ComboFix 15-10-28.01 - GUAZOU 02/11/2015 18:11:00.1.2 - x86
Microsoft Windows 7 Édition Starter 6.1.7600.0.1252.33.1036.18.2013.480 [GMT 1:00]
Lancé depuis: c:\users\GUAZOU\Desktop\ComboFix.exe
AV: avast! Antivirus *Enabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
FW: avast! Antivirus *Enabled* {2F96FC65-F07D-9D1E-5A6E-3DA5C487EAF0}
SP: avast! Antivirus *Enabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Un nouveau point de restauration a été créé
.
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\1e2b019c-075e-4efb-9a4d-b8fdd03a8e4a\0bf96f10-a892-4a35-86d4-290f5497a273.dll
c:\program files\7-Zip\213ca8c1-bc54-458b-9fd5-b5b06bed4121.dll
c:\program files\CinemaP-1.9cV31.10\6b292d44-b984-4c46-8a91-49ce0473afad.dll
c:\users\GUAZOU\AppData\Roaming\DRPSu
c:\users\GUAZOU\AppData\Roaming\DRPSu\DrvUpdater.exe
.
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_globalUpdate
.
.
((((((((((((((((((((((((((((( Fichiers créés du 2015-10-02 au 2015-11-02 ))))))))))))))))))))))))))))))))))))
.
.
2015-11-02 17:18 . 2015-11-02 17:18 -------- d-----w- c:\users\Default\AppData\Local\temp
2015-11-01 07:59 . 2015-11-02 17:17 -------- d-----w- c:\program files\1e2b019c-075e-4efb-9a4d-b8fdd03a8e4a
2015-11-01 07:59 . 2015-11-01 07:59 -------- d-----w- c:\users\GUAZOU\AppData\Local\globalUpdate
2015-11-01 07:59 . 2015-11-01 07:59 -------- d-----w- c:\program files\globalUpdate
2015-11-01 07:59 . 2015-11-02 17:17 -------- d-----w- c:\program files\CinemaP-1.9cV31.10
2015-11-01 07:52 . 2015-11-01 07:52 -------- d-----w- c:\program files\RayDld
2015-11-01 07:51 . 2015-11-01 07:52 -------- d-----w- c:\users\GUAZOU\AppData\Roaming\oursurfing
2015-10-27 21:59 . 2015-10-27 21:59 -------- d-----w- c:\program files\Common Files\Skype
2015-10-27 21:59 . 2015-10-27 21:59 -------- d-----r- c:\program files\Skype
2015-10-22 08:55 . 2015-10-22 08:55 -------- d-----w- c:\program files\Common Files\Java
2015-10-21 16:07 . 2015-10-11 19:47 313472 ----a-w- c:\windows\system32\aswBoot.exe
2015-10-19 17:06 . 2015-10-19 17:06 -------- d-----w- c:\programdata\GRETECH
2015-10-18 07:44 . 2015-10-22 14:26 -------- d-----w- c:\windows\system32\config\systemprofile\.oracle_jre_usage
2015-10-17 10:16 . 2015-10-22 08:55 -------- d-----w- c:\users\GUAZOU\.oracle_jre_usage
2015-10-17 08:04 . 2015-10-17 08:31 -------- d-----w- c:\programdata\Oracle
2015-10-16 16:17 . 2015-10-22 08:54 95840 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2015-10-11 19:47 . 2015-10-11 19:47 26096 ----a-w- c:\windows\system32\drivers\aswKbd.sys
2015-10-11 19:47 . 2015-10-11 19:47 107984 ----a-w- c:\windows\system32\drivers\ngvss.sys
2015-10-11 19:47 . 2015-10-11 19:47 43112 ----a-w- c:\windows\avastSS.scr
2015-10-11 19:47 . 2015-10-11 19:47 275856 ----a-w- c:\windows\system32\drivers\aswNdisFlt.sys
.
.
