppData\Roaming\k
pcgrhynko..vbs"
04 - HKLM\..\Run : [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
04 - HKLM\..\Run : [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-St
atic\CLIStart.exe" MSRun
04 - HKLM\..\Run : [AMD AVT] Cmd.exe /c start "AMD Accelerated Video Transcoding
device initialization" /min "C:\Program Files\AMD AVT\bin\kdbsync.exe" aml
04 - HKLM\..\Run : [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\G
rooveMonitor.exe"
04 - HKLM\..\Run : [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /m
in
04 - HKLM\..\Run : [ApnTBMon] "C:\Program Files\AskPartnerNetwork\Toolbar\Update
r\TBNotifier.exe"
04 - HKLM\..\Run : [kpcgrhynko] wscript.exe //B "C:\Users\Asus\AppData\Roaming\k
pcgrhynko..vbs"
04 - HKLM\..\Run : [CheckNDISPort_df] C:\Program Files\Hostless Modem\3G Mobile
Hotspot\CheckNDISPort_df.exe
04 - HKLM\..\Run : [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java
Update\jusched.exe"
04 - HKU\S-1-5-19\..\Run : [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe
/autoRun
04 - HKU\S-1-5-20\..\Run : [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe
/autoRun
04 - HKU\S-1-5-21-2522502146-3211948395-1212076981-1000\..\Run : [Messenger (Yah
oo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
04 - HKU\S-1-5-21-2522502146-3211948395-1212076981-1000\..\Run : [Skype] "C:\Pro
gram Files\Skype\Phone\Skype.exe" /minimized /regrun
04 - HKU\S-1-5-21-2522502146-3211948395-1212076981-1000\..\Run : [Sidebar] C:\Pr
ogram Files\Windows Sidebar\sidebar.exe /autoRun
04 - HKU\S-1-5-21-2522502146-3211948395-1212076981-1000\..\Run : [uTorrent] "C:\
Users\Asus\AppData\Roaming\uTorrent\uTorrent.exe" /MINIMIZED
04 - HKU\S-1-5-21-2522502146-3211948395-1212076981-1000\..\Run : [BitTorrent Syn
c] "C:\Program Files\BitTorrent Sync\BTSync.exe" /MINIMIZED
04 - HKU\S-1-5-21-2522502146-3211948395-1212076981-1000\..\Run : [kpcgrhynko] ws

cript.exe //B "C:\Users\Asus\AppData\Roaming\kpcgrhynko..vbs"


04 - HKU\S-1-5-19\..\RunOnce : [mctadmin] C:\Windows\System32\mctadmin.exe
04 - HKU\S-1-5-20\..\RunOnce : [mctadmin] C:\Windows\System32\mctadmin.exe
[b]################## | Generic Research |[/b]
Found ! C:\Users\Asus\AppData\Roaming\kpcgrhynko..vbs
Found ! C:\Users\Asus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Star
tup\kpcgrhynko..vbs
[b]################## | Registry |[/b]
Found ! HKU\S-1-5-21-2522502146-3211948395-1212076981-1000\Software\Microsoft\Wi
ndows\CurrentVersion\Run|kpcgrhynko
Found ! HKLM\Software\Microsoft\Windows\CurrentVersion\Run|kpcgrhynko
Found ! HKCU\Software\Microsoft\Windows\CurrentVersion\Run|kpcgrhynko
[b]################## | E.O.F | [url=http://www.sosvirus.net/]http://www.sosviru
s.net/[/url] | [url=http://www.en.usbfix.net/]http://www.en.usbfix.net/[/url] |[
/b]

S-ar putea să vă placă și