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-11-02 17:19 . 2015-07-15 00:26 62576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{0CC92ABE-5BBE-4B33-83F7-02CE8127A28D}\offreg.dll
2015-10-21 20:39 . 2014-09-06 15:42 780488 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2015-10-21 20:39 . 2014-09-06 15:42 142536 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2015-10-11 19:47 . 2014-09-06 21:10 49776 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2015-10-11 19:47 . 2014-09-06 21:10 434184 ----a-w- c:\windows\system32\drivers\aswSP.sys
2015-10-11 19:47 . 2014-09-06 21:10 208664 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2015-10-11 19:47 . 2014-09-06 21:10 115640 ----a-w- c:\windows\system32\drivers\aswStm.sys
2015-10-11 19:47 . 2014-09-06 21:10 76000 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2015-10-11 19:47 . 2014-09-06 21:10 24016 ----a-w- c:\windows\system32\drivers\aswHwid.sys
2015-10-11 19:47 . 2014-09-06 21:10 81728 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2015-10-11 19:47 . 2014-09-06 21:10 789296 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2015-09-10 22:39 . 2014-11-22 10:01 119512 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-09-06 15:18 . 2014-09-06 15:57 6010880 ----a-w- c:\program files\GUT8D51.tmp
2013-02-07 12:22 . 2013-02-07 12:22 50330 ----a-w- c:\program files\AntiDust.exe
.
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2015-10-11 19:47 696120 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\IDM Shell Extension]
@="{CDC95B92-E27C-4745-A8C5-64A52A78855D}"
[HKEY_CLASSES_ROOT\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}]
2014-04-21 08:02 23008 ----a-w- c:\program files\Internet Download Manager\IDMShellExt.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2014-10-15 3882576]
"uTorrent"="c:\users\GUAZOU\AppData\Roaming\uTorrent\uTorrent.exe" [2015-10-08 1822048]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-01 153136]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2013-01-22 11738184]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-11-17 138808]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-11-17 172088]
"Persistence"="c:\windows\system32\igfxpers.exe" [2012-11-17 173624]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2015-10-11 6134544]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2015-10-06 596528]
.
c:\users\GUAZOU\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Yahoo! Widgets.lnk - c:\program files\Yahoo!\Widgets\YahooWidgets.exe [2007-12-11 3746856]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
TP-LINK Wireless Configuration Utility.lnk - c:\program files\TP-LINK\TP-LINK Wireless Configuration Utility\TWCU.exe -nogui [2014-12-20 788992]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"SoftwareSASGeneration"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
R0 tcoifh;tcoifh; [x]
R1 BAPIDRV;BAPIDRV;c:\windows\system32\DRIVERS\BAPIDRV.sys [x]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes Anti-Malware\mbamservice.exe [2015-03-17 1080120]
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2015-07-09 327296]
R3 globalUpdatem;globalUpdate Update Service (globalUpdatem);c:\program files\globalUpdate\Update\globalupdate.exe [2015-11-01 68608]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys [2015-09-10 119512]
R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys [2015-03-17 51928]
R3 wacomrouterfilter;Wacom Router Filter Driver;c:\windows\system32\DRIVERS\wacomrouterfilter.sys [2012-12-20 13296]
R4 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes Anti-Malware\mbamscheduler.exe [2015-03-17 1871160]
S0 aswNdisFlt;Avast! Firewall Driver;c:\windows\system32\DRIVERS\aswNdisFlt.sys [2015-10-11 275856]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S0 iusb3hcs;Pilote de commutateur de contrôleur d'hôte Intel(R) USB 3.0;c:\windows\system32\DRIVERS\iusb3hcs.sys [2012-12-04 16440]
S0 ngvss;ngvss; [x]
S1 aswKbd;aswKbd;c:\windows\system32\drivers\aswKbd.sys [2015-10-11 26096]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2015-10-11 789296]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2015-10-11 434184]
S2 aswHwid;avast! HardwareID;c:\windows\system32\drivers\aswHwid.sys [2015-10-11 24016]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2015-10-11 76000]
S2 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys [2015-10-11 115640]
S2 avast! Firewall;Avast Firewall;c:\program files\AVAST Software\Avast\afwServ.exe [2015-10-11 109008]
S2 IDMWFP;IDMWFP;c:\windows\system32\DRIVERS\idmwfp.sys [2014-10-01 115240]
S2 ihpmServer;ihpmServer;c:\program files\RayDld\ihpmServer.exe [2015-10-12 270568]
S2 VBoxAswDrv;VBoxAsw Support Driver;c:\program files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [2015-10-11 220752]
S3 AvastVBoxSvc;AvastVBox COM Service;c:\program files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [2015-10-11 3219136]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2015-03-17 23256]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2012-12-27 614624]
.
.
--- Autres Services/Pilotes en mémoire ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ SSDPSRV upnphost SCardSvr TBS FontCache fdrespub AppIDSvc QWAVE wcncsvc
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2015-10-24 11:32 997704 ----a-w- c:\program files\Google\Chrome\Application\46.0.2490.80\Installer\chrmstp.exe
.
Contenu du dossier 'Tâches planifiées'
.
2015-11-02 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-10-16 20:39]
.
2015-11-02 c:\windows\Tasks\f509f073-bc61-4f4e-b140-93c6eeff83cb-1-6.job
- c:\program files\CinemaP-1.9cV31.10\f509f073-bc61-4f4e-b140-93c6eeff83cb-1-6.exe [2015-11-01 08:00]
.
2015-11-02 c:\windows\Tasks\f509f073-bc61-4f4e-b140-93c6eeff83cb-1-7.job
- c:\program files\CinemaP-1.9cV31.10\f509f073-bc61-4f4e-b140-93c6eeff83cb-1-7.exe [2015-11-01 08:00]
.
2015-11-02 c:\windows\Tasks\f509f073-bc61-4f4e-b140-93c6eeff83cb-10_user.job
- c:\program files\CinemaP-1.9cV31.10\f509f073-bc61-4f4e-b140-93c6eeff83cb-10.exe [2015-11-01 07:59]
.
2015-11-02 c:\windows\Tasks\f509f073-bc61-4f4e-b140-93c6eeff83cb-3.job
- c:\program files\CinemaP-1.9cV31.10\f509f073-bc61-4f4e-b140-93c6eeff83cb-3.exe [2015-11-01 07:59]
.
2015-11-02 c:\windows\Tasks\f509f073-bc61-4f4e-b140-93c6eeff83cb-5.job
- c:\program files\CinemaP-1.9cV31.10\f509f073-bc61-4f4e-b140-93c6eeff83cb-5.exe [2015-11-01 08:00]
.
2015-11-02 c:\windows\Tasks\f509f073-bc61-4f4e-b140-93c6eeff83cb-5_user.job
- c:\program files\CinemaP-1.9cV31.10\f509f073-bc61-4f4e-b140-93c6eeff83cb-5.exe [2015-11-01 08:00]
.
2015-11-02 c:\windows\Tasks\f509f073-bc61-4f4e-b140-93c6eeff83cb-6.job
- c:\program files\CinemaP-1.9cV31.10\f509f073-bc61-4f4e-b140-93c6eeff83cb-6.exe [2015-11-01 07:59]
.
2015-11-02 c:\windows\Tasks\f509f073-bc61-4f4e-b140-93c6eeff83cb-7.job
- c:\program files\CinemaP-1.9cV31.10\f509f073-bc61-4f4e-b140-93c6eeff83cb-7.exe [2015-11-01 07:59]
.
2015-11-02 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1211305808-845881549-706634446-1000Core.job
- c:\users\GUAZOU\AppData\Local\Facebook\Update\FacebookUpdate.exe [2014-09-11 11:36]
.
2015-11-02 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1211305808-845881549-706634446-1000UA.job
- c:\users\GUAZOU\AppData\Local\Facebook\Update\FacebookUpdate.exe [2014-09-11 11:36]
.
2015-11-02 c:\windows\Tasks\globalUpdateUpdateTaskMachineCore.job
- c:\program files\globalUpdate\Update\globalupdate.exe [2015-11-01 07:59]
.
2015-11-02 c:\windows\Tasks\globalUpdateUpdateTaskMachineUA.job
- c:\program files\globalUpdate\Update\globalupdate.exe [2015-11-01 07:59]
.
2015-11-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2014-09-06 22:54]
.
2015-11-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2014-09-06 22:54]
.
2015-11-02 c:\windows\Tasks\Jk2enZtT7KqCduM.job
- c:\users\GUAZOU\AppData\Roaming\Jk2enZtT7KqCduM.exe [2015-04-20 14:05]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.oursurfing.com/?type=hp&ts=1446364286&z=e360a9d9b790d204eae2a09g6zez1qeccqaz6o1b8q&from=amt&uid=hitachixhds721050cla362_jp5511hc044brp044brpx
mStart Page = hxxp://www.oursurfing.com/?type=hp&ts=1446364286&z=e360a9d9b790d204eae2a09g6zez1qeccqaz6o1b8q&from=amt&uid=hitachixhds721050cla362_jp5511hc044brp044brpx
uInternet Settings,ProxyOverride = *.local
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Télécharger avec IDM - c:\program files\Internet Download Manager\IEExt.htm
IE: Télécharger tous les liens avec Internet Download Manager - c:\program files\Internet Download Manager\IEGetAll.htm
TCP: DhcpNameServer = 37.48.108.142 8.8.8.8
.
- - - - ORPHELINS SUPPRIMES - - - -
.
Toolbar-10 - (no file)
ShellIconOverlayIdentifiers-{FC9D8189-520A-4417-AED7-9EAC810C6FBA} - (no file)
HKCU-Run-DrvUpdater - c:\users\GUAZOU\AppData\Roaming\DRPSu\DrvUpdater.exe
c:\users\GUAZOU\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\C-cleaner.lnk - (no file)
c:\users\GUAZOU\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VideoLAN.lnk - (no file)
AddRemove-DRPSu Updater - c:\users\GUAZOU\AppData\Roaming\DRPSu\DrvUpdater.exe
AddRemove-Yahoo! Search - c:\users\GUAZOU\AppData\Local\Pay-By-Ads\Yahoo! Search\1.3.15.4\dsrsetup.exe
.
.
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
.
[HKEY_USERS\S-1-5-21-1211305808-845881549-706634446-1000_Classes\CLSID\{236ac274-65b3-496b-9f8b-7886e6e83efc}]
@Denied: (Full) (Everyone)
@Allowed: (Read) (RestrictedCode)
"Model"=dword:00000115
"Therad"=dword:0000001e
"MData"=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26,
38,95,44,61,31,13,17,f6,24,93,f7,10,c8,62,d0,eb,d7,30,93,d3,2d,d4,d5,62,30,\
.
[HKEY_USERS\S-1-5-21-1211305808-845881549-706634446-1000_Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
@Allowed: (Read) (RestrictedCode)
"scansk"=hex(0):bd,16,54,98,fa,8f,ee,80,8d,f0,2f,6b,4d,28,f4,93,af,f9,23,5a,73,
56,48,30,b6,57,31,9c,b5,f9,79,bc,20,b4,67,44,96,f2,d7,78,00,00,00,00,00,00,\
.
[HKEY_USERS\S-1-5-21-1211305808-845881549-706634446-1000_Classes\CLSID\{7286db7a-5c62-4f89-94b3-d03d0a7ef5b9}]
@Denied: (Full) (Everyone)
@Allowed: (Read) (RestrictedCode)
"Model"=dword:000000ab
"Therad"=dword:00000016
"MData"=hex(0):73,d5,cf,b8,a4,07,89,80,31,e4,35,6b,2a,ca,fe,43,b6,1f,81,1f,5a,
1b,4d,36,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,\
.
[HKEY_USERS\S-1-5-21-1211305808-845881549-706634446-1000_Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):c1,2e,d3,45,f9,e6,25,06,66,68,93,28,1a,93,2f,7a,0c,ac,e3,f2,08,
27,f8,63,1b,f9,e5,1c,d7,35,58,c1,b5,af,95,5b,66,fe,fc,92,00,00,00,00,00,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\windows\system32\taskhost.exe
c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\conhost.exe
c:\program files\TP-LINK\TP-LINK Wireless Configuration Utility\TWCU.exe
c:\program files\Common Files\Ahead\Lib\NMIndexingService.exe
c:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\system32\sppsvc.exe
c:\program files\Google\Chrome\Application\chrome.exe
c:\program files\Google\Chrome\Application\chrome.exe
c:\program files\Google\Chrome\Application\chrome.exe
c:\program files\Google\Chrome\Application\chrome.exe
c:\program files\Google\Chrome\Application\chrome.exe
c:\program files\Google\Chrome\Application\chrome.exe
c:\program files\Google\Chrome\Application\chrome.exe
c:\program files\Google\Chrome\Application\chrome.exe
c:\program files\Google\Chrome\Application\chrome.exe
c:\program files\Google\Chrome\Application\chrome.exe
.
**************************************************************************
.
Heure de fin: 2015-11-02 18:23:13 - La machine a redémarré
ComboFix-quarantined-files.txt 2015-11-02 17:23
.
Avant-CF: 148 854 964 224 octets libres
Après-CF: 148 588 363 776 octets libres
.
- - End Of File - - 23069913BFAF12E4ACCA871FAA8ECA40
A36C5E4F47E84449FF07ED3517B43A31